I am struggling through this. I have a new server built and IPA 4.6.4-10 installed.  I made it a replica from the v3.0.0-51 master.

 

Ipa-replica-manage shows 3 ipa servers, the original 2 v3.0.0-51 servers and the new ipa v4.6.4-10 server.  But when I poll for replication agreements I get no answer.

 

From <server1> I issued the following commands:

$ sudo ipa-replica-manage list

Directory Manager password:

 

<server1>.mydomain.local: master

<server2>.mydomain.local: master

<server3 – new>.mydomain.local: master

 

$ sudo ipa-replica-manage list <server2>

[sudo] password for <user>:

Cannot find servername in public server list

 

$ sudo ipa-replica-manage list <server3>

[sudo] password for <user>:

Cannot find servername in public server list

 

$ ldapsearch -x -D 'cn=directory manager' -W -b 'cn=mapping tree,cn=config'

Enter LDAP Password:

 

There is an extensive response that includes:

# dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config

.

.

nsslapd-referral: ldap://<server3>.mydomain..local:389/dc%3Dmydomain%2Cdc%3Dlocal

nsslapd-referral: ldap://<server2>.mydomain.local:389/dc%3Dmydomain%2Cdc%3Dlocal

 

# replica, dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config

dn: cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping tree,cn=config

cn: replica

nsDS5Flags: 1

objectClass: top

objectClass: nsds5replica

objectClass: extensibleobject

nsDS5ReplicaType: 3

nsDS5ReplicaRoot: dc=mydomain,dc=local

nsds5ReplicaLegacyConsumer: off

nsDS5ReplicaId: 4

nsDS5ReplicaBindDN: cn=replication manager,cn=config

nsDS5ReplicaBindDN: krbprincipalname=ldap/<invalid, removed server that should not even appear here>.mydomain.local@MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local

nsDS5ReplicaBindDN: krbprincipalname=ldap/<server2>.mydomain.local@MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local

nsDS5ReplicaBindDN: krbprincipalname=ldap/<server3>.mydomain.local@MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local

nsState:: BAAAAAAAAAA+CUNdAAAAAGEAAAAAAAAAkgAAAAAAAAAEAAAAAAAAAA==

nsDS5ReplicaName: a5641a0e-252711e3-96afcc83-6ff9b802

nsds5ReplicaChangeCount: 3768023

nsds5replicareapactive: 0

 

# meTo<server2>.mydomain.local, replica, dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config

dn: cn=meTo<server2>.mydomain.local,cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping tree,cn=config

cn: meTo<server2>.mydomain.local

objectClass: nsds5replicationagreement

objectClass: top

nsDS5ReplicaTransportInfo: LDAP

description: me to <server2>.mydomain.local

nsDS5ReplicaRoot: dc=mydomain,dc=local

nsDS5ReplicaHost: <server2>.mydomain.local

nsds5replicaTimeout: 120

nsDS5ReplicaPort: 389

nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof idnssoaserialentryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount

nsDS5ReplicaBindMethod: SASL/GSSAPI

nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount

nsds50ruv: {replicageneration} 5241a52a000000040000

nsds50ruv: {replica 7 ldap://<server2>.mydomain.local:389} 54c80f57000000070000 5d271a1b000700070000

nsds50ruv: {replica 4 ldap://<server1>.mydomain.local:389} 5241a584000800040000 5d271866000300040000

nsds50ruv: {replica 8 ldap://<server3>.mydomain.local:389} 5d166840000000080000 5d270db6000500080000

nsruvReplicaLastModified: {replica 7 ldap://<server2>.mydomain.local:389} 00000000

nsruvReplicaLastModified: {replica 4 ldap://<server1>.mydomain.local:389} 00000000

nsruvReplicaLastModified: {replica 8 ldap://<server3>.mydomain.local:389} 00000000

nsds5ReplicaStripAttrs: modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp

nsds5replicareapactive: 0

nsds5replicaLastUpdateStart: 20190801154606Z

nsds5replicaLastUpdateEnd: 20190801154607Z

nsds5replicaChangesSentSinceStartup:: NDo2MDAvMjI1MjE1OSA4OjM1OS8wIA==

nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental update succeeded

nsds5replicaUpdateInProgress: FALSE

nsds5replicaLastInitStart: 0

nsds5replicaLastInitEnd: 0

 

# meTo<server3>.mydomain.local, replica, dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config

dn: cn=meTo<server3>.mydomain.local,cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping tree,cn=config

cn: meTo<server3>.mydomain.local

objectClass: nsds5replicationagreement

objectClass: top

nsDS5ReplicaTransportInfo: LDAP

nsds5ReplicaStripAttrs: modifiersName modifyTimestamp internalModifiersName in

ternalModifyTimestamp

nsDS5ReplicaRoot: dc=mydomain,dc=local

nsDS5ReplicaHost: <server3>.mydomain.local

nsds5replicaTimeout: 120

nsDS5ReplicaPort: 389

nsDS5ReplicaBindMethod: SASL/GSSAPI

nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof idnssoaserialentryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount

description: me to <server3>.mydomain.local

nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount

nsds50ruv: {replicageneration} 5241a52a000000040000

nsds50ruv: {replica 8 ldap://<server3>.mydomain.local:389} 5d166840000000080000 5d271a1b000000080000

nsds50ruv: {replica 4 ldap://<server1>.mydomain.local:389} 5241a584000800040000 5d271866000300040000

nsds50ruv: {replica 7 ldap://<server2>.mydomain.local:389} 54c80f57000000070000 5d2717a3000300070000

nsruvReplicaLastModified: {replica 8 ldap://<server3>.mydomain.local:389} 00000000

nsruvReplicaLastModified: {replica 4 ldap://<server1>.mydomain.local:389} 00000000

nsruvReplicaLastModified: {replica 7 ldap://<server2>.mydomain.local:389} 00000000

nsds5replicareapactive: 0

nsds5replicaLastUpdateStart: 20190801154606Z

nsds5replicaLastUpdateEnd: 20190801154607Z

nsds5replicaChangesSentSinceStartup:: NDo2MDAvMTkyNTgzNyA3OjUxMi8wIA==

nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental update succeeded

nsds5replicaUpdateInProgress: FALSE

nsds5replicaLastInitStart: 0

nsds5replicaLastInitEnd: 0

 

# search result

search: 2

result: 0 Success

 

# numResponses: 6

# numEntries: 5

 

Are there no replication agreements between these servers or is there  something missing in “public server list” that the agreements cannot be found?

 

I imagine that all parts need to be seeing each other properly at this point before I even begin to try and make <server3> the new ultimate master.  I will then add a <server4> ipa server and replicate it from <server3> once it is the master and retire <server1> and <server2>.  At least that is the scope of the project.

 

Steven Auerbach

Assistant Director of Information Systems

Information Technology & Security

State University System of Florida

Board of Governors

325 W. Gaines Street, Suite 1625

Tallahassee, Florida 32399

(850) 245-9592

Steven.auerbach@flbog.edu | www.flbog.edu

email_sig