Requirements for replicas that preserve identities and permissions

The sites of replicas that preserve both identities and permissions must support the same set of user and group accounts (at least for the accounts that can be assigned to VOB elements). The user and group names and numerical IDs (UID/GIDs on Linux® or the SIDS on Windows®) must be the same across sites.

For example, on Linux®, the sites must share the same NIS map. On Windows®, the replicas must be in the same Windows® domain. You cannot create identity-preserving replicas where some replicas are located on Linux® or UNIX® systems, and the others are located on Windows® systems.

On Linux® and the UNIX® system, you can maintain separate but identical user/group databases across NIS domains. On Windows®, ownership modes (SIDs) are not consistent across domains.

Therefore, the entire set of replicas cannot preserve identities in either of the following cases:

All replicas in a VOB family are not in the same Windows® domain.
Some replicas in a VOB family are located on Linux® or UNIX® system-based machines, and others are located on Windows® machines.

You can preserve identities in a subset of replicas in a VOB family. For example:

A VOB family consists of the replicas bangalore and tokyo, hosted on Windows® in different domains, and the replicas boston_hub, sanfran_hub, buenosaires, and sydney, hosted on a UNIX® system. The VOB hosts for boston_hub and sanfran_hub are in NIS domains that have the same user/group databases, so boston_hub and sanfran_hub are created as identities-preserving replicas.
A VOB family consists of five replicas on Windows®: seattle, aloha, troy, boston, and boston_backup. All replicas except boston and boston_backup are located in different Windows® domains. The replica boston_backup is used as a backup replica for boston, and the hosts for these replicas are in the same Windows® domain (but registered on two different HCL VersionVault registry hosts). The replicas boston and boston_backup are created as identities-preserving replicas.

There can be only one subset of identities- and permissions-preserving replicas in a VOB family, even if some replicas do not exchange update packets with all other replicas in the family.

Note: Because oplog entries are not created when you make changes to security identifiers using the vob_sidwalk command, the changes are not propagated to sibling replicas, even if those replicas are configured as identity preserving. Therefore, you must run vob_sidwalk at all replicas in any VOB family that preserve user and group IDs. After all members of the identity-preserving replica family have been updated, run vob_sidwalk again using the –delete_groups option to remove the historical group SIDs.