OpenDJ uses advanced data replication with automated conflict resolution to help ensure your directory services remain available during administrative operations that take an individual server offline, or in the event a server crashes or a network goes down. This chapter explains how to manage OpenDJ directory data replication. In this chapter you will learn to: Set up replication as part of initial installation using OpenDJ control panel, or at any time using command-line tools Understand how replication operates in order to configure it appropriately Enable, initialize, and stop data replication Configure stand-alone directory servers and replication servers, or break a server that plays both roles into two stand-alone servers Configure replication groups, read-only replicas, assured replication, subtree replication, and fractional replication for complex deployments Configure and use change notification to synchronize external applications with changes to directory data Recover from situations where a user error has been applied to all replicas

Replication Quick setup High availability Replication You can set up replication during installation by using the setup wizard, starting with the Topology Options screen. In the Topology Options screen for the first server you set up, select This server will be part of a replication topology. If you also choose Configure as Secure, then replication traffic is protected by Transport Layer Security. In the Topology Options screen for subsequent servers, select There is already a server in the topology. Provide the Host Name, Administration Connector Port number, global Admin User identifier, and Admin Password for the first server. When presented with the Create Global Administrator screen, provide a Global Administrator ID and Global Administrator Password. The Global Administrator account exists on all servers in the replication topology. The account is stored under cn=admin data. It provides an account to administer replication with the same credentials on every server in the topology. In the Data Replication screen, select the user and application data base DN(s) to replicate. OpenDJ directory server automatically replicates configuration data and directory schema. Once replication is set up, it works for all the replicas. You can monitor replication status through OpenDJ Control Panel.

Replication Overview Before you take replication further than setting up replication in the setup wizard, read this section to learn more about how OpenDJ replication works.

Replication is the process of copying updates between OpenDJ directory servers such that all servers converge on identical copies of directory data. Replication is designed to let convergence happen over time by default. Assured replication can require, however, that the convergence happen before the client application is notified that the operation was successful. Letting convergence happen over time means that different replicas can be momentarily out of sync, but it also means that if you lose an individual server or even an entire data center, your directory service can keep on running, and then get back in sync when the servers are restarted or the network is repaired. Replication is specific to the OpenDJ directory service. Replication uses a specific protocol that replays update operations quickly, storing enough historical information about the updates to resolve most conflicts automatically. For example, if two client applications separately update a user entry to change the phone number, replication can work out which was the latest change, and apply that change across servers. The historical information needed to resolve these issues is periodically purged to avoid growing larger and larger forever. As a directory administrator, you must ensure that you do not purge the historical information more often than you backup your directory data. Keep server clocks synchronized for your topology. You can use NTP for example. Keeping server clocks synchronized helps prevent issues with SSL connections and with replication itself. Keeping server clocks synchronized also makes it easier to compare timestamps from multiple servers.

The primary unit of replication is the suffix, specified by a base DN such as dc=example,dc=com.When you configure partial and fractional replication, however, you can replicate only part of a suffix, or only certain attributes on entries. Also, if you split your suffix across multiple backends, then you need to set up replication separately for each part of suffix in a different backend. Replication also depends on the directory schema, defined on cn=schema, and the cn=admin data suffix with administrative identities and certificates for protecting communications. Thus that content gets replicated as well. The set of OpenDJ servers replicating data for a given suffix is called a replication topology. You can have more than one replication topology. For example, one topology could be devoted to dc=example,dc=com, and another to dc=example,dc=org. OpenDJ servers are capable of serving more than one suffix. They are also capable of participating in more than one replication topology. Three replication topologies set up correctly In this figure, all OpenDJ servers serve the replicated suffix dc=example,dc=com. Only servers A and B serve dc=example,dc=org. Only server C and D serve dc=example,dc=net. Within a replication topology, the suffixes being replicated are identified to the replication servers by their DNs. All the replication servers are fully connected in a topology. Consequently it is impossible to have multiple separate, independent topologies for data under the same DN within the overall set of servers. This is illustrated in the following diagram. Two replication topologies, one of which does not work You cannot have all servers replicating both dc=example,dc=com and also dc=example,dc=org, but with all servers connected for dc=example,dc=com and only some of the servers connected for dc=example,dc=org.

In order to understand what happens when individual servers stop responding due to a network partition or a crash, know that OpenDJ can offer both directory service and also replication service, and the two services are not the same, even if they can run alongside each other in the same OpenDJ server in the same Java Virtual Machine. Replication relies on the replication service provided by OpenDJ replication servers, where OpenDJ directory servers publish changes made to their data, and subscribe to changes published by other OpenDJ directory servers. A replication server manages replication data only, handling replication traffic with directory servers and with other replication servers, receiving, sending, and storing only changes to directory data rather than directory data itself. Once a replication server is connected to a replication topology, it maintains connections to all other replication servers in that topology. A directory server handles directory data. It responds to requests, stores directory data and historical information. For each replicated suffix, such as dc=example,dc=com, cn=schema and cn=admin data, the directory server publishes changes to a replication server, and subscribes to changes from that replication server. (Directory servers do not publish changes to other directory servers.) A directory server also resolves any conflicts that arise when reconciling changes from other directory servers, using the historical information about changes to resolve the conflicts. (Conflict resolution is the responsibility of the directory server rather than the replication server.) Once a directory server is connected to a replication topology for a particular suffix, it connects to one replication server at a time for that suffix. The replication server provides the directory server with a list of all replication servers for that suffix. Given the list of possible replication servers to which it can connect, the directory server can determine which replication server to connect to when starting up, or when the current connection is lost or becomes unresponsive. For each replicated suffix, a directory server prefers to connect to a replication server: In the same group as the directory server Having the same initial data for the suffix as the directory server If initial data were the same, having all the latest changes from the directory server Running in the same Java Virtual Machine as the directory server Having the most available capacity relative to other eligible replication servers Available capacity depends on how many directory servers in the topology are already connected to a replication server, and what proportion of all directory servers in the topology ought to be connected to the replication server. To determine what proportion of the total number of directory servers should be connected to a replication server, OpenDJ uses replication server weight. When configuring a replication server, you can assign it a weight (default: 1). The weight property takes an integer that indicates capacity to provide replication service relative to other servers. For example, a weight of 2 would indicate a replication server that can handle twice as many connected servers as a replication server with weight 1. The proportion of directory servers in a topology that should be connected to a given replication server is equal to (replication server weight)/(sum of replication server weights). In other words, if there are 4 replication servers in a topology each with default weights, the proportion for each replication server is 1/4. Consider a situation where 7 directory servers are connected to replication servers A, B, C, and D for dc=example,dc=com data. Suppose 2 directory servers each are connected to A, B, and C, and 1 directory server is connected to replication server D. Replication server D is therefore the server with the most available capacity relative to other replication servers in the topology. All other criteria being equal, replication server D is the server to connect to when an 8th directory server joins the topology. The directory server regularly updates the list of replication servers in case it must reconnect. As available capacity of replication servers for each replication topology can change dynamically, a directory server can potentially reconnect to another replication server to balance the replication load in the topology. For this reason the server can also end up connected to different replication servers for different suffixes.

