[boomstik]

Well, after fighting with this for about two weeks, here’s what I keep running into.

Whenever I try to promote one of the 10.4.8 member servers to OD Replica, it says “Establishing Replica” for a while, and then Server Admin comes back with an “Error while writing settings (unable to authenticate as directory domain administrator)”. the replica never gets created.

Upon digging in the slapd.log, on the OD master, I see this error repeating twice whenever I try the replica exercise:

Dec 29 19:45:20 fileserver slapd[62]: SASL [conn=97059] Failure: GSSAPI Error: Miscellaneous failure (Decrypt integrity check failed)\n

Where do I start troubleshooting this???
thanks for any help….

[boomstik]

The replica is definitely not an actual replica. it pulls down the directory from the Master, but the Master doesn’t know about Replica’s existence.

Well, I did a little test today. Shut down both the master and replica, and then brought the master back up without powering on the replica.

Result: no dice. Still can’t edit OD on the master…. Authentication still works, everything seems to be running okay – just can’t edit the OD.

At this point, I am worried that my OD on the 10.4.8 server is actually in 10.3.9 format/schema (if that makes any sense), and that’s why everything but the passwords is greyed out when I try to edit it with the 10.4.7 WGM.

I am now thinking of two possible paths:

Path one:
1) bring up another replica (this time on a 10.4.8 server) – let’s call it Server2
2) let it replicate,
3) make current master (Server1) a standalone server,
4) Promote Server2 to master,
5) and then repeat the process backwards: make Server1 the replica of Server2
6) after replication, promote Server1 to master,
7) demote Server2 to replica.

Path two:
1) Create an archive of OD on Server1 (using Archive functionality in Server Admin)
2) Demote Server1 to Standalone server
3) Promote Server1 back to Master
4) Import the archive
5) Create replicas on 10.4.8 servers as needed, and stay away from 10.3.9.

Which would you recommend in this case, and are there any caveats to watch out for? For example, if I do any of the above, will I lose my ACLs on the file shares, or is there anything else I need to make a note of beforehand? Is there anything that the “Archive” function does NOT back up?

Any advice would be greatly appreciated – I’d love to be able to resolve this the “right” way the first time…

Thanks!

[Author]

Posts