[389-users] DSA unwilling to process update / Viewing contents of replication updates

[Rich Megginson]

Chris Phillips wrote:
> Hi,
>
> I've a cluster of boxes with replication form two multimasters to 6 
> read only replicas. There appears to be a problem in the replication 
> in that the error logs state that the DSA is unwilling to process 
> updates for a specific user account, so the replication status in the 
> idm just stays at saying it started rather than completed. I could 
> just delete the account and recreate it, but as it's unfortunately 
> *my* account (and is in this state *possibly* because I was messing 
> with the resetpasswordretrytime field (or something very similarly 
> named) which I get the impression is treated differently to other 
> fields) I'd like to avoid deleting the account.
>
> To this end I'm hoping a suitable solution is to remove whatever the 
> change is that is trying to be pushed across, but I can't see any way 
> with SSL replication to see what the actual attributes it doesn't like 
> are. Any way to pull this straight out with ldapsearch or something? 
> Any tips for elegantly troubleshooting this in a heavily locked down 
> environment would be appreciated.

Yes, it probably has to do with one of those password related 
operational attributes.  There are a couple of ways to handle this
1) change your replication agreement to exclude the attributes 
passwordRetryCount, retryCountResetTime, and accountUnlockTime - you do 
this by adding these attributes to be excluded in fractional replication 
- you should be able to modify your existing replication agreements to 
exclude these
2) add the attribute passwordIsGlobalPolicy in cn=config to "on" on your 
servers - this will allow those attributes to be replicated
>
> Thanks
>
> Chris
> ------------------------------------------------------------------------
>
> --
> 389 users mailing list
> 389-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20090609/91d0a353/attachment.bin>