centos7-ldap 双主复制

#要把2台LDAP server配置成mirror mode，互相replicate，需要满足以下几个条件：
1.OpenLDAP的两台服务之间需要保持时间同步（ntpd）
2.软件包版本保持一致
3.节点之间域名可以相互解析
4.schema文件保持一致
5.需要提供完全一样的配置及目录树信息（配置信息中只有server ID和provider的信息不同）

#软件安装
yum install -y libtool-ltdl libtool-ltdl-devel openldap-servers openldap-clients
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap. /var/lib/ldap/DB_CONFIG
systemctl start slapd && systemctl enable slapd

#openldap的管理员密码  cn=Manager,dc=xxxxxx,dc=cc    
slappasswd  -s xxxxxx

#存放ldif目录
mkdir -p /root/ldap

# 执行命令，修改ldap配置，通过-f执行文件
ldapadd -Y EXTERNAL -H ldapi:/// -f   changepwd.ldif
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}+tJveP17v6SLCzFQMEL/jbm4HUeTt3lo

cat /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{0\}config.ldif

#导入基本模式
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/collective.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/corba.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/duaconf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/java.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/misc.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/openldap.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/pmi.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif

# 执行命令，修改配置
ldapmodify -Y EXTERNAL -H ldapi:/// -f  changedomain.ldif  #修改域信息
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=xxxxx,dc=cc" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=hosso,dc=cc

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=xxxxx,dc=cc

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}+tJveP17v6SLCzFQMEL/jbm4HUeTt3lo

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=xxxxx,dc=cc" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=xxxxx,dc=cc" write by * read

###########添加mod_syncprov.ldif  syncprov.ldif      (ldap-master-1,ldap-master-2 都需要添加）
[root@ldap-master-1 ldap]# cat mod_syncprov.ldif 
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: syncprov.la

ldapadd -Y EXTERNAL -H ldapi:/// -f  /root/ldap/mod_syncprov.ldif  -W

#cat syncprov.ldif 
dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
olcSpCheckpoint: 100 10
olcSpSessionLog: 100

ldapadd -Y EXTERNAL -H ldapi:/// -f /root/ldap/syncprov.ldif  -W

#######################ldap-master-1-配置
vi ldap-master-1.ldif 
[root@ldap-master-1 ldap]# cat ldap-master-1.ldif 
dn: cn=config
changetype: modify
replace: olcServerID
olcServerID: 1

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSyncRepl
olcSyncRepl: rid=001
             provider=ldap://192.168.56.202:389
             bindmethod=simple
             binddn="cn=Manager,dc=xxxx,dc=cc"
             credentials=xxxxxx
             searchbase="dc=xxxxx,dc=cc"
             filter="(objectClass=*)"
             scope=sub
             schemachecking=off
             attrs="*,+"
             type=refreshAndPersist
             retry="5 5 300 +"
             interval=00:00:01:00
-
add: olcMirrorMode
olcMirrorMode: TRUE
-
add: olcDbIndex
olcDbIndex: entryUUID eq
-
add: olcDbIndex
olcDbIndex: entryCSN eq

ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/ldap/ldap-master-1.ldif -W

#########################ldap-master-2-配置
ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/ldap/ldap-master-2.ldif -W
[root@ldap-master-2 ldap]# cat ldap-master-2.ldif 
dn: cn=config
changetype: modify
replace: olcServerID
olcServerID: 2

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSyncRepl
olcSyncRepl: rid=001
             provider=ldap://192.168.56.201:389
             bindmethod=simple
             binddn="cn=Manager,dc=xxxxx,dc=cc"
             credentials=xxxx
             searchbase="dc=xxxx,dc=cc"
             filter="(objectClass=*)"
             scope=sub
             schemachecking=off
             attrs="*,+"
             type=refreshAndPersist
             retry="5 5 300 +"
             interval=00:00:01:00