Issue starting replication

[exjet]

Hello!

I have a quick question on how to get replication started up using version 1.1.10
I have set the following environment variables:
LDAP_REPLICATION: 'true'
LDAP_REPLICATION_HOSTS: "#PYTHON2BASH:['ldaps://server1-ldap04','ldaps://server2-ldap03']"
As far as I can tell replication is not getting setup or at least is not functioning. I see no errors, but data is not replicating.
I have double checked that the hostnames match the ones being set for the containers and also that they are resolvable from inside the containers.
Any help would be appreciated.

Thank you!

to you have any error running tests ?

make test

[mastermindg]

LDAPS replication is failing for me in 1.1.9 as well. I ran several tests against both versions.

Use this script to replicate the failure:

https://gist.github.com/mastermindg/6bb0dc360046c4ba8ba35e70ec2cce1a

This script works fine - doesn't use ldaps:

https://gist.github.com/mastermindg/5fb3aeea0cc452ffa4f6f590dd2b675d

Both scripts have the same results regardless of whether they're run off of 1.1.9 or 1.1.10.

BTW: Tests pass locally BUT none of the tests actually use ldaps:// so that would explain why.

[mastermindg]

After further investigation it makes sense why ldaps wouldn't work: It requires a little more configuration - i.e. shared certificates/keys. This isn't done by default and is a more advanced use-case.

by default the replication is done over tls (see starttls=critical in LDAP_REPLICATION_CONFIG_SYNCPROV and LDAP_REPLICATION_DB_SYNCPROV)

and the result search is also done via starttls (-ZZ in test.bats)

not sure why this fail with ldaps any explanation welcomed.

but note that ldaps seems deprecated in favor of starttls
http://www.openldap.org/faq/data/cache/605.html

[mastermindg]

LDAPS uses SSL and not TLS which is why replication fails with the default configuration. You need to switch to SSL and configure the SSL certificate/keys to get LDAPS to work. Moving to TLS over LDAP makes more sense unless you need an extra level of security, i.e. are connecting to LDAP over the Internet.

[exjet]

In my case I was using docker-compose and after the initial bootstrap I connected to the config DIT and there were no replication settings present so the replication was not getting setup at all by the bootstrap script. Is this a limitation of using docker compose as opposed to using the command line to start the containers?

[mastermindg]

Replication won't work out of the box with docker-compose unless you've got a DNS server entry that can be picked up by the containers. The command line example saves the DNS map to /etc/hosts on each container. You could also accomplish something similar by using a network driver with compose like so:

version: ‘2’
services:
  ldap1:
    image: osixia/openldap:1.1.10
    .................
    networks:
      main:
        aliases:
          - ldap1
  ldap2:
    image: osixia/openldap:1.1.10
    ................
    networks:
      main:
        aliases:
          - ldap2
networks:
  main: