LDAP Replication Checker

A small operational utility that verifies password replication across LDAP/389-DS servers.

I created this utility because we would sometimes have replication issues, and there was no good, easy way to catch the problem until we fixed it.

The script forces a password change on a test account and then queries each LDAP server to confirm that a specific attribute has replicated correctly. If all servers report the same timestamp, replication is considered healthy.

This tool is intended for quick operational checks of directory replication consistency.

---

How It Works

1. Resolve LDAP servers via DNS SRV records (_ldap._tcp.<domain>), or use a manually supplied list.
2. Change the password of a designated test service account.
3. Wait briefly to allow replication to occur.
4. Query each LDAP server for the account’s attribute.
5. Compare timestamps across all servers.
6. Report whether replication is consistent.

If multiple different timestamps are detected, replication mismatch is reported and the script exits with a non-zero status.

---

Requirements

Python 3

Python modules:

python-ldap dnspython

Install with pip if needed:

pip install python-ldap dnspython

The script also requires valid client TLS credentials to authenticate using SASL EXTERNAL.

Configured paths in the script:

LDAP_CERT = [your cert location] LDAP_KEY = [your ldap key location]

---

Default Behavior

By default the script:

1. Resolves LDAP servers using DNS SRV records
2. Uses the domain defined by:

DEFAULT_PREFIX = example.com

3. Performs the replication check against the discovered servers.

Example:

./replcheck.py

---

Command Line Options

--prefix

Specify the domain used for SRV lookup instead of using the hardcoded default.

Example:

./replcheck.py --prefix lab.example.com

This resolves:

_ldap._tcp.lab.example.com

---

--servers

Manually supply a comma-separated list of LDAP servers.

When this option is used, DNS SRV discovery is skipped.

Example:

./replcheck.py --servers ldap1.example.com,ldap2.example.com

---

--additional-servers

Adds extra servers to the list discovered via SRV lookup.

This option is intentionally explicit so operators can clearly see when additional servers are being tested.

Mode 1 – Use built-in defaults

./replcheck.py --additional-servers

Uses the internal list of additional servers to whatever is discovered via SRV records defined in the script:

DEFAULT_ADDITIONAL_SERVERS

Mode 2 – Override default list of additional servers

./replcheck.py --additional-servers ldapA.example.com,ldapB.example.com

Replaces the default list with the provided servers in addition to ones in SRV records..

Important

Additional servers are only added when this option is explicitly provided.

If the flag is omitted, only SRV-discovered hosts are checked.

---

Output Example

Resolving SRV records for _ldap._tcp.example.com

LDAP servers discovered via SRV (with additional servers):
ldap1.example.com
ldap2.example.com
ldap3.example.com

Setting test service account password now...
sleeping for 10 seconds to allow replication:
..........

Checking replication for 3 servers
...

pwdUpdateTime: 20260306153145Z
Replication looks good!

---

Replication Mismatch Example

Replication mismatch detected:

20260306153145Z: ldap1.example.com
20260306153140Z: ldap2.example.com

The script will exit with status code 1.

---

Exit Codes

Code	Meaning
0	Replication consistent
1	Replication mismatch detected
non-zero	DNS or LDAP error

---

Operational Notes

• The script modifies the password of a dedicated test account.
• This account must exist and be replicated across all directory servers.
• TLS client authentication is required.
• Ensure all servers accept SASL EXTERNAL authentication from the certificate used.

---

Intended Use

This tool is meant for:

• replication validation
• post-maintenance checks
• troubleshooting replication lag
• verifying new LDAP nodes before production use

It is designed to be simple, deterministic, and easy to run during incidents.