Synchronizing information

Edit online

There are two main kinds of configuration information that must be kept synchronized among the servers in a distributed directory.

Subtree policies
ACLs are currently the only type of subtree policy. ACLs are honored locally within a server only. When data is split across a flat container each server contains the parent entry. If ACLs are defined on the parent entry, they must be defined on each of the parent entries. ACLs defined at the parent level or below must not have any dependencies on entries above the parent entry in the tree. The server does not enforce ACLs defined on another server.

At setup time, exact copies of the entire parent entry are added to each server if ddsetup is used; otherwise, it is the user's responsibility to add copies of the entire parent entry to the server. If the parent entry has ACLs defined on it, each server has the same ACLs for the entries below the parent after initial configuration. Any changes that are made to the parent entries after initial configuration must be sent to each server containing the parent entry without using the proxy that server. It is the administrator's responsibility to keep the parent entries (including the ACLs on the parent) synchronized among the servers.

Global policies including schema and password policy
The cn=ibmpolicies and cn=schema subtree store global configuration and must be replicated among the servers in a distributed directory. Set gateway replication agreements under the cn=ibmpolicies subtree, so that if any of the servers have a replica, the change is passed on to their individual replica. With the cn=ibmpolicies replication agreement, the cn=schema and cn=pwdpolicy subtrees are automatically replicated. Global policies include the global administration group entry that is stored under cn=ibmpolicies. For more information, see Global administration group.
Note:
  1. The global policies are not replicated to the proxy server.
  2. Changes to cn=schema is not replicated to the proxy server.
Attention: When you create a new directory server instance, be aware of the information that follows. If you want to use a distributed directory, you must cryptographically synchronize the server instances to obtain the best performance.
If you are creating a directory server instance that must be cryptographically synchronized with an existing directory server instance, you must synchronize the server instances before you do any of the following steps:
  • Start the second server instance
  • Run the idsbulkload command from the second server instance
  • Run the idsldif2db command from the second server instance
See Synchronizing two-way cryptography between server instances for information about synchronizing directory server instances.