Limiting which attributes get replicated

[Philip Colmer <philip.colmer@linaro.org>]

Hi

We've got a core set of OpenLDAP servers that are in a multi-master
configuration. We are looking at building out that set of servers so
that our data centres can have local copies of the data. However,
those copies don't need to be of everything, so I want to limit which
attributes get replicated.

I wanted to check that I've understood the configuration correctly ...

According to http://www.openldap.org/doc/admin22/syncrepl.html, it
looks like I can specify on the consuming LDAP server which attributes
are synced, and I can also ensure that the binddn account only has
access to those attributes on the providing LDAP server.

The example given in the documentation has:

filter="(objectClass=organizationalPerson)"

What do I do if I want to synchronise all objectClasses but only
restrict the attributes on the organizationalPerson class? So, for
example, I want everything on groups but I don't want jpegPhoto on
people.

What happens if one of the consuming LDAP servers is then itself
queried for an attribute that hasn't been synced? So, for example, if
a system in a data centre connects to a local consuming LDAP server
and asks for a jpegPhoto, that won't be on the local server, so what
happens then?

Thank you.

Philip