I have uninstalled the new server and installed it again and tried the whole thing again.
Now it fails with the following error:
Starting replication, please wait until this has completed.
Update in progress, 15 seconds elapsed
[ldap://vmfripa-1c.redcapcloud.local:389] reports: Update failed! Status: [49 - LDAP
error: Invalid credentials]
[error] RuntimeError: Failed to start replication
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR Failed to start replication
ipapython.admintool: ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
On 21 Feb 2019, at 16:28, Peter Zoltan Keresztes
<zozo6015(a)gmail.com> wrote:
Any idea how to get this fixed or I am in a hopeless situation?
> On 20 Feb 2019, at 10:09, Florence Blanc-Renaud <flo(a)redhat.com
<mailto:flo@redhat.com>> wrote:
>
> On 2/19/19 4:55 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
>> I have not changed anything manually. All the config files are the way the
application has configured them when I run ipa-client-install
> Ok, the so mech=EXTERNAL is probably a red herring.
>
> Can you check if there are replication conflicts on the master?
> On earlier versions of 389-ds you need to run (please replace BASEDN with your base
dn):
> $ ldapsearch -D "cn=directory manager" -W -b $BASEDN
"nsds5ReplConflict=*" \* nsds5ReplConflict
>
> or on more recent versions:
> $ ldapsearch -D "cn=Directory Manager" -W -b $BASEDN
"(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))" \* nsds5ReplConflict
>
> flo
>
>> The content of /etc/ldap/ldap.conf is the following
>> # File modified by ipa-client-install
>> # We do not want to break your existing configuration, hence:
>> # URI, BASE and TLS_CACERT have been added if they were not set.
>> # In case any of them were set, a comment with trailing note
>> # "# modified by IPA" note has been inserted.
>> # To use IPA server with openLDAP tools, please comment out your
>> # existing configuration for these options and uncomment the
>> # corresponding lines generated by IPA.
>> #
>> # LDAP Defaults
>> #
>> # See ldap.conf(5) for details
>> # This file should be world readable but not world writable.
>> #BASE dc=example,dc=com
>> #URI
ldap://ldap.example.com <ldap://ldap.example.com>
ldap://ldap-master.example.com:666 <ldap://ldap-master.example.com:666>
>> #SIZELIMIT 12
>> #TIMELIMIT 15
>> #DEREF never
>> # TLS certificates (needed for GnuTLS)
>> #TLS_CACERT /etc/ipa/ca.crt # modified by IPA
>> TLS_CACERT /etc/ssl/certs/ca-certificates.crt
>> URI ldaps://vmfripa-1c.redcapcloud.local
<ldaps://vmfripa-1c.redcapcloud.local>
>> BASE dc=redcapcloud,dc=local
>>> On 19 Feb 2019, at 17:18, Florence Blanc-Renaud <flo(a)redhat.com
<mailto:flo@redhat.com>> wrote:
>>>
>>> On 2/19/19 2:45 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
>>>> I can see this line about 10-15 lines before the lines I already posted
>>>> [18/Feb/2019:17:21:25.961763243 +0000] conn=2 op=0 BIND
dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL
>>>>
>>> I am surprised to see sasl mechanism = EXTERNAL. Did you configure
/etc/openldap/ldap.conf with the setting
>>> SASL_MECH EXTERNAL
>>> before calling ipa-replica-install?
>>> What is the content of this file on the replica?
