Hello,
can someone please help me understanding this error:
[07/May/2018:13:51:13 +0200] slapi_ldap_bind - Error: could not send bind request for id [cn=MasterMasterReplicationManager,cn=config] authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP server), system error -5987 (Invalid function argument.), network error 115 (Operation now in progress, host "ldap-master-b02.mydomain.com:636”)
There is no error on the other side, of course the host and port is reachable, and SSL is enabled with a trusted certificate on the other side (what I verified by querying that server using ldapsearch).
This is the full dump of the replica entry:
# rw-to-ldap-master-b02.dev.mydomain.com, replica, dc\3Dmydomain\2C dc\3Deu, mapping tree, config dn: cn=rw-to-ldap-master-b02.dev.mydomain.com,cn=replica,cn=dc\3D mydomain\2Cdc\3Deu,cn=mapping tree,cn=config nsDS5ReplicaUpdateSchedule: 0001-2359 0123456 nsDS5ReplicaBindMethod: SIMPLE nsDS5ReplicaPort: 636 nsDS5ReplicaTransportInfo: SSL nsDS5ReplicaBindDN: cn=MasterMasterReplicationManager,cn=config objectClass: nsds5replicationagreement objectClass: top nsDS5ReplicaRoot: dc=mydomain,dc=eu nsDS5ReplicaHost: ldap-master-b02.dev.mydomain.com nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE authorityRevocationLis t description: Agreement between ldap-master-b01.dev.mydomain.com a nd ldap-master-b02.dev.mydomain.com cn: rw-to-ldap-master-b02.dev.mydomain.com nsDS5ReplicaCredentials: {AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1NxR1NJYjNEUUVG RERBNEJDUXhZamN5WXpNeVppMDNPR00zTXpOaA0KTUMxaE1XTmtabUl5WmkwMVpUVmtOR1l5TlFBQ 0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJCQlFjWk9FZlZBL2xQeG tMQ2ZRcHZmbw==}OjATeE/K+0qb9fB4HpA1sA== nsds5replicareapactive: 0 nsds5replicaLastUpdateStart: 19700101000000Z nsds5replicaLastUpdateEnd: 19700101000000Z nsds5replicaChangesSentSinceStartup: nsds5replicaLastUpdateStatus: -1 Unable to acquire replicaLDAP error: Can't co ntact LDAP server nsds5replicaUpdateInProgress: FALSE nsds5replicaLastInitStart: 19700101000000Z nsds5replicaLastInitEnd: 19700101000000Z
Thanks
Michal
On 05/07/2018 08:00 AM, Michal Medvecky wrote:
[07/May/2018:13:51:13 +0200] slapi_ldap_bind - Error: could not send bind request for id [cn=MasterMasterReplicationManager,cn=config] authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP server), system error -5987 (Invalid function argument.), network error 115 (Operation now in progress, host "ldap-master-b02.mydomain.com:636”)
Is there anything else the errors log? What about the access log on: ldap-master-b02.mydomain.com? Personally I have not seen this exact error, but I don't see anything that says it's SSL specific. If you change the agreement to use LDAP instead of SSL does it work?
On 8 May 2018, at 17:45, Mark Reynolds mreynolds@redhat.com wrote:
On 05/07/2018 08:00 AM, Michal Medvecky wrote:
[07/May/2018:13:51:13 +0200] slapi_ldap_bind - Error: could not send bind request for id [cn=MasterMasterReplicationManager,cn=config] authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP server), system error -5987 (Invalid function argument.), network error 115 (Operation now in progress, host "ldap-master-b02.mydomain.com:636”)
Is there anything else the errors log? What about the access log on: ldap-master-b02.mydomain.com?
No, absolutely no error log. I can send you tcpdump :)
Personally I have not seen this exact error, but I don't see anything that says it's SSL specific. If you change the agreement to use LDAP instead of SSL does it work?
Yes, I’m actually modifying my previously working plain replication Ansible playbook to SSL-enabled…
Michal
On 05/08/2018 04:47 PM, Michal Medvecky wrote:
On 8 May 2018, at 17:45, Mark Reynolds mreynolds@redhat.com wrote:
On 05/07/2018 08:00 AM, Michal Medvecky wrote:
[07/May/2018:13:51:13 +0200] slapi_ldap_bind - Error: could not send bind request for id [cn=MasterMasterReplicationManager,cn=config] authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP server), system error -5987 (Invalid function argument.), network error 115 (Operation now in progress, host "ldap-master-b02.mydomain.com:636”)
Is there anything else the errors log? What about the access log on: ldap-master-b02.mydomain.com?
No, absolutely no error log.
Then where did the above error message come from? :-) Usually there are a few more messages when replication fails to connect to a consumer.
You should also see "something" in the consumer's access log.
Under cn=config, what is "nsslapd-ssl-check-hostname" set to? Try setting it to "off" to see if it makes a difference.
If that still doesn't help enable connection and replication verbose error logging:
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/ht...
Set "nsslapd-errorlog-level" to 8200
Fyi, 8 (conn logging) + 8192 (repl logging) = 8200, then when you are done set it to zero or simply remove the attribute.
Then send that output please.
Thanks, Mark
I can send you tcpdump :)
Personally I have not seen this exact error, but I don't see anything that says it's SSL specific. If you change the agreement to use LDAP instead of SSL does it work?
Yes, I’m actually modifying my previously working plain replication Ansible playbook to SSL-enabled…
Michal _______________________________________________ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
389-users@lists.fedoraproject.org
-
Mark Reynolds -
Michal Medvecky