ldapsearch -h idm1 -x -b "cn=domain,cn=topology,cn=ipa,cn=etc,dc=test,dc=mcd,dc=com" -D "uid=admin,cn=users,cn=accounts,dc=test,dc=mcd,dc=com" -W
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=domain,cn=topology,cn=ipa,cn=etc,dc=test,dc=mcd,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
dn: cn=domain,cn=topology,cn=ipa,cn=etc,dc=test,dc=mcd,dc=com
nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth
nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth
objectClass: top
objectClass: iparepltopoconf
ipaReplTopoConfRoot: dc=test,dc=mcd,dc=com
nsds5ReplicaStripAttrs: modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp
cn: domain
ipaReplTopoSegmentDirection: both
objectClass: iparepltoposegment
objectClass: top
ipaReplTopoSegmentStatus: autogen
# search result
search: 2
result: 0 Success
# numResponses: 3
# numEntries: 2
Yuri Krysko via FreeIPA-users wrote:
Hello FreeIPA Community!
My FreeIPA setup consists of two servers in master-master replication
scenario. I have recently made a change to LDAP schema to *not*
exclude *krbloginfailedcount *attribute* *from replication. I am seeing
incremental updates being pushed from the server where failed login
occurs, and the other freeIPA server acquires these replication updates,
however it does not seem to update its *krbloginfailedcount *for the
respective user. Hence, my goal to have user account locked out after X
number of failed logins irrespective of the auth server is not
successful, as each server still seems to maintain its own version of
failed auth attempts. Am I doing something wrong?
We would need to see what changes you made.
rob