On 27 October 2017 at 07:38, Rob Crittenden <rcritten@redhat.com> wrote:
Lachlan Musicman via FreeIPA-users wrote:

>
> ipa -version
> VERSION: 4.5.0, API_VERSION: 2.228

It shouldn't be even trying port 7389 with v4.5.0. Very old versions of
IPA used to use two separate 389-ds instances, one for the IPA data and
one for the CA data. They were combined long ago. This could just be a
check in case you had a very old master in which case this is a red herring.



I went back to take another look at the dirsrv logs after you said this, and I saw something I didn't see yesterday. I notice that the cn has "meTo" appended to the start of the master server name.

Is that meant to be that way, or have I mistyped in the wrong window at the wrong time somewhere?

ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meTovmpr-linuxidm.unix.domain.com" (vmpr-linuxidm:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) ()


Cheers
L.


------
"The antidote to apocalypticism is apocalyptic civics. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. "

Greg Bloom @greggish https://twitter.com/greggish/status/873177525903609857