Description of problem:
When configuring RHDS fractional replication, with passwordRetryCount,
retryCountResetTime, and accountUnlockTime are in exclude list.
Each operation which will lead to change any of attribute will result an error
in slapd error logs.

I created a environment, where I had 5 attributes excluded.

memberof,
passwordRetryCount,
retryCountResetTime,
accountUnlockTime,
telephonenumber

When I tried to edit/add  phone no. in  RHDS, It was not replicated to other
RHDS - Expected behaviour, but also it didnt generated any error.

But When I tried with a invalid login attempt, that made change in
passwordretycount & retrycountresettime, It was not replicated - Expected but
it generated a lots of error like below.

[04/Mar/2012:13:33:05 -0500] NSMMReplicationPlugin - agmt="cn=test-replication"
(ldap56:389): Failed to send modify operation: LDAP error 89 (Bad parameter to
an ldap routine)
[04/Mar/2012:13:33:05 -0500] NSMMReplicationPlugin - agmt="cn=test-replication"
(ldap56:389): Failed to send update operation to consumer (uniqueid
b0461981-662611e1-bd268601-f3e9af2f, CSN 4f53b400000000010000): Timed out. Will
retry later.
[04/Mar/2012:13:33:11 -0500] NSMMReplicationPlugin - agmt="cn=test-replication"
(ldap56:389): Failed to send modify operation: LDAP error 89 (Bad parameter to
an ldap routine)
[04/Mar/2012:13:33:11 -0500] NSMMReplicationPlugin - agmt="cn=test-replication"
(ldap56:389): Failed to send update operation to consumer (uniqueid
b0461981-662611e1-bd268601-f3e9af2f, CSN 4f53b400000000010000): Bad parameter
to an ldap routine. Will retry later.
[04/Mar/2012:13:33:16 -0500] NSMMReplicationPlugin - agmt="cn=test-replication"
(ldap56:389): Failed to send modify operation: LDAP error 89 (Bad parameter to
an ldap routine)

cl-dump output for above csn

changetype: modify
replgen: 4f53ad37000000020000
csn: 4f53b400000000010000
nsuniqueid: b0461981-662611e1-bd268601-f3e9af2f
dn: uid=user,ou=people,dc=example,dc=com
change::
replace: retryCountResetTime
retryCountResetTime: 20120304183711Z
-
replace: passwordRetryCount
passwordRetryCount: 1
-

Replication agreement.

dn: cn=test-replication,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,
 cn=config
objectClass: top
objectClass: nsDS5ReplicationAgreement
description: MMR
cn: test-replication
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaHost: ldap56.example.com
nsDS5ReplicaPort: 389
nsDS5ReplicaBindDN: uid=rmanager,cn=config
nsDS5ReplicaTransportInfo: LDAP
nsDS5ReplicaBindMethod: SIMPLE
nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE accountUnlockTime memb
 erOf passwordRetryCount retryCountResetTime telephoneNumber
nsDS5ReplicaCredentials: {DES}QA/cJhx3x8I=
creatorsName: cn=directory manager
modifiersName: cn=Multimaster Replication Plugin,cn=plugins,cn=config
createTimestamp: 20120304180002Z
modifyTimestamp: 20120305184057Z
nsds50ruv: {replicageneration} 4f53ad37000000020000
nsds50ruv: {replica 2 ldap://ldap56.example.com:389} 4f53b27c000000020000 4f55
 0345000000020000
nsds50ruv: {replica 1 ldap://ldap5.example.com:389} 4f53b400000000010000 4f550
 2bd000000010000
nsruvReplicaLastModified: {replica 2 ldap://ldap56.example.com:389} 00000000
nsruvReplicaLastModified: {replica 1 ldap://ldap5.example.com:389} 00000000


Version-Release number of selected component (if applicable):
redhat-ds-admin-8.2.1-1.el5dsrv
redhat-ds-8.2.0-2.el5dsrv
redhat-ds-base-8.2.8-2.el5dsrv
redhat-ds-console-8.2.0-4.el5dsrv


How reproducible:
100%

Steps to Reproduce:
1. Configure MMR replication with passwordisglobalpolicy = off
2. Configure Account Lockout policy on invalid logins.
3. Try to login with invalid credentials of any users.

Actual results:
give the error for "LDAP error 89 (Bad parameter to an ldap routine)" in slapd
error logs

Expected results:
It should not dump above logs.

Additional info:
This is not reproducible in RHDS 9.0.
I have this environment locally configured, Let me know if additional debug
logs are required.