Replication Configuring This section shows how to configure replication with command-line tools, such as the dsreplication command.

You can start the replication process by using the dsreplication enable command. $ dsreplication \ enable \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --host1 opendj.example.com \ --port1 4444 \ --bindDN1 "cn=Directory Manager" \ --bindPassword1 password \ --replicationPort1 8989 \ --host2 opendj2.example.com \ --port2 4444 \ --bindDN2 "cn=Directory Manager" \ --bindPassword2 password \ --replicationPort2 8989 \ --trustAll \ --no-prompt Establishing connections ..... Done. Checking registration information ..... Done. Updating remote references on server opendj.example.com:4444 ..... Done. Configuring Replication port on server opendj2.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server opendj.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server opendj2.example.com:4444 ..... Done. Updating registration configuration on server opendj.example.com:4444 ..... Done. Updating registration configuration on server opendj2.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server opendj.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server opendj2.example.com:4444 ..... Done. Initializing registration information on server opendj2.example.com:4444 with the contents of server opendj.example.com:4444 ..... Done. Initializing schema on server opendj2.example.com:4444 with the contents of server opendj.example.com:4444 ..... Done. Replication has been successfully enabled. Note that for replication to work you must initialize the contents of the base DN's that are being replicated (use dsreplication initialize to do so). See /var/.../opends-replication-7958637258600693490.log for a detailed log of this operation. To enable secure connections for replication use the --secureReplication1 and --secureReplication2 options, which are equivalent to selecting Configure as Secure in the replication topology options screen of the setup wizard. As you see in the command output, replication is set up to function once enabled. You must however initialize replication in order to start the process. When scripting the configuration to set up multiple replicas in quick succession, use the same initial replication server each time you run the command. In other words, pass the same --host1, --port1, --bindDN1, --bindPassword1, and --replicationPort1 options for each of the other replicas that you set up in your script. If you need to add another OpenDJ directory server to participate in replication, use the dsreplication enable with the new server as the second server.

You can initialize replication between servers by performing initialization over the network after you have enabled replication, or by importing the same LDIF data on all servers and then enabling replication. You can also add a new server by restoring a backup from an existing replica onto the new server and then enabling replication with an existing replica. The alternatives are described step-by-step in the following procedures. Initialization over the network while the server is online works well when you have no initial data, or when your network bandwidth is large compared to the initial amount of data to replicate. Enable replication on all servers. See for instructions. Start replication with the dsreplication initialize-all command. $ dsreplication \ initialize-all \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --hostname opendj.example.com \ --port 4444 \ --trustAll \ --no-prompt Initializing base DN dc=example,dc=com with the contents from opendj.example.com:4444: 160 entries processed (100 % complete). Base DN initialized successfully. See /var/.../opends-replication-5020375834904394170.log for a detailed log of this operation. This procedure can be useful when you are starting with a large amount of directory data that is available locally to all directory servers. Import the same LDIF on all servers as described in the procedure, To Import LDIF Data. Do not yet accept updates to the directory data. shows how to prevent replicas from accepting updates from clients. Enable replication for all servers. See for instructions. Allow updates to the directory data by setting writability-mode:enabled using a command like the one you found in . You can create a new replica from a backup of a server in the existing topology. Install a new server to use as the new replica. Backup the database on an existing server as described in Backing Up Directory Data. At this point, other servers in the topology can continue to process updates. Enable replication on the new replica. $ dsreplication \ enable \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --host1 opendj.example.com \ --port1 4444 \ --bindDN1 "cn=Directory Manager" \ --bindPassword1 password \ --replicationPort1 8989 \ --host2 opendj3.example.com \ --port2 4444 \ --bindDN2 "cn=Directory Manager" \ --bindPassword2 password \ --replicationPort2 8989 \ --trustAll \ --no-prompt Establishing connections ..... Done. Checking registration information ..... Done. Updating remote references on server opendj.example.com:4444 ..... Done. Configuring Replication port on server opendj3.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server opendj.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server opendj3.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server opendj2.example.com:4444 ..... Done. Updating remote references on server opendj2.example.com:4444 ..... Done. Updating registration configuration on server opendj.example.com:4444 ..... Done. Updating registration configuration on server opendj3.example.com:4444 ..... Done. Updating registration configuration on server opendj2.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server opendj.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server opendj3.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server opendj2.example.com:4444 ..... Done. Initializing registration information on server opendj3.example.com:4444 with the contents of server opendj.example.com:4444 ..... Done. Replication has been successfully enabled. Note that for replication to work you must initialize the contents of the base DN's that are being replicated (use dsreplication initialize to do so). See /var/.../opends-replication-1672058070147419978.log for a detailed log of this operation. Contrary to the message from the command, you do not need to use the dsreplication initialize command at this point. On the new server, restore the database from the backup archive as described in the procedure, To Restore a Replica. As long as you restore the database on the new replica before the replication purge delay runs out, updates processed by other servers after you created the backup are replicated to the new server after you restore the data. OpenDJ replication is designed to make directory data converge across all replicas in a topology. Directory replication mechanically applies new changes to ensure that replicated data is the same everywhere, with newer changes taking precedence over older changes. When you restore older backup data, for example, directory replication applies newer changes to the older data. This behavior is a good thing when the newer changes are correct. This behavior can be problematic in the following cases: A bug or serious user error results in unwanted new changes that are hard to fix. The data in a test or proof-of-concept environment must regularly be reinitialized to a known state. The dsreplication command has the following subcommands that let you reinitialize directory data, preventing replication from replaying changes that occurred before reinitialization: The dsreplication pre-external-initialization command removes the setting for the generation ID across the topology for a specified base DN. The generation ID is an internal-use identifier that replication uses to determine what changes to apply. This has the effect of halting replication. The dsreplication post-external-initialization command sets a new generation ID across the topology, effectively resuming replication. The steps in this procedure reinitialize the replication changelog, eliminating the history of changes that occurred before replication resumed. The replication changelog is described in . Applications that depend on the changelog for change notifications must be reinitialized after this procedure is completed. Prevent changes to the affected data during the procedure, as such changes are lost for the purposes of replication. For example, make each replica read-only as described in . On a single server in the topology, run the dsreplication pre-external-initialization command for the base DN holding the relevant data, as shown in the following example: $ dsreplication \ pre-external-initialization \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --hostname opendj.example.com \ --port 4444 \ --trustAll \ --no-prompt Preparing base DN dc=example,dc=com to be initialized externally ..... Done. Now you can proceed to the initialization of the contents of the base DNs on all the replicated servers. You can use the command import-ldif or the binary copy to do so. You must use the same LDIF file or binary copy on each server. When the initialization is completed you must use the subcommand 'post-external-initialization' for replication to work with the new base DNs contents. Replication halts as the command takes effect. Changes made at this time are not replicated, even after replication resumes. On each server in the topology, restore the data in the topology to the known state in one of the following ways: Import the data from LDIF as described in To Import LDIF Data. Restore the data from backup as described in To Restore a Stand-alone Server. On a single server in the topology, run the dsreplication post-external-initialization command for the base DN holding the relevant data, as shown in the following example: $ dsreplication \ post-external-initialization \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --hostname opendj.example.com \ --port 4444 \ --trustAll \ --no-prompt Updating replication information on base DN dc=example,dc=com ..... Done. Post initialization procedure completed successfully. Replication resumes as the command takes effect. If you made replicas read-only, make them read-write again by setting writability-mode:enabled.

