<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>I’m trying to set up password/identity sync to the
FreeIPA server from a Windows 2003R2 SP2 server to a Fedora 10 VM.<o:p></o:p></p>
<p class=MsoNormal>I have installed the FreeIPA software and can load its
configuration page on the IPA server – so the service appears to be
running.<o:p></o:p></p>
<p class=MsoNormal>I have our Windows DC running the Windows 2003 Enterprise
Certificate Authority service and have exported its root certificate and SCP’ed
that to the IPA server.<o:p></o:p></p>
<p class=MsoNormal>Following the instructions from TFM, I run the following
command:<o:p></o:p></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>[root@ipamem1
~]# ipa-replica-manage add --winsync --binddn
CN=PassSync,OU=Admins,DC=evscorporation,DC=com --bindpw WindowsAccountPassword
--cacert /root/dc1-base64-x509.cer dc1.evscorporation.com -v --passsync
PasswordEnteredIntoPassSync<o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>This is the output from that command:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>Directory
Manager password: <o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Shutting
down dirsrv: <o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>
EVSCORPORATION-COM...
[ OK ]<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Starting
dirsrv: <o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>
EVSCORPORATION-COM...
[ OK ]<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Added
CA certificate /root/dc1-base64-x509.cer to certificate database for
ipamem1.evscorporation.com<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Restarted
directory server ipamem1.evscorporation.com<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Could
not validate connection to remote server dc1.evscorporation.com:636 -
continuing<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:The
error was: {'info': 'error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed', 'desc':
"Can't contact LDAP server"}<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>The
user for the Windows PassSync service is uid=passsync,cn=sysaccounts,cn=etc,dc=evscorporation,dc=com<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>Windows
PassSync entry exists, not resetting password<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Added
new sync agreement, waiting for it to become ready . . .<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Replication
Update in progress: FALSE: status: 81 - LDAP error: Can't contact LDAP
server: start: 0: end: 0<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Agreement
is ready, starting replication . . .<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>Starting
replication, please wait until this has completed.<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>[ipamem1.evscorporation.com]
reports: Update failed! Status: [81 - LDAP error: Can't contact LDAP
server]<o:p></o:p></span></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>INFO:root:Added
agreement for other host dc1.evscorporation.com</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Additionally, in the /var/lib/dirsrv/ errors log, I have the
following error:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='margin-left:.5in'><span style='font-family:"Cambria","serif"'>[25/Jul/2009:14:41:50
-0500] slapi_ldap_bind - Error: could not send bind request for id
[CN=PassSync,OU=Admins,DC=evscorporation,DC=com] mech [SIMPLE]: error 81 (Can't
contact LDAP server) -8179 (Peer's Certificate issuer is not recognized.) 11
(Resource temporarily unavailable)<o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>On the Windows server, the Passsync service is running and as
far as I know I installed the right certificate on the Passsync side by
following the instructions at (<a
href="http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Windows_Sync-Configuring_Windows_Sync.html#Configuring_Windows_Sync-Configure_the_Password_Sync_Service">http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Windows_Sync-Configuring_Windows_Sync.html#Configuring_Windows_Sync-Configure_the_Password_Sync_Service</a>)
and the only message in the Passsync log on the Windows side is:<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='text-indent:.5in'><span style='font-family:"Cambria","serif"'>07/25/09
14:32:15: PassSync service started<o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I’m sure that I’m just missing some simple,
stupid little thing…but I have no earthly idea as to what that could be.
Any help/suggestions/troubleshooting anyone can help me with, I would greatly
appreciate it.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Thanks.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt'>----<br>
<br>
Jeff Moody<br>
Senior Systems Engineer<br>
<br>
EVS Corporation<br>
5050 Poplar Avenue ,Suite 1600<br>
Memphis, Tennessee 38157<br>
(901) 259-2387 - 24x7 Helpdesk<br>
<br>
(901) 881-0919 - Office<br>
(901) 497-1444 - Cell<br>
jeff.moody@evscorporation.com</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</body>
</html>