Only one minor thing I want to add - .dsrc processing.
But feel free to review the actual tool now. It is working and it has all the logic.

Also, I've added a function get_consumer_replicas but I haven't used it in the code because it would make the logic more complex and harder to understand.
But it can be used by someone in the future, so I've decided to leave it there.

We should also have an option to read in a connection's bind password from a file (that would make things easier in the UI).

Supplier: localhost:5555
------------------------
Replica Root: dc=example,dc=com
Replica ID: 33
Max CSN: 5d88ece0000000210000
-
Status for agreement: "to master" (localhost:389)

What is the line with the "-"? Can it be removed?

dsconf localhost replication monitor --connection localhost:389:cn=dm:password --connection localhost:5555:cn=dm:password 
Enter a bind DN for localhost:389: 

Why am I being prompted for a password since I've already provided one?

Ok, so this is where that "-" was coming from. At first I thought it was a "value" without an "attribute". If you are looking for a separator, then perhaps it should many dashes"------------------------------", otherwise it's confusing. Or, even something with a title like "---- Agreement Details ----"

dsconf localhost replication monitor --connection localhost:389:cn=dm:password --connection localhost:5555:cn=dm:password

Enter a bind DN for localhost:389:

Why am I being prompted for a password since I've already provided one?

Okay I see I misused the CLI. It expects only one "--connection" parameter. I think we should change this so it's a one-to-one relationship. One arg per connection:

# dsconf localhost replication monitor -c <connection> -c <connection> -c <connection>

Also :-) The old script accepted a config file which was just a list of connections. I think dsconf should accept a config/connection file as well, and it should accept the same format used in the old tool so customers can just reuse the same file.

We should also have an option to read in a connection's bind password from a file (that would make things easier in the UI).

Added.

What is the line with the "-"? Can it be removed?

Sure. I just copied the thing from the original report but I agree it looks cleaner without it. Removing.

dsconf localhost replication monitor --connection localhost:389:cn=dm:password --connection localhost:5555:cn=dm:password
Enter a bind DN for localhost:389:
Why am I being prompted for a password since I've already provided one?

Okay I see I misused the CLI. It expects only one "--connection" parameter. I think we should change this so it's a one-to-one relationship. One arg per connection:
dsconf localhost replication monitor -c -c -c

You can specify multiple args like this:

# dsconf localhost replication monitor -c <connection> <connection> <connection>

I think the option you propose will make the CLI more confusing... argparse originally uses nargs="*" which gives you - -c [CONNECTION [CONNECTION ...]] help usage. Which is consistent and more compact.

Also :-) The old script accepted a config file which was just a list of connections. I think dsconf should accept a config/connection file as well, and it should accept the same format used in the old tool so customers can just reuse the same file.

Yep, just added. Though I've changed the format a bit because I use existing ~/.dsrc functionality that I got working. And it uses ConfigParser which has its limitations... (for example, there is no elegant way to specify multiple arguments - what I've chosen is lesser evil)

Example:

[repl-monitor-connection]
connection1 = server1.example.com:38901:cn=Directory manager:*
connection2 = server2.example.com:38901:cn=Directory manager:[~/pwd.txt]
connection3 = hub1.example.com:.*:cn=Directory manager:password
[repl-monitor-alias]
M1 = server1.example.com:38901
M2 = server1.example.com:38902
H1 = hub1.example.com:38902

Please, review.

You can specify multiple args like this:
dsconf localhost replication monitor -c

I think the option you propose will make the CLI more confusing... argparse originally uses nargs="*" which gives you - -c [CONNECTION [CONNECTION ...]] help usage. Which is consistent and more compact.

Then change the long arg to "--connections" so it's more obvious it takes multiple values.

Yep, just added. Though I've changed the format a bit because I use existing ~/.dsrc functionality that I got working. And it uses ConfigParser which has its limitations... (for example, there is no elegant way to specify multiple arguments - what I've chosen is lesser evil)
Example:
[repl-monitor-connection]
connection1 = server1.example.com:38901:cn=Directory manager:
connection2 = server2.example.com:38901:cn=Directory manager:[~/pwd.txt]
connection3 = hub1.example.com:.:cn=Directory manager:password

Does the connection name matter?

Then change the long arg to "--connections" so it's more obvious it takes multiple values.

Sure, makes sense. It was another thing I've copied from the original but we better change it, yeah.

Does the connection name matter?

Nope

Fixed. Please, review.

Also, the How-To docs are on review too:
https://github.com/marcus2376/389wiki/pull/16

Thanks, ack

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3669

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.