Symantec Access Management

 View Only
  • 1.  Steps for replicating two DSA's

    Posted Aug 10, 2015 04:06 PM

    Hi All,

     

    Could someone please share the steps to replicate two DSA's in CA Directory.bookshelf is not that clear. I have planned to do multi-write DISP, decided on the benefits and since its recommended by CA. But the steps are not that clear. I have two separate servers with one DSA on each, and want to replicate these DSA on server1 and server2.

     

    1, Have to set the multi-write-disp-overlay = true in shared knowledge file of DSA, does this needs to be done on both the DSA(servers).

     

    this is only step i could understand,

    what are the further steps, could someone please provide me with a document which could be followed.

     

     

    I am using CA Directory as policy store for CA SSO R12.52.

     

    thanks in advance.



  • 2.  Re: Steps for replicating two DSA's
    Best Answer

    Posted Aug 10, 2015 08:18 PM

    I've looked at the CA Directory Admin Guide and yes are correct, there should be an example. I will follow up on this. In the mean time, assuming you are using text-based configuration (not DXmanager):

     

    Say we have two DSAs on two servers

    server1: dsa1

    server2: dsa2

     

    To enable multi-write replication with DISP recovery (MW-DISP) on UNIX (procedure same for Windows just different paths/env vars).

     

    Stop DSAs

    server1: dxserver stop dsa1

    server2: dxserver stop dsa2

     

    Enable multi-write on server1: $DXHOME/config/knowledge/dsa1.dxc

        set dsa "dsa1" =

        {

        prefix = <c US><o CA>

          dsa-name = <c US><o CA><cn "dsa1">

          dsa-password = "secret"

          address = tcp "{hostname}" port 20000

          disp-psap = DISP

          snmp-port = 20000

          console-port = 20001

          auth-levels = anonymous, clear-password

          dsa-flags = multi-write

          trust-flags = allow-check-password

        };

     

    Enable multi-write on server1: $DXHOME/config/knowledge/dsa2.dxc.

     

    If this file doesn't exist copy from server2, for example, copy server2: $DXHOME/config/knowledge/dsa2.dxc to server1: $DXHOME/config/knowledge

        set dsa "dsa2" =

        {

         prefix = <c US><o CA>

         dsa-name = <c US><o CA><cn "dsa2">

         dsa-password = "secret"

          address = tcp "{hostname}" port 20000

          disp-psap = DISP

          snmp-port = 20000

          console-port = 20001

          auth-levels = anonymous, clear-password

          dsa-flags = multi-write

          trust-flags = allow-check-password

        };

     

    Note: The prefix must be the same for dsa1 and dsa2 for replication to work

     

     

    Create a knowledge group server1: $DXHOME/config/knowledge/dsas.dxg

        source "dsa1.dxc";

        source "dsa2.dxc";

     

    Note: If a knowledge group file already exists for dsa1 and dsa2, this can be updated to ensure that both dsa1 and dsa2 are sourced.

     

    Update server1: $DXHOME/config/servers/dsa1.dxi to source knowledge group and also enable MW-DISP while there

     

             Locate the following line

            clear dsas;

            source "../knowledge/dsa1.dxc";

            And replace with

            clear dsas;

            source "../knowledge/dsas.dxg";

     

           To enable MW-DISP locate the following line

           # multiwrite DISP recovery

           set multi-write-disp-recovery = false;

           And replace with

           # multiwrite DISP recovery

           set multi-write-disp-recovery = true;

     

    Check for syntax errors

    server1: dxsyntax dsa1

     

    Copy the following files to server2

    Copy server1: $DXHOME/config/knowledge/dsa1.dxc server2: $DXHOME/config/knowledge

    Copy server1: $DXHOME/config/knowledge/dsa2.dxc server2: $DXHOME/config/knowledge

    Copy server1: $DXHOME/config/knowledge/dsas.dxg server2: $DXHOME/config/knowledge

     

    Note: It is a good idea to update the knowledge on one server and copy. This keeps them consistent!

     

    Update server2: $DXHOME/config/servers/dsa2.dxi to source the newly copied knowledge group and also enable MW-DISP while there


             Locate the following line

            clear dsas;

            source "../knowledge/dsa1.dxc";

            And replace with

            clear dsas;

            source "../knowledge/dsas.dxg";

     

           To enable MW-DISP locate the following line

            # multiwrite DISP recovery

            set multi-write-disp-recovery = false;

           And replace with

            # multiwrite DISP recovery

            set multi-write-disp-recovery = true;

     

    Do the DSAs contain data?

    If the DSAs contain data and the data is synchronized (loads from the same LDIF for example) then when enabling MW-DISP it is important to checkpoint the DSAs.

    server1: dxdisp dsa2

    server2: dxdisp dsa1

    This step prevents existing data from being superfluously replicated.

