Hi,
At first look, I would say svgipa02 fails trigger its total update from
svgipa01 because ipa02 fails authenticate on ipa01.
Are the logs from ipa02 ? if it is, it shows that ipa01 did not even try
to reinit it.
Could you send the DS access/errors logs from both ipa01 and ipa02 at
the period of time when you run 'ipa-replica-manage re-initialize' ?
best regards
thierry
On 10/15/2018 10:42 AM, Karl Dag Gursli via FreeIPA-users wrote:
Hi
We experienced issues with one of our IPA server(svgipa02) as it did
not receive updates. It was the decided to run on svgipa02
ipa-replicate-manage re-initialize --from=svgipa01
[root@svgipa02 slapd-NO-EP-CORP-LOCAL]# date; ipa-replica-manage
re-initialize --from=svgipa01.no.ep.corp.local;date
Mon Oct 15 10:33:26 CEST 2018
Directory Manager password:
Update in progress, 15 seconds elapsed
[ldaps://svgipa01.no.ep.corp.local:636] reports: Update failed!
Status: [49 - LDAP error: Invalid credentials]
Mon Oct 15 10:33:52 CEST 2018
[root@svgipa02 slapd-NO-EP-CORP-LOCAL]#
From the dirsrv errors log
[15/Oct/2018:10:33:34.192011467 +0200] - DEBUG - schema-compat-plugin
- searching from "cn=mapping tree,cn=config" for
"(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))"
with scope 2 (sub)
[15/Oct/2018:10:33:34.192823822 +0200] - DEBUG - cos-plugin -
cos_cache_vattr_types - Failed to get class of service reference
[15/Oct/2018:10:33:34.193697399 +0200] - DEBUG - schema-compat-plugin
- searching from "cn=schema" for "(objectClass=*)" with scope 0
(base)
[15/Oct/2018:10:33:34.456582623 +0200] - DEBUG - schema-compat-plugin
- searching from "cn=mapping tree,cn=config" for
"(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))"
with scope 2 (sub)
[15/Oct/2018:10:33:34.457479057 +0200] - DEBUG - cos-plugin -
cos_cache_vattr_types - Failed to get class of service reference
[15/Oct/2018:10:33:34.736019484 +0200] - DEBUG - schema-compat-plugin
- searching from "cn=mapping tree,cn=config" for
"(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))"
with scope 2 (sub)
[15/Oct/2018:10:33:34.736561662 +0200] - DEBUG - cos-plugin -
cos_cache_vattr_types - Failed to get class of service reference
The procedure did not finish and svgipa02 was left in an empty state
What is the producedure to solve this issue?
rgds
Karl Dag
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...