On ke, 10 maalis 2021, Rob Crittenden via FreeIPA-devel wrote:
I don't know if this is something odd with my setup so before
investigating I thought I'd ask.
I was testing an upgrade change so I installed one server and then added
a replica with a CA. Doing this number of rounds of install/uninstall on
the replica and it would frequently fail trying to get a keytab for DS.
I noticed that after uninstall the ldap principal for the server
remained. How I have no idea.
Anyone else seen this?
How did you remove the replica? There is a particular process you need
to follow first:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
===================================================
To remove
server1.example.com:
1. On another server, run the ipa server-del command to remove
server1.example.com. The command removes all topology segments pointing
to the server:
[user@server2 ~]$ ipa server-del
Server name:
server1.example.com
Removing
server1.example.com from replication topology, please wait...
----------------------------------------------------------
Deleted IPA server "server1.example.com"
----------------------------------------------------------
2. On
server1.example.com, run the ipa server-install --uninstall
command to uninstall the server components from the machine.
[root@server1 ~]# ipa server-install --uninstall
===================================================
The key here is that ldap principal should be in place to allow the
replication topology plugin perform a cleanup.
This is from ipaserver/plugins/server.py:server_del class:
def _remove_server_host_services(self, ldap, master):
"""
delete server kerberos key and all its svc principals
"""
try:
# do not delete ldap principal if server-del command
# has been called on a machine which is being deleted
# since this will break replication.
# ldap principal to be cleaned later by topology plugin
# necessary changes to a topology plugin are tracked
# under
https://pagure.io/freeipa/issue/7359
https://www.freeipa.org/page/V4/Manage_replication_topology#handling_repl...
===================================================
== handling replica removal
For the topology plugin the removal of a replica is the removal of a
managed server, the removal of a host from cn=masters. Before the host
is removed at least one segment connecting this host must remain, its
removal would be rejected. To allow a clean removal of a replica the
plugin implements the following actions: If a replica/master is removed,
all segments connecting this server will be removed and with the segment
removal also the corresponding replication agreements will be removed.
The ldap principal of the removed servers will be removed from the
allowed binddns in a replica object and as a member of the bindDN group.
===================================================
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland