The problem came back, but I think i found the root cause. We have a batch script which starts slapd, it has always been the same on both the producers and consumers. The "-w" slapadd option was being provided in this script, for both the consumer and the producer. This has been the case for quite some time (2.3.x and 2.4.16), but it only recently became an issue after the upgrade to 2.4.19. The sync problem would then appear or disappear randomly, depending of which of the provider or consumer was loaded first.

Is it patently wrong to provide the "-w" option on the consumer, or is this a bug ?

At the very least it is probably a usability "gotcha", if not a bug.

If this is an issue perhaps slapadd should refuse to do "-w" on a shadow context, or warn and not actually perform the option ?

Cheers
Brett