To reproduce:

• Install IPA server with dogtag CA
• Prepare replica: ipa-replica-prepare serverb.example.com
• Install on replica with CA: ipa-replica-install serverb.example.com --setup-ca

dogtag handles creating the replication agreement. The dogtag DS instance can be found on both servers in /etc/dirsrv/slapd-PKI-IPA/

This repeats in the log on the initial master every 5 minutes:

[02/Feb/2012:16:04:02 -0500] NSMMReplicationPlugin - agmt="cn=masterAgreement1-doberman.greyoak.com-pki-ca" (doberman:7389): Schema replication update failed: Invalid syntax
[02/Feb/2012:16:04:02 -0500] NSMMReplicationPlugin - agmt="cn=masterAgreement1-doberman.greyoak.com-pki-ca" (doberman:7389): Warning: unable to replicate schema: rc=1

99user.ldif contains lots of custom schema (attached). If I copy this to the replica and restart it then dogtag appears to work fine.

attachment
99user.ldif

0001-Ticket-278-Schema-replication-update-failed-Invalid-.patch
0001-Ticket-278-Schema-replication-update-failed-Invalid-.patch

To ssh://git.fedorahosted.org/git/389/ds.git
bbb4139..b4c3983 master -> master
commit changeset:b4c3983cad8e6c0e47494bcbd98466d4a274a1db/389-ds-base
Author: Rich Megginson rmeggins@redhat.com
Date: Thu Feb 2 15:54:27 2012 -0700
Reviewed by: nkinder (Thanks!)
Branch: master
Fix Description: Schema replication apparently either sends everything or
re-reads everything. unhashed#user#password is an invalid attribute
name - # is not allowed in an attribute name. The fix is to explicitly
allow this particular attribute name.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=788726

Added initial screened field value.

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=970934 (''Red Hat Directory Server'')

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/278

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.