Replication Stopping How you stop replication depends on whether the change is meant to be temporary or permanent. If you must stop a server from replicating temporarily, you can do so by using the dsconfig command. Do not allow modifications on the replica for which replication is disabled, as no record of such changes is kept, and the changes cause replication to diverge. Disable the multimaster synchronization provider. $ dsconfig \ set-synchronization-provider-prop \ --port 4444 \ --hostname opendj2.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --set enabled:false \ --trustAll \ --no-prompt When you are ready to resume replication, enable the multimaster synchronization provider. $ dsconfig \ set-synchronization-provider-prop \ --port 4444 \ --hostname opendj2.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --set enabled:true \ --trustAll \ --no-prompt If you need to stop a server from replicating permanently, for example in preparation to remove a server, you can do so with the dsreplication disable command. Stop replication using the dsreplication disable command. $ dsreplication \ disable \ --disableAll \ --port 4444 \ --hostname opendj2.example.com \ --bindDN "cn=Directory Manager" \ --adminPassword password \ --trustAll \ --no-prompt Establishing connections ..... Done. Disabling replication on base DN cn=admin data of server opendj2.example.com:4444 ..... Done. Disabling replication on base DN dc=example,dc=com of server opendj2.example.com:4444 ..... Done. Disabling replication on base DN cn=schema of server opendj2.example.com:4444 ..... Done. Disabling replication port 8989 of server opendj2.example.com:4444 ..... Done. Removing registration information ..... Done. Removing truststore information ..... Done. See /var/.../opends-replication-125248191132797765.log for a detailed log of this operation. The dsreplication disable as shown completely removes the replication configuration information from the server. If you want to restart replication for the server, you need to run the dsreplication enable and dsreplication initialize commands again.

Replication Dedicated servers Replication in OpenDJ is designed to be both easy to implement in environments with a few servers, and also scalable in environments with many servers. You can enable the replication service on each OpenDJ directory server in your deployment, for example, to limit the number of servers you deploy. Yet in a large deployment, you can use stand-alone replication servers — OpenDJ servers that do nothing but relay replication messages — to configure (and troubleshoot) the replication service separately from the directory service. You only need a few stand-alone replication servers publishing changes to serve many directory servers subscribed to the changes. Furthermore, replication is designed such that you need only connect a directory server to the nearest replication server for the directory server to replicate with all others in your topology. Yet only the stand-alone replication servers participate in fully-meshed replication. All replication servers in a topology are connected to all other replication servers. Directory servers are connected only to one replication server at a time, and their connections should be to replication servers on the same LAN. Therefore the total number of replication connections, Totalconn is expressed as follows. Totalconn = (NRS * NRS-1)/2 + NDS Here, NRS is the number of replication servers, and NDS is the number of stand-alone directory servers. In other words, if you have only 3 servers, then Totalconn is 3 with no stand-alone servers. However, if you have two data centers, and need 12 directory servers, then with no stand-alone directory servers Totalconn is (12 * 11)/2 or 66. Yet, with 4 stand-alone replication servers, and 12 stand-alone directory servers, Totalconn is (4 * 3)/2 + 12, or 18, with only four of those connections needing to go over the WAN. (By running four directory servers that also run replication servers and eight stand-alone directory servers, you reduce the number of replication connections to 14 for 12 replicas.)

Dedicated servers versus consolidated instances Dedicated servers are suited to environments with large numbers of replicas.

