On 02.10.20 11:29, Florence Blanc-Renaud wrote:
> On 10/2/20 11:03 AM, Ronald Wimmer via FreeIPA-users wrote:
>> At the moment we only have KRA on one of our eight IPA servers. Is it
>> sufficient to issue the ipa-kra-install command on a replica where
>> the CA role is already present?
> yes, ipa-kra-install can be used to install a replica KRA. No
> additional steps required.
Looks like that did not work as expected. The only KRA server at the
moment is pipa02. pipa06 should become an additional KRA server.
Last login: Fri Oct 2 11:16:49 2020 from 172.20.73.225
[root@pipa06 ~]# ipa-kra-install
Directory Manager password:
The SecurityDomainClient.get_security_domain_info() has been deprecated
The DomainInfo.systems has been deprecated
Lookup failed: Preferred host pipa06.linux.mydomain.at does not provide
Custodia uses 'pipa02.linux.mydomain.at' as master peer.
This program will setup Dogtag KRA for the IPA Server.
Your system may be partly configured.
If you run into issues, you may have to re-install IPA on this server.
401 Client Error: Unauthorized for url:
The ipa-kra-install command failed. See
/var/log/ipaserver-kra-install.log for more information
I could not find anything useful in the log file. Any hints on what I
could try next?