On 8/6/19 9:21 PM, Auerbach, Steven via FreeIPA-users wrote:
As I work through understanding the current state of my CA mastering
in this realm I am getting results I do not understand from these ipa commands (on the
v4.6.4 server) and from the ldapsearch commands (on the v3.0.0 server):
On the v4.6.4 replica (ipa<3>):
$ sudo ipa config-show |grep 'CA renewal master'
[sudo] password for <user>:
$
$
On the v3.0.0 (ipa<1>):
$ sudo ldapsearch -H ldap://$HOSTNAME -D 'cn=Directory Manager' -W -b
'cn=masters,cn=ipa,cn=etc,dc=fbog,dc=local'
'(&(cn=CA)(ipaConfigString=caRenewalMaster))' dn
[sudo] password for <user>:
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=masters,cn=ipa,cn=etc,dc=<mydomain>,dc=local> with scope subtree
# filter: (&(cn=CA)(ipaConfigString=caRenewalMaster))
# requesting: dn
#
# search result
search: 2
result: 0 Success
# numResponses: 1
Hi,
the ipaConfigString=caRenewalMaster attribute was introduced in freeIPA
4.0 (please see [1] Howto/Promote_CA_to_Renewal_and_CRL_Master), hence I
am not surprised that the search does not return anything.
When the 3.0 server was installed, the attribute did not exist yet. When
the 4.x replica was installed, the attribute was not added since the new
replica wasn't CA master.
As the attribute is not set at all, the ipa config-show command
(internally using the same ldapsearch you did) is unable to find a CA
master.
If you want to move the CA master role to ipa3, just follow the steps in
[1], making sure to apply the steps for the corresponding IPA version.
Also please note that we do not recommend using versions 3.x and 4.x
together over a long period of time. This is completely OK when you want
to migrate but once you have ensured all the services are properly
working, the 3.x master should be decommissioned. Please see [2].
HTH,
flo
[1]
https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master
[2]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
Neither tells me anything. Is it possible that the original installation never had a CA
master at all? This seems odd considering when I look for CA Master(s), on the v4.6.4
(ipa<3>) tells me:
$ sudo ipa server-role-find --role 'CA server'
[sudo] password for <user>:
----------------------
3 server roles matched
----------------------
Server name: ipa<2>.mydomain.local
Role name: CA server
Role status: absent
Server name: ipa<1>.mydomain.local
Role name: CA server
Role status: enabled
Server name: ipa<3>.mydomain.local
Role name: CA server
Role status: absent
----------------------------
Number of entries returned 3
----------------------------
And on the v3.0.0 (ipa<1>) I get:
$ sudo ldapsearch -H ldap://$HOSTNAME -D 'cn=Directory Manager' -W -b
'cn=masters,cn=ipa,cn=etc,dc=<mydomain>,dc=local'
'(&(cn=CA)(ipaConfigString=caServer))' dn
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=masters,cn=ipa,cn=etc,dc=fbog,dc=local> with scope subtree
# filter: (&(cn=CA)(ipaConfigString=caServer))
# requesting: dn
#
# search result
search: 2
result: 0 Success
# numResponses: 1
I know I am missing something basic and fundamental here. Is there a CA Master or not?
If not, would I want to just enable the CA Master on the newest server (ipa<3>)?
The way forward is not clear.
-Steven Auerbach
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...