Using Web Administration

Edit online

You can to create a subtree using the Web Administration Tool through the information provided here.

About this task

Before you start, be sure that:
  1. Both servers are running.
  2. The servers are cryptographically synchronized if necessary. See Synchronizing two-way cryptography between server instances, in the Administering section of the IBM® Verify Directory documentation.
  3. In the Web Administration Tool, be sure that you are logged in to one of the servers. (This procedure assumes that you are logged in to the first of the two servers, server1.)

To set up two peer masters:

Procedure

  1. In the Web Administration Tool, expand the Replication management category in the navigation area and click Manage topology
  2. Select the subtree that you want to replicate and click Show topology.If you want to view the existing topology, click the box next to the existing servers to expand the list of supplier servers.
  3. Click Replication topology to highlight it, and then click Add master.
  4. On the Server tab of the Add master window:
    1. Select Server is a gateway to make this server a Gateway server or select Supplier gateway and then select a server from the drop-down list to add the server as a master server.
    2. From the Server hostname:port drop-down list, select an LDAP server for the master server. If you want to provide another server as master server, which is not registered on the console server, select Use entry from below item from the Server hostname:port drop-down list and then enter the host name and port number for the master server in the field in the hostname:port format.Note: The default port is 389 for non-SSL and 636 for SSL.
    3. Select the Enable SSL encryption check box to enable SSL communications.
    4. In the Peer master name field, enter the server name or leave this field blank to use the host name.
    5. Enter the server ID. If the server on which you are creating the peer-master is running, click Get server ID to automatically prefill this field. If you do not know the server ID, enter unknown.
    6. Optionally, enter a description of the server.
    7. You must specify the credentials that the server uses to communicate with the master server. Click Select beside the Credential object field. The Select credential window is displayed. On the Select credential window:
      1. Select the location for the credentials you want to use. Preferably this is cn=replication,cn=localhost. The Web Administration Tool allows you to define credentials in the following places:
        • cn=replication,cn=localhost, which keeps the credentials only on the server that uses them. Placing credentials in cn=replication,cn=localhost is considered more secure.
        • cn=replication,cn=IBMpolicies, which is available even when the server under which you are trying to add a replica is not the same server that you are connected to with the Web Administration Tool. Credentials placed under this location are replicated to the servers. The location cn=replication,cn=IBMpolicies is available only if the IBMpolicies support OID, 1.3.18.0.2.32.18, is present under the ibm-supportedcapabilities of the root DSE.
        • Within the replicated subtree, in which case the credentials are replicated with the rest of the subtree. Credentials placed in the replicated subtree are created beneath the ibm-replicagroup=default entry for that subtree.
      2. If you have already created a set of credentials:
        • Click Show credentials. A list of existing credentials is shown in the Select credentials field.
        • Expand the list of credentials and select the one you want to use.
      3. If you do not have preexisting credentials, click Add credentials to create the credentials. See Adding credentials , in the Administering section of the IBM Verify Directory documentation for additional information about agreement credentials.
      4. Click OK.
  5. On the Additional tab:
    1. If you want to use an existing replication schedule, select the replication schedule from the drop-down list. If you want to create a new replication schedule:
      1. Click Add.
      2. See Creating replication schedules , in the Administering section of the IBM Verify Directory documentation for information about replication schedules. When you return to the Add master panel, select the schedule you created from the list of schedules.
    2. From the Capabilities replicated to consumer list, you can deselect any capabilities that you do not want replicated to the consumer. If your network has a mix of servers at different releases, capabilities are available on later releases that are not available on earlier releases.Some capabilities, like filter ACLs and password policy, make use of operational attributes that are replicated with other changes.In most cases, if these features are used, you want all servers to support them.If all of the servers do not support the capability, you do not want to use it. For example, you would not want different ACLs in effect on each server.However, there might be cases where you want to use a capability on the servers that support it, and not have changes related to the capability replicated to servers that do not support the capability.In such cases, you can use the capabilities list to mark certain capabilities to not be replicated.
    3. Check the Add credential information on consumer check box. This selection automatically updates the supplier credentials in the configuration file of the consumer server. This enables the topology information to be replicated to server2.
      • Type the Administrator DN for the consumer server (server2); for example, cn=root. If the administrator DN that was created during the server configuration process was cn=root, then enter the full administrator DN. Do not use only root.
      • Type the Administrator password for the consumer server; for example, secret.
    4. Click OK.
    5. On the Create additional supplier agreements panel, supplier and consumer agreements are listed between the new master server and any existing servers. Clear the check boxes for any agreements that you do not want to be created.
    6. Click Continue.
    7. If a message is displayed asking if you want to restart server2, click Yes. Other messages might be displayed noting that additional actions must be taken. Perform or take note of the appropriate actions. When you are finished, click OK.
    8. Add the appropriate credentials to configure agreements from server2 to server1:
      1. Select the location for the credentials you want to use. Preferably this is cn=replication,cn=localhost.
      2. If you have already created a set of credentials:
        1. Click Show credentials. A list of existing credentials is shown in the Select credentials field.
        2. Expand the list of credentials and select the one you want to use.
      3. Click OK.
      Note: In some cases the Select credentials panel will open asking for a credential that is located in a place other than cn=replication,cn=localhost. In such situations you must provide a credential object that is located in a place other than cn=replication,cn=localhost. Select the credentials the subtree is going to use from the existing sets of credentials or create new credentials. See Adding credentials , in the Administering for information about credentials.
    9. Click OK to create the peer-master.
    10. Messages might be displayed noting that additional actions must be taken. Perform or take note of the appropriate actions. When you are finished, click OK.