This chapter contains detailed information about the following groups of tasks:
4.3 Enabling Multi-Master Replication of the Configuration Instances
4.4 Enabling Multi-Master Replication of the User Data Instances
The Java ES installer must be mounted on the host computer system where you will install Directory Server. See the section 2.2 Downloading and Mounting the Java Enterprise System 2005Q4 Installer in this manual.
Use the following as your checklist or installing two Directory Server:
As a root user, log in to the Directory Server 3SP host.
Start the installer with the nodisplay option. Example:
# cd /mnt/Solaris_sparc # ./installer -nodisplay
When prompted, provided the following information:
|
Press Enter. |
|
|
Press Enter. |
|
|
Enter y. |
|
|
Enter 8 to select “English only.” |
|
|
Enter 6,20. Be sure you've specified Sun Java System Administration Server 5 2005Q4 and Sun Java System Directory Server 5 2005Q4. |
|
|
Press Enter. |
|
|
If upgrades are required, enter 1 to upgrade shared components. |
|
|
Accept the default value for each product. |
|
|
Enter 1 to continue. |
|
|
Enter 1 to configure now. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
For this example, enter admin123. |
|
|
Enter the same password again. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
For this example, enter admin123. |
|
|
Enter the same password again. |
|
|
Accept the default value. |
|
|
For this example, enter 11111111. |
|
|
Enter the same password again. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Enter 1390. |
|
|
Enter dc=siroe,dc=com. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Enter 1 to choose “The new instance will be the configuration directory server.” |
|
|
Enter 1 to store data in the new directory server. |
|
|
Enter 4 to choose “Populate with no data.” |
|
|
Enter n. |
|
|
Accept the default value. |
|
|
Enter 1391. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
For this example, enter admin123. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Enter 1 to install now. |
(Optional) During installation, you can monitor the log to watch for installation errors. Example:
# cd /var/sadm/install/logs
# tail —f Java_Enterprise_System_install.B xxxxxx
Upon successful installation, enter ! to exit.
Verify that Directory Server was successfully installed.
As a root user, log in to Directory Server 3SP.
Start the Directory Server.
# cd /var/opt/mps/serverroot/slapd-DirectoryServer-3SP # ./stop-slapd; ./start-slapd
Use the tail command to monitor the Directory Server error log and see that the server successfully starts up.
# tail -50 logs/errors
Use the netstat command to verify that the Directory Server port is open and listening.
# netstat -an | grep 1390 * 1390 *.* 0 0 49152 0 LISTEN
Start the Administration Server that manages Directory Server.
cd /var/opt/mps/serverroot ./stop-admin; ./start-admin
Installation is successful if the Administration Server displays a start-up message.
Use the netstat command to verify that the Administration Server port is open and listening.
# netstat -an | grep 1391 * 1391 *.* 0 0 49152 0 LISTEN
As a root user, log in to the Directory Server 4SP host.
Start the installer with the nodisplay option. Example:
# cd /mnt/Solaris_sparc # ./installer -nodisplay
When prompted, provided the following information:
|
Press Enter. |
|
|
Press Enter. |
|
|
Enter y. |
|
|
Enter 8 to select “English only.” |
|
|
Enter 6,20. Be sure you've specified Sun Java System Administration Server 5 2005Q4 and Sun Java System Directory Server 5 2005Q4. |
|
|
Press Enter. |
|
|
If upgrades are required, enter 1 to upgrade shared components. |
|
|
Accept the default value for each product. |
|
|
Enter 1 to continue. |
|
|
Enter 1 to configure now. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
For this example, enter admin123. |
|
|
Enter the same password again. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
For this example, enter admin123. |
|
|
Enter the same password again. |
|
|
Accept the default value. |
|
|
For this example, enter 11111111. |
|
|
Enter the same password again. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Enter 1390. |
|
|
Enter dc=siroe,dc=com. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Enter 1 to choose “The new instance will be the configuration directory server.” |
|
|
Enter 1 to store data in the new directory server. |
|
|
Enter 4 to choose “Populate with no data.” |
|
|
Enter n. |
|
|
Accept the default value. |
|
|
Enter 1391 |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
For this example, enter admin123. |
|
|
Accept the default value. |
|
|
Accept the default value. |
|
|
Enter 1 to install now. |
(Optional) During installation, you can monitor the log to watch for installation errors. Example:
# cd /var/sadm/install/logs
# tail —f Java_Enterprise_System_install.B xxxxxx
Upon successful installation, enter ! to exit.
