Configuring password policy operational attributes replication

Edit online

To synchronize password policy operational attributes between a master and a read-only replica, configure the feature in a replication topology.

Before you begin

To replicate the password policy operational attributes, you must complete the following tasks:
  • Configure password policy. See, Setting the global password policy.
  • Configure replication that includes master and read-only replica in the topology. See, Creating a master-replica topology.

Procedure

  1. Log in as the instance owner.
  2. Configure the ibm-slapdReplicateSecurityAttributes attribute on all the servers in the replication topology.
    idsldapmodify -h host_name -p port -D adminDN -w adminDN -i file.ldif
    The file.ldif contains the following entries: 
    dn: cn=Replication, cn=configuration
changetype: modify 
add: ibm-slapdReplicateSecurityAttributes
ibm-slapdReplicateSecurityAttributes: true
  3. Verify whether the ibm-replicareferralURL attribute is configured for a replication context.
    idsldapsearch -h host_name -p port -D adminDN -w adminDN\
-s one -b replcation_context objectclass=*
  4. On the read-only replica servers, for each replication contexts configure the ibm-replicareferralURL attribute with the IP address and port of all its master servers.
    • If the ibm-replicareferralURL attribute is not configured, run the following command:
      idsldapmodify -l -h host_name -p port -D adminDN -w adminDN -i ref_file.ldif
      The ref_file.ldif contains the following entries: 
      dn: cn=ibmpolicies 
changetype: modify 
add: ibm-replicareferralURL
ibm-replicareferralURL: ldap://server1:port1 ldaps://server2:port2
    • If the ibm-replicareferralURL attribute is configured, run the following command:
      idsldapmodify -l -h host_name -p port -D adminDN -w adminDN -i ref_file1.ldif
      The ref_file1.ldif contains the following entries: 
      dn: cn=ibmpolicies 
changetype: modify 
replace: ibm-replicareferralURL
ibm-replicareferralURL: ldap://server1:port1 ldaps://server2:port2
  5. Restart the directory server and the administration server. 
    ibmslapd -I dsrdbm01 -k
ibmdiradm -I dsrdbm01 -k
ibmslapd -I dsrdbm01 -n
ibmdiradm -I dsrdbm01