If you set up OpenDJ directory server to replicate by using the Quick Setup wizard, then the wizard activated the replication service for that server. You can turn off the replication service on OpenDJ directory server, and then configure the server to work with a separate, stand-alone replication server instead. Start by using the dsreplication disable --disableReplicationServer command to turn off the replication service on the server. This example sets up a stand-alone replication server to handle the replication traffic between two directory servers that do not handle replication themselves. Here the replication server is rs.example.com. The directory servers are opendj.example.com and opendj2.example.com. In a real deployment, you would have more replication servers to avoid a single point of failure. Setup the replication server as a directory server that has no database. Setup the directory servers as stand-alone directory servers. Enable replication with the appropriate --noReplicationServer and --onlyReplicationServer options. $ dsreplication \ enable \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --host1 opendj.example.com \ --port1 4444 \ --bindDN1 "cn=Directory Manager" \ --bindPassword1 password \ --noReplicationServer1 \ --host2 rs.example.com \ --port2 4444 \ --bindDN2 "cn=Directory Manager" \ --bindPassword2 password \ --replicationPort2 8989 \ --onlyReplicationServer2 \ --trustAll \ --no-prompt Establishing connections ..... Done. Only one replication server will be defined for the following base DN's: dc=example,dc=com It is recommended to have at least two replication servers (two changelogs) to avoid a single point of failure in the replication topology. Checking registration information ..... Done. Configuring Replication port on server rs.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server opendj.example.com:4444 ..... Done. Updating registration configuration on server opendj.example.com:4444 ..... Done. Updating registration configuration on server rs.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server opendj.example.com:4444 ..... Done. Initializing registration information on server rs.example.com:4444 with the contents of server opendj.example.com:4444 ..... Done. Replication has been successfully enabled. Note that for replication to work you must initialize the contents of the base DN's that are being replicated (use dsreplication initialize to do so). See /var/.../opends-replication-1720959352638609971.log for a detailed log of this operation. $ dsreplication \ enable \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --host1 opendj2.example.com \ --port1 4444 \ --bindDN1 "cn=Directory Manager" \ --bindPassword1 password \ --noReplicationServer1 \ --host2 rs.example.com \ --port2 4444 \ --bindDN2 "cn=Directory Manager" \ --bindPassword2 password \ --replicationPort2 8989 \ --onlyReplicationServer2 \ --trustAll \ --no-prompt Establishing connections ..... Done. Only one replication server will be defined for the following base DN's: dc=example,dc=com It is recommended to have at least two replication servers (two changelogs) to avoid a single point of failure in the replication topology. Checking registration information ..... Done. Updating remote references on server rs.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server opendj2.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server opendj.example.com:4444 ..... Done. Updating registration configuration on server opendj2.example.com:4444 ..... Done. Updating registration configuration on server rs.example.com:4444 ..... Done. Updating registration configuration on server opendj.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server opendj2.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server opendj.example.com:4444 ..... Done. Initializing registration information on server opendj2.example.com:4444 with the contents of server rs.example.com:4444 ..... Done. Replication has been successfully enabled. Note that for replication to work you must initialize the contents of the base DN's that are being replicated (use dsreplication initialize to do so). See /var/folders/.../opends-replication-5893037538856033562.log for a detailed log of this operation. Initialize replication from one of the directory servers. $ dsreplication \ initialize-all \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --hostname opendj.example.com \ --port 4444 \ --trustAll \ --no-prompt Initializing base DN dc=example,dc=com with the contents from opendj.example.com:4444: 160 entries processed (100 % complete). Base DN initialized successfully. See /var/.../opends-replication-7677303986403997574.log for a detailed log of this operation.

Replication Dedicated servers When you configure replication for an OpenDJ directory server, you can give the directory server the capability to handle replication traffic as well. As described in , OpenDJ servers can also be configured to handle only replication traffic. Alternatively you can configure an OpenDJ directory server to connect to a remote replication server of either variety, but to remain only a directory server itself. This sort of stand-alone directory server replica is shown in . Furthermore, you can make this stand-alone directory server replica read-only for client applications, accepting only replication updates. The following steps show how to configure the server as a stand-alone, directory server only replica of an existing replicated directory server. Set up replication between other servers. Install the directory server without configuring replication, but creating at least the base entry to be replicated. Enable replication with the appropriate --noReplicationServer option. $ dsreplication \ enable \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --host1 master.example.com \ --port1 4444 \ --bindDN1 "cn=Directory Manager" \ --bindPassword1 password \ --host2 ds-only.example.com \ --port2 4444 \ --bindDN2 "cn=Directory Manager" \ --bindPassword2 password \ --noReplicationServer2 \ --trustAll \ --no-prompt Establishing connections ..... Done. Checking registration information ..... Done. Updating remote references on server master.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server master.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server ds-only.example.com:4444 ..... Done. Updating replication configuration for baseDN dc=example,dc=com on server master2.example.com:4444 ..... Done. Updating remote references on server master2.example.com:4444 ..... Done. Updating registration configuration on server master.example.com:4444 ..... Done. Updating registration configuration on server ds-only.example.com:4444 ..... Done. Updating registration configuration on server master2.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server master.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server ds-only.example.com:4444 ..... Done. Updating replication configuration for baseDN cn=schema on server master2.example.com:4444 ..... Done. Initializing registration information on server ds-only.example.com:4444 with the contents of server master.example.com:4444 ..... Done. Initializing schema on server ds-only.example.com:4444 with the contents of server master.example.com:4444 ..... Done. Replication has been successfully enabled. Note that for replication to work you must initialize the contents of the base DNs that are being replicated (use dsreplication initialize to do so). See /var/.../opendj-replication-859181866587327450.log for a detailed log of this operation. Here the existing server is both directory server and replication server. If the existing server is a stand-alone replication server, then also use the appropriate --onlyReplicationServer option. Initialize data on the new directory server replica. $ dsreplication \ initialize \ --adminUID admin \ --adminPassword password \ --baseDN dc=example,dc=com \ --hostSource master.example.com \ --portSource 4444 \ --hostDestination ds-only.example.com \ --portDestination 4444 \ --trustAll \ --no-prompt Initializing base DN dc=example,dc=com with the contents from master.example.com:4444: 0 entries processed (0 % complete). 176 entries processed (100 % complete). Base DN initialized successfully. See /var/.../opendj-replication-4326340645155418876.log for a detailed log of this operation. If you want to make the directory server replica read-only for client application traffic, see .