     

    Start the DSAs

    server1: dxserver start dsa1

    server2: dxserver start dsa2

     

    Check Replication is Ok

    It is important to check that the DSAs have contacted each other and the state of replication is ok.

     

    server1: telnet localhost 20001

    server1: get dsp;

    server1: logout;

       ...

       ...

        multi-write-group-credit = 0

        multi-write-outstanding-ops = 10

        dsa2: OK, total 0, waiting remote 0, confirmed local 0

     

    server2: telnet localhost 20001

    server2: get dsp;

    server2: logout;

       ...

       ...

        multi-write-group-credit = 0

        multi-write-outstanding-ops = 10

        dsa1: OK, total 0, waiting remote 0, confirmed local 0

     

    For the output of "get dsp;" we are looking for the replicating queue status to be OK. Anything other than OK like DISP-FAILED indicates either a replication problem or a connectivity problem between the two DSAs. The warn-log and alarm-log a good places to start when diagnosing these kinds of replication problems.

     

    Another sanity test is to connect to dsa1 via an LDAP browser (like JXplorer) and perform a modify. Then connect to dsa2 and ensure the update has been replicated. A similar test for MW-DISP can be performed by stop dsa2 before updating dsa1. When dsa2 is started it will recov0r from dsa1 and the update should be reflected.

     

    Other considerations

    * We would also recommend running one or more router DSAs with the replicas to allow for automatic failover and failback

    * Ensuring $DXHOME/config/knowledge are identical between machines will ensure that all DSAs will function in a consistent manner

    * We would recommend setting one of the replicas as a preferred master. This is achieved adding the following line to the router.dxi file: "set write-precedence = dsa1, dsa2;". This prevents update conflicts (same entry updated at the same time on dsa1 and dsa2).

     

    In Summary

    • We ensured the that the 2 DSAs have the same prefix
    • We set dsa-flags = multi-write in the knowledge file for both DSAs
    • We ensured that the knowledge files for both DSAs were copied to each server and sourced via a knowledge group file
    • We then sourced this knowledge group from each initialization file (.dxi) instead of sourcing the individual knowledge file for the DSA
    • We enabled MW-DISP by changing multi-write-disp-recovery from true to false
    • We check pointed the data if any pre-existing data after ensuring that the data is synchronized
    • We then verified replication was working as expected

     

    I hope that helps in enabling MW-DISP with 2 DSAs. Please let me know if you have any further queries. I will talk to our tech writing team to ensure an example like the above is included to assist in setting up 2 replication peers.



  • 3.  Re: Steps for replicating two DSA's

    Posted Aug 11, 2015 06:40 AM

    Hi Justin McDonald,

     

    Thank you so much, this is just awesom.. so clear and explanative.. this is what we would like to see in the documentations, this is not only for Directory, it goes for CA SSO also, in that case, it might be the same for all products from CA.

     

    Can I have same name for DSA, hope that will not be an issue. And also I am using CA Directory R12.0.15, will the steps be same for this version too.



  • 4.  Re: Steps for replicating two DSA's

    Posted Aug 11, 2015 07:29 AM

    Not a problem :)

     

    DSA names must be unique. These are used to match the server name from the initialisation file with the corresponding knowledge file. For example, dsa1.dxc will use the knowledge file under the set dsa dsa1... command in the knowledge file to define itself. The dsa-name item must also be unique.

     

    These instructions are for all versions of directory (including 12.0.15) that use the text-based configuration files.



  • 5.  Re: Steps for replicating two DSA's

    Posted Aug 11, 2015 11:15 AM

    @Justin McDonald

     

    if I have already created DSA of same name on two servers, what is best method to rename it.

     

    This is what I did,

     

    I manually renamed all the dsa name in one of the servers, including the files in $DXHOME/data. and started the DSA, it started perfectly fine and was able to see the data in jxplorer, but for some reason, replication is not happening. and I get the below error

    "MW-DISP not in sync"

     

    What could be the issue, could you please help?



  • 6.  Re: Steps for replicating two DSA's

    Posted Dec 22, 2016 12:36 AM

    Thank you so much for the step-by-step detailed explanation.  It helped us a lot. I'm sure it is helping many others as well. Good contribution Justin McDonald



  • 7.  Re: Steps for replicating two DSA's

    Posted Aug 11, 2015 07:35 AM

    thank you..

     

    Gonna try this in another couple of hours.. if I do replication, data or the policies in both dsa will be in sync right?



  • 8.  Re: Steps for replicating two DSA's

    Posted Aug 11, 2015 06:43 PM

    Yes that's correct



  • 9.  Re: Steps for replicating two DSA's

    Broadcom Employee
    Posted Dec 21, 2017 11:29 AM

    Hi Justin,

     

    Thanks for the post. I have 4 PS DSAs and 4 SS DSAs, this should work the same way, right?

    Also, what's the best practice to do the replication between PRD and DR policy/session stores?

     

    Thank you,

     

    -June