9 Replies Latest reply: Sep 22, 2012 5:05 AM by rockhill04
Joe Swenson Level 3 Level 3 (735 points)

slapconfig -createreplica --certAdminEmail username@university.edu cpstudx1.domain.priv diradmin

diradmin's Password:

2012-02-06 21:49:49 +0000 command: /usr/sbin/sso_util info -r /LDAPv3/ldap://cpstudx1.domain.priv -p

sso_util command failed with status 2

2012-02-06 21:49:49 +0000 _preflightLDAPReplica: could not read the Kerberos realm from the master cpstudx1.domain.priv

2012-02-06 21:49:49 +0000 Not creating replica due to failure to read Kerberos realm from master. (error = 78)

2012-02-06 21:49:49 +0000 Not creating replica due to preflight failure.

2012-02-06 21:49:49 +0000 Not creating replica due to preflight failure. (error = 78)

 

I had this system as a replica, I demoted it from replica status in an apparently vain attempt to see if I could clear up all these errors:

 

Feb  6 16:03:10 cpstudx1 slapd[1058]: slap_client_connect: URI=ldap://MASTUDXM.local:389 ldap_sasl_interactive_bind_s failed (-1)

Feb  6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl1: client_connect failed (-1)

Feb  6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl: rid=005 rc -1 retrying

Feb  6 16:03:10 cpstudx1 slapd[1058]: slap_client_connect: URI=ldap://BCSTUDXM.DOMAIN.PRIV:389 ldap_sasl_interactive_bind_s failed (-2)

Feb  6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl1: client_connect failed (-1)

Feb  6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl: rid=002 rc -1 retrying

Feb  6 16:03:10 cpstudx1 slapd[1058]: slap_client_connect: URI=ldap://erstudxm.domain.priv:389 ldap_sasl_interactive_bind_s failed (-2)

Feb  6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl1: client_connect failed (-1)

Feb  6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl: rid=003 rc -1 retrying

Feb  6 16:03:11 cpstudx1 slapd[1058]: SASL [conn=1279] Failure: incorrect digest response

 

Anyone have useful thoughts? Thanks


Mac OS X (10.7.3)
  • bezzoh Level 1 Level 1 (0 points)

    Exactly the same issues with the 1 replica i managed to join to my Master. Further to this i am unable to add additional replicas, getting an error that I cant authenticate as diradmin as it may not be a Directory Administrator. Getting on my nerves now.

  • Joe Swenson Level 3 Level 3 (735 points)

    Shoot. I should have replied to this thread.

    After spending a bunch of time with Apple Support, I figured out that there's a computer group called com.apple.opendirectory.group that is retaining records of previously connected replicas, and this data isn't being removied or over-written.

    So, here's what you do:

     

    On the Master remove the failed replicas from command line

              $ sudo slapconfig -removereplica replica.fqdn.priv

              $ sudo slapconfig -removereplica replica2.fqdn.priv

     

    On both replicas, run this command

              $ sudo slapconfig -destroyldapserver

     

    On the master open /System/Library/CoreServices/Directory Utility.app

    Click on the "Directory Editor" tab

    Change the node to /LDAPv3/127.0.0.1

    Go to ComputerGroups

    Select the com.apple.opendirectory.group

    Delete the offending replicas from GroupMembers (you'll have to figure out the replica's GeneratedUID, which I do by looking at the computer accounts), GroupMembership and Member

     

    Now you should be able to re-connect the replica

  • bezzoh Level 1 Level 1 (0 points)

    That explains a few things then as i was importing computer groups originally. I have since today however abandoned all hope of complete replication however and reverted to each site having a standalone server. Reason being, once i had gotten a server replicated the one time replication worked fine, however subsequent ones did not and the LDAP log consistenly gets full of ldap_sasl_interactive_bind_s failed errors on both the master and replica.

     

    Unless you have any insight on this also, i'm unfortunately stuck with multiple masters at each customer site (which is a real pain for management).

     

    Thanks for your response however, that did at least explain how I got 1 server connected this morning (as i'd actually demoted that one when in 10.6 prior to the 10.7 install.

  • Joe Swenson Level 3 Level 3 (735 points)

    Yeah I wish I did. I've found it becomes an inconsistent error over time, but that's the best I can offer at this time.

  • Joe Swenson Level 3 Level 3 (735 points)
  • bezzoh Level 1 Level 1 (0 points)

    I read that earlier today. Maybe it is related to SSL (None of the other solutions worked for me), however I havent even enabled SSL on my master, so I didnt think this would be the cause. I may do some more digging.... Or upgrade to 10.8 haha

  • Joe Swenson Level 3 Level 3 (735 points)

    SSL is supposed to be the solution.

  • bezzoh Level 1 Level 1 (0 points)

    I'll give it a crack tomorrow then and let you know how I get on...

  • rockhill04 Level 1 Level 1 (0 points)

    I tried your suggestion and I am down to this error. Any feedback on how to fix this. The OD Master is brand new installed.

     

    sso_util command failed with status 2

    2012-09-22 11:58:53 +0000 _preflightLDAPReplica: could not read the Kerberos realm from the master server.mydomain.com

    2012-09-22 11:58:53 +0000 Not creating replica due to failure to read Kerberos realm from master. (error = 78)

    2012-09-22 11:58:53 +0000 Not creating replica due to preflight failure.

    2012-09-22 11:58:53 +0000 Not creating replica due to preflight failure. (error = 78)

     

    Thanks in advance for any feedback.

     

    running 10.7.5