On 3/26/19 2:23 PM, Bret Wortman via FreeIPA-users wrote:I broke out of it, but the two are still out of sync. Is there a way toget past that?photo*Bret Wortman*Founder, Damascus Products, LLC855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co<https://link.getmailspring.com/link/76FBB986-2615-4565-A74D-E3C1D7A38233@getmailspring.com/0?redirect=mailto%3Abret%40wrapbuddies.co&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>http://wrapbuddies.co/<https://link.getmailspring.com/link/76FBB986-2615-4565-A74D-E3C1D7A38233@getmailspring.com/1?redirect=http%3A%2F%2Fwrapbuddies.co%2F&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>70 Main St. Suite 23 Warrenton, VA 20186<https://link.getmailspring.com/link/76FBB986-2615-4565-A74D-E3C1D7A38233@getmailspring.com/2?redirect=http%3A%2F%2Ffacebook.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn><https://link.getmailspring.com/link/76FBB986-2615-4565-A74D-E3C1D7A38233@getmailspring.com/3?redirect=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fbretwortman&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn> <https://link.getmailspring.com/link/76FBB986-2615-4565-A74D-E3C1D7A38233@getmailspring.com/4?redirect=http%3A%2F%2Ftwitter.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn> <https://link.getmailspring.com/link/76FBB986-2615-4565-A74D-E3C1D7A38233@getmailspring.com/5?redirect=http%3A%2F%2Finstagram.com%2Fwrapbuddies&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>On Mar 26 2019, at 9:07 am, Rob Crittenden <rcritten@redhat.com> wrote:Bret Wortman via FreeIPA-users wrote:Oops. I spoke too soon. The one I thought I fixed is now justscrolling"No status yet" over and over...You can break out of that. There is a bug where we are checking thewrong status. I can't find the BZ at the moment but IIRC it will befixed in the next release.The BZ is https://bugzilla.redhat.com/show_bug.cgi?id=1666843robphoto*Bret Wortman*Founder, Damascus Products, LLC855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co<https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/0?redirect=mailto%3Abret%40wrapbuddies.co&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>http://wrapbuddies.co/<https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/1?redirect=http%3A%2F%2Fwrapbuddies.co%2F&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>70 Main St. Suite 23 Warrenton, VA 20186<https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/2?redirect=http%3A%2F%2Ffacebook.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn><https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/3?redirect=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fbretwortman&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn><https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/4?redirect=http%3A%2F%2Ftwitter.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn><https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/5?redirect=http%3A%2F%2Finstagram.com%2Fwrapbuddies&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>On Mar 26 2019, at 8:54 am, Bret Wortman<bret.wortman@damascusgrp.com>wrote:One had a clock skew error (fixed), but the other non-CA replicashows:ipa3.spx.net:<https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/6?redirect=ipa3.spx.net%3A&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>replicalast init status: Nonelast init ended: 1970-01-01 00:00:00+00:00last update status: Error (3) Replication error acquiringreplica: Unable to acquire replica: permission denied. The bind dndoes not have permission to supply replication updates to thereplica. Will retry later. (permission denied)Do I need to re-init this replica from scratch (as in, remove it,unbind it from the servers, re-add it as a client and thenre-promote it)?The "init" status is updated when a full reinitialization is done, notduring normal replication updates. The "last update status" is therelevant information in your case.
Can you check if each master has a valid keytab and is able to use thiskeytab to authenticate to the other masters? See
What is your 389-ds version?
You may check that the group "cn=replicationmanagers,cn=sysaccounts,cn=etc,$BASEDN" contains as member all yourreplication principals, for instance:dn: cn=replication managers,cn=sysaccounts,cn=etc,$BASEDNcn: replication managersmember:krbprincipalname=ldap/master.domain.com@DOMAIN.COM,cn=services,cn=accounts,$BASEDNmember:krbprincipalname=ldap/replica.domain.com@DOMAIN.COM,cn=services,cn=accounts,$BASEDNand that the group is configured as nsds5replicabinddngroup incn=replica,cn=dc\3Ddomain\2Cdc\3Dcom,cn=mapping tree,cn=configIf you have an older version, I believe nsds5replicabinddn is usedinstead of nsds5replicabinddngroup.
HTH,flophoto*Bret Wortman*Founder, Damascus Products, LLC855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co<https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/7?redirect=mailto%3Abret%40wrapbuddies.co&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>http://wrapbuddies.co/<https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/8?redirect=http%3A%2F%2Fwrapbuddies.co%2F&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>70 Main St. Suite 23 Warrenton, VA 20186<https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/9?redirect=http%3A%2F%2Ffacebook.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn><https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/10?redirect=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fbretwortman&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn><https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/11?redirect=http%3A%2F%2Ftwitter.com%2Fwrapbuddiesco&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn><https://link.getmailspring.com/link/1183D1DD-2462-44D7-A501-D9F2A79E8D1C@getmailspring.com/12?redirect=http%3A%2F%2Finstagram.com%2Fwrapbuddies&recipient=ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn>On Mar 26 2019, at 8:47 am, Rob Crittenden <rcritten@redhat.com>wrote:Bret Wortman via FreeIPA-users wrote:Looks like I've somehow managed to get my 3 IPA servers outof sync:[root@ipa3 ~]# ipa-replica-manage listipa3.my.net:masteripa4.my.net:masteripa5.my.net:master[root@ipa3 ~]# ipa host-find solr14.my.net---------------0 hosts matched-------------------------------------------Number of entries returned 0----------------------------On ipa4:[root@ipa3 ~]# ipa host-find solr14.my.net---------------1 hosts matched---------------Host name: solr14.my.net----------------------------Number of entries returned 1----------------------------On ipa5:[root@ipa3 ~]# ipa host-find solr14.my.net---------------1 hosts matched---------------Host name: solr14.my.netPrincipal name: host/solr14.my.net@MY.NET<mailto:host/solr14.my.net@MY.NET>::----------------------------Number of entries returned 1----------------------------So they've obviously stopped talking. What's the right wayto get themback in sync and ensure that they don't drift again? Is there areplication entry that's "stuck" and causing this?On each master run: ipa-replica-manage list -v `hostname`That will give you the replication status.You can try to wake up an agreement with: ipa-replica-manageforce-sync--from <host>robSent from Mailspring_______________________________________________FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.orgTo unsubscribe send an email tofreeipa-users-leave@lists.fedorahosted.orgFedora Code of Conduct: https://getfedora.org/code-of-conduct.htmlList Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelinesList Archives:https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.orgSent from Mailspring_______________________________________________FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.orgTo unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.orgFedora Code of Conduct: https://getfedora.org/code-of-conduct.htmlList Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelinesList Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org