Replication Grouping servers Replication lets you define groups so that replicas communicate first with replication servers in the group before going to replication servers outside the group. Groups are identified with unique numeric group IDs. Replication groups are designed for deployments across multiple data centers, where you aim to focus replication traffic on the LAN rather than the WAN. In multi-data center deployments, group nearby servers together. For each group, set the appropriate group ID for the topology on both the replication servers and the directory servers. The example commands in this procedure set up two replication groups, each with a replication server and a directory server. The directory servers are opendj.example.com and opendj2.example.com. The replication servers are rs.example.com and rs2.example.com. In a full-scale deployment, you would have multiple servers of each type in each group, such as all the replicas and replication servers in each data center being in the same group. Pick a group ID for each group. The default group ID is 1. Set the group ID for each group by replication domain on the directory servers. $ dsconfig \ set-replication-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name "dc=example,dc=com" \ --set group-id:1 \ --trustAll \ --no-prompt $ dsconfig \ set-replication-domain-prop \ --port 4444 \ --hostname opendj2.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name "dc=example,dc=com" \ --set group-id:2 \ --trustAll \ --no-prompt Set the group ID for each group on the replication servers. $ dsconfig \ set-replication-server-prop \ --port 4444 \ --hostname rs.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --set group-id:1 \ --trustAll \ --no-prompt $ dsconfig \ set-replication-server-prop \ --port 4444 \ --hostname rs2.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --set group-id:2 \ --trustAll \ --no-prompt

Replication Read-only servers By default all directory servers in a replication topology are read-write. You can however choose to make replicas take updates only from the replication protocol, and refuse updates from client applications. $ dsconfig \ set-global-configuration-prop \ --port 4444 \ --hostname opendj2.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --set writability-mode:internal-only \ --trustAll \ --no-prompt

Replication Assured In standard replication, when a client requests an update operation the directory server performs the update and, if the update is successful, sends information about the update to the replication service, and sends a result code to the client application right away. As a result, the client application can conclude that the update was successful, but only on the replica that handled the update. Assured replication lets you force the replica performing the initial update to wait for confirmation that the update has been received elsewhere in the topology before sending a result code to the client application. You can configure assured replication either to wait for one or more replication servers to acknowledge having received the update, or to wait for all directory servers to have replayed the update. As you might imagine, assured replication is theoretically safer than standard replication, yet it is also slower, potentially waiting for a timeout before failing when the network or other servers are down. Safe data mode requires the update be sent to assured-sd-level replication servers before acknowledgement is returned to the client application. For each directory server, set safe data mode for the replication domain, and also set the safe data level. $ dsconfig \ set-replication-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name "dc=example,dc=com" \ --set assured-type:safe-data \ --set assured-sd-level:1 \ --trustAll \ --no-prompt $ dsconfig \ set-replication-domain-prop \ --port 4444 \ --hostname opendj2.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name "dc=example,dc=com" \ --set assured-type:safe-data \ --set assured-sd-level:1 \ --trustAll \ --no-prompt Safe read mode requires the update be replayed on all directory servers before acknowledgement is returned to the client application. For each directory server, set safe read mode for the replication domain. $ dsconfig \ set-replication-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name "dc=example,dc=com" \ --set assured-type:safe-read \ --trustAll \ --no-prompt $ dsconfig \ set-replication-domain-prop \ --port 4444 \ --hostname opendj2.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name "dc=example,dc=com" \ --set assured-type:safe-read \ --trustAll \ --no-prompt When working with assured replication, the replication server property degraded-status-threshold (default: 5000), sets the number of operations allowed to build up in the replication queue before the server is assigned degraded status. When a replication server has degraded status, assured replication ceases to have an effect.

Replication Subtree OpenDJ can perform subtree replication, for example replicating ou=People,dc=example,dc=com, but not the rest of dc=example,dc=com, by putting the subtree in a separate backend from the rest of the suffix. For example, in this case you might have a userRoot backend containing everything in dc=example,dc=com except ou=People,dc=example,dc=com, and a separate peopleRoot backend for ou=People,dc=example,dc=com. Then you replicate ou=People,dc=example,dc=com in its own topology.

Replication Fractional OpenDJ can perform fractional replication, whereby you specify the attributes to include in or to exclude from the replication process. You set fractional replication configuration as fractional-include or fractional-exclude properties for a replication domain. When you include attributes, the attributes that are required on the relevant object classes are also included, whether you specify them or not. When you exclude attributes, the excluded attributes must be optional attributes for the relevant object classes. Fractional replicas still respect schema definitions. Fractional replication works by filtering objects at the replication server. Initialize replication as you would normally. Of course you cannot create a full replica from a replica with only a subset of the data. If you must prevent data from being replicated across a national boundary, split the replication server handling the updates from the directory servers receiving the updates as described in . For example, you might configure an externally facing fractional replica to include only some inetOrgPerson attributes. $ dsconfig \ set-replication-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name "dc=example,dc=com" \ --trustAll \ --no-prompt \ --set \ fractional-include:inetorgperson:cn,givenname,mail,mobile,sn,telephonenumber As another example, you might exclude a custom attribute called sessionToken from being replicated. $ dsconfig \ set-replication-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name "dc=example,dc=com" \ --set fractional-exclude:*:sessionToken \ --trustAll \ --no-prompt This last example only works if you first define a sessionToken attribute in the directory server schema.

