slurpd replication problem

["David Browning" <david.browning@intelligraphics.com>]

I have tried to review all possible documentation and read through all
mailing list archives relevant to this problem.  My apologies if this has
been covered before and I have missed it.

No matter what kind of change I make I continue to get err=19 when I try
to replicate.

May 17 23:25:35 ldap2 slapd[3097]: conn=1 op=8 MOD attr=description
entryCSN modifiersName modifyTimestamp
May 17 23:25:35 ldap2 slapd[3097]: conn=1 op=8 RESULT tag=103 err=19
text=entryCSN: no user modification allowed

I am running Fedora Core 5 with ldap version openldap-servers-2.3.30-2.fc5
on both the master and slave.

I currently am using the rootdn simply because there shouldn't be any
restrictions on that user.  I was using a different user previously with
the exact same results.  Both systems have an exact copy of the same LDAP
db.

Here is my master LDAP slapd.conf file.

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/samba.schema
include         /etc/openldap/schema/officeperson.schema
include         /etc/openldap/schema/RADIUS-LDAPv3.schema

allow bind_v2

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
TLSCertificateFile /etc/pki/tls/certs/ldap.intelligraphics.com-crt.crt
TLSCertificateKeyFile /etc/pki/tls/certs/ldap.intelligraphics.com-key.pem

access to attrs=userPassword,sambaLMPassword,sambaNTPassword
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by self write
      by anonymous auth
      by * none
access to attrs=uid
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by * read
access to
attrs=mail,homeemail,telephonenumber,homephone,mobile,ipphone,facsimiletelephonenumber,postaladdress,l,st,postalcode,c,comment,description
      by group="cn=phoneadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by self write
      by * read
access to attrs=o
      by group="cn=phoneadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by self write
      by * read
access to *
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by self write
      by * read

database        bdb
suffix          "dc=intelligraphics,dc=com"
rootdn          "cn=Manager,dc=intelligraphics,dc=com"
rootpw          password

directory       /var/lib/ldap

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index      sambaSID,sambaPrimaryGroupSID,sambaDomainName    eq

replogfile /var/lib/ldap/openldap-master-replog
replica uri=ldap://ldap2.intelligraphics.com
        binddn="cn=Manager,dc=intelligraphics,dc=com"
        bindmethod=simple credentials=password


Here is my slave LDAP slapd.conf file.

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/samba.schema
include         /etc/openldap/schema/officeperson.schema
include         /etc/openldap/schema/RADIUS-LDAPv3.schema

allow bind_v2

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
TLSCertificateFile /etc/pki/tls/certs/openvpn.intelligraphics.com-cert.pem
TLSCertificateKeyFile /etc/pki/tls/certs/openvpn.intelligraphics.com-key.pem

access to attrs=userPassword,sambaLMPassword,sambaNTPassword
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by self write
      by anonymous auth
      by * none
access to attrs=uid
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by * read
access to
attrs=mail,homeemail,telephonenumber,homephone,mobile,ipphone,facsimiletelephonenumber,postaladdress,l,st,postalcode,c,comment,description
      by group="cn=phoneadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by self write
      by * read
access to attrs=o
      by group="cn=phoneadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by self write
      by * read
access to *
      by group="cn=ldapadmins,ou=Groups,dc=intelligraphics,dc=com" write
      by self write
      by * read

database        bdb
suffix          "dc=intelligraphics,dc=com"
rootdn          "cn=Manager,dc=intelligraphics,dc=com"
rootpw          password

directory       /var/lib/ldap

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index      sambaSID,sambaPrimaryGroupSID,sambaDomainName    eq

updatedn="cn=Manager,dc=intelligraphics,dc=com"
updateref="ldap://ldap.intelligraphics.com";


Does anyone have any ideas on what to try?

David Browning
david.browning@intelligraphics.com