Verify that Directory Server was successfully installed.
As a root user, log in to Directory Server 4SP.
Start the Directory Server.
# cd /var/opt/mps/serverroot/slapd-DirectoryServer-4SP # ./stop-slapd; ./start-slapd
Use the tail command to monitor the Directory Server error log and verify that the server successfully starts up.
# tail -50 logs/errors
Use the netstat command to verify that the Directory Server port is open and listening.
# netstat -an | grep 1390 * 1390 *.* 0 0 49152 0 LISTEN
Start the Administration Server that manages Directory Server.
cd /var/opt/mps/serverroot ./stop-admin; ./start-admin
Installation is successful if the Administration Server displays a start-up message.
Use the netstat command to verify that the Administration Server port is open and listening.
# netstat -an | grep 1391 * 1391 *.* 0 0 49152 0 LISTEN
On each Directory Server, create a new configuration instance and a new user data instance. When you're finished, Directory Server 3SP and Directory Server 4SP will each contain three instances. For example, Directory Server 3SP will contain three instances: DirectoryServer-3SP, fm-config, and fm-users. DirectoryServer-3SP stores Directory Server administration configuration. The instance named fm-config stores Federation Manager configuration, and the instance named fm-users stores Federation Manager user data. Directory Server 4SP will contain the identical directory structure.
Use the following as your checklist for creating new Directory Server instances:
Create a new Configuration Instance in Directory Server 3SP.
Create a new Configuration Instance in Directory Server 4SP.
Create a new data instance for storing Federation Manager configuration. This ensures that if you ever have to uninstall or restore Federation Manager configuration, the Directory Server configuration remains untouched and will not have to be restored.
As a root user, log in to Directory Server 3SP.
Set the X window display variable, and start the Directory Server 3SP console.
# cd /var/opt/mps/serverroot/ # export DISPLAY=DirectoryServer-3SP.siroe.com:1 # ./startconsole &
Log in to the Directory Server 3SP console.
cn=Directory Manager
11111111
http://DirectoryServer-3SP.siroe.com:1391
In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see the Server Group item.
Right-click on Server Group, and choose “Create an instance of Sun Directory Server.”
In the Create New Instance dialog box, provide the following information:
Enter fm-config.
Enter 1389.
Enter o=siroe.com.
Enter cn=Directory Manager
For this example, enter 11111111.
Enter the same password to confirm it.
Enter root.
Click OK, and then close the status window.
Verify that the new Directory Server instance named fm-config successfully starts up .
As a root user, log in to Directory Server 3SP.
Start the new data Directory Server instance.
# cd /var/opt/mps/serverroot/slapd-fm-config # ./stop-slapd; ./start-slapd |
Use the tail command to monitor the Directory Server error log and see that the server starts up successfully.
# tail —f logs/errors |
Create a new data instance for storing both Federation Manager configuration and user data. This ensures that if you ever have to uninstall or restore Federation Manager configuration, the Directory Server configuration remains untouched and will not have to be restored.
As a root user, log in to Directory Server 3SP.
Set the X window display variable, and start the Directory Server console.
# cd /var/opt/mps/serverroot/ # export DISPLAY=DirectoryServer-3SP.siroe.com:1 # ./startconsole &
Log in to the Directory Server 3SP console.
cn=Directory Manager
11111111
http://DirectoryServer-3SP.siroe.com:1391
In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see the Server Group item.
Right-click on Server Group, and choose “Create an instance of Sun Directory Server.”
In the Create New Instance dialog box, provide the following information:
Enter fm-users.
Enter 1489.
Enter o=siroeusers.com.
Enter cn=Directory Manager
For this example, enter 11111111.
Enter the same password to confirm it.
Enter root.
Click OK, and then close the status window.
Verify that the new Directory Server instance named fm-users successfully starts up .
As a root user, log in to Directory Server 3SP.
Start the new data Directory Server instance.
# cd /var/opt/mps/serverroot/slapd-fm-users # ./stop-slapd; ./start-slapd |
Use the tail command to monitor the Directory Server error log and see that the server starts up successfully.
# tail —f logs/errors |
As a root user, log in to Directory Server 4SP.
Set the X window display variable, and start the Directory Server console.
# cd /var/opt/mps/serverroot/ # export DISPLAY=DirectoryServer-4SP.siroe.com:1 # ./startconsole &
Log in to the Directory Server 4SP console.
cn=Directory Manager
11111111
http://DirectoryServer-4SP.siroe.com:1391
In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see Server Group item.