As described in , a replication topology is made up of servers playing the role of directory server, and servers playing the role of replication server. By default, each replicated OpenDJ server plays both roles. Some deployments call for stand-alone directory servers and stand-alone replication servers, however. In practice, "stand-alone" technically usually refers only to the role with respect to replication of user data. In fact stand-alone servers generally continue to play both roles for server configuration data under cn=admin data and cn=schema. The update traffic to these suffixes is however generally orders of magnitude lower than update traffic for user data. If possible avoid breaking apart an existing multi-role server. Instead, set up stand-alone servers as described in and . The following procedure breaks a multi-role server into two stand-alone servers while preserving existing data. It does require disk space initially to hold copies of existing data. The following steps show how to break a multi-role OpenDJ server into a stand-alone directory server and a stand-alone replication server. While you carry out this procedure, do not allow any client traffic to the servers you modify. Make sure you have already set up at least a couple of OpenDJ servers that replicate user data. This example starts with the following multi-role servers. /path/to/dsrs1 (ports: 1389, 1636, 4444, 8989; replicating user data for dc=example,dc=com) /path/to/dsrs2 (ports: 2389, 2636, 5444, 9989; replicating user data for dc=example,dc=com) /path/to/dsrs1 is the target server to be broken into stand-alone components. When you begin, the target server has both directory server and replication server components. Before you proceed: Read the rest of the procedure, and make sure you understand the steps. Direct client traffic away from the target server. Back up the target server. Run the dsreplication status command before making changes. $ dsreplication \ status \ --port 4444 \ --hostname opendj.example.com \ --adminUID admin \ --adminPassword password \ --baseDN "cn=admin data" \ --baseDN cn=schema \ --baseDN dc=example,dc=com \ --trustAll \ --no-prompt Suffix DN :...: DS ID : RS ID :... ------------------:...:-------:-------:... cn=admin data :...: 29388 : 32560 :... cn=admin data :...: 7044 : 29137 :... cn=schema :...: 24612 : 32560 :... cn=schema :...: 22295 : 29137 :... dc=example,dc=com :...: 20360 : 32560 :... dc=example,dc=com :...: 12164 : 29137 :... ... Keep the output of the command for the IDs shown. The information is used later in this procedure. Temporarily disable the multimaster synchronization provider on the target server. $ dsconfig \ set-synchronization-provider-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --set enabled:false \ --trustAll \ --no-prompt This step is also shown in . Temporarily disable the backend holding the replicated data. $ dsconfig \ set-backend-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --backend-name userRoot \ --set enabled:false \ --trustAll \ --no-prompt Stop the target server. $ stop-ds Stopping Server... ... msg=The Directory Server is now stopped Make two copies of the server files. $ cd /path/to/ One copy is to become the stand-alone directory server. $ cp -r dsrs1 ds The other copy is to become the stand-alone replication server. $ cp -r dsrs1 rs Start the copy that is to become the stand-alone directory server, remove the replication server and changelog configuration, enable the user data backend, and then enable the multimaster synchronization provider on the directory server. # The following command removes the replication server configuration. dsconfig \ delete-replication-server \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --trustAll \ --no-prompt # The following command disables the changelog for the user data # in dc=example,dc=com. dsconfig \ set-external-changelog-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name dc=example,dc=com --set enabled:false --trustAll \ --no-prompt # The following command enables the user data backend. dsconfig \ set-backend-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --backend-name userRoot \ --set enabled:true \ --trustAll \ --no-prompt # The following command enables the multimaster synchronization provider. dsconfig \ set-synchronization-provider-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --set enabled:true \ --trustAll \ --no-prompt You can then remove the files for the changelog on the directory server. $ rm /path/to/ds/changelogDb/* If the replication server is on the same host as the directory server, carefully change the connection handler port numbers and the administration port number in the configuration file before starting the replication server. Before making any changes, make sure that the new port numbers you use are available, and not in use by any other services on the system. Change the port numbers for the LDAP and LDAPS connection handlers as described in the procedure To Change the LDAP Port Number. The following example changes the administration port to 6444. After this command succeeds, you must restart the server in order to use the dsconfig command again. $ dsconfig \ set-administration-connector-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --set listen-port:6444 \ --trustAll \ --no-prompt Restart the server to be able to connect on the new administration port. $ stop-ds --restart Stopping Server... ... ...The Directory Server has started successfully Change the server ID values for the cn=admin data and cn=schema replication domains on the copy that is to become the stand-alone replication server. Replication uses unique server IDs to distinguish between different directory server replicas. When you make identical copies of the original multi-role server, the server IDs on the new stand-alone directory server and on the new stand-alone replication server are identical. For the user data replication domains, such as dc=example,dc=com, you are going to fix the duplicate server ID problem as part of this procedure. When you remove the replication domain configuration information from the new stand-alone replication server for user data, part of the configuration information that you remove is the server ID. For the administrative data and directory schema, however, the new stand-alone replication server must maintain its administrative and schema data in sync with other servers, so it still holds that data like any other directory server. The server IDs for the cn=admin data and cn=schema replication domains must therefore be changed so as not to conflict with other existing server IDs. If you try to edit server IDs by using the dsconfig command, you encounter an error: The Replication Domain property "server-id" is read-only and cannot be modified You must instead edit the server ID values directly in the configuration file while the new stand-alone replication server is stopped. Before editing the configuration file, refer to the information you gather in for the list of IDs that are in use in the replication topology. You must choose server ID values that are unique, and that are between 0 and 65535 inclusive. After choosing two valid, unused server ID values, carefully edit the configuration file, /path/to/rs/config/config.ldif, to change the ds-cfg-server-id values for the entries with DNs cn=cn=admin data,cn=domains,cn=Multimaster Synchronization,cn=Synchronization Providers,cn=config and cn=cn=schema,cn=domains,cn=Multimaster Synchronization,cn=Synchronization Providers,cn=config. For example if the duplicate server IDs were 29388 and 24612, and you edited the configuration file to use 12345 and 23456 instead, the result might appear as follows: $ grep -B 1 ds-cfg-server-id /path/to/rs/config/config.ldif cn: cn=admin data #ds-cfg-server-id: 29388 ds-cfg-server-id: 12345 -- cn: cn=schema #ds-cfg-server-id: 24612 ds-cfg-server-id: 23456 Start the copy that is to become the stand-alone replication server, remove the user data backend configuration, remove the replication domain for the user data, and then enable the multimaster synchronization provider on the directory server. # The following command removes the user data backend configuration. dsconfig \ delete-backend \ --port 6444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --backend-name userRoot \ --trustAll \ --no-prompt # The following command removes the replication domain for the user data. dsconfig \ delete-replication-domain \ --port 6444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name dc=example,dc=com \ --trustAll \ --no-prompt # The following command enables the multimaster synchronization provider. dsconfig \ set-synchronization-provider-prop \ --port 6444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --set enabled:true \ --trustAll \ --no-prompt You can then remove the files for the user data backend on the replication server. $ rm -rf /path/to/rs/db/userRoot If you have moved servers with secure ports configured, the host names in the server certificates might no longer correspond to the new host names. For details, see the chapter, Changing Server Certificates. After testing that everything is working to your satisfaction, you can allow normal client traffic to the new directory server, and retire the old multi-role server (rm -rf /path/to/dsrs1 in this example).

