Issue #6051: kadmin.local error on adding ldap/$replica service principal on ipa-replica-install - freeipa

freeipa

#6051 kadmin.local error on adding ldap/$replica service principal on ipa-replica-install

Closed: Invalid Opened Jul 11, 2016 by zacekm.

I installed new server and on the current IPA master (fido2.img.local) created gpg replica file (ipa-replica-prepare fido1.img.local). When I tried create replica on the new server with command "ipa-replica-install /var/lib/ipa/replica-info-fido1.img.local.gpg" I got this error:

... cut ...
Configuring Kerberos KDC (krb5kdc). Estimated time: 30 seconds
  [1/8]: adding sasl mappings to the directory
  [2/8]: configuring KDC
  [3/8]: creating a keytab for the directory
  [error] CalledProcessError: Command ''kadmin.local' '-q' 'addprinc -randkey ldap/fido1.img.local@IMG.LOCAL' '-x' 'ipa-setup-override-restrictions'' returned non-zero exit status 1
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

Full log attached.

zacekm commented Jul 11, 2016

attachment
ipareplica-install.log

zacekm commented Jul 11, 2016

System: CentOS Linux release 7.2.1511 - 3.10.0-327.22.2.el7.x86_64

pvoborni commented Jul 12, 2016

Are krb- and ipa- packages up to date? What is the version of krb5-* packages?

Does it work with the latest versions?

zacekm commented Jul 12, 2016

Yes, everything is up to date.

[root@fido1 ~]# rpm -qa | grep krb5- [[br]]
sssd-krb5-common-1.13.0-40.el7_2.9.x86_64
krb5-libs-1.13.2-12.el7_2.x86_64
krb5-workstation-1.13.2-12.el7_2.x86_64
krb5-pkinit-1.13.2-12.el7_2.x86_64
sssd-krb5-1.13.0-40.el7_2.9.x86_64
krb5-server-1.13.2-12.el7_2.x86_64
pam_krb5-2.4.8-4.el7.x86_64

[root@fido1 ~]# rpm -qa | grep ipa- [[br]]
ipa-server-dns-4.2.0-15.0.1.el7.centos.17.x86_64
ipa-client-4.2.0-15.0.1.el7.centos.17.x86_64
ipa-server-4.2.0-15.0.1.el7.centos.17.x86_64
ipa-admintools-4.2.0-15.0.1.el7.centos.17.x86_64
ipa-python-4.2.0-15.0.1.el7.centos.17.x86_64
sssd-ipa-1.13.0-40.el7_2.9.x86_64

zacekm commented Jul 12, 2016

I tried dig little deeper and I found there is different version of krb5-server on servers. Older on working IPA server is krb5-server-1.13.2-10.el7.x86_64 and on new server is krb5-server-1.13.2-12.el7_2.x86_64.

When I straced "kadmin.local -q list_principals -p admin/admin@IMG.LOCAL" I found difference in reading from LDAP. Interesting part of strace from both server attached (Line 13-14 and 28-29). Ldapsearch on cn=IMG.LOCAL,cn=kerberos,dc=img,dc=local looks the same on both servers.

zacekm commented Jul 12, 2016

attachment
strace__kadmin.local_-q_list_principals

simo commented Jul 19, 2016

if you go on the current master and list principals, do you find that ldap/fido1.img.local@IMG.LOCAL already exists by chance ?

pvoborni commented Aug 12, 2016

Closing due to insufficient info.

Metadata Update from @zacekm:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

Feb 27, 2017