Right-click on Server Group, and choose “Create an instance of Sun Directory Server.”
In the Create New Instance dialog box, provide the following information:
Enter fm-config.
Enter 1389.
Enter o=siroe.com.
Enter cn=Directory Manager
For this example, enter 11111111.
Enter the same password to confirm it.
Enter root.
Click OK, and then close the status window.
Verify that the new Directory Server instance named fm-config successfully starts up .
As a root user, log in to Directory Server 4SP.
Start the new data Directory Server instance.
# cd /var/opt/mps/serverroot/slapd-fm-config # ./stop-slapd; ./start-slapd |
Use the tail command to monitor the Directory Server error log and see that the server starts up successfully.
# tail —f logs/errors |
As a root user, log in to Directory Server 4SP.
Set the X window display variable, and start the Directory Server console.
# cd /var/opt/mps/serverroot/ # export DISPLAY=DirectoryServer-4SP.siroe.com:1 # ./startconsole &
Log in to the Directory Server 4SP console.
cn=Directory Manager
11111111
http://DirectoryServer-4SP.siroe.com:1391
In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see Server Group item.
Right-click on Server Group, and choose “Create an instance of Sun Directory Server.”
In the Create New Instance dialog box, provide the following information:
Enter fm-users.
Enter 1489.
Enter o=siroeusers.com.
Enter cn=Directory Manager
For this example, enter 11111111.
Enter the same password to confirm it.
Enter root.
Click OK, and then close the status window.
Verify that the new Directory Server instance named fm-users successfully starts up .
In this procedure you enable multi-master replication (MMR) between two directory masters. With MMR enabled, whenever a directory entry is changed in Directory Server 3SP, the change is automatically replicated in Directory Server 4SP. The reverse is also true.
Use the following as your checklist for enabling MMR among the configuration instances:
Enable multi-master replication of the Configuration Instance on Directory Server 3SP.
Enable multi-master replication of the Configuration Instance on Directory Server 4SP.
Create a replication agreement for the Configuration Instance on Directory Server 3SP.
Create a replication agreement for the Configuration Instance on Directory Server 4SP.
Start the Directory Server 3SP console.
# cd /var/opt/mps/serverroot/ # ./startconsole & |
Log in to the Directory Server 3SP console.
cn=Directory Manager
11111111
http://DirectoryServer-3SP.siroe.com:1391
In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see the Server Group item.
Click to expand the Server Group.
You should see three items: an Administration Server, a Directory Server (fm-config), and a Directory Server (fm-config).
Double-click the instance name Directory Server (fm-config) to display the console for managing the instance fm-config.
Click the Configuration tab and navigate to the Replication pane.
Click the “Enable replication” button to start the Replication Wizard.
Select Master Replica, and then click Next to continue.
Enter a Replica ID, and then click Next.
For this example, when enabling replication on DirectoryServer-3SP, assign the number 11.
If you have not already been prompted to select the change log file, you are prompted to select one now.
The default change log file is shown in the text field. If you do not wish to use the default, type in a filename for the change log, or click Browse to display a file selector. If the change log has already been enabled, the wizard will skip this step.
If you have not already been prompted to enter and confirm a password for the default replication manager, you are prompted now.
The replication manager is not used in the case of single-master replication, but you must still enter a password to proceed. For this example, enter 11111111.
The Replication Wizard displays a status message while updating the replication configuration.
Click Close when replication is finished.
Start the Directory Server 4SP console.
# cd /var/opt/mps/serverroot/ # ./startconsole & |
Log in to the Directory Server 4SP console.
cn=Directory Manager
11111111
http://DirectoryServer-4SP.siroe.com:1391
In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see the Server Group item.
Click to expand the Server Group.
You should see three items: an Administration Server, a Directory Server (fm-config), and a Directory Server (fm-users).
Double-click the instance name Directory Server (fm-config) to display the console for managing the instance fm-config.
Click the Configuration tab and navigate to the Replication pane.
Click the “Enable replication” button to start the Replication Wizard.
Select Master Replica, and then click Next to continue.
Enter a Replica ID, and then click Next.
For this example, when enabling replication on DirectoryServer-4SP, assign the number 22.
If you have not already been prompted to select the change log file, you are prompted to select one now.
The default change log file is shown in the text field. If you do not wish to use the default, type in a filename for the change log, or click Browse to display a file selector. If the change log has already been enabled, the wizard will skip this step.
