Description of problem:
Customer has minssff set to 56 on the IDM master, due to PCI compliance.
Replica install is failing with
Version-Release number of selected component (if applicable):
ipa-server-4.4.0-14.el7_3.7.x86_64
How reproducible:
Everytime
Steps to Reproduce:
1. ipa-replica-install
2.
3.
Actual results:
 [26/40]: creating DS keytab
  [27/40]: setting up initial replication
  [error] DatabaseError: Server is unwilling to perform: Minimum SSF not met.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
Server is unwilling to perform: Minimum SSF not met.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for
more information
Expected results:
replica install to complete
Additional info:
On the IDM master, ldapsearches are failing due to the same issue.
[root@avid4p03 ~]# ldapsearch -D "cn=directory manager" -W -b
"dc=example,dc=com" "(nsds5replconflict=*)"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (nsds5replconflict=*)
# requesting: ALL
#
# search result
search: 2
result: 53 Server is unwilling to perform
text: Minimum SSF not met.
[root@avid4p03 ~]# grep minssf /etc/dirsrv/slapd-EXAMPLE-COM/dse.ldif
nsslapd-minssf: 56
nsslapd-minssf-exclude-rootdse: on