Master is now replica, and Replica is Master?!?!

[boomstik]

Hey all. My first post in this great community! (actually, I thought I posted once earlier today… but can’t find that post… so let’s count this one as the first).

Anyhow.

I’ve got an OD Master running 10.4.8 and a Replica running 10.3.9.
This morning I came to realize that connecting to the Master with WGM will not let me edit anything except for users’ passwords. Everything else is greyed out.
Well, when I connect to the Replica, I can edit the OD just fine. Moreover, if I create a new user on the Replica, it later appears on the Master.

It seems like the two have switched roles, which makes no sense whatsoever to me. The Master is still listed as “open directory master” in the Server Admin, and the Replica is also listed as such.

Could someone please help shed some light on this? Things seem to be working so far, but this is just really weird and I want to fix it before the proverbial substance hits the fan.

Thanks for any help!!

[boomstik]

The replica is definitely not an actual replica. it pulls down the directory from the Master, but the Master doesn’t know about Replica’s existence.

Well, I did a little test today. Shut down both the master and replica, and then brought the master back up without powering on the replica.

Result: no dice. Still can’t edit OD on the master…. Authentication still works, everything seems to be running okay – just can’t edit the OD.

At this point, I am worried that my OD on the 10.4.8 server is actually in 10.3.9 format/schema (if that makes any sense), and that’s why everything but the passwords is greyed out when I try to edit it with the 10.4.7 WGM.

I am now thinking of two possible paths:

Path one:
1) bring up another replica (this time on a 10.4.8 server) – let’s call it Server2
2) let it replicate,
3) make current master (Server1) a standalone server,
4) Promote Server2 to master,
5) and then repeat the process backwards: make Server1 the replica of Server2
6) after replication, promote Server1 to master,
7) demote Server2 to replica.

Path two:
1) Create an archive of OD on Server1 (using Archive functionality in Server Admin)
2) Demote Server1 to Standalone server
3) Promote Server1 back to Master
4) Import the archive
5) Create replicas on 10.4.8 servers as needed, and stay away from 10.3.9.

Which would you recommend in this case, and are there any caveats to watch out for? For example, if I do any of the above, will I lose my ACLs on the file shares, or is there anything else I need to make a note of beforehand? Is there anything that the “Archive” function does NOT back up?

Any advice would be greatly appreciated – I’d love to be able to resolve this the “right” way the first time…

Thanks!

[boomstik]

Well, after fighting with this for about two weeks, here’s what I keep running into.

Whenever I try to promote one of the 10.4.8 member servers to OD Replica, it says “Establishing Replica” for a while, and then Server Admin comes back with an “Error while writing settings (unable to authenticate as directory domain administrator)”. the replica never gets created.

Upon digging in the slapd.log, on the OD master, I see this error repeating twice whenever I try the replica exercise:

Dec 29 19:45:20 fileserver slapd[62]: SASL [conn=97059] Failure: GSSAPI Error: Miscellaneous failure (Decrypt integrity check failed)\n

Where do I start troubleshooting this???
thanks for any help….

[Author]

Posts