Change replication password

You can change the used replication passwords by using the Web Administration Tool or the command-line.

Before you begin, consider the design and usage of the stored replication credentials (bindDN and password).

For an existing replication agreement two places exist, where the used credentials are stored.

The first place is the defined replication credential stored in the replication topology (entry with objectclass ibm-replicationcredentials).

This is assigned to a replication agreement entry and is used by the supplier (master) to bind to the consumer (replica).

The second place is the ibmslapd.conf of the consumer, which contains the supplier information with masterDN and MasterPW. Depending on how the replication environment is set up (for example with Web Administration Tool or command-line) the entries with the supplier information can vary - either you have an entry "dn: cn=Master Server, cn=configuration", which is also called the "Default credentials", or you have entries "dn: cn=Supplierxxxxxxxxxxxxx, cn=configuration", which exists for each replicated subtree; and where xxxxxxxxxxxxx represents a random number.

The consumer uses this information to check the validity of the replication bind from a supplier ( replication-bindDN and password). If they are valid, the consumer allows the master to bind and to push the replication change.

So if you want to change the used replication credentials, you must change them at both the master (supplier) and the replica (consumer).

You can do this change either with the Directory Server Web Administration Tool or with the command line.

Change replication password with Web Administration Tool

Login to the Web Administration Tool and connect to the master (supplier)
Go to Replication Management -> Manage Topology.
3. Select the replication subtree, with the used replication password that must change and clickShow topology.
Click the menu symbol behind the replica, with the password that must be, and select Edit agreement.
The replication agreement definition panel opens for this master-replica agreement and you see the current used replication credentials object in the "Credentials object" field.
Click Edit.
The credentials Edit panel displays.
Enter the new password in Bind password and Confirm password.
The new password that you enter is effective for all the replication agreements, with which you accessed the credentials object for editing.
Click OK twice.
Click Close.

With this the replication credentials were changed at the master (supplier). Now you still have to adjust the password information at the replica (consumer).

Log in to the Web Administration Tool and connect to the replica (consumer).
Go to Replication Management -> Manage Replication Properties.
Select in "Supplier information:" the subtree, for which you had changed the password at the master (supplier) and click Edit.
Enter the new password in the "Replication bind password" and "Confirm password" fields.
Click OK twice.

After these steps the master should be able to bind to the replica with the new password.

You can test the new set password at the replica (consumer), for example:

ldapsearch -D <replication bindDN> -w <new_repl_bind_PWD> -b "" -s base objectclass=*

Change replication password with the command-line

Determine at the master (supplier) the used replication credential object for the replication agreement, for which you want to change the password, by executing the following ldapsearch at the master:
ldapsearch -D <adminDN> -w <adminDN_passwd> -b "replicated_subtree" -s sub objectclass=ibm-replicationagreement ibm-replicacredentialsdn
Sample:
ldapsearch -D cn=root -w secret -b "o=sample" -s sub objectclass=ibm-replicationagreement ibm-replicacredentialsdn
You should get an output like:
cn=replica1:389,cn=master1:389,ibm-replicaGroup=default,O=SAMPLE
ibm-replicacredentialsdn=cn=my_cred,cn=replication,cn=localhost
Assuming, that this is the replication agreement, for which you want to change the password, execute the following ldapmodify command at the master:
ldapmodify -D <adminDN> -w <adminDN_passwd> -i change_pwd.ldif
Example:
ldapmodify -D cn=root -w secret -i change_pwd.ldif
where the change_pwd.ldif contains the following lines:
```
dn: cn=my_cred,cn=replication,cn=localhost
changetype: modify
replace: replicacredentials
replicacredentials: new_password
```
Go to the replica (consumer) and modify the supplier information in the ibmslapd.conf file, by using the ldapmodify command.
1. Make a backup copy of the current ibmslapd.conf.
2. Determine the supplier entry, for which you changed the password at the master before by executing:
  ldapsearch -D <adminDN> -w <adminDN_passwd> -b cn=configuration -s sub objectclass=ibm-slapdReplication
  ldapsearch -D <adminDN> -w <adminDN_passwd> -b cn=configuration -s sub objectclass=ibm-slapdsupplier ibm-slapdreplicasubtree
  Example:
  ldapsearch -D cn=root -w secret -b cn=configuration -s sub objectclass=ibm-slapdsupplier ibm-slapdreplicasubtree
  Example output:
```
 cn=Supplier1535616047280, cn=configuration
 ibm-slapdreplicasubtree=O=SAMPLE
 cn=Supplier1536236710636, cn=configuration
 ibm-slapdreplicasubtree=CN=IBMPOLICIES
```
3. Change the password in the according supplier entry via ldapmodify:
  ldapmodify -D <adminDN> -w <adminDN_passwd> -i new_pwd.ldif
  Because we changed the replication credentials (password) for the replication agreement for o=sample in the samples before, the new_pwd.ldif must contain the following entries
```
 dn: cn=Supplier1535616047280, cn=configuration
 changetype: modify
 replace: ibm-slapdmasterpw
 ibm-slapdmasterpw: new_password
```
4. Restart the ibmslapd, so that the the new password takes effect.
  After these steps the master should be able to bind to the replica with the new password.
  You can test the new set password at the replica (consumer) e.g. by
  ldapsearch -D <replication bindDN> -w <new_repl_bind_PWD> -b "" -s base objectclass=*