Lion OD replica problem

Question

Joe Swenson Author

Level 3

743 points

Lion OD replica problem

slapconfig -createreplica --certAdminEmail username@university.edu cpstudx1.domain.priv diradmin

diradmin's Password:

2012-02-06 21:49:49 +0000 command: /usr/sbin/sso_util info -r /LDAPv3/ldap://cpstudx1.domain.priv -p

sso_util command failed with status 2

2012-02-06 21:49:49 +0000 _preflightLDAPReplica: could not read the Kerberos realm from the master cpstudx1.domain.priv

2012-02-06 21:49:49 +0000 Not creating replica due to failure to read Kerberos realm from master. (error = 78)

2012-02-06 21:49:49 +0000 Not creating replica due to preflight failure.

2012-02-06 21:49:49 +0000 Not creating replica due to preflight failure. (error = 78)

I had this system as a replica, I demoted it from replica status in an apparently vain attempt to see if I could clear up all these errors:

Feb 6 16:03:10 cpstudx1 slapd[1058]: slap_client_connect: URI=ldap://MASTUDXM.local:389 ldap_sasl_interactive_bind_s failed (-1)

Feb 6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl1: client_connect failed (-1)

Feb 6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl: rid=005 rc -1 retrying

Feb 6 16:03:10 cpstudx1 slapd[1058]: slap_client_connect: URI=ldap://BCSTUDXM.DOMAIN.PRIV:389 ldap_sasl_interactive_bind_s failed (-2)

Feb 6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl1: client_connect failed (-1)

Feb 6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl: rid=002 rc -1 retrying

Feb 6 16:03:10 cpstudx1 slapd[1058]: slap_client_connect: URI=ldap://erstudxm.domain.priv:389 ldap_sasl_interactive_bind_s failed (-2)

Feb 6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl1: client_connect failed (-1)

Feb 6 16:03:10 cpstudx1 slapd[1058]: do_syncrepl: rid=003 rc -1 retrying

Feb 6 16:03:11 cpstudx1 slapd[1058]: SASL [conn=1279] Failure: incorrect digest response

Anyone have useful thoughts? Thanks

Mac OS X (10.7.3)

Posted on Feb 6, 2012 2:09 PM

Reply

Answer 1

bezzoh

Level 1

4 points

Jul 26, 2012 3:13 AM in response to Joe Swenson

Exactly the same issues with the 1 replica i managed to join to my Master. Further to this i am unable to add additional replicas, getting an error that I cant authenticate as diradmin as it may not be a Directory Administrator. Getting on my nerves now.

Reply

Answer 2

Joe Swenson Author

Level 3

743 points

Jul 26, 2012 8:35 AM in response to bezzoh

Shoot. I should have replied to this thread.

After spending a bunch of time with Apple Support, I figured out that there's a computer group called com.apple.opendirectory.group that is retaining records of previously connected replicas, and this data isn't being removied or over-written.

So, here's what you do:

On the Master remove the failed replicas from command line

$ sudo slapconfig -removereplica replica.fqdn.priv

$ sudo slapconfig -removereplica replica2.fqdn.priv

On both replicas, run this command

$ sudo slapconfig -destroyldapserver

On the master open /System/Library/CoreServices/Directory Utility.app

Click on the "Directory Editor" tab

Change the node to /LDAPv3/127.0.0.1

Go to ComputerGroups

Select the com.apple.opendirectory.group

Delete the offending replicas from GroupMembers (you'll have to figure out the replica's GeneratedUID, which I do by looking at the computer accounts), GroupMembership and Member

Now you should be able to re-connect the replica

Reply

Answer 3

bezzoh

Level 1

4 points

Jul 26, 2012 8:56 AM in response to Joe Swenson

That explains a few things then as i was importing computer groups originally. I have since today however abandoned all hope of complete replication however and reverted to each site having a standalone server. Reason being, once i had gotten a server replicated the one time replication worked fine, however subsequent ones did not and the LDAP log consistenly gets full of ldap_sasl_interactive_bind_s failed errors on both the master and replica.

Unless you have any insight on this also, i'm unfortunately stuck with multiple masters at each customer site (which is a real pain for management).

Thanks for your response however, that did at least explain how I got 1 server connected this morning (as i'd actually demoted that one when in 10.6 prior to the 10.7 install.

Reply

Answer 4

Joe Swenson Author

Level 3

743 points

Jul 26, 2012 9:13 AM in response to bezzoh

Yeah I wish I did. I've found it becomes an inconsistent error over time, but that's the best I can offer at this time.

Reply

Answer 5

Joe Swenson Author

Level 3

743 points

Jul 26, 2012 9:14 AM in response to bezzoh

https://groups.google.com/forum/#!msg/macenterprise/nXabV-SCHsk/yqBuTBHQmB4J

Perhaps a solution is here

Reply

Answer 6

bezzoh

Level 1

4 points

Jul 26, 2012 9:44 AM in response to Joe Swenson

I read that earlier today. Maybe it is related to SSL (None of the other solutions worked for me), however I havent even enabled SSL on my master, so I didnt think this would be the cause. I may do some more digging.... Or upgrade to 10.8 haha

Reply