<html> <head> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 07/03/17 16:48, Ludwig Krispenz wrote: </div> <blockquote cite="mid:58BEE45D.7060607@redhat.com" type="cite"> On 03/07/2017 05:29 PM, lejeczek wrote: <blockquote type="cite"> On 07/03/17 12:39, Martin Babinsky wrote: <blockquote type="cite">On Tue, Mar 07, 2017 at 09:55:52AM +0000, lejeczek wrote: <blockquote type="cite">hi, I presume I need to use ldapmodify/delete? I found this(obfuscated by me): cn=dzien.priv.xx.xx.priv.xx.xx.x+nsuniqueid=9e47680e-296e11e6-83a59f45-6ec26a1e,cn=masters,cn=ipa,cn=etc,dc=priv,dc=xx.dc=xx.dc=priv,dc=xx,dc=xx,dc=x To confirm? Would removing it fix the problem? I'm probably missing something else, aren't I? many thank, L -- Manage your subscription for the Freeipa-users mailing list: <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a class="moz-txt-link-freetext" href="http://freeipa.org">http://freeipa.org</a> for more info on the project </blockquote> That seems like a replication conflict. Consult the following guide to solve it: <a class="moz-txt-link-freetext" href="https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10/html/Administration_Guide/Managing_Replication-Solving_Common_Replication_Conflicts.html">https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10/html/Administration_Guide/Managing_Replication-Solving_Common_Replication_Conflicts.html</a> </blockquote> I'm not sure whether I'm dealing with single or multi-valued DN and I should rename+keep original copy(following that doc) or simply remove that DN. </blockquote> this is something which cannot be generally answered, you need to look at the specific entries. In the case of conflicts you always have entries like cn=xxxx,<rest of dn> and cn=xxxx+nsuniqueid=nnnnnnnn-nnnnnnn-nnnnnnn-nnnnnn,<rest of dn> and usually they are created if the same entry is added at the same time on two replicas, then they are identical and you can just delete the conflict entry. Only if you want to keep both entries you need to rename the conflict. </blockquote> to confirm - I presume this should be a recursive deletion with '-r' , the whole lot, right? thx, L. <blockquote cite="mid:58BEE45D.7060607@redhat.com" type="cite"> <blockquote type="cite"> <blockquote type="cite">Just a side question, how did you end up with such entry? Did you happen to upgrade multiple IPA masters at once? </blockquote> </blockquote> </blockquote> </body> </html>