I can see this line about 10-15 lines before the lines I already posted

[18/Feb/2019:17:21:25.961763243 +0000] conn=2 op=0 BIND dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL



On 19 Feb 2019, at 15:19, Florence Blanc-Renaud <flo@redhat.com> wrote:

On 2/19/19 1:25 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
Here are the outputs of the two commands:
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
ipaAllowedTarget: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
memberPrincipal: HTTP/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
memberPrincipal: HTTP/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
cn: ipa-http-delegation
objectClass: ipaKrb5DelegationACL
objectClass: groupOfPrincipals
objectClass: top
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
memberPrincipal: ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
memberPrincipal: ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
cn: ipa-ldap-delegation-targets
objectClass: groupOfPrincipals
objectClass: top
And in the access log the result of the search:
[18/Feb/2019:17:21:36.259672879 +0000] conn=6 fd=64 slot=64 connection from local to /var/run/slapd-REDCAPCLOUD-LOCAL.socket
[18/Feb/2019:17:21:36.260597395 +0000] conn=6 AUTOBIND dn="cn=Directory Manager"
[18/Feb/2019:17:21:36.260604747 +0000] conn=6 op=0 BIND dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL
[18/Feb/2019:17:21:36.260656509 +0000] conn=6 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0000462749 dn="cn=Directory Manager"
[18/Feb/2019:17:21:36.260806067 +0000] conn=6 op=1 MOD dn="cn=Auto Membership Plugin,cn=plugins,cn=config"
[18/Feb/2019:17:21:36.265134066 +0000] conn=6 op=1 RESULT err=0 tag=103 nentries=0 etime=0.0004388316
[18/Feb/2019:17:21:36.265232071 +0000] conn=6 op=2 UNBIND
[18/Feb/2019:17:21:36.265247421 +0000] conn=6 op=2 fd=64 closed - U1
[18/Feb/2019:17:21:36.267548186 +0000] conn=2 op=10 SRCH base="cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local" scope=0 filter="(objectClass=*)" attrs="memberPrincipal"
[18/Feb/2019:17:21:36.267674095 +0000] conn=2 op=10 RESULT err=32 tag=101 nentries=0 etime=0.1760815055
[18/Feb/2019:17:21:36.425570348 +0000] conn=2 op=11 UNBIND

This shows that the entry is not found on the replica (err=32 = no such object), could either be because the replication did not replicate yet or because access rights prevent the user from seeing the entry. Do you see a line with
conn=2 op=<something> BIND ...
earlier in the log? It would help understand which user is performing the search.

flo

On 19 Feb 2019, at 14:15, Florence Blanc-Renaud <flo@redhat.com> wrote:

On 2/19/19 12:29 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
After setting the $BASEDN I am getting the following:
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
memberPrincipal: ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL <mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
memberPrincipal: ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL <mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
cn: ipa-ldap-delegation-targets
objectClass: groupOfPrincipals
objectClass: top
Ok, so the entry exists on the master. Did you also check cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$BASEDN and the access log on the replica as I explained in a previous mail [1]?

Thanks,
flo

[1] https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/message/CHBZVWEG346L2DPXR6FTHM2A7O7FIW2W/

On 19 Feb 2019, at 12:25, Florence Blanc-Renaud <flo@redhat.com <mailto:flo@redhat.com>> wrote:

/etc/ipa/default.conf
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org

_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org