The credentials are correct, copied and confirmed. I ended up tailing the dirsrv service on the new replica and saw:
+0000] - ERR - sasl_io_start_packet - SASL encrypted packet length exceeds maximum allowed limit (length=2097156, limit=2097152). Change the nsslapd-maxsasliosize attribute in cn=config to increase limit. When I increased the limit on the working replica and the new replica with: ipa-replica-install --principal admin -v --dirsrv-config-file=params.ldif cat params.ldif dn: cn=config changetype: modify replace: nsslapd-maxsasliosize nsslapd-maxsasliosize: 16777216 I then see: +0000] - ERR - dbmdb_import_writer - Failed to write in the database. Error is 0xffff87c3: MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED size. May 19 12:43:40 ipa-lon-3.thomac.net ns-slapd[6815]: [19/May/2026:12:43:40.149633282 +0000] - ERR - dbmdb_import_monitor_threads - import userRoot: thread writer aborted ==> Aborting bulk import. which seems to be a known bug: https://gitlab.com/redhat/centos-stream/rpms/389-ds-base/-/blob/c9s/0009-Issue-7213-MDB_BAD_VALSIZE-error-while-handling-VLV-.patch I have no updates to 389 available on rocky 9 or rocky 10, so not sure what a workaround would be short of hoping a update is soon. Many Thanks, Tania -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
