Hey,

Things have been fine for a long time, but in the last day or so we've been seeing a lot of errors. We can't create any IPA users, and we get this whenever we try to run ipa-client-install:

Synchronizing time with KDC...
Attempting to sync time using ntpd.  Will timeout after 15 seconds
Attempting to sync time using ntpd.  Will timeout after 15 seconds
Unable to sync time with NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.
Joining realm failed: RPC failed at server.  Server is unwilling to perform: Automember Plugin update unexpectedly failed.

I see this error repeatedly in the logs:

[14/Mar/2018:22:23:40.011998888 +0000] seq id2entry err -30988
[14/Mar/2018:22:23:40.013516946 +0000] DSRetroclPlugin - replog: an error occured while adding change number 1, dn = changenumber=1,cn=changelog: Already exists.
[14/Mar/2018:22:23:40.014652652 +0000] retrocl-plugin - retrocl_postob: operation failure [68]

And this is in sssd/sssd_nss.log:

(Wed Mar 14 22:18:05 2018) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline]

I've tried stopping and starting ipactl, sssd, and nothing changes. I tried rebooting the instance, that didn't help either.

Any ideas?