Replication Change notification External change log Some applications require notification when directory data updates occur. For example, an application might need to sync directory data with another database, or the application might need to kick off other processing when certain updates occur. In addition to supporting persistent search operations, OpenDJ provides an external change log mechanism to allow applications to be notified of changes to directory data. OpenDJ directory servers without replication cannot expose an external change log. The OpenDJ server that exposes the change log must function both as a directory server, and also as a replication server for the suffix whose changes you want logged. Enable replication without using the --noReplicationServer or --onlyReplicationServer options. With replication enabled, the data is under cn=changelog. The user reading the changelog must however have access to read and search the changelog and must have the changelog-read privilege. By default, Directory Manager has this privilege. $ ldapsearch \ --hostname opendj.example.com \ --port 1389 \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --baseDN cn=changelog \ "(objectclass=*)" \ \* + dn: cn=changelog cn: changelog objectClass: top objectClass: container subschemaSubentry: cn=schema hasSubordinates: false entryDN: cn=changelog To allow other users to read the changelog, add the changelog-read privilege to their entries. For details on how to add a privilege, see the section, Configuring Privileges. You read the external change log over LDAP. In addition, when you poll the change log periodically, you can get the list of updates that happened since your last request. The external change log mechanism uses an LDAP control with OID 1.3.6.1.4.1.26027.1.5.4 to allow the exchange of cookies for the client application to bookmark the last changes seen, and then start reading the next set of changes from where it left off on the previous request. This procedure shows the client reading the change log as cn=Directory Manager. Make sure your client application reads the changes with sufficient access and privileges to view all the changes it needs to see. Send an initial search request using the LDAP control with no cookie value. Notice the value of the changeLogCookie attribute for the last of the two changes. $ ldapsearch \ --baseDN cn=changelog \ --port 1389 \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --control "1.3.6.1.4.1.26027.1.5.4:false" \ "(objectclass=*)" \ \* + dn: cn=changelog cn: changelog objectClass: top objectClass: container subschemaSubentry: cn=schema hasSubordinates: true entryDN: cn=changelog # Public changelog exchange control(1.3.6.1.4.1.26027.1.5.4): dc=example,dc=com:0000013087cbc28212d100000001; dn: replicationCSN=0000013087cbc28212d100000001,dc=example,dc=com,cn=changelog targetDN: cn=arsene lupin,ou=special users,dc=example,dc=com changeNumber: 0 changes:: b2JqZWN0Q2xhc3M6IHBlcnNvbgpvYmplY3RDbGFzczogdG9wCmNuOiBBcnNlbmUgTHVwaW 4KdGVsZXBob25lTnVtYmVyOiArMzMgMSAyMyA0NSA2NyA4OQpzbjogTHVwaW4KZW50cnlVVUlEOiA5M GM3MTRmNy00ODZiLTRkNDctOTQwOS1iNDRkMTlkZWEzMWUKY3JlYXRlVGltZXN0YW1wOiAyMDExMDYx MzA2NTg1NVoKY3JlYXRvcnNOYW1lOiBjbj1EaXJlY3RvcnkgTWFuYWdlcixjbj1Sb290IEROcyxjbj1 jb25maWcK changeType: add changeTime: 20110613065855Z objectClass: top objectClass: changeLogEntry targetEntryUUID: 90c714f7-486b-4d47-9409-b44d19dea31e replicationCSN: 0000013087cbc28212d100000001 numSubordinates: 0 replicaIdentifier: 4817 changeLogCookie: dc=example,dc=com:0000013087cbc28212d100000001; changeInitiatorsName: cn=Directory Manager,cn=Root DNs,cn=config subschemaSubentry: cn=schema hasSubordinates: false entryDN: replicationCSN=0000013087cbc28212d100000001,dc=example,dc=com,cn=change log # Public changelog exchange control(1.3.6.1.4.1.26027.1.5.4): dc=example,dc=com:0000013087cbc34a12d100000002; dn: replicationCSN=0000013087cbc34a12d100000002,dc=example,dc=com,cn=changelog targetDN: cn=horace velmont,ou=special users,dc=example,dc=com changeNumber: 0 changes:: b2JqZWN0Q2xhc3M6IHBlcnNvbgpvYmplY3RDbGFzczogdG9wCmNuOiBIb3JhY2UgVmVsbW 9udAp0ZWxlcGhvbmVOdW1iZXI6ICszMyAxIDEyIDIzIDM0IDQ1CnNuOiBWZWxtb250CmVudHJ5VVVJR DogNmIyMjQ0MGEtNzZkMC00MDMxLTk0YjctMzViMWQ4NmYwNjdlCmNyZWF0ZVRpbWVzdGFtcDogMjAx MTA2MTMwNjU4NTVaCmNyZWF0b3JzTmFtZTogY249RGlyZWN0b3J5IE1hbmFnZXIsY249Um9vdCBETnM sY249Y29uZmlnCg== changeType: add changeTime: 20110613065855Z objectClass: top objectClass: changeLogEntry targetEntryUUID: 6b22440a-76d0-4031-94b7-35b1d86f067e replicationCSN: 0000013087cbc34a12d100000002 numSubordinates: 0 replicaIdentifier: 4817 changeLogCookie: dc=example,dc=com:0000013087cbc34a12d100000002; changeInitiatorsName: cn=Directory Manager,cn=Root DNs,cn=config subschemaSubentry: cn=schema hasSubordinates: false entryDN: replicationCSN=0000013087cbc34a12d100000002,dc=example,dc=com,cn=change log In this example, two new users were added to another replica before the change log request was made. Here the changes are base64 encoded, so you can decode them using the base64 command. $ base64 decode --encodedData b2JqZW...ZmlnCg== objectClass: person objectClass: top cn: Horace Velmont telephoneNumber: +33 1 12 23 34 45 sn: Velmont entryUUID: 6b22440a-76d0-4031-94b7-35b1d86f067e createTimestamp: 20110613065855Z creatorsName: cn=Directory Manager,cn=Root DNs,cn=config For the next search, provide the cookie to start reading where you left off last time. In this example, a description was added to Babs Jensen's entry. $ ldapsearch \ --baseDN cn=changelog \ --port 1389 \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --control "1.3.6.1.4.1.26027.1.5.4:false:dc=example, \ dc=com:0000013087cbc34a12d100000002;" \ "(objectclass=*)" \ \* + dn: cn=changelog cn: changelog objectClass: top objectClass: container subschemaSubentry: cn=schema hasSubordinates: true entryDN: cn=changelog # Public changelog exchange control(1.3.6.1.4.1.26027.1.5.4): dc=example,dc=com:0000013087d7e27f12d100000003; dn: replicationCSN=0000013087d7e27f12d100000003,dc=example,dc=com,cn=changelog targetDN: uid=bjensen,ou=people,dc=example,dc=com changeNumber: 0 changes:: YWRkOiBkZXNjcmlwdGlvbgpkZXNjcmlwdGlvbjogQSB0aGlyZCBjaGFuZ2UKLQpyZXBsYW NlOiBtb2RpZmllcnNOYW1lCm1vZGlmaWVyc05hbWU6IGNuPURpcmVjdG9yeSBNYW5hZ2VyLGNuPVJvb 3QgRE5zLGNuPWNvbmZpZwotCnJlcGxhY2U6IG1vZGlmeVRpbWVzdGFtcAptb2RpZnlUaW1lc3RhbXA6 IDIwMTEwNjEzMDcxMjEwWgotCg== changeType: modify changeTime: 20110613071210Z objectClass: top objectClass: changeLogEntry targetEntryUUID: fc252fd9-b982-3ed6-b42a-c76d2546312c replicationCSN: 0000013087d7e27f12d100000003 numSubordinates: 0 replicaIdentifier: 4817 changeLogCookie: dc=example,dc=com:0000013087d7e27f12d100000003; changeInitiatorsName: cn=Directory Manager,cn=Root DNs,cn=config subschemaSubentry: cn=schema hasSubordinates: false entryDN: replicationCSN=0000013087d7e27f12d100000003,dc=example,dc=com,cn=change log If we base64-decode the changes, we see the following. $ base64 decode --encodedData YWRkO...gotCg== add: description description: A third change - replace: modifiersName modifiersName: cn=Directory Manager,cn=Root DNs,cn=config - replace: modifyTimestamp modifyTimestamp: 20110613071210Z - If for some reason you lose the cookie, you can start over from the earliest available change by sending a search request with no value for the cookie. As shown above, the changes returned from a search on the external change log include only what was actually changed. If you have applications that need additional attributes published with every change log entry, regardless of whether or not the attribute itself has changed, then specify those using ecl-include and ecl-include-for-deletes. Set the attributes to include for all update operations with ecl-include. $ dsconfig \ set-external-changelog-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name dc=example,dc=com \ --set ecl-include:"@person" \ --trustAll \ --no-prompt Set the attributes to include for deletes with ecl-include-for-deletes. $ dsconfig \ set-external-changelog-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name dc=example,dc=com \ --add ecl-include-for-deletes:"*" \ --add ecl-include-for-deletes:"+" \ --trustAll \ --no-prompt You can limit external change log content by disabling the domain for a base DN. By default, cn=schema and cn=admin data are not enabled. Prevent OpenDJ from logging changes by disabling the domain. $ dsconfig \ set-external-changelog-domain-prop \ --port 4444 \ --hostname opendj.example.com \ --bindDN "cn=Directory Manager" \ --bindPassword password \ --provider-name "Multimaster Synchronization" \ --domain-name dc=example,dc=com \ --set enabled:false \ --trustAll \ --no-prompt The external change log can also work for applications that follow the Internet-Draft: Definition of an Object Class to Hold LDAP Change Records. Nothing special is required to get the objects specified for this legacy format. Such applications cannot however use the change log cookies that are shared across the replication topology, and therefore can continue to be used after failover to another replica in a multi-master replication environment. External change log Legacy format

