Setting up multi master replication error 81

[David Hoskinson]

I have setup 2 servers running the following versions of 389 Directory server

389-adminutil-1.1.13-1.el5
389-admin-1.1.16-1.el5
389-dsgw-1.1.6-1.el5
389-ds-1.2.1-1.el5
389-ds-base-1.2.8.3-1.el5
389-admin-console-1.1.7-1.el5
389-console-1.1.4-1.el5
389-admin-console-doc-1.1.7-1.el5
389-ds-base-libs-1.2.8.3-1.el5
389-ds-console-1.2.5-1.el5
389-ds-console-doc-1.2.5-1.el5

I have also enabled ssl and created the appropriate certs for each machine.  I am able to set each machine as a client so I can test that from server A, I can login to server A while being authenticated by server B and vice versa.

The last problem that I seem to be having is setting up replication.  I have enabled the changelog, created a replication account, and enabled replica.  When I create my replication agreement on the userRoot, the supplier shows as server A port 389 and the consumer shows as server B 636.  I am using Use TLS with ldaps, and simple bind with my replication account and password.  I next leave enable fractional replication unchecked, always keep directories in sync and initialize consumer... this is on server A and done.  I get the following error message.  Consumer initialization has unsuccessfully completed.  The error received by the replica is '81 - LDAP error: Can't contact LDAP server'

I believe I am reading that in some manner the cacert.asc from server A has to be on server B and the cacert B has to be on server A but am not sure and having problems with this.

Any help with this would be appreciated and can provide additional information if needed...

David Hoskinson | DATATRAK International
Systems Engineer
Mayfield Heights, Ohio, USA
+1.440.443.0082 x 124 (p) | +1.319.471.3689 (m)
[e-mail] | www.datatrak.nethttp://www.datatrak.net/

[Rich Megginson]

On 08/31/2011 08:45 AM, David Hoskinson wrote:
> I have setup 2 servers running the following versions of 389 Directory 
> server
>
> 389-adminutil-1.1.13-1.el5
>
> 389-admin-1.1.16-1.el5
>
> 389-dsgw-1.1.6-1.el5
>
> 389-ds-1.2.1-1.el5
>
> 389-ds-base-1.2.8.3-1.el5
>
> 389-admin-console-1.1.7-1.el5
>
> 389-console-1.1.4-1.el5
>
> 389-admin-console-doc-1.1.7-1.el5
>
> 389-ds-base-libs-1.2.8.3-1.el5
>
> 389-ds-console-1.2.5-1.el5
>
> 389-ds-console-doc-1.2.5-1.el5
>
> I have also enabled ssl and created the appropriate certs for each 
> machine.  I am able to set each machine as a client so I can test that 
> from server A, I can login to server A while being authenticated by 
> server B and vice versa.
>
> The last problem that I seem to be having is setting up replication.  
> I have enabled the changelog, created a replication account, and 
> enabled replica.  When I create my replication agreement on the 
> userRoot, the supplier shows as server A port 389 and the consumer 
> shows as server B 636.  I am using Use TLS with ldaps, and simple bind 
> with my replication account and password.  I next leave enable 
> fractional replication unchecked, always keep directories in sync and 
> initialize consumer... this is on server A and done.  I get the 
> following error message.  Consumer initialization has unsuccessfully 
> completed.  The error received by the replica is '81 -- LDAP error: 
> Can't contact LDAP server'
>
> I believe I am reading that in some manner the cacert.asc from server 
> A has to be on server B and the cacert B has to be on server A

Correct.
http://directory.fedoraproject.org/wiki/Howto:SSL#Exporting_the_certs_for_us...
> but am not sure and having problems with this.
>
> Any help with this would be appreciated and can provide additional 
> information if needed...
>
> David Hoskinson | *DATATRAK*International
> Systems Engineer
> Mayfield Heights, Ohio, USA
> +1.440.443.0082 x 124 (p) | +1.319.471.3689 (m)
> [e-mail]  | 
> www.datatrak.net http://www.datatrak.net/
>
> --
> 389 users mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/389-users