I might have pasted a wrong password. The issue is back to square 1.
So the reason that Flo was asking for the ldapsearch output is based on
what the step that is failing is trying to do.
It first retrieves this entry from LDAP:
cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
It adds itself to the memberPrincipal of that and writes the result to LDAP.
Then it does the same for ipa-ldap-delegation-targets.
It is failing on the first one.
You've confirmed that the entries exist with the ldapsearch, at least
some time post-install. The replication setup was successful so it is
keeping itself up-to-date. The initial sync should have brought
everything over though.
Can you look on the failed replica 389-ds access log,
/var/log/dirsrv/slapd-REDCAPCLOUD-LOCAL/access for a search for
ipa-http-delegation around the time of 2019-02-18T17:21:36Z?
That may provide some insights into what is/was going on at the time.
There will be a connection associated with the bind, it would be best to
show all log entries on that connection.
For example, mine was conn=4866 and looks like:
[21/Feb/2019:13:31:17.334322845 -0500] conn=4866 op=0 BIND
dn="cn=directory manager" method=128 version=3
[21/Feb/2019:13:31:17.334399605 -0500] conn=4866 op=0 RESULT err=0
tag=97 nentries=0 etime=0 dn="cn=directory manager"
[21/Feb/2019:13:31:17.336678294 -0500] conn=4866 op=1 SRCH
base="cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=example,dc=com"
scope=2 filter="(objectClass=*)" attrs=ALL
[21/Feb/2019:13:31:17.337080590 -0500] conn=4866 op=1 RESULT err=0
tag=101 nentries=1 etime=0 notes=U
[21/Feb/2019:13:31:17.342578506 -0500] conn=4866 op=2 UNBIND
[21/Feb/2019:13:31:17.342595551 -0500] conn=4866 op=2 fd=130 closed - U1
rob
> On 20 Feb 2019, at 10:09, Florence Blanc-Renaud <flo(a)redhat.com
> <mailto:flo@redhat.com>> wrote:
>
> On 2/19/19 4:55 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
>> I have not changed anything manually. All the config files are the
>> way the application has configured them when I run ipa-client-install
> Ok, the so mech=EXTERNAL is probably a red herring.
>
> Can you check if there are replication conflicts on the master?
> On earlier versions of 389-ds you need to run (please replace BASEDN
> with your base dn):
> $ ldapsearch -D "cn=directory manager" -W -b $BASEDN
> "nsds5ReplConflict=*" \* nsds5ReplConflict
>
> or on more recent versions:
> $ ldapsearch -D "cn=Directory Manager" -W -b $BASEDN
> "(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))" \*
nsds5ReplConflict
>
> flo
>
>> The content of /etc/ldap/ldap.conf is the following
>> # File modified by ipa-client-install
>> # We do not want to break your existing configuration, hence:
>> # URI, BASE and TLS_CACERT have been added if they were not set.
>> # In case any of them were set, a comment with trailing note
>> # "# modified by IPA" note has been inserted.
>> # To use IPA server with openLDAP tools, please comment out your
>> # existing configuration for these options and uncomment the
>> # corresponding lines generated by IPA.
>> #
>> # LDAP Defaults
>> #
>> # See ldap.conf(5) for details
>> # This file should be world readable but not world writable.
>> #BASEdc=example,dc=com
>> #URIldap://ldap.example.com ldap://ldap-master.example.com:666
>> #SIZELIMIT12
>> #TIMELIMIT15
>> #DEREFnever
>> # TLS certificates (needed for GnuTLS)
>> #TLS_CACERT /etc/ipa/ca.crt # modified by IPA
>> TLS_CACERT/etc/ssl/certs/ca-certificates.crt
>> URI ldaps://vmfripa-1c.redcapcloud.local
>> BASE dc=redcapcloud,dc=local
>>> On 19 Feb 2019, at 17:18, Florence Blanc-Renaud <flo(a)redhat.com
>>> <mailto:flo@redhat.com>> wrote:
>>>
>>> On 2/19/19 2:45 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
>>>> I can see this line about 10-15 lines before the lines I already posted
>>>> [18/Feb/2019:17:21:25.961763243 +0000] conn=2 op=0 BIND
>>>> dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL
>>>>
>>> I am surprised to see sasl mechanism = EXTERNAL. Did you configure
>>> /etc/openldap/ldap.conf with the setting
>>> SASL_MECHEXTERNAL
>>> before calling ipa-replica-install?
>>> What is the content of this file on the replica?
