On to, 11 maalis 2021, Rob Crittenden via FreeIPA-devel wrote:
Alexander Bokovoy via FreeIPA-devel wrote:
> On ke, 10 maalis 2021, Rob Crittenden via FreeIPA-devel wrote:
>> I don't know if this is something odd with my setup so before
>> investigating I thought I'd ask.
>>
>> I was testing an upgrade change so I installed one server and then added
>> a replica with a CA. Doing this number of rounds of install/uninstall on
>> the replica and it would frequently fail trying to get a keytab for DS.
>>
>> I noticed that after uninstall the ldap principal for the server
>> remained. How I have no idea.
>>
>> Anyone else seen this?
>
> How did you remove the replica? There is a particular process you need
> to follow first:
>
>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
I missed that the ldap principal is purposely kept. We should probably
test for that during replica installation and fail gracefully if it
already exists (or delete it if the server otherwise doesn't exist yet).
Replication topology plugin should be removing it already on the master
side when other principals are removed if the sequence is correct.
Thepology plugin has a hook to check DEL operation:
void
ipa_topo_util_delete_host(Slapi_Entry *hostentry)
{
char* delhost = NULL;
delhost = slapi_entry_attr_get_charptr(hostentry,"cn");
/* if the deleted host is the current host, do not
* delete the segments, deleting segments will trigger
* removal of replication agreements and it cannot be
* ensured that the deletion of the host will reach
* other servers in the replica before.
* So wait until the delete is received on the other
* servers and the deletion of segments is received.
*/
if (0 == strcasecmp(delhost,ipa_topo_get_plugin_hostname())) {
return;
} else {
/* find all segments connecting the local master to the
* deleted master.
* - mark the segments as no longer managed
* - delete the segments
* - if the segment originates at the local host
* remove the corresponding replication agreement
*/
int i = 0;
char **shared_root = ipa_topo_get_plugin_replica_root();
while (shared_root[i]) {
ipa_topo_util_disable_repl_from_host(shared_root[i], delhost);
ipa_topo_util_delete_segments_for_host(shared_root[i], delhost);
i++;
}
}
}
The issue I see with trying to remove the ldap/.. principal if the rest
was removed already is that we have no assurance that a server we are
connecting this replica-to-be to has up to date replication state.
May be we should add an error message to ipa-replica-install that
instructs to wait until the previous host and topology removal has been
propagated and the remnants of the previous replica were removed?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland