Re: Sync problems with AD 2012 R2

Noriko Hosoi <nhosoi@xxxxxxxxxx> · Mon, 16 May 2016 14:02:25 -0700



    On 05/16/2016 01:01 PM, Alberto Viana
      wrote:

    
      I'm trying to setup a new scenario with 389 and AD
        2012 R2 (So far I'm using with AD 2008 R2 and everything works
        fine).
    
    Did you use the same version of 389-ds-base against AD on 2008 R2
    and 2012 R2?

    
        389-Directory/1.3.4.8 B2016.063.1654

        
    Please share the output frpm this command line "rpm -q 389-ds-base"?

    
        Windows 2012 R2 64bits
      
    
    Both 2008 R2 and 2012 R2 are supported.

    
        : 

        
        After configure the AD replication and Initiate a full
          sync, it starts to do some entries and I got the following
          error:
        

        [16/May/2016:16:36:47 -0300] NSMMReplicationPlugin -
          windows sync - agmt="cn=AD - DF-GTI-DC01" (gti-df-dc01:636):
          windows_process_total_add: Cannot replay add operation.

        
    Does this error message follow some other detailed error messages? 
    Such as ...

    YOUR_AGREEMENT_NAMEFailed to send %s operation: LDAP
      error (ERROR_CODE) ERROR_MESSAGE

    
    or 

    YOUR_AGREEMENT: Received error [%s] when attempting to
      %s entry [%s]: Please correct the attribute specified in the error
      message.  Refer to the Windows Active Directory docs for more
      information.

    
    If not, could you enable the replication log level and share the
    error log with us?

    
        And after that:
        

          [16/May/2016:16:36:47 -0300] NSMMReplicationPlugin -
            windows sync - agmt="cn=AD - DF-GTI-DC01" (gti-df-dc01:636):
            Replica has no update vector. It has never been initialized.
          [16/May/2016:16:36:47 -0300] NSMMReplicationPlugin -
            windows sync - agmt="cn=AD - DF-GTI-DC01" (gti-df-dc01:636):
            Replica has no update vector. It has never been initialized.
          [16/May/2016:16:36:51 -0300] NSMMReplicationPlugin -
            windows sync - agmt="cn=AD - DF-GTI-DC01" (gti-df-dc01:636):
            Replica has no update vector. It has never been initialized.
        
        
        I found a really old ticket that seems to be related to
          same error:
        

        https://fedorahosted.org/389/ticket/47589

        
    This is a regression only affected 389-ds-base-1.3.1.x.  So, 1.3.4.x
    does not need the patch.

    
        but with win2008r2 and fixed.
        

        According to this link -> https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10/html/Administration_Guide/supported-ad.html
        

        2012 R2 is supported, is that true?
      
    
    Could you also share your Windows Sync agreement?  Do you happen to
    have 2 Directory Servers -- one for 2008R2 and another for 2012R2,
    could you provide both?

    
        Any clues?
        

      --
389-users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
http://lists.fedoraproject.org/admin/lists/389-users@xxxxxxxxxxxxxxxxxxxxxxx

    
--
389-users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
http://lists.fedoraproject.org/admin/lists/389-users@xxxxxxxxxxxxxxxxxxxxxxx