If you have not already been prompted to enter and confirm a password for the default replication manager, you are prompted now.
The replication manager is not used in the case of single-master replication, but you must still enter a password to proceed. For this example, enter 11111111 .
The Replication Wizard displays a status message while updating the replication configuration.
Click Close when replication is finished.
On DirectoryServer-3SP, in the Directory Server console, display the general properties for the Directory Server instance named fm-config .
Navigate through the tree in the left panel to find the Directory Server instance named fm-config, and click on the instance name to display its general properties.
Click the Open button to display the console for managing the fm-config instance.
Click the Configuration tab and navigate to the Replication pane.
Click the New button.
In the Replication Agreement dialog box, click the Other button.
In the Remote Server dialog box, provide the following information, and then click OK.
DirectoryServer-4SP.siroe.com
1389
Leave this box unmarked.
In the Replication Agreement dialog, for the distinguished name (DN) of the replication manager entry on the consumer server, accept the default value.
By default, the DN is that of the default replication manager.
For the password of the replication manager, enter 11111111.
(Optional) Provide a description string for this agreement.
For this example, enter Replication from DirectoryServer-3SP to DirectoryServer-4SP.
Click OK when done.
In the confirmation dialog, click Yes to test the connection to the server and port number.
Use the given replication manager and password 11111111.
If the connection fails, you will still have the option of using this agreement. For example, the parameters are correct but the server is offline. When you have finished, the agreement appears in the list of replication agreements for this master replica.
On DirectoryServer-4, in the Directory Server console, display the general properties for the Directory Server instance named fm-config.
Navigate through the tree in the left panel to find the Directory Server instance named fm-config, and click on the instance name to display its general properties.
Click the Open button to display the console for managing the fm-config instance.
Click the Configuration tab and navigate to the Replication pane.
Click the New button.
In the Replication Agreement dialog box, click the Other button.
In the Remote Server dialog box, provide the following information, and then click OK.
DirectoryServer-3SP.siroe.com
1389
Leave this box unmarked.
In the Replication Agreement dialog, for the distinguished name (DN) of the replication manager entry on the consumer server, accept the default value.
By default, the DN is that of the default replication manager.
For the password of the replication manager, enter 11111111.
(Optional) Provide a description string for this agreement.
For this example, enter Replication from DirectoryServer-4SP to DirectoryServer-3SP.
Click OK when done.
In the confirmation dialog, click Yes to test the connection to the server and port number.
Use the given replication manager and password.
If the connection fails, you will still have the option of using this agreement. For example, the parameters are correct but the server is offline. When you have finished, the agreement appears in the list of replication agreements for this master replica.
In the Directory Server 3SP console, navigate through the tree in the left panel to find the Directory Server instance named fm-config.
Click on the instance name to display its general properties.
Double-click the instance name Directory Server (fm-config) in the tree to display the console for managing the data.
Click the Configuration tab and navigate to the Replication pane.
In the list of defined agreements, select the replication agreement corresponding to Directory Server 4SP, the consumer you want to initialize.
Click Action > Initialize remote replica.
A confirmation message warns you that any information already stored in the replica on the consumer will be removed.
In the Confirmation dialog, click Yes.
Online consumer initialization begins immediately. The icon of the replication agreement shows a red gear to indicate the status of the initialization process.
Click Refresh > Continuous Refresh to follow the status of the consumer initialization.
Any messages for the highlighted agreement will appear in the text box below the list.
Verify that replication is working properly.
Log in to both Directory Server hosts as a root user, and start both Directory Server consoles.
Log in to each Directory Server console.
In each Directory Server console, enable the audit log on both Directory Server instances.
Go to Configuration > Logs > Audit Log. Check Enable Logging, and then click Save.
In separate terminal windows , use the tail -f command to watch the audit log files change.
In the Directory Server 3SP console, create a new user entry.
Go to the Directory tab, and right-click the suffix o=siroe. Then click New > Group.
Name the new group People, and then click OK.
Click People, and then right-click to choose New > User.
In the Create New User dialog, enter a first name and last name, an then click OK.
Note the user entry is created in the instance audit log. Check to be sure the same entry is also created in Directory Server 4SP in the Directory Server instance audit log
On DirectoryServer-4SP, in the Directory Server console, create a new user entry.
Go to the Directory tab, and right—click the suffix o=siroe.com. Click People, and then right-click to choose New > User.
In the Create New User dialog, enter a first name and last name, an then click OK.
