On Jun 23, 2023, at 08:30, Florence Blanc-Renaud
<flo(a)redhat.com> wrote:
Hi,
On Thu, Jun 22, 2023 at 3:18 PM Joe Rhodes via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>
>
>> On Jun 21, 2023, at 18:07, Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>> wrote:
>>
>> Joe Rhodes via FreeIPA-users wrote:
>>> Hello all!
>>>
>>> I have a CentOS 7 based FreeIPA system that I’m migrating to Rocky 9.
>>> As suggested, I’ve created a Rocky 8 instance replica first.
>>>
>>> As I’ve been working on this (in a dev environment first), I’ve gotten
>>> myself into a state where I have two servers in the config that I cannot
>>> delete. (The VMs have been uninstalled and deleted.)
>>>
>>> ipa server-find
>>>
>>> ---------------------
>>>
>>> 7 IPA servers matched
>>>
>>> ---------------------
>>>
>>> Server name: ia-ipa-1.dev.purestake.tech
>>>
>>> Min domain level: 0
>>>
>>> Max domain level: 1
>>>
>>>
>>> Server name: ia-ipa-2.dev.purestake.tech
>>>
>>> Min domain level: 0
>>>
>>> Max domain level: 1
>>>
>>>
>>> Server name: joe-rocky-8.dev.purestake.tech
>>>
>>> Min domain level: 1
>>>
>>> Max domain level: 1
>>>
>>>
>>> Server name: joe-rocky-9.dev.purestake.tech
>>>
>>> Min domain level: 1
>>>
>>> Max domain level: 1
>>>
>>>
>>> Server name: oh-ipa-1.dev.purestake.tech
>>>
>>> Min domain level: 0
>>>
>>> Max domain level: 1
>>>
>>>
>>> Server name: oh-ipa-2.dev.purestake.tech
>>>
>>> Min domain level: 0
>>>
>>> Max domain level: 1
>>>
>>>
>>> Server name: oh-ipa-21.dev.purestake.tech
>>>
>>> Min domain level: 1
>>>
>>> Max domain level: 1
>>>
>>>
>>>
>>> The two servers I want to delete are joe-rocky-9 and oh-ipa-21.
>>>
>>> Trying to delete either give me:
>>>
>>> ipa server-del joe-rocky-9.dev.purestake.tech
>>>
>>> Removing joe-rocky-9.dev.purestake.tech from replication topology,
>>> please wait...
>>>
>>> ipa: ERROR: Server removal aborted:
>>>
>>>
>>> Replication topology in suffix 'domain' is disconnected:
>>>
>>> Topology does not allow server ia-ipa-1.dev.purestake.tech to replicate
>>> with servers:
>>>
>>> joe-rocky-9.dev.purestake.tech
>>>
>>> Topology does not allow server ia-ipa-2.dev.purestake.tech to replicate
>>> with servers:
>>>
>>> joe-rocky-9.dev.purestake.tech
>>>
>>> Topology does not allow server joe-rocky-8.dev.purestake.tech to
>>> replicate with servers:
>>>
>>> joe-rocky-9.dev.purestake.tech
>>>
>>> Topology does not allow server joe-rocky-9.dev.purestake.tech to
>>> replicate with servers:
>>>
>>> joe-rocky-8.dev.purestake.tech
>>>
>>> oh-ipa-1.dev.purestake.tech
>>>
>>> oh-ipa-2.dev.purestake.tech
>>>
>>> ia-ipa-1.dev.purestake.tech
>>>
>>> oh-ipa-21.dev.purestake.tech
>>>
>>> ia-ipa-2.dev.purestake.tech
>>>
>>> Topology does not allow server oh-ipa-1.dev.purestake.tech to replicate
>>> with servers:
>>>
>>> joe-rocky-9.dev.purestake.tech
>>>
>>> Topology does not allow server oh-ipa-2.dev.purestake.tech to replicate
>>> with servers:
>>>
>>> joe-rocky-9.dev.purestake.tech
>>>
>>> Topology does not allow server oh-ipa-21.dev.purestake.tech to replicate
>>> with servers:
>>>
>>> joe-rocky-9.dev.purestake.tech.
>>>
>>>
>>> and attempting to delete, ignoring the replication topology:
>>>
>>> ipa server-del joe-rocky-9.dev.purestake.tech --ignore-topology-disconnect
>>>
>>> Removing joe-rocky-9.dev.purestake.tech from replication topology,
>>> please wait...
>>>
>>> ipa: ERROR: Not allowed on non-leaf entry
This error shows that there are child entries below the entry for the server. You
mentioned replication conflicts, what is the output of:
# ldapsearch -D "cn=Directory Manager" -W -b $BASEDN
"(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))" \* nsds5ReplConflict
(replace $BASEDN with your base dn).
You may have to manually remove the replication conflict entries before the server entry
can be deleted.
flo
Flo:
YES! This was the ldap search I needed!
