My IBM Directory Server P2P replication blocks on add new entry and changes to operational attributes by the pwdpolicy mechanism. How do I avoid this?

Question

I setup a peer-to-peer replication topology on 2 IBM LDAP servers (Version 6.4). It works, both ways, with simple attribute modifications like changing description or displayName attributes. But it blocks when I add a new entry on either server. I checked the logs and see an error 50 (insufficient access) for the change. The audit logs show an "extra" operational attribute, ibm-entryuuid, are added to the other server, which maybe causes the error.

It also blocks when I try to login on an account with an invalid password. I get an error 65 (object class violation). This is maybe because the password policy mechanism modifies/adds/deletes certain operational attributes(e.g. PWDFAILURETIME)

The schema files are the same for both servers. And both servers are cryptographically synched.

I use JXplorer to test. I use admin credentials.

What should I do to allow these operations to replicate? Thanks in advance for any help.

Update: I have checked the supplier credentials and when I tried to change the ibm-slapdmasterdn and ibm-slapdmasterpw, I get an Already Exists error. What do I do?

Answer 1

I found the problem. I didn't quite understand what the credentials attributes meant until I re-read the IBM tutorial. I was trying to modify the replica DN to the admin DN, that's why I got the error.

It replicates smoothly now.