>>>
>>> flo
>>>
>>>>> On 19 Feb 2019, at 15:19, Florence Blanc-Renaud <flo(a)redhat.com
>>>>> <mailto:flo@redhat.com> <mailto:flo@redhat.com>>
wrote:
>>>>>
>>>>> On 2/19/19 1:25 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
>>>>>> Here are the outputs of the two commands:
>>>>>> dn:
>>>>>>
cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>> ipaAllowedTarget:
>>>>>>
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>> ipaAllowedTarget:
>>>>>>
cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>> memberPrincipal:
>>>>>> HTTP/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
>>>>>>
<mailto:HTTP/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>
<mailto:HTTP/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>> memberPrincipal:
>>>>>> HTTP/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
>>>>>>
<mailto:HTTP/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>
<mailto:HTTP/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>> cn: ipa-http-delegation
>>>>>> objectClass: ipaKrb5DelegationACL
>>>>>> objectClass: groupOfPrincipals
>>>>>> objectClass: top
>>>>>> dn:
>>>>>>
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>> memberPrincipal:
>>>>>> ldap/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
>>>>>>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>> memberPrincipal:
>>>>>> ldap/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
>>>>>>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>> cn: ipa-ldap-delegation-targets
>>>>>> objectClass: groupOfPrincipals
>>>>>> objectClass: top
>>>>>> And in the access log the result of the search:
>>>>>> [18/Feb/2019:17:21:36.259672879 +0000] conn=6 fd=64 slot=64
>>>>>> connection from local to /var/run/slapd-REDCAPCLOUD-LOCAL.socket
>>>>>> [18/Feb/2019:17:21:36.260597395 +0000] conn=6 AUTOBIND
>>>>>> dn="cn=Directory Manager"
>>>>>> [18/Feb/2019:17:21:36.260604747 +0000] conn=6 op=0 BIND
>>>>>> dn="cn=Directory Manager" method=sasl version=3
mech=EXTERNAL
>>>>>> [18/Feb/2019:17:21:36.260656509 +0000] conn=6 op=0 RESULT err=0
>>>>>> tag=97 nentries=0 etime=0.0000462749 dn="cn=Directory
Manager"
>>>>>> [18/Feb/2019:17:21:36.260806067 +0000] conn=6 op=1 MOD
>>>>>> dn="cn=Auto Membership Plugin,cn=plugins,cn=config"
>>>>>> [18/Feb/2019:17:21:36.265134066 +0000] conn=6 op=1 RESULT err=0
>>>>>> tag=103 nentries=0 etime=0.0004388316
>>>>>> [18/Feb/2019:17:21:36.265232071 +0000] conn=6 op=2 UNBIND
>>>>>> [18/Feb/2019:17:21:36.265247421 +0000] conn=6 op=2 fd=64 closed -
U1
>>>>>> [18/Feb/2019:17:21:36.267548186 +0000] conn=2 op=10 SRCH
>>>>>>
base="cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local"
>>>>>> scope=0 filter="(objectClass=*)"
attrs="memberPrincipal"
>>>>>> [18/Feb/2019:17:21:36.267674095 +0000] conn=2 op=10 RESULT
err=32
>>>>>> tag=101 nentries=0 etime=0.1760815055
>>>>>> [18/Feb/2019:17:21:36.425570348 +0000] conn=2 op=11 UNBIND
>>>>>
>>>>> This shows that the entry is not found on the replica (err=32 = no
>>>>> such object), could either be because the replication did not
>>>>> replicate yet or because access rights prevent the user from
>>>>> seeing the entry. Do you see a line with
>>>>> conn=2 op=<something> BIND ...
>>>>> earlier in the log? It would help understand which user is
>>>>> performing the search.
>>>>>
>>>>> flo
>>>>>
>>>>>>> On 19 Feb 2019, at 14:15, Florence Blanc-Renaud
<flo(a)redhat.com
>>>>>>> <mailto:flo@redhat.com>
<mailto:flo@redhat.com>> wrote:
>>>>>>>
>>>>>>> On 2/19/19 12:29 PM, Peter Zoltan Keresztes via FreeIPA-users
wrote:
>>>>>>>> After setting the $BASEDN I am getting the following:
>>>>>>>> dn:
>>>>>>>>
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>>>>> memberPrincipal:
>>>>>>>> ldap/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
>>>>>>>>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>>>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>>>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>>> memberPrincipal:
>>>>>>>> ldap/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
>>>>>>>>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>>>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>>>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>>>>> cn: ipa-ldap-delegation-targets
>>>>>>>> objectClass: groupOfPrincipals
>>>>>>>> objectClass: top
>>>>>>> Ok, so the entry exists on the master. Did you also check
>>>>>>> cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$BASEDN and the
>>>>>>> access log on the replica as I explained in a previous mail
[1]?
>>>>>>>
>>>>>>> Thanks,
>>>>>>> flo
>>>>>>>
>>>>>>> [1]
>>>>>>>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>>>>
>>>>>>>>> On 19 Feb 2019, at 12:25, Florence Blanc-Renaud
>>>>>>>>> <flo(a)redhat.com <mailto:flo@redhat.com>
>>>>>>>>> <mailto:flo@redhat.com>
<mailto:flo@redhat.com>> wrote:
>>>>>>>>>
>>>>>>>>> /etc/ipa/default.conf
>>>>>>>> _______________________________________________
>>>>>>>> FreeIPA-users mailing list --
>>>>>>>> freeipa-users(a)lists.fedorahosted.org
>>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>> To unsubscribe send an email to
>>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
>>>>>>>> List Guidelines:
>>>>>>>>
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>>>>>> List Archives:
>>>>>>>>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>>>>
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list
--freeipa-users(a)lists.fedorahosted.org
>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>> To unsubscribe send an email
>>>>>> tofreeipa-users-leave(a)lists.fedorahosted.org
>>>>>> <mailto:tofreeipa-users-leave@lists.fedorahosted.org>
>>>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>> Fedora Code of
Conduct:https://getfedora.org/code-of-conduct.html
>>>>>> List
>>>>>>
Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>>>> List
>>>>>>
Archives:https://lists.fedorahosted.org/archives/list/freeipa-users@lists...
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>> To unsubscribe send an email to
>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>> List Archives:
>>>>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>
>> To unsubscribe send an email
>> to freeipa-users-leave(a)lists.fedorahosted.org
>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>> Fedora Code of
Conduct: https://getfedora.org/code-of-conduct.html
>> List
Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List
>>
Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@list...
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...