Thank you for your reply.

So i'm trying to install freeipa as a replica using the following command until it says LDAP error: Invalid credentials.
What is missing?

# ipa-replica-install --principal=admin --admin-password=XXXX  --server=oldserver.domain.local --domain=domainlocal --realm=DOMAINLOCAL --setup-dns --mkhomedir --ssh-trust-dns --auto-reverse --forwarder=.....
[...]
Run connection check to master
Connection check OK
Configuring directory server (dirsrv). Estimated time: 30 seconds
  [1/41]: creating directory server instance
  [2/41]: enabling ldapi
  [3/41]: configure autobind for root
  [4/41]: stopping directory server
  [5/41]: updating configuration in dse.ldif
  [6/41]: starting directory server
  [7/41]: adding default schema
  [8/41]: enabling memberof plugin
  [9/41]: enabling winsync plugin
  [10/41]: configuring replication version plugin
  [11/41]: enabling IPA enrollment plugin
  [12/41]: configuring uniqueness plugin
  [13/41]: configuring uuid plugin
  [14/41]: configuring modrdn plugin
  [15/41]: configuring DNS plugin
  [16/41]: enabling entryUSN plugin
  [17/41]: configuring lockout plugin
  [18/41]: configuring topology plugin
  [19/41]: creating indices
  [20/41]: enabling referential integrity plugin
  [21/41]: configuring certmap.conf
  [22/41]: configure new location for managed entries
  [23/41]: configure dirsrv ccache
  [24/41]: enabling SASL mapping fallback
  [25/41]: restarting directory server
  [26/41]: creating DS keytab
  [27/41]: ignore time skew for initial replication
  [28/41]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 15 seconds elapsed
[ldap://oldserever.domain.local:389] reports: Update failed! Status: [Error (49)  - LDAP error: Invalid credentials]

  [error] RuntimeError: Failed to start replication
Your system may be partly configured.

Run /usr/sbin/ipa-server-install --uninstall to clean up.

Failed to start replication
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information


On Tue, Apr 16, 2019 at 12:32 PM François Cami <fcami@redhat.com> wrote:
On Tue, Apr 16, 2019 at 12:09 PM Alexander Bokovoy via FreeIPA-users
<freeipa-users@lists.fedorahosted.org> wrote:
>
> On ti, 16 huhti 2019, fujisan wrote:
> >and then re-install each client with --server=new-server.my.domain?
> No. You don't need to reinstall anything. Looks like you didn't install
> any replica before?
>
> Instructions are here for a replica installation:
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/creating-the-replica

The documentation emphasizes it, but just in case: be sure to install
a CA on the replica if the old server has one (--setup-ca).


> Instructions are here for a server removal:
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/uninstalling_ipa_servers
>
> Old server name might be mentioned in three configuration files on the
> clients if you deployed them with --server option to ipa-client-install
> instead of using auto-discovery.
>
> - /etc/sssd/sssd.conf might have a direct reference to IPA master
>   instead of _srv_ label. If it has both, make sure you keep _srv_
>   first and replace old server name by the new one there. On IPA masters
>   itself there should be no _srv_ label.
>
> - /etc/ipa/default.conf has name of the master this server was enrolled
>   into. It can be updated to a new server without any trouble if old
>   server will be decommissioned.
>
> - /etc/krb5.conf can have a reference to the old server as a KDC. It can
>   also be updated without any issue.
>
>
>
> >On Tue, Apr 16, 2019 at 11:42 AM Alexander Bokovoy <abokovoy@redhat.com>
> >wrote:
> >
> >> On ti, 16 huhti 2019, fujisan via FreeIPA-users wrote:
> >> >Hello,
> >> >
> >> >I just got a new server on which I'd like to install a FreeIPA server.
> >> >Today it is installed on the old server.
> >> >
> >> >I just tried to install it with ipa-server-install but of course it
> >> >complained saying the DNS domain is handled by the old server.
> >> >
> >> >What is the best way to install FreeIPA on the new server without
> >> >disturbing the users too much?
> >> Add a new server as a replica.
> >>
> >>
> >> --
> >> / Alexander Bokovoy
> >> Sr. Principal Software Engineer
> >> Security / Identity Management Engineering
> >> Red Hat Limited, Finland
> >>
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org