I would like to return to a problem that I have had since I first posted about it on Feb 29, 2012, and which was never resolved. I have been successfully running 2 FDS multi-masters since I installed them in ~2007, and which have been updated ever since with yum. My current package set is: 389-admin-1.1.38-1.fc21.x86_64 389-admin-console-1.1.8-7.fc21.noarch 389-admin-console-doc-1.1.8-7.fc21.noarch 389-adminutil-1.1.21-1.fc21.x86_64 389-console-1.1.7-7.fc21.noarch 389-ds-1.2.2-6.fc21.noarch 389-ds-base-1.3.3.8-1.fc21.x86_64 389-ds-base-devel-1.3.3.8-1.fc21.x86_64 389-ds-base-libs-1.3.3.8-1.fc21.x86_64 389-ds-console-1.2.7-4.fc21.noarch 389-ds-console-doc-1.2.7-4.fc21.noarch 389-dsgw-1.1.11-4.fc21.x86_64

The directory service is working fine. I use it only to authenticate user logins on ~dozen fedora clients. I can run 389-console on one of the masters, but not the other. I used to be able to run it before 2012. Now when I run 389-console and log in, I get: Cannot connect to the directory server: netscape.ldap.LDAPException: error result (32): No such object

I tried running setup-ds-admin.pl -u, but it yields: Configuration directory server URL [ldap://XXXX.org:389/o%3DNetscapeRoot]: Configuration directory server admin ID [uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot]: Configuration directory server admin password: Configuration directory server admin domain [org]: Could not authenticate as user 'uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot' to server 'ldap://XXXX.org:389/o%3DNetscapeRoot'. Error: No such object

I notice that when I start dirsrv-admin, I get the following message in /var/log/dirsrv/admin-serv/error: [:crit] [pid 18514:tid 140642010404992] populate_tasks_from_server(): Unable to search [cn=admin-serv-XXXX, cn=389 Administration Server, cn=Server Group, cn=XXXX.org, ou=org, o=NetscapeRoot] for LDAPConnection [XXXX.org:389]

Each server is its own configuration directory server. There is a replication agreement between the two servers, but only on userRoot, not NetscapeRoot.

I also note that ldapsearch -x -b "o=NetscapeRoot" on the problem server yields: # extended LDIF # # LDAPv3 # base <o=NetscapeRoot> with scope subtree # filter: (objectclass=*) # requesting: ALL #

# NetscapeRoot dn: o=NetscapeRoot objectClass: top objectClass: organization o: NetscapeRoot

# search result search: 2 result: 0 Success

# numResponses: 2 # numEntries: 1

The same command on the working server produces a response with 46 entries and lots of good things in it. Did my NetscapeRoot somehow get emptied? How do I get it back?

I thought a "restoreconfig" command would help me, but I never did a "saveconfig" and don't have any /var/lib/dirsrv/slapd-XXXX/bak/*.ldif files. I do have a /var/lib/dirsrv/slapd-XXXX/ldif/XXXX-NetscapeRoot-2010_09_16_090402.ldif file, but it's quite old and from the documentation that I read, it says it is an "example" file. I do have backups in /var/lib/dirsrv/slapd-XXXX/bak/. Among others, I have ones from 2011_07_20_10_54_37/ and 2012_02_20_13_29_00/. I believe everything was working correctly in 2011, but not by 2012. Could this help in any way?

Alternatively, I just now did a saveconfig, and it produced an .ldif file with 146 entries! If I now restore from that file, might that fix things up? Can it hurt to try?