Synchronizing two-way cryptography between server instances

Edit online

You can use the procedure provided here to synchronize two-way cryptography between server instances.

About this task

If you want to use replication, use a distributed directory, or import and export LDIF data between server instances, you must cryptographically synchronize the server instances to obtain the best performance.

If you already have a server instance, and you have another server instance that you want to cryptographically synchronize with the first server instance, use the following procedure before you do any of the following steps:

  • Start the second server instance
  • Run the idsbulkload command from the second server instance
  • Run the idsldif2db command from the second server instance

To cryptographically synchronize two server instances, assuming that you have already created the first server instance:

Procedure

  1. Create the second server instance, but do not start it, and do not execute idsbulkload or idsldif2db on the second server.
  2. Use the idsgendirksf utility on the second server instance with the seed and salt key values of the first server instance to re-create the ibmslapddir.ksf file (the key stash file) from the first server instance. This file is used to replace the second server instance's originalibmslapddir.ksf file. See the idsgendirksf command information in the Command Reference for more information about the idsgendirksf utility. If the first server instance and the second server instance are running at the same operating system, then you can alternatively copy the ibmslapddir.ksf file (the key stash file) from the first server instance to the second server instance. The file is in the drive_name:\idsslapd-instance_name\etc directory on Windows® systems, or in the instance_user_home_dir/idsslapd-instance_name/etc directory on AIX® and Linux™ systems. (instance_name is the name of the server instance).
  3. Run the idsbulkload or idsldif2db command on the second server instance first, and then start the second server instance.

Configuring a new Directory server synchronization

Edit online

About this task

If you are creating a new directory server instance and you want it to be cryptographically synchronized with other directory server instances, use the following procedure:

Procedure

  1. On the original server, obtain the encryption salt value by performing the following search:    ldapsearch -D adminDN -w adminPw -b "cn=crypto,cn=localhost" objectclass=* ibm-slapdCryptoSalt .
  2. A value similar to the following value is returned:ibm-slapdCryptoSalt=d?TRm$'ucc5mThe part of the string after the equals to sign (=) is the encryption salt value. In this example, the encryption salt value is d?TRm$'ucc5m.
  3. Find the encryption seed value that was supplied when creating the original server.
  4. Create the new server using one of the following methods:
    • Use the Instance Administration Tool and provide the encryption seed value from the original server in the Encryption seed string field and the encryption salt value from the original server in the Encryption salt string field.
    • Use the idsicrt command, and specify the -e encryptionseed and -g encryptsalt options.