cn=config partial replication

[The Ranger <ranger@risk.ee>]

Hello,

I have multiple v. 2.4.23 and 2.4.26 servers doing the master-slave 
replication using syncrepl.

The main server contains multiple subordinate DIT-s that get replicated 
to different servers:

* DIT1 from master to server A, B, C
* DIT2 from master to server D, E, F
* DIT3 from master to server G

etc.

Now I would like also to setup the cn=config replication. Actually the 
most important for me would be the cn=schema,cn=config since everything 
else is rather static.

What would be the best setup with minimal configuration settings/values 
duplication?

There are many howtos on the net how to sync only cn=schema,cn=config, 
but putting the olcSyncrepl value to olcDatabase={0}config will make the 
whole DB shadowed and redirect the database config changes to master 
server which is not the reasonable solution.

The best solution would be when the cn=schema,cn=config (and maybe olso 
the proper olcDatabase subtree) would be synchronized with the master. 
All the rest of the config database should be locally manageable.

I read about the suffixmassage, but this needs ldap server upgrade on 
2.4.23 servers (there is no package in debian 6.0.3 for that). And as 
far as I understand it also requires separate cn=config,cn=slave 
subtrees on the server with duplicated database configuration and acl 
definitions etc.

I simply try to find the best solution to hit as much problems at once 
as I can and reduce the config overhead as much as possible.

Could you please advise what are my options?


--
rgrds,
Ivari