[Freeipa-users] Replication Update in progress : FALSE LDAP ERROR

[Nathan Peters]

I have updated the bug report you filed below.

The issue was that the instructions would only work in Windows Server 2003 
because My Network Places was removed in 2008 and above.  Since the manual 
clearly states that the AD sync is to be performed with server 2008 / 2012 
only it made no sense to give instructions for an incompatible version of 
windows.

I have added to the ticket 2 methods to get the *correct* certificate that 
will work in both server 2008 r2 and server 2012 r2.

On 05/15/2015 03:09 PM, nathan at nathanpeters.com wrote:
>> On 05/14/2015 11:33 PM, nathan at nathanpeters.com wrote:
>>>>> [root at ipadc1 cacerts]# ipa-replica-manage connect --winsync --binddn
>>>>> "cn=ad sync,cn=Users,dc=test,dc=mycompany,dc=net" --bindpw
>>>>> supersecretpassword --passsync supersecretpassword --cacert
>>>>> /etc/openldap/cacerts/addc2-test.cer addc2.test.mycompany.net -v
>>>>> Directory Manager password:
>>>>>
>>>>> Added CA certificate /etc/openldap/cacerts/addc2-test.cer to
>>>>> certificate
>>>>> database for ipadc1.ipadomain.net
>>>>> ipa: INFO: AD Suffix is: DC=test,DC=mycompany,DC=net
>>>>> The user for the Windows PassSync service is
>>>>> uid=passsync,cn=sysaccounts,cn=etc,dc=ipadomain,dc=net
>>>>> Windows PassSync system account exists, not resetting password
>>>>> ipa: INFO: Added new sync agreement, waiting for it to become ready .
>>>>> .
>>>>> .
>>>>> ipa: INFO: Replication Update in progress: FALSE: status: -11  - LDAP
>>>>> error: Connect error: start: 0: end: 0
>>>>> ipa: INFO: Agreement is ready, starting replication . . .
>>>>> Starting replication, please wait until this has completed.
>>>>>
>>>>> [ipadc1.ipadomain.net] reports: Update failed! Status: [-11  - LDAP
>>>>> error:
>>>>> Connect error]
>>>> Have you tried using ldapsearch to verify the connection?
>>>>
>>>> # LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-DOMAIN-COM ldapsearch -xLLL -ZZ
>>>> -h
>>>> addc2.test.mycompany.net -D "cn=ad
>>>> sync,cn=Users,dc=test,dc=mycompany,dc=net" -w
>>>> "supersecretpassword" -s base -b "cn=Users,dc=test,dc=mycompany,dc=net"
>>>> "objectclass=*"
>>>>
>>>> and/or
>>>>
>>>> # LDAPTLS_CACERT=/etc/openldap/cacerts/addc2-test.cer  ldapsearch -xLLL
>>>> -ZZ -h addc2.test.mycompany.net -D "cn=ad
>>>> sync,cn=Users,dc=test,dc=mycompany,dc=net" -w
>>>> "supersecretpassword" -s base -b "cn=Users,dc=test,dc=mycompany,dc=net"
>>>> "objectclass=*"
>>>>
>>> Both commands give the same successful result.  I don't think it's a
>>> problem with the credentials because I was able to generate different
>>> error messages during the attempted sync setup if I intentionally gave a
>>> bad password or username.
>> Ok.  Have you tried enabling the replication log level?
>>
>> http://www.port389.org/docs/389ds/FAQ/faq.html#troubleshooting
> Ok, that helped a lot.  I got this fixed now.  Because the manual tells
> you to export the cert using a way that doesn't work on newer versions of
> windows, I tried to improvise and my first attempt exported the wrong
> cert.
>
> The correct way is to go to mmc.exe and add the certificates snap-in.
> Then go to personal certificates store for the machine account and export
> the one that has -CA at the end of it in the issued to column.
>
> Now that the correct certificate was exported, replication succeeded.  The
> docs should be updated though to reflect the proper way to export.
>
https://bugzilla.redhat.com/show_bug.cgi?id=1222161

Please add yourself to the bug and provide any additional information.