Replication problem with attributes

[Dennis Meyer <snooops84@gmail.com>]

Hi,

i have setup a new multimaster with mirrormode = true cluster with
Debian 9 and openldap 2.4.44.

There are two Servers ldap1 and ldap2.
As its just a lab Environment there is no need to hide passwords and stuff:

/etc/ldap/slapd.d/cn=config/olcDatabase={1}mdb.ldif

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 8fb04e78
dn: olcDatabase={1}mdb
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=localdomain
olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * non
 e
olcAccess: {1}to attrs=loginShell,gecos by dn="cn=admin,dc=localdomain" writ
 e by self write by * read
olcAccess: {2}to attrs=shadowLastChange by self write by * read
olcAccess: {3}to * by * read
olcAccess: {4}to attrs=userPassword,shadowLastChange by self write by anonym
 ous auth by dn="cn=admin,dc=localdomain" write by dn="cn=mirrormode,dc=loca
 ldomain" read by * none
olcLastMod: TRUE
olcRootDN: cn=admin,dc=localdomain
olcRootPW:: e1NTSEF9Z05GbEJIRHE1aTNpa0ZsYVk0WVh3VTM4SkF0VkF0b3Q=
olcDbCheckpoint: 512 30
olcDbIndex: member,memberUid eq
olcDbIndex: cn pres,sub,eq
olcDbIndex: uid pres,sub,eq
olcDbIndex: displayName pres,sub,eq
olcDbIndex: default sub
olcDbIndex: uidNumber eq
olcDbIndex: gidNumber eq
olcDbIndex: mail,givenName eq,subinitial
olcDbIndex: dc eq
olcDbIndex: objectClass,entryCSN,entryUUID eq
olcDbMaxSize: 1073741824
structuralObjectClass: olcMdbConfig
entryUUID: e9f1dcca-5978-1037-8f17-b1d4dc2a991d
creatorsName: cn=admin,cn=config
createTimestamp: 20171109090544Z
olcMirrorMode: TRUE
olcSyncrepl: {0}rid=001 provider=ldap://10.211.55.20:389 bindmethod=simple b
 inddn="cn=mirrormode,dc=localdomain" credentials=iechi1Eid_ie:quu searchbas
 e="dc=localdomain" schemachecking=on type=refreshAndPersist retry="60 +"
entryCSN: 20171109101419.176516Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20171109101419Z


Here is my Database, its on both ldap servers identical - i dumped
this on both servers and ran a diff
slapcat:

dn: dc=localdomain
objectClass: top
objectClass: dcObject
objectClass: organization
o: localdomain
dc: localdomain
structuralObjectClass: organization
creatorsName: cn=admin,dc=localdomain
entryUUID: 1854fd30-597f-1037-9872-eb46faf4f5e0
createTimestamp: 20171109094959Z
entryCSN: 20171109094959.802699Z#000000#000#000000
modifiersName: cn=admin,dc=localdomain
modifyTimestamp: 20171109094959Z
contextCSN: 20171109100725.365127Z#000000#000#000000

dn: cn=admin,dc=localdomain
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9Z05GbEJIRHE1aTNpa0ZsYVk0WVh3VTM4SkF0VkF0b3Q=
structuralObjectClass: organizationalRole
entryUUID: e9f75c72-5978-1037-8289-d381257e6532
creatorsName: cn=admin,dc=localdomain
createTimestamp: 20171109090545Z
entryCSN: 20171109090545.033599Z#000000#000#000000
modifiersName: cn=admin,dc=localdomain
modifyTimestamp: 20171109090545Z

dn: cn=mirrormode,dc=localdomain
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: mirrormode
description: Syncrepl user for mirrormode operation
structuralObjectClass: organizationalRole
entryUUID: 49734c42-5979-1037-9e9b-d338d82a2242
creatorsName: cn=admin,dc=localdomain
createTimestamp: 20171109090825Z
userPassword:: e1NTSEF9T3hzeUVnanhLTThZSDJjK3JweG1sM2pWOG5USEkwS1c=
entryCSN: 20171109100725.365127Z#000000#000#000000
modifiersName: cn=admin,dc=localdomain
modifyTimestamp: 20171109100725Z


And this is the error i get only on ldap1 after setting up replication
on both servers:

Nov  9 12:36:16 ldap1 slapd[17296]: Entry (cn=admin,dc=localdomain):
object class 'simpleSecurityObject' requires attribute 'userPassword'
Nov  9 12:36:16 ldap1 slapd[17296]: null_callback : error code 0x41
Nov  9 12:36:16 ldap1 slapd[17296]: syncrepl_entry: rid=001 be_add
cn=admin,dc=localdomain failed (65)
Nov  9 12:36:16 ldap1 slapd[17296]: do_syncrepl: rid=001 rc 65 retrying


Any Ideas how could solve this?

Best regards
Dennis