IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Looking for help configuring IDS LDAP replication

    Posted yesterday
    Edited by Frank Tate 14 hours ago

    I am trying to configure Peer-to-Peer replication for IBM Directory Server V6.4 on RHEL 9.5 from the command line, and as far as I can tell, the documentation is missing some information. I'm using the ldapreplcfg command (https://www.ibm.com/docs/en/sdse/6.4.0?topic=SSVJJU_6.4.0/com.ibm.IBMDS.doc_6.4/ds_ag_srv_adm_repl_topology_config_tool.htm), and it creates some entries, but replication doesn't work. Details:

    I have two LDAP servers: fplvm1t and fplvm1p (fpl=Frank's Personal Lab). Here's the command I'm using to try to configure replication:

    /opt/IBM/ldap/V6.4/bin/ldapreplcfg -s dc=gulfsoft,dc=com -topo PP -h1 fplvm1t -h2 fplvm1p -p1 389 -p2 389 -D1 cn=root -D2 cn=root -w1 passw0rd1 -w2 passw0rd1

    That command successfully creates the following entries under dc=gulfsoft,dc=com in the DIT on both servers:

    cn=creds1193316171

    ibm-replicaGroup=default

    • cn=fplvm1p:389
      • cn=fplvm1t:389
    • cn-fplvm1t:389
      • cn=fplvm1p:389

    That all seems good, except the cn=creds1193316171 entry has these values:

    replicaBindDN: cn=fplvm1t
    replicaCredentials: fplvm1t

    Looking in ibmslapd.log on fplvm1p (similar on fplvm1t), I see this error:

    2025-07-17T08:44:40.189027-4:00  GLPRPL036E Error 'simple bind: Invalid credentials' occurred for replica 'CN=FPLVM1T:389,CN=FPLVM1P:389,IBM-REPLICAGROUP=DEFAULT,DC=GULFSOFT,DC=COM': bind failed using masterDn 'cn=fplvm1t'.

    Seeing this, I changed the replicaBundDN to cn=root and set the replicaCredentials to passw0rd1 (the admin userid and password). Now I see this message in ibmslapd.log on fplvm1p (similar on fplvm1t), which I thought was a good thing:

    2025-07-17T08:58:01.002221-4:00 GLPRPL029I Established connection for replica 'CN=FPLVM1T:389,CN=FPLVM1P:389,IBM-REPLICAGROUP=DEFAULT,DC=GULFSOFT,DC=COM' on host 'fplvm1t' port 389.

    However, no replication is actually performed. Also, following these docs, I ran this command:

    /opt/IBM/ldap/V6.4/bin/idsldapsearch -h localhost -p 389 -b "dc=gulfsoft,dc=com" -s "sub" "objectclass=ibm-replicationAgreement" ibm-replicationState

    And it shows me that the ibm-replicationState=binding, when I would think it should show "Ready".

    So that's where I am. Any pointers?

    Frank



    ------------------------------
    Frank Tate
    Gulfsoft Consulting
    https://www.gulfsoft.com
    AIOps Experts. Contact us for implementation help.
    ------------------------------



  • 2.  RE: Looking for help configuring IDS LDAP replication

    Posted yesterday
    Edited by Frank Tate 6 hours ago

    Thanks for anyone who spent any time on this. I figured out at least one way to fix it. I created a user on each LDAP server named cn=fplvm1t with the password set to fplvm1t (just like the credential was initially created). I did that with the following entry in my ibmslapd.conf file:

    dn: CN=fplvm1t, CN=ADMINGROUP, CN=CONFIGURATION
    cn: fplvm1t
    ibm-slapdAdminDN: cn=fplvm1t
    ibm-slapdAdminPW: fplvm1t
    ibm-slapdAdminRole: AuditAdmin
    ibm-slapdAdminRole: DirDataAdmin
    ibm-slapdAdminRole: SchemaAdmin
    ibm-slapdAdminRole: ServerStartStopAdmin
    objectClass: top
    objectClass: ibm-slapdConfigEntry
    objectClass: ibm-slapdAdminGroupMember

    I then restarted the servers, and now the ldapsearch command shows the state as "ready", and changes are being replicated.

    So I am guessing the constraint is that you can't use cn=root as the replication ID.



    ------------------------------
    Frank Tate
    Gulfsoft Consulting
    https://www.gulfsoft.com
    AIOps Experts. Contact us for implementation help.
    ------------------------------

    Original Message


  • 3.  RE: Looking for help configuring IDS LDAP replication

    Posted 6 hours ago

    Unfortunately, I celebrated too early. The credentials were not the problem. What I'm seeing is that the replicationState is "ready" right up until I make a change or add an object to the DIT. At that point, the server on which I made the change shows the replicationState as "binding", and simply nothing happens. So I'm back to looking for hints.



    ------------------------------
    Frank Tate
    Gulfsoft Consulting
    https://www.gulfsoft.com
    AIOps Experts. Contact us for implementation help.
    ------------------------------

    Original Message


Related Content