Chris Phillips wrote: > Hi, > > I've a cluster of boxes with replication form two multimasters to 6 > read only replicas. There appears to be a problem in the replication > in that the error logs state that the DSA is unwilling to process > updates for a specific user account, so the replication status in the > idm just stays at saying it started rather than completed. I could > just delete the account and recreate it, but as it's unfortunately > *my* account (and is in this state *possibly* because I was messing > with the resetpasswordretrytime field (or something very similarly > named) which I get the impression is treated differently to other > fields) I'd like to avoid deleting the account. > > To this end I'm hoping a suitable solution is to remove whatever the > change is that is trying to be pushed across, but I can't see any way > with SSL replication to see what the actual attributes it doesn't like > are. Any way to pull this straight out with ldapsearch or something? > Any tips for elegantly troubleshooting this in a heavily locked down > environment would be appreciated. Yes, it probably has to do with one of those password related operational attributes. There are a couple of ways to handle this 1) change your replication agreement to exclude the attributes passwordRetryCount, retryCountResetTime, and accountUnlockTime - you do this by adding these attributes to be excluded in fractional replication - you should be able to modify your existing replication agreements to exclude these 2) add the attribute passwordIsGlobalPolicy in cn=config to "on" on your servers - this will allow those attributes to be replicated > > Thanks > > Chris > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3258 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20090609/91d0a353/attachment.bin