Note the user entry is created in the instance audit log. Check to be sure the same entry is also created in Directory Server 3SP in the Directory Server instance audit log
Delete both new user entries in the Directory Server 4SP console.
Look in the Directory Server 3SP console to verify that both users have been deleted.
Use the following as your checklist for enabling MMR among the user data instances:
Enable multi-master replication for the User Data Instance on Directory Server 3SP.
Enable multi-master replication for the User Data Instance on Directory Server 4SP.
Create a replication agreement for the User Data Instance on Directory Server 3SP.
Create a replication agreement for the User Data Instance on Directory Server 4SP.
On Directory Server 3SP, start the Directory Server console.
# cd /var/opt/mps/serverroot/ # ./startconsole & |
Log in to the Directory Server 3SP console.
cn=Directory Manager
11111111
http://DirectoryServer-3SP.siroe.com:1391
In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see the Server Group item.
Click to expand the Server Group.
You should see three items: an Administration Server, a Directory Server (fm-config), and a Directory Server (fm-users).
Double-click the instance name Directory Server (fm-users) to display the console for managing the instance fm-users.
Click the Configuration tab and navigate to the Replication pane.
Click the “Enable replication” button to start the Replication Wizard.
Select Master Replica, and then click Next to continue.
Enter a Replica ID, and then click Next.
For this example, when enabling replication on Directory Server 3SP, assign the number 33.
If you have not already been prompted to select the change log file, you are prompted to select one now.
The default change log file is shown in the text field. If you do not wish to use the default, type in a filename for the change log, or click Browse to display a file selector. If the change log has already been enabled, the wizard will skip this step.
If you have not already been prompted to enter and confirm a password for the default replication manager, you are prompted now.
The replication manager is not used in the case of single-master replication, but you must still enter a password to proceed. For this example, enter 11111111.
The Replication Wizard displays a status message while updating the replication configuration.
Click Close when replication is finished.
Start the Directory Server 4SP console.
# cd /var/opt/mps/serverroot/ # ./startconsole & |
Log in to the Directory Server 4SP console.
cn=Directory Manager
11111111
http://DirectoryServer-4SP.siroe.com:1391
In the Directory Server console, under the Servers and Applications tab, expand the Server Administration domain list until you see the Server Group item.
Click to expand the Server Group.
You should see three items: an Administration Server, a Directory Server (fm-config), and a Directory Server (fm-users).
Double-click the instance name Directory Server (fm-users) to display the console for managing the instance fm-users.
Click the Configuration tab and navigate to the Replication pane.
Click the “Enable replication” button to start the Replication Wizard.
Select Master Replica, and then click Next to continue.
Enter a Replica ID, and then click Next.
For this example, when enabling replication on Directory Server 4SP, assign the number 44.
If you have not already been prompted to select the change log file, you are prompted to select one now.
The default change log file is shown in the text field. If you do not wish to use the default, type in a filename for the change log, or click Browse to display a file selector. If the change log has already been enabled, the wizard will skip this step.
If you have not already been prompted to enter and confirm a password for the default replication manager, you are prompted now.
The replication manager is not used in the case of single-master replication, but you must still enter a password to proceed. For this example, enter 11111111 .
The Replication Wizard displays a status message while updating the replication configuration.
Click Close when replication is finished.
In the Directory Server 3SP console, display the general properties for the Directory Server instance named fm-users .
Navigate through the tree in the left panel to find the Directory Server instance named fm-users, and click on the instance name to display its general properties.
Click the Open button to display the console for managing the fm-users instance.
Click the Configuration tab and navigate to the Replication pane.
Click the New button.
In the Replication Agreement dialog box, click the Other button.
In the Remote Server dialog box, provide the following information, and then click OK.
DirectoryServer-4SP.siroe.com
1489
Leave this box unmarked.
In the Replication Agreement dialog, for the distinguished name (DN) of the replication manager entry on the consumer server, accept the default value.
By default, the DN is that of the default replication manager.
For the password of the replication manager, enter 11111111.
(Optional) Provide a description string for this agreement.
For this example, enter Replication from DirectoryServer-3SP to DirectoryServer-4SP.
Click OK when done.
In the confirmation dialog, click Yes to test the connection to the server and port number.
Use the given replication manager and password 11111111.
If the connection fails, you will still have the option of using this agreement. For example, the parameters are correct but the server is offline. When you have finished, the agreement appears in the list of replication agreements for this master replica.
