Re: Partial replication, remove branch

[jehan procaccia <jehan.procaccia@it-sudparis.eu>]

Le 20/03/2012 12:37, anax a écrit :
> On 03/20/2012 10:54 AM, jehan procaccia wrote:
> > I would like to replicate only some OUs under the baseDN ; ou=people and
> > ou=group,ou=system, but not the remaining of OUs below ou=system =>
> > ou=Hosts , ou=Networks, ou=Protocol.
> > How can I remove those branches to replicate ?
> > my actual syncrepl config that replicate all the subtree branches:
> > syncrepl rid=001
> > provider=ldaps://master.domain.fr
> > type=refreshAndPersist
> > searchbase="dc=int-evry,dc=fr"
> > filter="(objectClass=*)"
> > attrs="*"
> > scope=sub
> > schemachecking=on
> > bindmethod=simple
> > retry="60 10 300 +"
> > binddn="cn=replic,ou=System,dc=int-evry,dc=fr"
> > credentials="secret"
> > updateref ldaps://master.domain.fr:636
> Define the ACL for binddn="cn=replic,ou=System,dc=int-evry,dc=fr" such 
> that it cannot access the ou's you don't want  to sync.
>
> suomi
Thanks, I achieved a partial replication to only wanted branches, as you 
suggested by restricting ACL to the replica's account on the 
branches/attributes I want.
However that's not an easy config to set up , I noticed that as soon as 
I forgot to mention an attribute in a subtree object, all the objects in 
that subtree aren't replicate, that's the same for a branches DN node , 
I initially forgot the attribute associatedDomain which was part of that 
object for example, then that object node and all subtree objects below 
weren't replicated .
So I ended with many more ACLs like that :

#ou=system,dc=int-evry,dc=fr BaseDN ACL to get ou=system object node
access to dn.exact="ou=system,dc=int-evry,dc=fr"
        by dn="cn=admin,dc=int-evry,dc=fr"                      write
        by dn="cn=replic,ou=System,dc=int-evry,dc=fr"             read
        by users                                                read
#Goups and associeted attributes
access to dn.subtree="ou=Group,ou=System,dc=int-evry,dc=fr" 
attrs=cn,sn,memberuid,member,mail,description,entry,objectclass,associatedDomain,gidNumber,ou
        by dn="cn=admin,dc=int-evry,dc=fr"                      write
        by dn="cn=replic,ou=System,dc=int-evry,dc=fr"             read
        by users                                                read

How can I check performance issue with all the ACL I added ? is there a 
program to test / bench the ACLs or optimise them ?

Thanks .