DJ has always attempted to support replication of offline changes to the schema backend. However, this support is not available for LDIF backends and, in particular, cn=admin data where symmetric keys are located.
Steps to reproduce:
- install two replicated DJ instances, DS1 and DS2, without enabling production mode
- observe that both servers do not contain any symmetric keys
- stop DS1
- perform an encrypted backup of DS1
- observe that DS1 now contains a single symmetric key, but DS2 does not yet
- restart DS1
- observe that the server starts and connects successfully to the topology, but the symmetric key is never synchronized to the rest of the topology. This prevents the backup from being restored on any other server other than DS1.
This bug is particularly important from a devops / automation point of view where servers may import data during a bootstrap phase.