Never mind.
Clock was skewed. Fixed it and now it is working.
On Tue, Apr 16, 2019 at 1:53 PM fujisan <fujisan43(a)gmail.com> wrote:
Thank you for your reply.
So i'm trying to install freeipa as a replica using the following command
until it says *LDAP error: Invalid credentials.*
What is missing?
# ipa-replica-install --principal=admin --admin-password=XXXX
--server=oldserver.domain.local --domain=domainlocal --realm=DOMAINLOCAL
--setup-dns --mkhomedir --ssh-trust-dns --auto-reverse --forwarder=.....
[...]
Run connection check to master
Connection check OK
Configuring directory server (dirsrv). Estimated time: 30 seconds
[1/41]: creating directory server instance
[2/41]: enabling ldapi
[3/41]: configure autobind for root
[4/41]: stopping directory server
[5/41]: updating configuration in dse.ldif
[6/41]: starting directory server
[7/41]: adding default schema
[8/41]: enabling memberof plugin
[9/41]: enabling winsync plugin
[10/41]: configuring replication version plugin
[11/41]: enabling IPA enrollment plugin
[12/41]: configuring uniqueness plugin
[13/41]: configuring uuid plugin
[14/41]: configuring modrdn plugin
[15/41]: configuring DNS plugin
[16/41]: enabling entryUSN plugin
[17/41]: configuring lockout plugin
[18/41]: configuring topology plugin
[19/41]: creating indices
[20/41]: enabling referential integrity plugin
[21/41]: configuring certmap.conf
[22/41]: configure new location for managed entries
[23/41]: configure dirsrv ccache
[24/41]: enabling SASL mapping fallback
[25/41]: restarting directory server
[26/41]: creating DS keytab
[27/41]: ignore time skew for initial replication
[28/41]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 15 seconds elapsed
[ldap://oldserever.domain.local:389] reports: Update failed! Status:
[Error (49) - LDAP error: Invalid credentials]
[error] RuntimeError: Failed to start replication
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
Failed to start replication
The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
On Tue, Apr 16, 2019 at 12:32 PM François Cami <fcami(a)redhat.com> wrote:
> On Tue, Apr 16, 2019 at 12:09 PM Alexander Bokovoy via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org> wrote:
> >
> > On ti, 16 huhti 2019, fujisan wrote:
> > >and then re-install each client with --server=new-server.my.domain?
> > No. You don't need to reinstall anything. Looks like you didn't install
> > any replica before?
> >
> > Instructions are here for a replica installation:
> >
>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>
> The documentation emphasizes it, but just in case: be sure to install
> a CA on the replica if the old server has one (--setup-ca).
>
>
> > Instructions are here for a server removal:
> >
>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
> >
> > Old server name might be mentioned in three configuration files on the
> > clients if you deployed them with --server option to ipa-client-install
> > instead of using auto-discovery.
> >
> > - /etc/sssd/sssd.conf might have a direct reference to IPA master
> > instead of _srv_ label. If it has both, make sure you keep _srv_
> > first and replace old server name by the new one there. On IPA masters
> > itself there should be no _srv_ label.
> >
> > - /etc/ipa/default.conf has name of the master this server was enrolled
> > into. It can be updated to a new server without any trouble if old
> > server will be decommissioned.
> >
> > - /etc/krb5.conf can have a reference to the old server as a KDC. It can
> > also be updated without any issue.
> >
> >
> >
> > >On Tue, Apr 16, 2019 at 11:42 AM Alexander Bokovoy <
> abokovoy(a)redhat.com>
> > >wrote:
> > >
> > >> On ti, 16 huhti 2019, fujisan via FreeIPA-users wrote:
> > >> >Hello,
> > >> >
> > >> >I just got a new server on which I'd like to install a FreeIPA
> server.
> > >> >Today it is installed on the old server.
> > >> >
> > >> >I just tried to install it with ipa-server-install but of course
it
> > >> >complained saying the DNS domain is handled by the old server.
> > >> >
> > >> >What is the best way to install FreeIPA on the new server without
> > >> >disturbing the users too much?
> > >> Add a new server as a replica.
> > >>
> > >>
> > >> --
> > >> / Alexander Bokovoy
> > >> Sr. Principal Software Engineer
> > >> Security / Identity Management Engineering
> > >> Red Hat Limited, Finland
> > >>
> >
> > --
> > / Alexander Bokovoy
> > Sr. Principal Software Engineer
> > Security / Identity Management Engineering
> > Red Hat Limited, Finland
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>