Q: What services can I run on an Open Directory Replica?

Nice work on building a redundant infrastructure.  As you discovered, services like OD and DNS are designed to integrate well across devices.  File Service, network homes (if needed), and Time Machine are also good tools to split across the devices to help with load balancing.

Regarding VPN, it is really the only service I can think of that needs a little adjustment. 

If you have multiple Open Directory servers and you want to allow a Replica Server to run VPN, you will discover that you will fail to connect with the following two error messages:

  DSAuth plugin: Could not retrieve key agent account information.

  DSAuth plugin: MPPE key required, but its retrieval failed.

To resolve this issue follow these steps:

1:  Connect to the Open Directory Master.

2:  Launch Server.app on the Open Directory Master.

3:  Select Users from the sidebar.

4:  From the Server.app’s View menu, choose Show System Accounts...

5:  In the list of users, find the VPN MPPE Key Access User and delete the account.  Yes, delete it.

6:  Connect to your Open Directory Replica.

7:  Using the Terminal application, run the following command:

sudo vpnaddkeyagentuser /LDAPv3/127.0.0.1

8:  You will be asked to enter the Directory Admin’s user name (commonly diradmin) and his password.

Enter admin name for node /LDAPv3/127.0.0.1:

Password:

9:  Stop and/or start the VPN service on the Open Directory Replica and try connecting again.

Hope this helps

Reid

Apple Consultants Network

Author - "El Capitan Server – Foundation Services"

Author - "El Capitan Server – Control & Collaboration"

Author - "El Capitan Server – Advanced Services"

:: Exclusively available in Apple's iBooks Store

It is possible to run additional services on an OD Replica but in nearly all cases this has nothing really to do with being a replica server.

One case that has not been mentioned yet is the fact that both the OD Master and the OD Replica will act as NTP time servers. They will also sync to each other and any OD client Mac can sync to them. This ensures all of them have their clocks in sync. In order for Kerberos to work the clocks must be in reasonably close synchronisation, if an individual machine has a clock significantly different this is a common cause of Kerberos failing.

Active Directory does something very similar but actually will change the AD client computer to use the AD server(s) as the NTP server automatically - something OD binding does not seem to do although you can automate this yourself in your own scripts, e.g. a script to both bind to OD and set the NTP server setting on the client.

Hi!

I have nearly the same setup:

Box1:

OD Master

File Sharing

Time Machine Server

Profile Manager

Box2:

OD Replica

Apple Remote Desktop - Task Server

I have an important hint for you regarding Profile Manager:

When you plan to update your OD Master Server (e.g. because of OSX update or Server update), shut down the OD replica server first, before you shutdown your OD master! Otherwise your Networkusers will be "moved" to the Replica OD and all your configurations in PM are lost (e.g. VPP settings) during update process!

1. Shutdown OD Replica

2. Shutdown OD Master and the rest of the services

3. Do your updates

4. Start OD Master before starting OD Replica

Cheers!