From b6ca0f210c093805f15177761b13070c6c246b34 Mon Sep 17 00:00:00 2001
From: Simo Sorce <ssorce@redhat.com>
Date: Mar 01 2011 16:02:55 +0000
Subject: Fix replica setup using replication admin kerberos credentials


Fixes: https://fedorahosted.org/freeipa/ticket/1022

---

diff --git a/install/share/replica-acis.ldif b/install/share/replica-acis.ldif
index a2f4cc2..baa6216 100644
--- a/install/share/replica-acis.ldif
+++ b/install/share/replica-acis.ldif
@@ -1,5 +1,10 @@
 # Replica administration
 
+dn: cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "replica admins read access"; allow (read, search, compare) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
+
 dn: cn="$SUFFIX",cn=mapping tree,cn=config
 changetype: modify
 add: aci
diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py
index 402577f..c9afc5d 100644
--- a/ipaserver/install/replication.py
+++ b/ipaserver/install/replication.py
@@ -592,7 +592,8 @@ class ReplicationManager:
         return self.wait_for_repl_init(conn, dn)
 
     def basic_replication_setup(self, conn, replica_id, repldn, replpw):
-        self.add_replication_manager(conn, repldn, replpw)
+        if replpw is not None:
+            self.add_replication_manager(conn, repldn, replpw)
         self.replica_config(conn, replica_id, repldn)
         self.setup_changelog(conn)