On DirectoryServer-4SP, in the Directory Server console, display the general properties for the Directory Server instance named fm-users.
Navigate through the tree in the left panel to find the Directory Server instance named fm-users, and click on the instance name to display its general properties.
Click the Open button to display the console for managing the fm-users instance.
Click the Configuration tab and navigate to the Replication pane.
Click the New button.
In the Replication Agreement dialog box, click the Other button.
In the Remote Server dialog box, provide the following information, and then click OK.
DirectoryServer-3SP.siroe.com
1489
Leave this box unmarked.
In the Replication Agreement dialog, for the distinguished name (DN) of the replication manager entry on the consumer server, accept the default value.
By default, the DN is that of the default replication manager.
For the password of the replication manager, enter 11111111.
(Optional) Provide a description string for this agreement.
For this example, enter Replication from DirectoryServer-4SP to DirectoryServer-3SP.
Click OK when done.
In the confirmation dialog, click Yes to test the connection to the server and port number.
Use the given replication manager and password.
If the connection fails, you will still have the option of using this agreement. For example, the parameters are correct but the server is offline. When you have finished, the agreement appears in the list of replication agreements for this master replica.
In the Directory Server 3SP console, navigate through the tree in the left panel to find the Directory Server instance named fm-users.
Click on the instance name to display its general properties.
Double-click the instance name Directory Server (fm-users) in the tree to display the console for managing the data.
Click the Configuration tab and navigate to the Replication pane.
In the list of defined agreements, select the replication agreement corresponding to Directory Server 4SP, the consumer you want to initialize.
Click Action > Initialize remote replica.
A confirmation message warns you that any information already stored in the replica on the consumer will be removed.
In the Confirmation dialog, click Yes.
Online consumer initialization begins immediately. The icon of the replication agreement shows a red gear to indicate the status of the initialization process.
Click Refresh > Continuous Refresh to follow the status of the consumer initialization.
Any messages for the highlighted agreement will appear in the text box below the list.
Verify that replication is working properly.
As a root user, log in to both Directory Server hosts, and start both Directory Server consoles.
Log in to each Directory Server console.
In each Directory Server console, enable the audit log on both Directory Server instances.
Go to Configuration > Logs > Audit Log. Check Enable Logging, and then click Save.
In separate terminal windows , use the tail -f command to watch the audit log files change.
In the Directory Server 3SP console, create a new user entry.
Go to the Directory tab, and right-click the suffix o=siroeusers.com. Then click New > Group.
Name the new group People, and then click OK.
Click People, and then right-click to choose New > User.
In the Create New User dialog, enter a first name and last name, an then click OK.
Note the user entry is created in the instance audit log. Check to be sure the same entry is also created in on DirectoryServer-4SP in the Directory Server instance audit log
In the Directory Server 4SP console, create a new user entry.
Go to the Directory tab, and right—click the suffix o=siroeusers.comClick People, and then right-click to choose New > User.
Delete both new user entries in the Directory Server 4SP console.
Look in the Directory Server 3SP console to verify that both users have been deleted.
In the following procedures, you configure one load balancer in front the Directory Server configuration instances, and one load balancer in front of the Directory Server user data instances.
Use the following as your checklist for configuring the Directory Server load balancers:
Configure Load Balancer 7 for the Directory Server Configuration instances.
Configure Load Balancer 8 for the Directory Server User Data instances.
In this deployment, both Directory Server load balancers are configured for simple persistence. When the load balancer is configured for simple persistence, all Federation Manager requests sent within a specified interval are sent to the same Directory Server for processing. Simple persistence ensures that within the specified interval, no errors or delays occur due to replication time or redirects when retrieving data.
When a request requires information to be written to Directory Server 3SP, that information is also replicated in Directory Server 4SP. But the replication takes time to complete. During that time, if a related request is directed by the load balancer to Directory Server 4SP, the request may fail.
For example, when simple persistence is not configured properly, creating a realm from the Federation Manager administration console could fail in the following way. A request for the parent entry creation is routed to Directory Server 3SP, and a second request to create the subentry is routed to Directory Server 4SP. But if the parent entry request is not yet fully replicated to Directory Server 4SP, the subentry request fails. The result is a partially created realm which may not contain all its subentries such as realm administration roles. Simple persistence eliminates this type of error. When persistence is properly configured, both the parent entry request and the subentry request are routed to Directory Server 3SP. The requests are processed in consecutive order. The parent entry is fully created before the subentry request begins processing.
Contact your network administrator to obtain an available virtual IP address for the load balancer you want to configure.
