Bret Wortman via FreeIPA-users wrote:
>
> [root@ipa2c7 ~]# ipa-replica-manage clean-ruv 5
> Directory Manager password:
>
> unable to decode: {replica 13} 60b907570001000d0000 60b907570001000d0000
> unable to decode: {replica 14} 60b923030002000e0000 60b923030002000e0000
> unable to decode: {replica 21} 60cb27ed000600150000 60cb27ed000600150000
> unable to decode: {replica 24} 60cc5b11000400180000 60cc5b11000400180000
> unable to decode: {replica 17} 60be13a5000000110000 60be13c9000700110000
> unable to decode: {replica 18} 60bf4aec000000120000 60c07065000200120000
> unable to decode: {replica 5} 53722a35000000050000 5a11c065000000050000
> Replica ID 5 not found
>
> I'd try interacting with the LDAP directly but I can't get an LDIF
> using db2ldif either with dsctl or without it (because I don't have
> dsctl and "yum provides */dsctl" returns no hits so I'm not sure where
> it comes from).
Scratch this last; it was a permissions error when trying to write the
output file. But I'm not sure that's going to help me remove these
"unable to decode" replicas.
The RUV search uses this filter against your suffix (dc=our,dc=net):
'(&(nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff)(objectclass=nstombstone))
nsds50ruv is the attribute which contains the replication information.
In fact, it seems that ipa2c7 doesn't want to delete the replica
because it thinks is still has a replication agreement with ipa2, but
none of the usual tools let me get in there and remove it.
[root@ipa2c7 slapd-OUR-NET]# ipa-replica-manage del
ipa2.our.net
Connection to 'ipa2.our.net' failed: cannot connect to
'ldaps://ipa2.our.net:636':
Unable to delete replica 'ipa2.our.net'
[root@ipa2c7 slapd-OUR-NET]# ipa server-del
ipa2.our.net
Removing
ipa2.our.net from replication topology, please wait...
ipa: ERROR:
ipa2.our.net: server not found
[root@ipa2c7 slapd-OUR-NET]# [23/Jun/2021:11:37:18.017970634 +0000] -
ERR -
NSMMReplicationPlugin - bind_and_check_pwp -
agmt="cn=meToipa2.our.net" (ipa2:389) - Replication bind with GSSAPI
auth failed: LDAP error -1 (Can't contact LDAP server) ()
[23/Jun/2021:11:37:18.027255085 +0000] - NOTICE -
NSMMReplicationPlugin - CleanAllRUV Task (rid 5): Replica not online
(agmt="cn=meToipa2.our.net" (ipa2:389))
[23/Jun/2021:11:37:18.028593839 +0000] - NOTICE -
NSMMReplicationPlugin - CleanAllRUV Task (rid 5): Not all replicas
online, retrying in 160 seconds...
Is this, then, a case where I need to go back and use ldapdelete to
remove any
entry that has a reference to
ipa2.our.net
You can try --force to have the iap-replica-manage delete work without
being able to contact the remote server. It may work if you're still at DL0.
rob