On ke, 01 elo 2018, Alfredo De Luca wrote:

Hi Alexander. yes I did.. these are all the options with client install

ipa-client-install --force-join --domain digit.test --server idm.digit.test --realm MYTESTDOMAIN.IT --hostname ipa-repl.digit.test --mkhomedir -U --principal admin --password <password>

and all went well. I can access the host with IPA users and so on....

What was the reason to force specifying --domain digit.test if your realm is MYTESTDOMAIN.IT and primary DNS domain mytestdomain.it?

You should have used --domain mytestdomain.it in the first place. According to the man page for ipa-client-install,

--domain=DOMAIN The primary DNS domain of an existing IPA deployment, e.g. example.com. This DNS domain should contain the SRV records generated by the IPA server installer. Usually the name is a lower-cased name of an IPA Kerberos realm name.

On ke, 01 elo 2018, Alfredo De Luca via FreeIPA-users wrote:

Thanks heaps Alexander. That made the trick.

Now if all the ipa clients point to the master and it goes down ...the replica will do the job but ...do I need to change the DNS to add the replica?

Read ipa-client-install man page, it has explanation. You don't really need to specify --server option. If you did, you pinned the client to that server. If you just use autodiscovery, --server is not needed.

Cheers

On Tue, Jul 31, 2018 at 2:52 PM Alfredo De Luca alfredo.deluca@gmail.com wrote:

...

Hi all. I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on Centos 7) but I get the following error;

ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Cannot promote this client to a replica. Local domain 'digit.test' does not match IPA domain 'mytestdomain.it'.

Now I know that on IPA server lev 1 you cannot add a replica from the server so that's why I tried

1. ipa-client-install (gone well)
2. ipa-replica-install (with errors)

Any idea?

-- *Alfredo*

-- *Alfredo*

---

FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost...

Hi Alex et all I wonder what I need to do on our internal DNS to point all the clients to both master and replica without changing all the ipa clients conf.

At this stage it's too late to change the server in autodiscovery. What should I do on the DNS server?

Cheers

On Wed, Aug 1, 2018 at 2:24 PM Alfredo De Luca alfredo.deluca@gmail.com wrote:

Thanks heaps.

Cheers

On Wed, Aug 1, 2018 at 12:12 PM Alexander Bokovoy abokovoy@redhat.com wrote:

...

On ke, 01 elo 2018, Alfredo De Luca via FreeIPA-users wrote:

...

Thanks heaps Alexander. That made the trick.

Now if all the ipa clients point to the master and it goes down ...the replica will do the job but ...do I need to change the DNS to add the replica?

Read ipa-client-install man page, it has explanation. You don't really need to specify --server option. If you did, you pinned the client to that server. If you just use autodiscovery, --server is not needed.

...

Cheers

On Tue, Jul 31, 2018 at 2:52 PM Alfredo De Luca <

alfredo.deluca@gmail.com>

...

wrote:

...

Hi all. I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4

on

...

...

Centos 7) but I get the following error;

ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):

ERROR

...

...

Cannot promote this client to a replica. Local domain 'digit.test'

does

...

...

not match IPA domain 'mytestdomain.it'.

Now I know that on IPA server lev 1 you cannot add a replica from the server so that's why I tried

1. ipa-client-install (gone well)
2. ipa-replica-install (with errors)

Any idea?

-- *Alfredo*

-- *Alfredo*

...

---

FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to

freeipa-users-leave@lists.fedorahosted.org

...

Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:

https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost...

-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

-- *Alfredo*