I don't know if this is something odd with my setup so before investigating I thought I'd ask.
I was testing an upgrade change so I installed one server and then added a replica with a CA. Doing this number of rounds of install/uninstall on the replica and it would frequently fail trying to get a keytab for DS.
I noticed that after uninstall the ldap principal for the server remained. How I have no idea.
Anyone else seen this?
Note: I tweaked my initial server so it's possible I messed something up but this is an unexpected side effect if so.
rob
On ke, 10 maalis 2021, Rob Crittenden via FreeIPA-devel wrote:
I don't know if this is something odd with my setup so before investigating I thought I'd ask.
I was testing an upgrade change so I installed one server and then added a replica with a CA. Doing this number of rounds of install/uninstall on the replica and it would frequently fail trying to get a keytab for DS.
I noticed that after uninstall the ldap principal for the server remained. How I have no idea.
Anyone else seen this?
How did you remove the replica? There is a particular process you need to follow first:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm...
=================================================== To remove server1.example.com:
1. On another server, run the ipa server-del command to remove server1.example.com. The command removes all topology segments pointing to the server:
[user@server2 ~]$ ipa server-del Server name: server1.example.com Removing server1.example.com from replication topology, please wait... ---------------------------------------------------------- Deleted IPA server "server1.example.com" ----------------------------------------------------------
2. On server1.example.com, run the ipa server-install --uninstall command to uninstall the server components from the machine.
[root@server1 ~]# ipa server-install --uninstall ===================================================
The key here is that ldap principal should be in place to allow the replication topology plugin perform a cleanup.
This is from ipaserver/plugins/server.py:server_del class:
def _remove_server_host_services(self, ldap, master): """ delete server kerberos key and all its svc principals """ try: # do not delete ldap principal if server-del command # has been called on a machine which is being deleted # since this will break replication. # ldap principal to be cleaned later by topology plugin # necessary changes to a topology plugin are tracked # under https://pagure.io/freeipa/issue/7359
https://www.freeipa.org/page/V4/Manage_replication_topology#handling_replica... =================================================== == handling replica removal
For the topology plugin the removal of a replica is the removal of a managed server, the removal of a host from cn=masters. Before the host is removed at least one segment connecting this host must remain, its removal would be rejected. To allow a clean removal of a replica the plugin implements the following actions: If a replica/master is removed, all segments connecting this server will be removed and with the segment removal also the corresponding replication agreements will be removed. The ldap principal of the removed servers will be removed from the allowed binddns in a replica object and as a member of the bindDN group. ===================================================
Alexander Bokovoy via FreeIPA-devel wrote:
On ke, 10 maalis 2021, Rob Crittenden via FreeIPA-devel wrote:
I don't know if this is something odd with my setup so before investigating I thought I'd ask.
I was testing an upgrade change so I installed one server and then added a replica with a CA. Doing this number of rounds of install/uninstall on the replica and it would frequently fail trying to get a keytab for DS.
I noticed that after uninstall the ldap principal for the server remained. How I have no idea.
Anyone else seen this?
How did you remove the replica? There is a particular process you need to follow first:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm...
I missed that the ldap principal is purposely kept. We should probably test for that during replica installation and fail gracefully if it already exists (or delete it if the server otherwise doesn't exist yet).
rob
On to, 11 maalis 2021, Rob Crittenden via FreeIPA-devel wrote:
Alexander Bokovoy via FreeIPA-devel wrote:
On ke, 10 maalis 2021, Rob Crittenden via FreeIPA-devel wrote:
I don't know if this is something odd with my setup so before investigating I thought I'd ask.
I was testing an upgrade change so I installed one server and then added a replica with a CA. Doing this number of rounds of install/uninstall on the replica and it would frequently fail trying to get a keytab for DS.
I noticed that after uninstall the ldap principal for the server remained. How I have no idea.
Anyone else seen this?
How did you remove the replica? There is a particular process you need to follow first:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm...
I missed that the ldap principal is purposely kept. We should probably test for that during replica installation and fail gracefully if it already exists (or delete it if the server otherwise doesn't exist yet).
Replication topology plugin should be removing it already on the master side when other principals are removed if the sequence is correct.
Thepology plugin has a hook to check DEL operation:
void ipa_topo_util_delete_host(Slapi_Entry *hostentry) { char* delhost = NULL;
delhost = slapi_entry_attr_get_charptr(hostentry,"cn"); /* if the deleted host is the current host, do not * delete the segments, deleting segments will trigger * removal of replication agreements and it cannot be * ensured that the deletion of the host will reach * other servers in the replica before. * So wait until the delete is received on the other * servers and the deletion of segments is received. */ if (0 == strcasecmp(delhost,ipa_topo_get_plugin_hostname())) { return; } else { /* find all segments connecting the local master to the * deleted master. * - mark the segments as no longer managed * - delete the segments * - if the segment originates at the local host * remove the corresponding replication agreement */ int i = 0; char **shared_root = ipa_topo_get_plugin_replica_root();
while (shared_root[i]) { ipa_topo_util_disable_repl_from_host(shared_root[i], delhost); ipa_topo_util_delete_segments_for_host(shared_root[i], delhost); i++; } }
}
The issue I see with trying to remove the ldap/.. principal if the rest was removed already is that we have no assurance that a server we are connecting this replica-to-be to has up to date replication state.
May be we should add an error message to ipa-replica-install that instructs to wait until the previous host and topology removal has been propagated and the remnants of the previous replica were removed?
freeipa-devel@lists.fedorahosted.org
-
Alexander Bokovoy -
Rob Crittenden