One had a clock skew error (fixed), but the other non-CA replica shows:

ipa3.spx.net: replica
  last init status: None
  last init ended: 1970-01-01 00:00:00+00:00
  last update status: Error (3) Replication error acquiring replica: Unable to acquire replica: permission denied. The bind dn does not have permission to supply replication updates to the replica. Will retry later. (permission denied)

Do I need to re-init this replica from scratch (as in, remove it, unbind it from the servers, re-add it as a client and then re-promote it)?


photo
Bret Wortman
Founder, Damascus Products, LLC

855-644-2783 | bret@wrapbuddies.co

http://wrapbuddies.co/

70 Main St. Suite 23 Warrenton, VA 20186
On Mar 26 2019, at 8:47 am, Rob Crittenden <rcritten@redhat.com> wrote:
Bret Wortman via FreeIPA-users wrote:
Looks like I've somehow managed to get my 3 IPA servers out of sync:

[root@ipa3 ~]# ipa-replica-manage list
ipa3.my.net:master
ipa4.my.net:master
ipa5.my.net:master
[root@ipa3 ~]# ipa host-find solr14.my.net
---------------
0 hosts matched
---------------
----------------------------
Number of entries returned 0
----------------------------

On ipa4:
[root@ipa3 ~]# ipa host-find solr14.my.net
---------------
1 hosts matched
---------------
  Host name: solr14.my.net
----------------------------
Number of entries returned 1
----------------------------

On ipa5:
[root@ipa3 ~]# ipa host-find solr14.my.net
---------------
1 hosts matched
---------------
  Host name: solr14.my.net
  Principal name: host/solr14.my.net@MY.NET
<mailto:host/solr14.my.net@MY.NET>
  :
  :
----------------------------
Number of entries returned 1
----------------------------

So they've obviously stopped talking. What's the right way to get them
back in sync and ensure that they don't drift again? Is there a
replication entry that's "stuck" and causing this?

On each master run: ipa-replica-manage list -v `hostname`

That will give you the replication status.

You can try to wake up an agreement with: ipa-replica-manage force-sync
--from <host>

rob
Sent from Mailspring