After banging my head on my desk for a couple of days trying to figure out how to get two OpenLDAP servers to mirror each other, I decided to create this post to detail how I got it working.
None of the tutorials I found had it quite right. Let’s get right into it.

First, I expect that you have two servers already up and running with ssh access.

I’m also expecting that you’re logged in as root. I’ll not be using a sudo prefix on these commands. You can gain a root prompt with sudo by running ‘sudo -s’:

user@host1$ sudo -s
[sudo] password for user:
root@host1#

Note: If at any time you want to completely start over, just run this command on both servers:

# apt remove --purge slapd -y; rm /var/lib/ldap/*

Step one: Configuring the host names

For this example, i’ll use hostX.location.example.com as the template for your FQDN’s. This will get translated automatically into the structure of your LDAP later on.

You have two servers: host1.location.example.com at 10.10.10.1 and host2.location.example.com at 10.10.10.2

Your /etc/hosts files should be edited to look like this:

#host1
127.0.0.1    localhost 
10.10.10.1   host1.location.example.com host1
10.10.10.2   host2.location.example.com host2

#host2
127.0.0.1    localhost
10.10.10.2   host2.location.example.com host2
10.10.10.1   host1.location.example.com host1

Step Two: Install OpenLDAP

On both servers, run this to install OpenLDAP:

# apt install slapd ldap-utils

When asked for a password to use with the ldap admin account, use the same one on both servers. Write it down or copy/paste it from somewhere. You’ll need it later. This process will not take long. When it’s done, you’ll have two separate OpenLDAP installations. The installation will create an ldap tree that matches your domain configuration. In this case it will translate ‘location.example.com’ to ‘dc=location,dc=example,dc=com’ and the admin account will be ‘cn=admin,dc=location,dc=example,dc=com’.

You can confirm this by running ‘slapcat’ from the command line. This will dump the tree to the screen for you to look at:

root@host1# slapcat                
dn: dc=location,dc=example,dc=com 
objectClass: top 
objectClass: dcObject 
objectClass: organization 
o: location.example.com 
dc: location 
structuralObjectClass: organization 
creatorsName: cn=admin,dc=location,dc=example,dc=com 
entryUUID: 4aad3c38-bae8-1036-8303-954f43b481de 
createTimestamp: 20170421141226Z 
entryCSN: 20170421141226.542122Z#000000#000#000000 
modifiersName: cn=admin,dc=location,dc=example,dc=com 
modifyTimestamp: 20170421141226Z 
contextCSN: 20170421141335.948963Z#000000#001#000000 
contextCSN: 20170421141314.583141Z#000000#002#000000 
 
dn: cn=admin,dc=location,dc=example,dc=com 
objectClass: simpleSecurityObject 
objectClass: organizationalRole 
cn: admin 
description: LDAP administrator 
structuralObjectClass: organizationalRole 
creatorsName: cn=admin,dc=location,dc=example,dc=com 
userPassword:: e10234hf0eyh230h23sdjksd03r2fhdfgasdldefg023= 
entryUUID: 4aad4b92-bae8-1036-8304-953420fh1de 
createTimestamp: 20170421141226Z 
entryCSN: 20170421141226.542544Z#000000#000#000000 
modifiersName: cn=admin,dc=location,dc=example,dc=com 
modifyTimestamp: 20170421141226Z

You can change this layout, and a couple of other things, by running ‘dpkg-reconfigure slapd’, but that is beyond the scope of this howto.

Step three: Configure Mirroring

Now that both OpenLDAP servers are up and running, lets get the mirroring working. This is done it two parts.

Part A: Mirroring the configuration tree

Instead of editing the /etc/slapd.conf file like in the old days, new versions of OpenLDAP store their configuration in the LDAP directory itself. This means that once it’s set up, even configuration and schema changes will be mirrored. It’s a fantastic thing, but it’s a bit, well, weird to set up if you’re coming from the file editing days.

I’m not going to do much explanation of how this works. It’s boring and all you really want is to get this up and running so you have a redundant LDAP database, right?

Create a file called ‘syncconfig.ldif’ in roots home directory. It should look like this:

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: {1}syncprov.la

dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: THE_PASSWORD_YOU_SAVED

dn: cn=config
changetype: modify
replace: olcServerID
olcServerID: 1 ldap://host1.location.example.com/
olcServerID: 2 ldap://host2.location.example.com/

dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov

dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001 provider=ldap://host1.location.example.com/ binddn="cn=config"
  bindmethod=simple credentials=THE_PASSWORD_YOU_SAVED
  searchbase="cn=config" type=refreshAndPersist
  retry="5 5 300 5" timeout=1
olcSyncRepl: rid=002 provider=ldap://host2.location.example.com/ binddn="cn=config"
  bindmethod=simple credentials=THE_PASSWORD_YOU_SAVED
  searchbase="cn=config" type=refreshAndPersist
  retry="5 5 300 5" timeout=1
-
add: olcMirrorMode
olcMirrorMode: TRUE

Now copy that to both servers, and on both servers run:

# ldapadd -Y EXTERNAL -H ldapi:/// -f syncconfig.ldif

WARNING!   These ldif files should have NO TRAILING WHITESPACE after any line. If there is any trailing whitespace, the above command will fail with errors like:

ldapadd: wrong attributeType at line 5, entry "cn=module{0},cn=config"

You may want to restart your OpenLDAP daemons:

# /etc/init.d/slapd restart

They should come up without any errors.

Congrats! Now your configuration will automatically sync between your servers. Any config changes we make from one of the hosts will propagate to the other.

Part B: Mirroring the dc=location,dc=example,dc=com tree

Now that this is working, we setup the syncing of the  ‘dc=location,dc=example,dc=com’ tree. To do this, we create another file called ‘synctree.ldif’. It should look like this:

dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov

dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001 provider=ldap://host1.location.example.com/ binddn="cn=admin,dc=location,dc=example,dc=com"
  bindmethod=simple credentials=THE_PASSWORD_YOU_SAVED
  searchbase="dc=location,dc=example,dc=com" type=refreshAndPersist
  retry="5 5 300 5" timeout=1
olcSyncRepl: rid=001 provider=ldap://host2.location.example.com/ binddn="cn=admin,dc=location,dc=example,dc=com"
  bindmethod=simple credentials=THE_PASSWORD_YOU_SAVED
  searchbase="dc=location,dc=example,dc=com" type=refreshAndPersist
  retry="5 5 300 5" timeout=1
-
add: olcMirrorMode
olcMirrorMode: TRUE

Since the config is synced, we only need to run this on one of the servers:

# ldapadd -Y EXTERNAL -H ldapi:/// -f synctree.ldif

You don’t need to restart the daemons after this, but why not…. and that’s it! Now the configuration AND the ‘dc=location,dc=example,dc=com’ trees are synced.