<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:Arial;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
tt
{font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>Dear
List Members,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>Release:
<b><span style='font-weight:bold'>fedora-ds-1.0.2-1.RHEL3.i386.opt.rpm<o:p></o:p></span></b></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>A typical
replication error log entry now follows (seen repeatedly at both fedora DS servers):<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>[28/Jun/2006:18:29:21
+0100] NSMMReplicationPlugin - agmt="cn=EDS from server 2"
(ukstatlap:636): Unable to acquire replica: permission denied. The <b><span
style='font-weight:bold'>bind dn ""</span></b> does not have
permission to supply replication updates to the replica. Will retry later.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>Believe
me, I have been investigating this one for 2 or 3 days now (having just switched
from OpenLDAP, since multiple master replication is required) before sending
this submission, just in case I missed a configuration item or work-around, but
unfortunately no luck (so far).<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>The
only reference I can find for SSL Client Authentication based Multiple Master
replication (2 Linux RHEL 3 servers being used) that supplies empty DNs, is the
Windows specific entry (whose work-around I tried anyway, but without success)…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><tt><font size=2 color=black face="Courier New"><span
style='font-size:10.0pt;color:black'>Unable to acquire replica: permission
denied. The bind dn "" does not have permission to supply replication
updates to the replica. Will retry later.</span></font></tt><font color=black
face=Helvetica><span style='font-family:Helvetica;color:black'> <br>
To workaround the problem, after you modify and save the replication schedule
of an agreement, refresh the console, reconfigure the connection settings (to
SSL client authentication) for the agreement, and save your changes.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><a
href="http://www.redhat.com/docs/manuals/dir-server/release-notes/ds611relnotes.html">http://www.redhat.com/docs/manuals/dir-server/release-notes/ds611relnotes.html</a><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>The
mutual “Current Supplier DNs” are indeed set (</span></font><font
face="Courier New"><span style='font-family:"Courier New"'>cn=Replication
Manager,cn=replication,cn=config</span></font>) and the corresponding directory
entries do exist.<o:p></o:p></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>The
respective server certificates and CA certificates are installed, with Subject
DN entries loaded.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>I do <u>not</u>
have Legacy Consumer enabled.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>CertMapping
is also defined (though with a NULL DN being supplied, I guess that will not be
kicking in just yet, though there are entries for the exact subject DN anyway.)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>When
using simple authentication, with or without SSL, all is well (although
replication did require both servers to Initialize the Consumer, I thought that
only one was required e.g. ID 1 initializing ID 2, but ID 2 then needed to initialize
ID 1 before successful 2-way replication was achieved).<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>Any
suggestions will be <u>most</u> gratefully received!<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>Regards,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'>Kevin<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>