Problem with cn=ibmpolicies subtree

A problem might occur with replicating or modifying the cn=ibmpolicies subtree, where this subtree becomes read-only or might not get replicated properly. Follow the steps to resolve this problem.

In IBM® Verify Directory, Version 6.0 and later, a partial replication configuration entry is automatically added to the cn=ibmpolicies subtree. The design of a directory server in version 6.0 and later versions have the ibm-replicationcontext, ibm-replicagroup, and ibm-replicasubentry setup automatically for the cn=ibmpolicies subtree the first time the LDAP server is started. Also, the partial entries are created with the default ibm-slapdServerId value (randomly generated when the instance is first created). As users often modify the ibm-slapdServerId value in the ibmslapd.conf file after the initial configuration, this subtree often become read-only or might not get replicated properly. To resolve this problem, you must consider removing these partial replication entries from all systems in the topology:

To remove the entries, complete the following steps:

1. Search the directory servers to get the entries. Issue the following command:

   idsldapsearch -D cn=root -w secret -L -b cn=ibmpolicies objectclass=\
   ibm-replica*
   
   dn: CN=IBMPOLICIES
   cn: IBMpolicies
   objectclass: container
   objectclass: top
   objectclass: ibm-replicationcontext
   
   dn: ibm-replicagroup=default,cn=ibmpolicies
   objectclass: top
   objectclass: ibm-replicagroup
   ibm-replicaGroup: default
   
   dn: ibm-replicaserverid=ac1156c0-a214-1029-934c-cd9424fd6984,\
   ibm-replicagroup=
   default,cn=ibmpolicies
   objectclass: top
   objectclass: ibm-replicasubentry
   ibm-replicationserverismaster: TRUE
   cn: V11.0.1 Migration
   ibm-replicaServerId: ac1156c0-a214-1029-934c-cd9424fd6984

   Note: The value, ac1156c0-a214-1029-934c-cd9424fd6984, for ibm-replicaserverid in the example output is a randomly generated serverID. For your system, the value must be different.
2. Delete the ibm-replicasubentry. Issue the following command:

   idsldapdelete -D cn=root -w secret -k ibm-replicaserverid=\
   ac1156c0-a214-1029-934c-cd9424fd6984,ibm-replicagroup=default,\
   cn=ibmpolicies

3. Delete the ibm-replicagroup. Issue the following command:

   idsldapdelete -D cn=root -w secret -k ibm-replicagroup=default,\
   cn=ibmpolicies

4. Modify the cn=ibmpolicies entry to remove the entry objectclass: ibm-replicationContext. Issue the following command:

   ldapmodify -D cn=root -w secret -k
   dn: cn=ibmpolicies
   changetype: modify
   delete: objectclass
   objectclass: ibm-replicationContext

   In the example, the -k option in the ldapmodify and ldapdelete command, which allows the admin user to modify objects in a read-only subtree. It might be necessary to also pass the -R option to not chase referrals.

After you remove these entries, you can set up replication on the cn=ibmpolicies subtree just as you would on any other subtree.