test

Deployment Example 2: Federation Using SAML v2

4.3 Enabling Multi-Master Replication of the Configuration Instances

In this procedure you enable multi-master replication (MMR) between two directory masters. With MMR enabled, whenever a directory entry is changed in Directory Server 3SP, the change is automatically replicated in Directory Server 4SP. The reverse is also true.

Use the following as your checklist for enabling MMR among the configuration instances:

  1. Enable multi-master replication of the Configuration Instance on Directory Server 3SP.

  2. Enable multi-master replication of the Configuration Instance on Directory Server 4SP.

  3. Create a replication agreement for the Configuration Instance on Directory Server 3SP.

  4. Create a replication agreement for the Configuration Instance on Directory Server 4SP.

  5. Initialize the Configuration Instance master replica.

ProcedureTo Enable Multi-Master Replication of the Configuration Instance on Directory Server 3SP

  1. Start the Directory Server 3SP console. 


    # cd /var/opt/mps/serverroot/ 
# ./startconsole &

  2. Log in to the Directory Server 3SP console.

    Username

    cn=Directory Manager

    Password

    11111111

    Administration URL

    http://DirectoryServer-3SP.siroe.com:1391

  3. In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see the Server Group item.

  4. Click to expand the Server Group.

    You should see three items: an Administration Server, a Directory Server (fm-config), and a Directory Server (fm-config).

  5. Double-click the instance name Directory Server (fm-config) to display the console for managing the instance fm-config.

  6. Click the Configuration tab and navigate to the Replication pane.

    1. Expand the Data node.

    2. Expand the node for the suffix you want to be a master replica.

      In this example, double-click the suffix o=siroe.com.

    3. Click Replication.

  7. Click the “Enable replication” button to start the Replication Wizard.

  8. Select Master Replica, and then click Next to continue.

  9. Enter a Replica ID, and then click Next.

    For this example, when enabling replication on DirectoryServer-3SP, assign the number 11.

  10. If you have not already been prompted to select the change log file, you are prompted to select one now.

    The default change log file is shown in the text field. If you do not wish to use the default, type in a filename for the change log, or click Browse to display a file selector. If the change log has already been enabled, the wizard will skip this step.

  11. If you have not already been prompted to enter and confirm a password for the default replication manager, you are prompted now.

    The replication manager is not used in the case of single-master replication, but you must still enter a password to proceed. For this example, enter 11111111.

    1. Click Next.

    The Replication Wizard displays a status message while updating the replication configuration.

  12. Click Close when replication is finished.

ProcedureTo Enable Multi-Master Replication of the Configuration Instance on Directory Server 4SP

  1. Start the Directory Server 4SP console.


    # cd /var/opt/mps/serverroot/ 
# ./startconsole &

  2. Log in to the Directory Server 4SP console.

    Username

    cn=Directory Manager

    Password

    11111111

    Administration URL

    http://DirectoryServer-4SP.siroe.com:1391

  3. In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see the Server Group item.

  4. Click to expand the Server Group.

    You should see three items: an Administration Server, a Directory Server (fm-config), and a Directory Server (fm-users).

  5. Double-click the instance name Directory Server (fm-config) to display the console for managing the instance fm-config.

  6. Click the Configuration tab and navigate to the Replication pane.

    1. Expand the Data node.

    2. Expand the node for the suffix you want to be a master replica.

      In this example, double-click the suffix o=siroe.com.

    3. Click Replication.

  7. Click the “Enable replication” button to start the Replication Wizard.

  8. Select Master Replica, and then click Next to continue.

  9. Enter a Replica ID, and then click Next.

    For this example, when enabling replication on DirectoryServer-4SP, assign the number 22.

  10. If you have not already been prompted to select the change log file, you are prompted to select one now.

    The default change log file is shown in the text field. If you do not wish to use the default, type in a filename for the change log, or click Browse to display a file selector. If the change log has already been enabled, the wizard will skip this step.

  11. If you have not already been prompted to enter and confirm a password for the default replication manager, you are prompted now.

    The replication manager is not used in the case of single-master replication, but you must still enter a password to proceed. For this example, enter 11111111 .

    1. Click Next.

    The Replication Wizard displays a status message while updating the replication configuration.

  12. Click Close when replication is finished.

ProcedureTo Create a Replication Agreement for the Configuration Instance on Directory Server 3SP

  1. On DirectoryServer-3SP, in the Directory Server console, display the general properties for the Directory Server instance named fm-config .

    Navigate through the tree in the left panel to find the Directory Server instance named fm-config, and click on the instance name to display its general properties.

  2. Click the Open button to display the console for managing the fm-config instance.

  3. Click the Configuration tab and navigate to the Replication pane.

    1. Expand the Data node.

    2. Expand the node for the suffix you want to be a master replica.

      In this example, double-click the suffix o=siroe.com.

