On Tue, 2022-05-31 at 16:29 -0400, Rob Crittenden via FreeIPA-users
wrote:
I wonder if it doesn't have permission because the DNS service
was
not
installed.
Not every master is providing DNS, but the one the replica found
definitely is.
I changed the install options to use that server specifically. I still
got the error.
You could check the DS access log on the server that the replica was
initially created against to see what error is being returned for the
add.
I don't see anthing obvious to me about an add error. I think this is the add:
[31/May/2022:13:48:08.198728059 -0700] conn=1291 op=45 ADD
dn="idnsname=p1ipac01,idnsname=the.domain.tld.,cn=dns,dc=the,dc=domain,dc=tld"
[31/May/2022:13:48:08.207263055 -0700] conn=1291 op=45 RESULT err=50 tag=105 nentries=0
wtime=0.079640467 optime=0.008546916 etime=0.088182374
[31/May/2022:13:48:08.279995013 -0700] conn=1291 op=46 UNBIND
[31/May/2022:13:48:08.280040850 -0700] conn=1291 op=46 fd=85 closed error - U1
Otherwise if IPA isn't providing DNS then I wouldn't worry
about the
message, but it shouldn't be thrown in any case.
Some of them are. My DNS tests against them have thus far been
returning results correctly.
I also ran ipahealthcheck, which besides a warning about the dnarange
being missing (I'll be fixing that), didn't report any dns probnlems.
--
Ranbir