You must also know the IP address of the load balancer hardware, the URL for the load balancer login page, and a username and password for logging in to the load balancer application.
The load balancer hardware and software used in the lab facility for this deployment is BIG-IP® manufactured by F5 Networks. If you are using different load balancer software, see the documentation that comes with that product for detailed settings information.
You must also have ready the IP addresses for Directory Server 3SP and Directory Server 4SP.
To obtain these IP addresses, on each Directory Server host, run the following command:
ifconfig —a
Create a Pool.
A pool contains all the backend server instances.
Go to URL for the Big IP load balancer login page.
Open the Configuration Utility.
Click “Configure your BIG-IP (R) using the Configuration Utility.”
In the left pane, click Pools.
On the Pools tab, click the Add button.
In the Add Pool dialog, provide the following information:
Example: federation_ds_pool
Round Robin
Add the IP address of both Directory Server hosts. In this example:
192.18.69.135( for DirectoryServer-3SP:1389)
192.18.72.136 (for DirectoryServer-4SP:1389)
Click the Done button.
Add a Virtual Server.
If you encounter Javascript errors or otherwise cannot proceed to create a virtual server, try using Microsoft Internet Explorer for this step.
In the left frame, Click Virtual Servers.
On the Virtual Servers tab, click the Add button.
In the Add a Virtual Server dialog box, provide the following information:
192.18.69.16 (for LoadBalancer-7.siroe.com )
389
federation_ds_pool
Continue to click Next until you reach the Pool Selection dialog box.
In the Pool Selection dialog box, assign the Pool (federation_ds_pool) that you have just created.
Click the Done button.
Add Monitors
Monitors are required for the load balancer to detect the backend server failures.
In the left frame, click Monitors.
Click the Basic Associations tab.
Add an LDAP monitor for the Directory Server 3SP node.
Three columns exist on this page: Node, Node Address, and Service. In the Node column, locate the IP address and port number DirectoryServer-3SP:1389. Select the Add checkbox.
Add an LDAP monitor for the Directory Server 4SP node.
In the Node column, locate the IP address and port number for DirectoryServer-4SP:1389 . Select the Add checkbox.
At the top of the Node column, in the drop-down list, choose tcp .
Click Apply.
Configure the load balancer for simple persistence.
Verify the Directory Server load balancer configuration.
Log in as a root user to the host of each Directory Server.
On each Directory Server host, use the tail command to monitor the Directory Server access log.
# cd /var/opt/mps/serverroot/slapd-DirectorySerer-3SP/logs
# tail -f access
You should see connections to the load balancer IP address opening and closing. Example:
conn=54 op=-1 msgId=-1 — fd=22 slot=22 LDAP connection from 192.18.69.18 to 192.18.72.33
conn=54 op=-1 msgId=-1 — closing — B1
conn=54 op=-1 msgId=-1 — closed.
Execute the following LDAP search against the Directory Server load balancer:
# cd /var/opt/mps/serverroot/shared/bin/ # ./ldapsearch -h LoadBalancer-7.siroe.com -p 389 -b "o=siroe.com" -D "cn=directory manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Make sure the directory access entries display in only one Directory Server access log.
Stop Directory Server 3SP, and again perform the following LDAP search against the Directory Server load balancer:
# ./ldapsearch -h LoadBalancer-7.siroe.com -p 389 -b "o=siroeusers.com" -D "cn=directory manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Verify that the Directory Server access entries display in only one Directory Server access log.
If you encounter the following error message:
# ./ldapsearch —h 192.18.69.13 —p 1389 —b “o=siroeusers.com“ —D “cn=Directory Manager” —w 11111111 ldap_simple_bind: Cant' connect to the LDAP server — Connection refused |
You can reset the timeout properties to lower values:
In the load balancer console, click the Monitors tab, and then click the ldap-tcp monitor name.
In the Interval field, set the value to 5.
In the Timeout field, set the value to 16.
Click Apply.
Repeat the LDAP search.
Restart the stopped Directory Server 3SP, and then stop Directory Server 4SP.
Confirm that the requests are forwarded to the running Directory Server 4SP.
Perform the following LDAP search against the Directory Server load balancer.
# ./ldapsearch -h LoadBalancer-7.siroe.com -p 389 -b "o=siroe.com" -D "cn=Directory Manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Make sure the directory access entries display in only the one Directory Server access log.
Contact your network administrator to obtain an available virtual IP address for the load balancer you want to configure.
