On Thu, Mar 14, 2024 at 7:36 PM Florence Blanc-Renaud flo@redhat.com wrote:
Hi,
On Thu, Mar 14, 2024 at 8:55 AM Ian Kumlien ian.kumlien@gmail.com wrote:
On Wed, Mar 13, 2024 at 1:58 PM Ian Kumlien ian.kumlien@gmail.com wrote:
[--8<--]
As a side node, the conncheck for ipa-ca-install fails all the time now, when executing check on remote master it ends with this: 2024-03-14T07:42:26Z DEBUG Destroyed connection context.rpcclient_139905569284576 2024-03-14T07:42:26Z ERROR ERROR: Remote master check failed with following error message(s): invalid 'cn': must be "freeipa-4.xerces.lan" 2024-03-14T07:42:26Z DEBUG Stopping listening thread.
Which seems really strange...
The message is highly misleading, but basically means that the conncheck part tried to check the connection to freeipa-4.xerces.lan, there was an issue and then a different server was tried. Discussed in this thread: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Ok, i have actually looked at that and checked the pki security-domain-show --- perhaps i should look at the bug options as well...
Can you provide the exact OS + ipa / 389-ds-base versions that you have on your server and on your replica? And any relevant info about the history of the master (for instance, was the master initially installed with this version or was it upgraded from older versions).
I verified that the plugin is available on the other end, so ... Centos 8 Stream - master: ipa-server-dns-4.9.10-6.module_el8.7.0+1209+42bcbcde.noarch ipa-server-4.9.10-6.module_el8.7.0+1209+42bcbcde.x86_64 ipa-server-common-4.9.10-6.module_el8.7.0+1209+42bcbcde.noarch 389-ds-base-1.4.3.28-6.module_el8.6.0+1102+fe5d910f.x86_64 389-ds-base-libs-1.4.3.28-6.module_el8.6.0+1102+fe5d910f.x86_64
Fedora 39 - replica: freeipa-server-common-4.11.1-2.fc39.noarch freeipa-server-4.11.1-2.fc39.x86_64 freeipa-server-dns-4.11.1-2.fc39.noarch 389-ds-base-libs-2.4.5-1.fc39.x86_64 389-ds-base-2.4.5-1.fc39.x86_64