Copying data to the replica

Edit online

You can use the instructions provided here to copy data to the replica.

About this task

To ensure that the servers are synchronized, you must first quiesce the master. This means that the master does not accept any updates from its clients.

Procedure

  1. If you have not already done so, use the Web Administration Tool to log on to the master server.
  2. Expand the Replication management category in the navigation area of the Web Administration Tool and click Manage topology.
  3. Select the subtree you have replicated.
  4. Click Quiesce/Unquiesce to quiesce the subtree.
  5. Click OK.

Results

You must now export the data from the master to the replica. This is a manual procedure. On the master server create an LDIF file for the data. To copy all the data contained on the master server, issue the command:idsdb2ldif -o <masterfile.ldif>-I <instance_name> -k <key seed> -t <key salt>Note: You must use the -I option if there is more than one instance. You must use the -k and -t options if keys on the server are not in sync.If you want to copy just the data from a single subtree the command is:idsdb2ldif -o <masterfile.ldif> -s <subtreeDN> -I <instance_name> -k <key seed> -t <key salt>Note: You must use the -I option if there is more than one instance. You must use the -k and -t options if keys on the server are not in sync. Note: The four operational attributes, createTimestamp, creatorsName, modifiersName, and modifyTimestamp are exported to the LDIF file unless the -j option is specified. On the computer where you are creating the replica:

  1. Ensure that the suffixes used by the master are defined in the ibmslapd.conf file.
  2. Stop the replica server.
  3. Copy the <masterfile.ldif> file to the replica and issue the command:idsldif2db -r no -i <masterfile.ldif> -I <instance name>The replication agreements, schedules, credentials (if stored in the replicated subtree) and entry data are loaded on the replica.
  4. Start the server.
Attention: If you are exporting data that will be imported into an Advanced Encryption Standard (AES)-enabled server and if the two servers are not cryptographically synchronized, select the Export data for AES-enabled destination server check box. Then complete the Encryption seed and Encryption salt fields. (See Synchronizing two-way cryptography between server instances for information about cryptographic synchronization of servers.)

When the source server (the server you are exporting data from) and the destination server (the server into which you will be importing the data) are using non-matching directory key stash files, and you specify the encryption seed and salt values of the destination server, any AES-encrypted data will be decrypted using the source server's AES keys, then re-encrypted using the destination server's encryption seed and salt values. This encrypted data is stored in the LDIF file.

The encryption seed is used to generate a set of AES secret key values. These values are stored in a directory stash file and used to encrypt and decrypt directory stored password and secret key attributes. The encryption seed must contain only printable ISO-8859-1 ASCII characters with values in the range of 33 to 126, and must be a minimum of 12 and a maximum of 1016 characters in length. See ASCII characters from 33 to 126 for information about these characters.

The encryption salt is a randomly generated value that is used to generate AES encryption keys. You can obtain the destination server's salt value by searching (using the idsldapsearch utility) the destination server's "cn=crypto,cn=localhost" entry. The attribute type is ibm-slapdCryptoSalt.