Master and Slave (and the other way around) [auf Viren überprüft]

[Hans Moser <hans.moser@ofd-sth.niedersachsen.de>]

Hi!

We plan to build an OpenLDAP-infrastructure with a central server and a
few decentral servers.
Changes on LDAP-objects can only be made in the OpenLDAP-masterserver,
not in the slave. That's what I read.
For the most of our data this is no problem, it is writen to the central
server, so it will become our master.
But a few attributes in special OU-branches have to be written to the
decentral servers. So my considerations is, it -if ever - might be
possible with different database backend definitions.

Can I split my DIT into different backends, so that some branches of the
DIT are slave on the central server and master on one decentral server?

Perhaps like this:
-------------------------------------------------
# central
# Top - master here
database	bdb
suffix	"dc=our-domain,dc=com"
directory /usr/local/var/openldap-data-top
# replica on server 1
replica uri=ldap://server1.example.com:389
                binddn="cn=Replicator,dc=example,dc=com"
                bindmethod=simple credentials=secret
# replica on server 2
replica uri=ldap://server2.example.com:389
                binddn="cn=Replicator,dc=example,dc=com"
                bindmethod=simple credentials=secret
#
# one OU - master on server 1
database	bdb
suffix	"ou=first,dc=our-domain,dc=com"
directory /usr/local/var/openldap-data-first
#
# another OU - master on server 2
database	bdb
suffix	"ou=second,dc=our-domain,dc=com"
directory /usr/local/var/openldap-data-second

-------------------------------------------------
# decentral 1
# Top - slave from central
database	bdb
suffix	"dc=our-domain,dc=com"
directory /usr/local/var/openldap-data-top
# one OU - master here
database	bdb
suffix	"ou=first,dc=our-domain,dc=com"
directory /usr/local/var/openldap-data-first
#
# replica on central
replica uri=ldap://central.example.com:389
                binddn="cn=Replicator,dc=example,dc=com"
                bindmethod=simple credentials=secret
#
# another OU - master on server 2
database	bdb
suffix	"ou=second,dc=our-domain,dc=com"
directory /usr/local/var/openldap-data-second
-------------------------------------------------

May this work propably?

A second question related to this is, will the slurpd replicate changes
in deligated OU-branches to the decentral servers, which are not master
for this branch, or has slurd to run on all the "master"-servers?


Hans