    3. Click Replication.

  4. Click the New button.

  5. In the Replication Agreement dialog box, click the Other button.

  6. In the Remote Server dialog box, provide the following information, and then click OK.

    Host

    DirectoryServer-4SP.siroe.com

    Port

    1389

    Secure Port

    Leave this box unmarked.

  7. In the Replication Agreement dialog, for the distinguished name (DN) of the replication manager entry on the consumer server, accept the default value.

    By default, the DN is that of the default replication manager.

  8. For the password of the replication manager, enter 11111111.

  9. (Optional) Provide a description string for this agreement.

    For this example, enter Replication from DirectoryServer-3SP to DirectoryServer-4SP.

  10. Click OK when done.

  11. In the confirmation dialog, click Yes to test the connection to the server and port number.

    Use the given replication manager and password 11111111.

    If the connection fails, you will still have the option of using this agreement. For example, the parameters are correct but the server is offline. When you have finished, the agreement appears in the list of replication agreements for this master replica.

ProcedureTo Create a Replication Agreement for the Configuration Instance on Directory Server 4SP

  1. On DirectoryServer-4, in the Directory Server console, display the general properties for the Directory Server instance named fm-config.

    Navigate through the tree in the left panel to find the Directory Server instance named fm-config, and click on the instance name to display its general properties.

  2. Click the Open button to display the console for managing the fm-config instance.

  3. Click the Configuration tab and navigate to the Replication pane.

    1. Expand the Data node.

    2. Expand the node for the suffix you want to be a master replica.

      In this example, double-click the suffix o=siroe.com.

    3. Click Replication.

  4. Click the New button.

  5. In the Replication Agreement dialog box, click the Other button.

  6. In the Remote Server dialog box, provide the following information, and then click OK.

    Host

    DirectoryServer-3SP.siroe.com

    Port

    1389

    Secure Port

    Leave this box unmarked.

  7. In the Replication Agreement dialog, for the distinguished name (DN) of the replication manager entry on the consumer server, accept the default value.

    By default, the DN is that of the default replication manager.

  8. For the password of the replication manager, enter 11111111.

  9. (Optional) Provide a description string for this agreement.

    For this example, enter Replication from DirectoryServer-4SP to DirectoryServer-3SP.

  10. Click OK when done.

  11. In the confirmation dialog, click Yes to test the connection to the server and port number.

    Use the given replication manager and password.

    If the connection fails, you will still have the option of using this agreement. For example, the parameters are correct but the server is offline. When you have finished, the agreement appears in the list of replication agreements for this master replica.

ProcedureTo Initialize the Configuration Instance Master Replica

  1. In the Directory Server 3SP console, navigate through the tree in the left panel to find the Directory Server instance named fm-config.

    Click on the instance name to display its general properties.

  2. Double-click the instance name Directory Server (fm-config) in the tree to display the console for managing the data.

  3. Click the Configuration tab and navigate to the Replication pane.

    1. Expand the Data node.

    2. Expand the node for the suffix you want to be a master replica.

      In this example, double-click the suffix o=siroe.com.

    3. Click Replication.

  4. In the list of defined agreements, select the replication agreement corresponding to Directory Server 4SP, the consumer you want to initialize.

  5. Click Action > Initialize remote replica.

    A confirmation message warns you that any information already stored in the replica on the consumer will be removed.

  6. In the Confirmation dialog, click Yes.

    Online consumer initialization begins immediately. The icon of the replication agreement shows a red gear to indicate the status of the initialization process.

  7. Click Refresh > Continuous Refresh to follow the status of the consumer initialization.

    Any messages for the highlighted agreement will appear in the text box below the list.

  8. Verify that replication is working properly.

    1. Log in to both Directory Server hosts as a root user, and start both Directory Server consoles.

    2. Log in to each Directory Server console.

    3. In each Directory Server console, enable the audit log on both Directory Server instances.

      Go to Configuration > Logs > Audit Log. Check Enable Logging, and then click Save.

    4. In separate terminal windows , use the tail -f command to watch the audit log files change.

    5. In the Directory Server 3SP console, create a new user entry.

      • Go to the Directory tab, and right-click the suffix o=siroe. Then click New > Group.

        Name the new group People, and then click OK.

      • Click People, and then right-click to choose New > User.

      • In the Create New User dialog, enter a first name and last name, an then click OK.

      Note the user entry is created in the instance audit log. Check to be sure the same entry is also created in Directory Server 4SP in the Directory Server instance audit log

    6. On DirectoryServer-4SP, in the Directory Server console, create a new user entry.

      • Go to the Directory tab, and right—click the suffix o=siroe.com. Click People, and then right-click to choose New > User.

      • In the Create New User dialog, enter a first name and last name, an then click OK.

        Note the user entry is created in the instance audit log. Check to be sure the same entry is also created in Directory Server 3SP in the Directory Server instance audit log

    7. Delete both new user entries in the Directory Server 4SP console.

      Look in the Directory Server 3SP console to verify that both users have been deleted.