EmbeddedLDAP BEA-171526 Error loading initial replica file, attempting

Question

After add a new XACML policy following the steps described in [1] I get the following error after restart a managed server.
>
<02/08/2012 16h35min03s BRT> <Error> <EmbeddedLDAP> <BEA-000000> <Error adding entry: >cn=urn@Lbea@[email protected]@Lentitlement@Lresource@LDummyMBeanAuthPolicy->v1+xacmlVersion=1.0,ou=Policies,ou=XACMLAuthorization,ou=myrealm,dc=poc-jmx>
<02/08/2012 16h35min03s BRT> <Notice> <EmbeddedLDAP> <BEA-171526> <Error loading initial replica file, attempting reload.>
<02/08/2012 16h35min04s BRT> <Error> <EmbeddedLDAP> <BEA-000000> <Error adding entry: >cn=urn@Lbea@[email protected]@Lentitlement@Lresource@LDummyMBeanAuthPolicy->v1+xacmlVersion=1.0,ou=Policies,ou=XACMLAuthorization,ou=myrealm,dc=poc-jmx>
<02/08/2012 16h35min04s BRT> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: >weblogic.ldap.EmbeddedLDAPException: [EmbeddedLDAP:171525]Error loading initial replica file. Check EmbeddedLDAP log for more details.
weblogic.ldap.EmbeddedLDAPException: [EmbeddedLDAP:171525]Error loading initial replica file. Check EmbeddedLDAP log for more details.
     at weblogic.ldap.EmbeddedLDAP.loadInitialReplicaFile(EmbeddedLDAP.java:1420)
     at weblogic.ldap.EmbeddedLDAP.start(EmbeddedLDAP.java:328)
     at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
<02/08/2012 16h35min04s BRT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FAILED>
<02/08/2012 16h35min04s BRT> <Error> <WebLogicServer> <BEA-000383> <A critical service failed. The server will shut itself down>
<02/08/2012 16h35min04s BRT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FORCE_SHUTTING_DOWN>"This error occurs only with managed servers. The Admin server starst fine. I tried to restore the myrealm security data but it not works. The managed servers are stuck on this error. The EmbededLDAP logs is empty.
My XACML policy (xml file used to load the policy into myrealm using WLST) has the following content:
<Policy PolicyId="urn:bea:xacml:2.0:entitlement:resource:DummyMBeanAuthPolicy-v1"
     RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable">
<Description>VBV XACML Authorization Policy</Description>
<Target>
<Resources>
<Resource>
<ResourceMatch
MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
          type=&lt;jmx&gt;, operation=invoke, application=, mbeanType=DummyMBean, target=dummyOperation
</AttributeValue>
<ResourceAttributeDesignator
AttributeId="urn:oasis:names:tc:xacml:2.0:resource:resource-ancestor-or-self"
DataType="http://www.w3.org/2001/XMLSchema#string"
MustBePresent="true"/>
</ResourceMatch>
</Resource>
</Resources>
</Target>
<Rule RuleId="primary-rule" Effect="Permit">
<Condition>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">
vbvRole
</AttributeValue>
<SubjectAttributeDesignator
AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role"
DataType="http://www.w3.org/2001/XMLSchema#string" />
</Apply>
</Condition>
</Rule>
<Rule RuleId="deny-rule" Effect="Deny"/>
</Policy>Some idea about this error?
Thanks.
[1] http://docs.oracle.com/cd/E12840_01/wls/docs103/secwlres/xacmlusing.html

Answer 1

Hey @The_assface!
I check again my domain -> security -> embeded ldap config and in fact the option "Master First" was unchecked (as default). When you suggested check this option on your last reply, I didn't pay attention and the option checked was the "Refresh Replica At Startup" (and not "Master First" as you pointed). By default both option is unchecked. My intention checking "Refresh Replica At Startup" was to force managed server get a fresh copy of master embedded ldap (hold by Admin server). But this didn't works in my scenario.
Now I unchecked "Refresh Replica At Startup" and checked "Master First". Then I restart Admin server and a managed server and until now the error do not occurs any more.
Your suggestion works, but one question remains: Why managed servers' embedded ldap (replica) got corrupted after adding a XACML policy manually?
Many thanks!