WTF? More info on the 10.3.9 Server Update

So, you installed 10.3.9 and your OD setup went crazy? It took them a while, but Apple has posted the info you need to know before you update your server.

Read on for more...

OK, here is the deal.

The 10.3.9 update makes some changes to the OD schema for Tiger compatibility. After these changes the database needs to be reindexed. Here is how it is supposed to happen:

1. The server takes the update and reboots.
2. On the first reboot the server removes 127.0.0.1 from it's authentication path, reindexes the LDAP DB --by means of slapconfig calling slapindex to do its bidding--, and re-adds localhost to the authentication path when it is done.

One problem is that this can take a while to run (Indeed, the slapindex man page notes, "This command provides ample opportunity for the user to obtain and drink their favorite beverage.".) and Apple doesn't warn you about it before it happens. The more users you have the longer it takes, and sysadmins start to freak out all across the Mac universe.

Another problem is that slapindex might crash and the only hints you have are it's crash log and a busted OD database. If this has happened you can do the reindex manually.

1. sudo SystemStarter stop LDAP
2. sudo slapindex
3. sudo SystemStarter start LDAP

Once you have that taken care of you need to check and make sure that /LDAPv3/127.0.0.1 is in your server's authentication path.

If you have replicas you must take even more precautions. Make sure that you update your replicas first then, and only then, do the master. If you did them out of sync you will need to demote the replicas to standalone and then re-promote them to replica status so they can pull the updated schema from the master.

You can find more info on the reindexing issue in KB 301384

You can find more info on the replica issue in KB 301295

Fun stuff.