Adding a peer-master or gateway server

Edit online

You can learn to add a peer-master or gateway server using the instructions provided here.

About this task

Note: The server must be running to perform this task.
Expand the Replication management category in the navigation area and click Manage topology.
  1. Select the subtree that you want to replicate and click Show topology.
  2. Click the box next to the Replication Topology to expand the list of supplier servers, if you want to view the existing topology.
  3. Click Add master.
On the Server tab of the Add master window:
  • Select Server is a gateway to make this server a Gateway server or select Supplier gateway and then select a server from the drop-down list to add the server as a master server.
  • From the Server hostname:port drop-down list, select an LDAP server for the master server.

    If you want to provide another server as master server, which is not registered on the console server, select Use entry from below item from the Server hostname:port drop-down list and then enter the host name and port number for the master server in the field in the hostname:port format.

    Note: The default port is 389 for non-SSL and 636 for SSL.
  • Select the Enable SSL encryption check box to enable SSL communications.
  • Enter the server name or leave this field blank to use the host name.
  • Enter the server ID. If the server on which you are creating the peer-master is running, click Get server ID to automatically prefill this field.
  • Enter a description of the server.
  • You must specify the credentials that the server uses to communicate with the other master server. Click Select.
    Note: The Web Administration Tool allows you to define credentials in the following places:
    • cn=replication,cn=localhost, which keeps the credentials only on the server that uses them. Placing credentials in cn=replication,cn=localhost is considered more secure.
    • cn=replication,cn=IBMpolicies, which is available even when the server under which you are trying to add a replica is not the same server that you are connected to with the Web Administration Tool. Credentials placed under this location are replicate to the servers.
      Note: The location cn=replication,cn=IBMpolicies is only available, if the IBMpolicies support OID, 1.3.18.0.2.32.18, is present under the ibm-supportedcapabilities of the root DSE.
    • Within the replicated subtree, in which case the credentials are replicated with the rest of the subtree. Credentials placed in the replicated subtree are created beneath the ibm-replicagroup=default entry for that subtree.
    1. Select the location for the credentials you want to use. Preferably this is cn=replication,cn=localhost.
    2. If you have already created a set of credentials, click Show credentials.
    3. Expand the list of credentials and select the one you want to use.
    4. Click OK.
    5. If you do not have preexisting credentials, click Add to create the credentials. See Adding credentials for additional information on agreement credentials.
On the Additional tab:
  1. Specify a replication schedule from the drop-down list or click Add to create one. See Creating replication schedules
  2. From the list of supplier capabilities, you can deselect any capabilities that you do not want replicated to the consumer.

    If your network has a mix of servers at different releases, capabilities are available on later releases that are not available on earlier releases.Some capabilities, like filter ACLs (Filtered ACLs) and password policy (Password policy settings), make use of operational attributes that are replicated with other changes.In most cases, if these features are used, you want all servers to support them.If all of the servers do not support the capability, you do not want to use it. For example, you would not want different ACLs in effect on each server.However, there might be cases where you might want to use a capability on the servers that support it, and not have changes related to the capability replicated to servers that do not support the capability.In such cases, you can use the capabilities list to mark certain capabilities to not be replicated.

  3. Check the Add credential information on consumer check box, if you want to enable dynamic updates of the supplier credentials. This selection automatically updates the supplier information in the configuration file of the server you are creating. This enables the topology information to be replicated to the server.
    • Type the Administration DN for this, the consumer, server. For example cn=root.
      Note: If the administrator DN which was created during the server configuration process was cn=root, then enter the full administrator DN. Do not just use root.
    • Type the Administration password for this, the consumer, server. For example secret.
  4. Click OK.
  5. Supplier and consumer agreements are listed between new master server and any existing servers. Uncheck any agreements that you do not want to be created. This is especially important if you are creating a gateway server.
  6. Click Continue.
  7. Messages might be displayed noting that additional actions must be taken. Perform or take note of the appropriate actions. When you are finished, click OK.
  8. Add the appropriate credentials.
    Note: In some cases the Select credentials panel will open asking for a credential that is located in a place other than cn=replication,cn=localhost. In such situations you must provide a credential object that is located in a place other than cn=replication,cn=localhost. Select the credentials the subtree is going to use from the existing sets of credentials or create new credentials. See Adding credentials.
  9. Check the Add credential information on consumer check box, if you want to enable dynamic updates of the supplier credentials. This selection automatically updates the supplier information in the configuration file of the server you are creating. This enables the topology information to be replicated to the server.
    • Type the Administration DN for this, the consumer, server. For example cn=root.
      Note: If the administrator DN which was created during the server configuration process was cn=root, then enter the full administrator DN. Do not just use root.
    • Type the Administration password for this, the consumer, server. For example secret.
  10. Click OK to create the peer-master.
  11. Messages might be displayed noting that additional actions must be taken. Perform or take note of the appropriate actions. When you are finished, click OK. See Starting replication.
Note: If an external credential object is selected while you are adding credentials on consumers during an Add master operation using the Web Administration Tool, then the following settings need to be configured on the machine where the WebSphere® Application Server is running:
  • In the JAVA_HOME\jre\lib\security\java.security file, check if the following two entries to register JCE provider and CMS provider are present. If the entries do not exist, add this entry in the java.security file by entering the following settings: 
    security.provider.X=com.ibm.crypto.provider.IBMJCE 
security.provider.X+1=com.ibm.security.cmskeystore.CMSProvider
    where, X is the next number in the order.
  • Restart WebSphere Application Server.
  • GSKit must be installed and gsk9\lib or gsk9\lib64 depending on the platform must be in the system path.
  • For the Web Administration Tool to read the keyfile containing credentials information that the master server uses to connect to the replica, and create credentials on replica,the keyfile must be present in C:\temp for Windows™ platforms, and in /tmp for UNIX™.