Hi,
You are right, sorry for the confusion. I have performed a new `ipa-replica-install` and you can find the logs for the master and replica in these links:
master ds389 access: https://www.rexhepi-lindberg.com/iparepl/20230223/se-rhidm03_access
master ds389 errors: https://www.rexhepi-lindberg.com/iparepl/20230223/se-rhidm03_errors
replica ds389 access: https://www.rexhepi-lindberg.com/iparepl/20230223/usidc1-rhidm01x_access
replica ds389 errors: https://www.rexhepi-lindberg.com/iparepl/20230223/usidc1-rhidm01x_errors
replica-install.log: https://www.rexhepi-lindberg.com/iparepl/20230223/usidc1-rhidm01x_ipareplica-install.log
master = se-rhidm03x
replica = usidc1-rhidm01x
The replication is enabled by setting
nsds5BeginReplicaRefresh=start
on the master (entry
cn=meTousidc1-rhidm01x.idc1.us.example.com,cn=replica,cn=dc\3Dlnx\2Cdc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
). We can see this operation on the master logs:
After that, the master tries to establish the connection to the replica but this fails. The logs on the replica show:
[23/Feb/2024:06:00:58.077083917 -0500] conn=6 fd=119 slot=119 connection from 10.0.13.146 to 192.168.224.21
[23/Feb/2024:06:00:58.083111562 -0500] conn=6 op=0 UNBIND
[23/Feb/2024:06:00:58.083129212 -0500] conn=6 op=0 fd=119 closed error - U1
This connection should be established from the master using the kerberos ticket for the principal
ldap/se-rhidm03x.se.example.com@
LNX.EXAMPLE.COM
obtained from /etc/dirsrv/ds.keytab, thanks to a mapping defined on the replica in cn=Peer Master,cn=mapping,cn=sasl,cn=config
:objectclass: top, nsSaslMapping
nsSaslMapRegexString: '^[^:@]+$'
nsSaslMapBaseDNTemplate: cn=config
nsSaslMapFilterTemplate: '(cn=&@IPA.TEST)'
nsSaslMapPriority: 1
You can try to reproduce the error with (from the master):
kinit -kt /etc/dirsrv/ds.keytab ldap/`hostname`