I've got an Availability Group going and need to map some logins to database users on an active secondary replica. (Node2) Unfortunately, when I try to
exec sp_change_users_login or
alter user with login, I get an error message telling me the database is read-only. That's no surprise, but I'm not sure how to fix it. I tried failing over last night, fixing the logins on Node2, and then failing back to Node1, but then the login/user mappings just end up wrong on Node1. When I fix those, Node2's logins get out of whack again.
This is a production system, so I can't do anything I want until later tonight. I didn't run into this problem in our test lab. The difference may be that I created the logins before joining the databases before, whereas this time I tried to create them afterwards, and failed to document the process correctly. Taking the AG down and rebuilding it is something I'd rather avoid if I can.
The problem makes sense to me, I just don't really know how to fix it.