Hi I am following the same issue with Robert. In /etc/dirsrv/slapd-<DOMAIN>/schema/99user.ldif we can see that these new attributes have been added. Unfortunately I couldn't verify using ldapsearch on 'cn=schema' to see if this is indeed the case as well within the LDAP data. However if I browse other pre-existing DNS zones using ldapsearch I see that these already have the two attributes in place, so I guess the update procedure managed to insert them somehow: idnsAllowQuery: any; idnsAllowTransfer: none; So we are a bit confused that when trying to add a new zone, we get errors due to these attributes. This is also preventing us to add new replicas (which require new reverse zones). Regards John <div class="gmail_quote">On Mon, Jul 30, 2012 at 2:57 PM, Simo Sorce <<a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class="im">On Mon, 2012-07-30 at 12:11 +0200, Robert Bowell wrote: > Hi Simo, > > Thanks for your reply. > > Yes the IPA server has been updated from 2.1 to 2.2. Prior to the > update, DNS zones could be created without any issues. > > I have also noticed that the command 'ipa ping' is displaying the > incorrect IPA server version (IPA server version 2.1.90.rc1. API > version 2.34) when infact the IPA server version 2.2.x should be > displayed. </div>This is odd, have you restarted httpd since the update ? The symptom below seem to suggest somethinhg went wrong in updating the DNS schema where we added a few attributes to allow zone transfers. Can you check the ipaserver-upgrade.log file and see if there are any errors in there ? Simo. <div class="im"> > Regards, > > Robert.. > > > On 27 July 2012 17:29, Simo Sorce <<a href="mailto:simo@redhat.com">simo@redhat.com</a>> wrote: > On Thu, 2012-07-26 at 09:47 +0200, Robert Bowell wrote: > > Hi, > > > > > > I'm encountering a strange problem.. upon trying to add a > new DNS zone > > the following message is being displayed "attribute > > "idnsAllowTransfer" not allowed" and the DNS entry is not > created. Has > > any one ever encountered such a problem if so what needs to > be done to > > resolve it ? > > > > > > IPA server version 2.1.3. API version 2.13 > > > > > Was this server upgraded from a 2.0.x one ? > > Simo. > > -- > Simo Sorce * Red Hat, Inc * New York > > -- Simo Sorce * Red Hat, Inc * New York </div>_______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </blockquote></div>