IPA replica appears in LDAP conflicts

[Andrey Ptashnik]

Team,

When I run LDAP search for conflicting records I see that one replica is listed as a conflicting record. Do you know how that may have happened and can I safely remove it?

# ldapsearch -xLLL -D "cn=Directory Manager" -W -b "dc=aws,dc=cccis,dc=com" "nsds5ReplConflict=*" dn | perl -p00e 's/\r?\n //g' | sed -e "s/dn: //g" > /tmp/ldap-conflicts.list

# cat ldap-conflicts_09.22.17.list 
dnaHostname=ipa-idm-replica-1b.sub.domain.com+dnaPortNum=389+nsuniqueid=c31c804c-9fa311e7-862eb8db-a442907b,cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=sub,dc=domain,dc=com

Thanks,
Andrey

[Rob Crittenden]

Andrey Ptashnik via FreeIPA-users wrote:
> Team,
>
> When I run LDAP search for conflicting records I see that one replica is listed as a conflicting record. Do you know how that may have happened and can I safely remove it?
>
> # ldapsearch -xLLL -D "cn=Directory Manager" -W -b "dc=aws,dc=cccis,dc=com" "nsds5ReplConflict=*" dn | perl -p00e 's/\r?\n //g' | sed -e "s/dn: //g" > /tmp/ldap-conflicts.list
>
> # cat ldap-conflicts_09.22.17.list 
> dnaHostname=ipa-idm-replica-1b.sub.domain.com+dnaPortNum=389+nsuniqueid=c31c804c-9fa311e7-862eb8db-a442907b,cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=sub,dc=domain,dc=com

It happens when two masters write to the entry in a way that the MMR
plugin can't easily resolve. What you want to do is look at the current
and conflict entry and merge whatever changes (if any) that weren't done
automatically. Then you can remove the conflict entry.

rob