You must also know the IP address of the load balancer hardware, the URL for the load balancer login page, and a username and password for logging in to the load balancer application.
The load balancer hardware and software used in the lab facility for this deployment is BIG-IP® manufactured by F5 Networks. If you are using different load balancer software, see the documentation that comes with that product for detailed settings information.
You must also have ready the IP addresses for Directory Server 3SP and Directory Server 4SP.
To obtain these IP addresses, on each Directory Server host, run the following command:
ifconfig —a
Create a Pool.
A pool contains all the backend server instances.
Go to URL for the Big IP load balancer login page.
Open the Configuration Utility.
Click “Configure your BIG-IP (R) using the Configuration Utility.”
In the left pane, click Pools.
On the Pools tab, click the Add button.
In the Add Pool dialog, provide the following information:
Example: federation_users_pool
Round Robin
Add the IP address of both Directory Server hosts. In this example: .
192.18.69.135(for DirectoryServer-3SP:1489)
192.18.72.136 (for DirectoryServer-4SP:1489)
Click the Done button.
Add a Virtual Server.
If you encounter Javascript errors or otherwise cannot proceed to create a virtual server, try using Microsoft Internet Explorer for this step.
In the left frame, Click Virtual Servers.
On the Virtual Servers tab, click the Add button.
In the Add a Virtual Server dialog box, provide the following information:
192.18.69.16 (for LoadBalancer-8.siroe.com )
1389
federation_users_pool
Continue to click Next until you reach the Pool Selection dialog box.
In the Pool Selection dialog box, assign the Pool (federation_users_pool) that you have just created.
Click the Done button.
Add Monitors
Monitors are required for the load balancer to detect the backend server failures.
In the left frame, click Monitors.
Click the Basic Associations tab.
Add an LDAP monitor for the Directory Server 3SP node.
Three columns exist on this page: Node, Node Address, and Service. In the Node column, locate the IP address and port number DirectoryServer-3SP:1489. Select the Add checkbox.
Add an LDAP monitor for the Directory Server 4SP node.
In the Node column, locate the IP address and port number for DirectoryServer-4SP:1489 . Select the Add checkbox.
At the top of the Node column, in the drop-down list, choose ldap-tcp .
Click Apply.
Configure the load balancer for simple persistence.
Verify the Directory Server load-balancer configuration.
Log in as a root user to the host of each Directory Server.
On each Directory Server host, use the tail command to monitor the Directory Server access log.
# cd /var/opt/mps/serverroot/slapd-fm-users/logs
# tail -f access
You should see connections to the load balancer IP address opening and closing. Example:
conn=54 op=-1 msgId=-1 — fd=22 slot=22 LDAP connection from 192.18.69.18 to 192.18.72.33
conn=54 op=-1 msgId=-1 — closing — B1
conn=54 op=-1 msgId=-1 — closed.
Execute the following LDAP search against the Directory Server load balancer:
# cd /var/opt/mps/serverroot/shared/bin/ # ./ldapsearch -h LoadBalancer-8.siroe.com -p 1389 -b "o=siroeusers.com" -D "cn=directory manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Make sure the directory access entries display in only one Directory Server access log.
Stop Directory Server 3SP, and again perform the following LDAP search against the Directory Server load balancer:
# ./ldapsearch -h LoadBalancer-8.siroe.com -p 1389 -b "o=siroeusers.com" -D "cn=directory manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Verify that the Directory Server access entries display in only one Directory Server access log.
If you encounter the following error message:
# ./ldapsearch —h 192.18.69.13 —p 1389 —b “o=siroeusers.com“ —D “cn=Directory Manager” —w 11111111 ldap_simple_bind: Cant' connect to the LDAP server — Connection refused
You can reset the timeout properties to lower values:
In the load balancer console, click the Monitors tab, and then click the ldap-tcp monitor name.
In the Interval field, set the value to 5.
In the Timeout field, set the value to 16.
Click Apply.
Repeat the LDAP search.
Restart the stopped Directory Server 3SP, and then stop Directory Server 4SP.
Confirm that the requests are forwarded to the running Directory Server 4SP.
Perform the following LDAP search against the Directory Server load balancer.
# ./ldapsearch -h LoadBalancer-8.siroe.com -p 389 -b "o=siroeusers.com" -D "cn=Directory Manager" -w 11111111 "(objectclass=*)" |
The ldapsearch operation should return entries. Make sure the directory access entries display in only the one Directory Server access log.