[Fedora-directory-users] SSL Hub replication

[Rich Megginson]

Juan Asensio Sánchez wrote:
> Hi
>
> I am trying to setup the replication with SSL. I have two buildings, 
> each building has two servers. Each building has its own organization 
> in a separate database. Each organization has the replica enabled. 
> This is a schema of the replication agreements (C1->Center1, 
> S1->Server1, S2->Server2):
>
> C1S1:
> - C1 Org.: Multimaster agreement with C1S2 and C2S1
> - C2 Org.: Hub agreement with C1S2
> C1S2:
> - C1 Org.: Multimaster agreement with C1S1 and C2S2
> - C2 Org.: Hub agreement with C1S1
> C2S1:
> - C1 Org.: Hub agreement with C2S2
> - C2 Org.: Multimaster agreement with C1S1 and C2S2
> C2S2:
> - C1 Org.: Hub agreement with C2S1
> - C2 Org.: Multimaster agreement with C1S1 and C2S1
>
> Non-SSL connections are disabled in all servers. I can connect with 
> console trough SSL, and make request to the directory server with SSL 
> also. The problem is the replication agreements with the hub 
> agreements. When I try to add a user in the C2 Org. from any server in 
> C1 Org. I get this error:
>
> Cannot save to directory server:
> netscape.ldap.LDAPException: Referrral connect failed: failed to 
> connect to server ldap://server11.center1.org.local:389 (91). cannot 
> connect to the LDAP server, Failed to follow referral
>
> It looks like trying to connect to the remote server in non-SSL, 
> although i have configured it to make the replication agreements with 
> SSL. This only occurrs with hub replicas. With multimaster replicas, 
> the updates are sent fine.
>
> Any idea? Thanks in advance.
Unfortunately the replication code does not know how to send SSL/TLS 
referrals.  Fortunately, you can set your own by using the 
nsDS5ReplicaReferral attribute in your cn=replica entry on your 
hubs/consumers:
*http://tinyurl.com/35qddb*

Note that the doc says "This should only be defined on a consumer." It 
means hub or consumer (i.e. read-only replicas).
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20090408/7727d18d/attachment.bin>