"(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))”
Once I did that, I found all my conflict entries. I think I was missing the
"objectClass=ldapSubEntry” in earlier searches. Your search showed me my conflict
entries for the two servers I was trying to delete:
# oh-ipa-21.dev.purestake.tech + 33c7e594-0c6611ee-ab65dcc1-bdea5cb1, masters, ipa, etc,
dev.purestake.tech
dn: cn=oh-ipa-21.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# KDC + 33c7e59a-0c6611ee-ab65dcc1-bdea5cb1, oh-ipa-21.dev.purestake.tech, masters, ipa,
etc, dev.purestake.tech
dn:
cn=KDC+nsuniqueid=33c7e59a-0c6611ee-ab65dcc1-bdea5cb1,cn=oh-ipa-21.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# oh-ipa-21.dev.purestake.tech + ea2fc894-0c6e11ee-a26cd21b-447b37f1, masters, ipa, etc,
dev.purestake.tech
dn:
cn=oh-ipa-21.dev.purestake.tech+nsuniqueid=ea2fc894-0c6e11ee-a26cd21b-447b37f1,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# oh-ipa-21.dev.purestake.tech + 1c90f4ab-0c7611ee-82aaaf7c-510224ff, masters, ipa, etc,
dev.purestake.tech
dn:
cn=oh-ipa-21.dev.purestake.tech+nsuniqueid=1c90f4ab-0c7611ee-82aaaf7c-510224ff,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# KDC + 1c90f4b1-0c7611ee-82aaaf7c-510224ff, oh-ipa-21.dev.purestake.tech, masters, ipa,
etc, dev.purestake.tech
dn:
cn=KDC+nsuniqueid=1c90f4b1-0c7611ee-82aaaf7c-510224ff,cn=oh-ipa-21.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# KPASSWD + 1c90f4b2-0c7611ee-82aaaf7c-510224ff, oh-ipa-21.dev.purestake.tech, masters,
ipa, etc, dev.purestake.tech
dn:
cn=KPASSWD+nsuniqueid=1c90f4b2-0c7611ee-82aaaf7c-510224ff,cn=oh-ipa-21.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# oh-ipa-21.dev.purestake.tech + 03d60e2b-0c7911ee-9fd2cbfa-da889042, masters, ipa, etc,
dev.purestake.tech
dn:
cn=oh-ipa-21.dev.purestake.tech+nsuniqueid=03d60e2b-0c7911ee-9fd2cbfa-da889042,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# KDC + 03d60e31-0c7911ee-9fd2cbfa-da889042, oh-ipa-21.dev.purestake.tech, masters, ipa,
etc, dev.purestake.tech
dn:
cn=KDC+nsuniqueid=03d60e31-0c7911ee-9fd2cbfa-da889042,cn=oh-ipa-21.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# oh-ipa-21.dev.purestake.tech + 3680061c-0c7911ee-9fd2cbfa-da889042, servers, dns,
dev.purestake.tech
dn:
idnsserverid=oh-ipa-21.dev.purestake.tech+nsuniqueid=3680061c-0c7911ee-9fd2cbfa-da889042,cn=servers,cn=dns,dc=dev,dc=purestake,dc=tech
# joe-rocky-9.dev.purestake.tech + c8be1f14-0eb011ee-b6bda485-29466b86, masters, ipa, etc,
dev.purestake.tech
dn:
cn=joe-rocky-9.dev.purestake.tech+nsuniqueid=c8be1f14-0eb011ee-b6bda485-29466b86,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# KDC + c8be1f1a-0eb011ee-b6bda485-29466b86, joe-rocky-9.dev.purestake.tech, masters, ipa,
etc, dev.purestake.tech
dn:
cn=KDC+nsuniqueid=c8be1f1a-0eb011ee-b6bda485-29466b86,cn=joe-rocky-9.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# KPASSWD + c8be1f1b-0eb011ee-b6bda485-29466b86, joe-rocky-9.dev.purestake.tech, masters,
ipa, etc, dev.purestake.tech
dn:
cn=KPASSWD+nsuniqueid=c8be1f1b-0eb011ee-b6bda485-29466b86,cn=joe-rocky-9.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# HTTP + d673a48a-0eb011ee-b6bda485-29466b86, joe-rocky-9.dev.purestake.tech, masters,
ipa, etc, dev.purestake.tech
dn:
cn=HTTP+nsuniqueid=d673a48a-0eb011ee-b6bda485-29466b86,cn=joe-rocky-9.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# OTPD + d673a48b-0eb011ee-b6bda485-29466b86, joe-rocky-9.dev.purestake.tech, masters,
ipa, etc, dev.purestake.tech
dn:
cn=OTPD+nsuniqueid=d673a48b-0eb011ee-b6bda485-29466b86,cn=joe-rocky-9.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# KEYS + d673a48c-0eb011ee-b6bda485-29466b86, joe-rocky-9.dev.purestake.tech, masters,
ipa, etc, dev.purestake.tech
dn:
cn=KEYS+nsuniqueid=d673a48c-0eb011ee-b6bda485-29466b86,cn=joe-rocky-9.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
# joe-rocky-9.dev.purestake.tech + f441099b-0eb011ee-b6bda485-29466b86, servers, dns,
dev.purestake.tech
dn:
idnsserverid=joe-rocky-9.dev.purestake.tech+nsuniqueid=f441099b-0eb011ee-b6bda485-29466b86,cn=servers,cn=dns,dc=dev,dc=purestake,dc=tech
# DNS + f441099e-0eb011ee-b6bda485-29466b86, joe-rocky-9.dev.purestake.tech, masters, ipa,
etc, dev.purestake.tech
dn:
cn=DNS+nsuniqueid=f441099e-0eb011ee-b6bda485-29466b86,cn=joe-rocky-9.dev.purestake.tech,cn=masters,cn=ipa,cn=etc,dc=dev,dc=purestake,dc=tech
I was able to ldapdelete those entries and then the servers that I couldn’t before.
They’re now gone from the GUI and CLI lists.
Thanks so much!
Just for concise searching in the future, I did this ldap searc command from a
functioning/existing IPA server:
ldapsearch -D "cn=Directory Manager” -W -b "dc=dev,dc=purestake,dc=tech"
-o ldif-wrap=no "(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))” dn
which gave me a list of replication error objects above. (It had nothing to do with the
nsTombstone objects as I had been thinking earlier.) I then uses standard ldapdelete
commands to delete those objects (as -D "cn=Directory Manager”) and then the servers
deleted normally.