We are using fractional replication that excludes the lockout attributes. 389-ds is seeing a change come in and then discards all the mods for replication purposes except that lastmodifybydate and user attributes, so we still get replication.

We'd like this to be suppressed, either by 389-ds knowing this case specifically or by not replicating when the only changes are to these two attributes.

This is mitigated somewhat by the options added in ticket https://fedorahosted.org/freeipa/ticket/2734

Fixed in 389-ds-base 1.2.11.4

We need to set something like this in the replication agreements (see 389-ds ticket for more details):

nsds5ReplicaStripAttrs: modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp

There's a bug in DS that prevents setting nsds5ReplicaStripAttrs; waiting for them to fix.

https://fedorahosted.org/389/ticket/413

Just for completeness:

Exactly same optimization is handy for DNS SOA serial auto incrementation feature also. DNS will work without this optimization, but in some cases it can cause "replication storm" as described in ssh/Kerberos case above.

master: 2ede70b

ipa-3-0: 1000bf0

Note that the associated BZ was re-assigned against the 389-ds-base component.

Moving closed RC1 tickets to Beta 3.