--[ UxBoD ]-- wrote:
> ----- Original Message -----
>
>> On Mon, 2010-07-19 at 07:01 -0600, Rich Megginson wrote:
>>
>>> John A. Sullivan III wrote:
>>>
>>>> On Mon, 2010-07-19 at 04:15 -0400, John A. Sullivan III wrote:
>>>>
>>>>
>>>>> On Wed, 2010-07-14 at 15:40 -0600, Rich Megginson wrote:
>>>>>
>>>>>
>>>>>> --[ UxBoD ]-- wrote:
>>>>>>
>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> We are setting up a new Windows 2K3 AD server and
attempting
>>>>>>> to
>>>>>>> syncronise the users from our LDAP server version 8.1.0.
>>>>>>>
>>>>>>> Performing the full sync fails after about 30 seconds with
a
>>>>>>> message in the error log:
>>>>>>>
>>>>>>> [14/Jul/2010:07:46:10 -0400] - add value "^V" to
attribute
>>>>>>> type
>>>>>>> "ARecord" in entry
>>>>>>>
"DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=domain,DC=com"
>>>>>>> failed: duplicate new value
>>>>>>> [14/Jul/2010:07:46:10 -0400] - add value "null or
non-ASCII"
>>>>>>> to
>>>>>>> attribute type "dnsproperty" in entry
>>>>>>>
"DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=domain,DC=com"
>>>>>>> failed: duplicate new value
>>>>>>>
>>>>>>> and none of the users or groups are sent to AD. I am
guessing
>>>>>>> it may be how our LDAP server schema is setup as we use
>>>>>>> something like:
>>>>>>>
>>>>>>> dc=domain,dc=com
>>>>>>> |_ o=Internal
>>>>>>> |___o=a0000
>>>>>>> |____ou=Desktops
>>>>>>> |_____uid=fred
>>>>>>>
>>>>>>> We have set the Windows subtree to be dc=domain,dc=com and
the
>>>>>>> replication subtree to be dc=domain,dc=com with a DS
subtree
>>>>>>> of
>>>>>>> o=Internal,dc=domain,dc=com.
>>>>>>>
>>>>>>> Our understanding was that within AD Users & Groups GUI
we
>>>>>>> should have seen a similar schema created.
>>>>>>>
>>>>>>> Though for some reason the replication is traversing the
whole
>>>>>>> of the internal AD tree.
>>>>>>>
>>>>>>>
>>>>>> Because you set the AD subtree to be dc=domain,dc=com ?
>>>>>>
>>>>>>
>>>>>>> Should we create a new Organisational Unit within AD
called,
>>>>>>> for arguments sake, clients and set the Windows subtree to
be
>>>>>>> ou=clients,dc=domain,dc=com so that it forces it to that
>>>>>>> branch
>>>>>>> ?
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>> I think that's the way it was designed. Usually AD trees
have a
>>>>>> CN=Users,DC=domain,DC=com where all of the user entries live,
>>>>>> and
>>>>>> winsync is designed to work with that sort of structure.
>>>>>>
>>>>>>
>>>>> <snip>
>>>>> Hmm . . . we've rooted AD in dc=myad,dc=domain,dc=com and
>>>>> synchronized
>>>>> at cn=users,dc=myad,dc=domain,dc=com but still have the exact
>>>>> same
>>>>> problem :(
>>>>>
>>>>>
>>>> <snip>
>>>> I also tried creating an ou in AD, e.g.,
>>>> ou=LDAPUSers,dc=myad,dc=domain,dc=com in case it did not like
>>>> building
>>>> Organizations under CNs but that also failed - John
>>>>
>>>>
>>> Not sure what you mean by "building Organizations" - but it
>>> shouldn't
>>> matter if it is under a CN or not.
>>>
>> <snip>
>> We're running 8.1. Based upon some of the change logs I've seen for
>> some of the more recent versions of 389, I wonder if this is just a
>> problem between 8.1 and Windows Server 2008. We are downgrading a
>> Domain Controller to 2003 to see if the problem goes away - John
>>
>>
>
> The problem still exists on W2K3/32bit and we see the following
> error:
>
> windows_tot_run: failed to obtain data to send to the consumer; LDAP
> error - 1
>
Enable the replication log level -
http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting
> The user we are bind with in AD is a member of Domain Admins; do we
> need to add some other group or security membership ?
>
Hi Rich,
that is what I did not get the error message. Here is the complete output:
[20/Jul/2010:10:42:20 -0400] NSMMReplicationPlugin - agmt="cn=DomainAD"
(adc01:636): Received result code 32 (0000208D: NameErr: DSID-031001CD, problem 2001
(NO_OBJECT), data 0, best match of: 'CN=Users,DC=ad,DC=domain,DC=com' ) for
add operation
[20/Jul/2010:10:42:20 -0400] NSMMReplicationPlugin - agmt="cn=DomainAD"
(adc01:636): windows_replay_update: Cannot replay add operation.
[20/Jul/2010:10:42:20 -0400] NSMMReplicationPlugin - agmt="cn=DomainAD"
(adc01:636): Beginning linger on the connection
[20/Jul/2010:10:42:20 -0400] NSMMReplicationPlugin - agmt="cn=DomainAD"
(adc01:636): windows_tot_run: failed to obtain data to send to the consumer; LDAP error -
1
[20/Jul/2010:10:42:20 -0400] NSMMReplicationPlugin - agmt="cn=DomainAD"
(adc01:636): No linger to cancel on the connection
[20/Jul/2010:10:42:20 -0400] NSMMReplicationPlugin - agmt="cn=DomainAD"
(adc01:636): Disconnected from the consumer
[20/Jul/2010:10:42:20 -0400] NSMMReplicationPlugin - agmt="cn=DomainAD"
(adc01:636): State: start -> ready_to_acquire_replica
--
Thanks, Phil