Hi Marc,
I’m having a similar issue migrating from Ubuntu 16.04 to Centos 7.
It’s a different attribute that it’s failing on, but it’s the same step in the
ipa-replica-install process.
I think this process needs to be made a bit more resilient and not just die on non
backwards compatible schema changes, or at the very least a schema upgrade tool should be
available that can be run on the existing master prior to a replication scenario such as
this where there might be variations in the schema.
My apologies if there already is one, if there is the documentation is fairly well
hidden.
On Dec 5, 2018, at 7:55 AM, Marc Wiatrowski via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
I'm trying to migrate a CentOS 6 IPA setup to CentOS 7. Both are fully updated
CentOS 6.10 (ipa-server-3.0.0-51) and CentOS 7.6 (ipa-server-4.6.4-10)
I've been following:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
<
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
I ran copy-schema-to-ca.py on centos6 and created the replica info file without any
issues. But then:
[root@centos7]$ ipa-replica-install /var/lib/ipa/replica-info-centos7.gpg --setup-ca
--ip-address 192.168.1.1 --setup-dns --no-forwarders
Directory Manager (existing master) password:
Run connection check to master
admin(a)DOMAIN.NET <mailto:admin@DOMAIN.NET> password:
Connection check OK
Adding [192.168.1.1
centos7.domain.net <
http://centos7.domain.net/>] to your
/etc/hosts file
Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv). Estimated time: 30 seconds
[1/41]: creating directory server instance
[2/41]: enabling ldapi
....
[27/41]: ignore time skew for initial replication
[28/41]: setting up initial replication
[error] DatabaseError: Server is unwilling to perform: modification of attribute
nsds5replicabinddngroupcheckinterval is not allowed in replica entry
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR Server is unwilling to perform: modification of attribute
nsds5replicabinddngroupcheckinterval is not allowed in replica entry
ipapython.admintool: ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
centos6:/var/log/dirsrv/slapd/errors:
[04/Dec/2018:14:58:13 -0500] NSMMReplicationPlugin - replica_config_modify: modification
of attribute nsds5replicabinddngroupcheckinterval is not allowed in replica entry
The ipareplica-install.log contains the same errors at the end. I have googled and seen
similar issues but the solutions span from fixed already in a previous release to not
having an answer in the thread. It appears CentOS 6 shouldn't have this attribute and
that should be ok? but fails all the same.
Any suggestions?
Thank you in advance,
Marc
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...