Changes to a replicated OpenDJ directory service are similar to those made with the Unix rm command, but with a twist. With the rm command, if you make a mistake you can restore your files from backup, and lose only the work done since the last backup. If you make a mistake with a update to the directory service however, then after you restore a server from backup, replication efficiently replays your mistake to the server you restored. Backup Recovery from user error Replication Recovery from user error Troubleshooting Recovery from user error There is more than one way to recover from user error. None of the ways involve simply changing OpenDJ settings. All of the ways instead involve manually fixing mistakes. Consider these alternatives. Encourage client applications to provide end users with "undo" capability if necessary. In this case, client applications take responsibility for keeping an "undo" history. Maintain a record of each update to the service, so that you can manually "undo" mistakes. You can use the external change log. A primary advantage to the external change log is that the change log is enabled with replication, and so it does not use additional space. See for instructions on enabling, using, and configuring the external change log. In particular, see for instructions on saving not only what is changed, but also all attributes when an entry is deleted. OpenDJ also provides a file-based audit log, but the audit log does not help with a general solution in this case. The OpenDJ audit log records changes to the data. When you delete an entry however, the audit log does not record the entry before deletion. The following example shows the audit log records of some changes made to Barbara Jensen's entry. # 30/Apr/2014:16:23:29 +0200; conn=7; op=10 dn: uid=bjensen,ou=People,dc=example,dc=com changetype: modify replace: description description: This is the description I want. - replace: modifiersName modifiersName: cn=Directory Manager,cn=Root DNs,cn=config - replace: modifyTimestamp modifyTimestamp: 20140430142329Z # 30/Apr/2014:16:23:46 +0200; conn=7; op=14 dn: uid=bjensen,ou=People,dc=example,dc=com changetype: modify replace: description description: I never should have changed this! - replace: modifiersName modifiersName: cn=Directory Manager,cn=Root DNs,cn=config - replace: modifyTimestamp modifyTimestamp: 20140430142346Z # 30/Apr/2014:16:24:53 +0200; conn=7; op=27 dn: uid=bjensen,ou=People,dc=example,dc=com changetype: delete You can use these records to fix the mistaken update to the description, but the audit log lacks the information needed to restore Barbara Jensen's deleted entry. For administrative errors that involve directory data, if you have properly configured the external change log, then use it. If not, an alternative technique consists of restoring backup to a separate server not connected to the replication topology. (Do not connect the server to the topology as replication replays mistakes, too.) Compare data on the separate restored server to the live servers in the topology, and then fix the mistakes manually. An more drastic alternative consists of rebuilding the entire service from backup, by disabling replication and restoring all servers from backup (or restoring one server and initializing all servers from that one). This alternative is only recommended in the case of a major error where you have a very fresh backup (taken immediately before the error), and no client applications are affected. For administrative configuration errors that prevent servers from starting, know that OpenDJ keeps a copy of the last configuration that OpenDJ could use to start the server in the file /path/to/opendj/config/config.ldif.startok. OpenDJ also backs up earlier versions of the configuration under /path/to/opendj/config/archived-configs/. You can therefore compare the current configuration with the earlier configurations, and repair mistakes manually (avoiding trailing white space at the end of LDIF lines) while the server is down.