>>>
>>> flo
>>>
>>>>> On 19 Feb 2019, at 15:19, Florence Blanc-Renaud <flo(a)redhat.com
<mailto:flo@redhat.com> <mailto:flo@redhat.com
<mailto:flo@redhat.com>>> wrote:
>>>>>
>>>>> On 2/19/19 1:25 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
>>>>>> Here are the outputs of the two commands:
>>>>>> dn:
cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>> ipaAllowedTarget:
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>> ipaAllowedTarget:
cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>> memberPrincipal:
HTTP/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:HTTP/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
<mailto:HTTP/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
<mailto:HTTP/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>>
>>>>>> memberPrincipal:
HTTP/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:HTTP/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
<mailto:HTTP/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
<mailto:HTTP/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>>
>>>>>> cn: ipa-http-delegation
>>>>>> objectClass: ipaKrb5DelegationACL
>>>>>> objectClass: groupOfPrincipals
>>>>>> objectClass: top
>>>>>> dn:
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>> memberPrincipal:
ldap/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>>
>>>>>> memberPrincipal:
ldap/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>>
>>>>>> cn: ipa-ldap-delegation-targets
>>>>>> objectClass: groupOfPrincipals
>>>>>> objectClass: top
>>>>>> And in the access log the result of the search:
>>>>>> [18/Feb/2019:17:21:36.259672879 +0000] conn=6 fd=64 slot=64
connection from local to /var/run/slapd-REDCAPCLOUD-LOCAL.socket
>>>>>> [18/Feb/2019:17:21:36.260597395 +0000] conn=6 AUTOBIND
dn="cn=Directory Manager"
>>>>>> [18/Feb/2019:17:21:36.260604747 +0000] conn=6 op=0 BIND
dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL
>>>>>> [18/Feb/2019:17:21:36.260656509 +0000] conn=6 op=0 RESULT err=0
tag=97 nentries=0 etime=0.0000462749 dn="cn=Directory Manager"
>>>>>> [18/Feb/2019:17:21:36.260806067 +0000] conn=6 op=1 MOD
dn="cn=Auto Membership Plugin,cn=plugins,cn=config"
>>>>>> [18/Feb/2019:17:21:36.265134066 +0000] conn=6 op=1 RESULT err=0
tag=103 nentries=0 etime=0.0004388316
>>>>>> [18/Feb/2019:17:21:36.265232071 +0000] conn=6 op=2 UNBIND
>>>>>> [18/Feb/2019:17:21:36.265247421 +0000] conn=6 op=2 fd=64 closed -
U1
>>>>>> [18/Feb/2019:17:21:36.267548186 +0000] conn=2 op=10 SRCH
base="cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local"
scope=0 filter="(objectClass=*)" attrs="memberPrincipal"
>>>>>> [18/Feb/2019:17:21:36.267674095 +0000] conn=2 op=10 RESULT err=32
tag=101 nentries=0 etime=0.1760815055
>>>>>> [18/Feb/2019:17:21:36.425570348 +0000] conn=2 op=11 UNBIND
>>>>>
>>>>> This shows that the entry is not found on the replica (err=32 = no
such object), could either be because the replication did not replicate yet or because
access rights prevent the user from seeing the entry. Do you see a line with
>>>>> conn=2 op=<something> BIND ...
>>>>> earlier in the log? It would help understand which user is performing
the search.
>>>>>
>>>>> flo
>>>>>
>>>>>>> On 19 Feb 2019, at 14:15, Florence Blanc-Renaud
<flo(a)redhat.com <mailto:flo@redhat.com> <mailto:flo@redhat.com
<mailto:flo@redhat.com>>> wrote:
>>>>>>>
>>>>>>> On 2/19/19 12:29 PM, Peter Zoltan Keresztes via FreeIPA-users
wrote:
>>>>>>>> After setting the $BASEDN I am getting the following:
>>>>>>>> dn:
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>>>> memberPrincipal:
ldap/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>>
>>>>>>>> memberPrincipal:
ldap/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>>
>>>>>>>> cn: ipa-ldap-delegation-targets
>>>>>>>> objectClass: groupOfPrincipals
>>>>>>>> objectClass: top
>>>>>>> Ok, so the entry exists on the master. Did you also check
cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$BASEDN and the access log on the replica as I
explained in a previous mail [1]?
>>>>>>>
>>>>>>> Thanks,
>>>>>>> flo
>>>>>>>
>>>>>>> [1]
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>>>>
>>>>>>>>> On 19 Feb 2019, at 12:25, Florence Blanc-Renaud
<flo(a)redhat.com <mailto:flo@redhat.com> <mailto:flo@redhat.com
<mailto:flo@redhat.com>> <mailto:flo@redhat.com
<mailto:flo@redhat.com>>> wrote:
>>>>>>>>>
>>>>>>>>> /etc/ipa/default.conf
>>>>>>>> _______________________________________________
>>>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>>>> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
<
https://getfedora.org/code-of-conduct.html>
>>>>>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
<
https://fedoraproject.org/wiki/Mailing_list_guidelines>
>>>>>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>>>>
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>> To unsubscribe send an email
tofreeipa-users-leave(a)lists.fedorahosted.org
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>> Fedora Code of
Conduct:https://getfedora.org/code-of-conduct.html
<
https://getfedora.org/code-of-conduct.html>
>>>>>> List
Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
<
https://fedoraproject.org/wiki/Mailing_list_guidelines>
>>>>>> List
Archives:https://lists.fedorahosted.org/archives/list/freeipa-users@lists...
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
<
https://getfedora.org/code-of-conduct.html>
>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
<
https://fedoraproject.org/wiki/Mailing_list_guidelines>
>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
<
https://getfedora.org/code-of-conduct.html>
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
<
https://fedoraproject.org/wiki/Mailing_list_guidelines>
>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...