On 27 October 2017 at 07:38, Rob Crittenden rcritten@redhat.com wrote:
Lachlan Musicman via FreeIPA-users wrote:
ipa -version VERSION: 4.5.0, API_VERSION: 2.228
It shouldn't be even trying port 7389 with v4.5.0. Very old versions of IPA used to use two separate 389-ds instances, one for the IPA data and one for the CA data. They were combined long ago. This could just be a check in case you had a very old master in which case this is a red herring.
I went back to take another look at the dirsrv logs after you said this, and I saw something I didn't see yesterday. I notice that the cn has "meTo" appended to the start of the master server name.
Is that meant to be that way, or have I mistyped in the wrong window at the wrong time somewhere?
ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn= meTovmpr-linuxidm.unix.domain.com" (vmpr-linuxidm:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) ()
Cheers L.
------ "The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. "
*Greg Bloom* @greggish https://twitter.com/greggish/status/873177525903609857