freeipa

#6109 Problem Installing a Replica server on Fedora 24
Closed: Invalid Opened by fauclair.

Closed: Invalid
Reopen Issue

Lately I have been trying to upgrade our freeipa setup. We currently are on a freeipa 3.0 on a centOS container in a promox infrastructure. The proxmox infrastructure has a "limited" core which I cant update... So Basicly my container is limited to centos 6.2 and freeipa 3.0.

So my option is to create a VM with either CentOS 7 or Fedora 24, install the most recent freeipa replica server and transfert my master from the old one to the most recent IPA.

Upon testing with Centos 7, I had installation Issues related to the Dogtag 10 version available for the us; Dogtag (pki-ca) had to be 10.2.6 in order to fix the issiue but in centos 7 the most recent version accessible is 10.2.5. So I went forward and created a Fedora VM since it has the correct version availaible.

I followed red hat's and fedora instructions and I get an installation error upon the step:

[26/41]: setting up initial replication 
[error] UNWILLING_TO_PERFORM: {'info': 'modification of attribute nsds5replicabinddngroup is not allowed in replica entry', 'desc': 'Server is unwilling to perform'}
Your system may be partly configured. 
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipa.ipapython.install.cli.install_tool(Replica): ERROR    {'info': 'modification of attribute nsds5replicabinddngroup is not allowed in replica entry', 'desc': 'Server is unwilling to perform'}
ipa.ipapython.install.cli.install_tool(Replica): ERROR    The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

\
And in the log it says: \
\

2016-07-21T14:53:06Z DEBUG stderr= \\
2016-07-21T14:53:06Z DEBUG wait_for_open_ports: localhost [389] timeout 300 \\
2016-07-21T14:53:06Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] \\
2016-07-21T14:53:06Z DEBUG flushing ldap://freeipa01.chose.lan:389 from SchemaCache
2016-07-21T14:53:06Z DEBUG retrieving schema for SchemaCache url=ldap://freeipa01.chose.lan:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fd0569afc20> \\
2016-07-21T14:53:06Z DEBUG Successfully updated nsDS5ReplicaId. \\
2016-07-21T14:53:06Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-CHOSE-LAN.socket from SchemaCache \\
2016-07-21T14:53:06Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-CHOSE-LAN.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fd056be0050> \\
2016-07-21T14:53:07Z DEBUG Traceback (most recent call last): \\
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 447, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 437, in run_step
    method()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 418, in __setup_replica
    r_bindpw=self.dm_password)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 1019, in setup_replication
    self.repl_man_dn, self.repl_man_passwd)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 991, in basic_replication_setup
    self.replica_config(conn, replica_id, repldn)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 453, in replica_config
    conn.modify_s(dn, mod)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1653, in modify_s
    return self.conn.modify_s(dn, modlist)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 402, in modify_s
    return self.result(msgid,all=1,timeout=self.timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 503, in result
    resp_type, resp_data, resp_msgid = self.result2(msgid,all,timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 507, in result2
    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all,timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 514, in result3
    resp_ctrl_classes=resp_ctrl_classes
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 521, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 106, in _ldap_call
    result = func(*args,**kwargs)
UNWILLING_TO_PERFORM: {'info': 'modification of attribute nsds5replicabinddngroup is not allowed in replica entry', 'desc': 'Server is unwilling to perform'}
2016-07-21T14:53:07Z DEBUG   [error] UNWILLING_TO_PERFORM: {'info': 'modification of attribute nsds5replicabinddngroup is not allowed in replica entry', 'desc': 'Server is unwilling to perform'}
2016-07-21T14:53:07Z DEBUG Destroyed connection context.ldap2_140532806887696
2016-07-21T14:53:07Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 318, in run
    cfgr.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 310, in run
    self.execute()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in execute
    for nothing in self._executor():
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 372, in __runner
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 359, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 586, in _configure
    next(executor)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 372, in __runner
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 449, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 446, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 359, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
    for nothing in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1657, in main
    install(self)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 377, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 793, in install
    ds = install_replica_ds(config, options, ca_enabled)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 125, in install_replica_ds
    promote=promote,
  File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 399, in create_replica
    self.start_creation(runtime=60)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 447, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 437, in run_step
    method()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 418, in __setup_replica
    r_bindpw=self.dm_password)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 1019, in setup_replication
    self.repl_man_dn, self.repl_man_passwd)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 991, in basic_replication_setup
    self.replica_config(conn, replica_id, repldn)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 453, in replica_config
    conn.modify_s(dn, mod)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1653, in modify_s
    return self.conn.modify_s(dn, modlist)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 402, in modify_s
    return self.result(msgid,all=1,timeout=self.timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 503, in result
    resp_type, resp_data, resp_msgid = self.result2(msgid,all,timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 507, in result2
    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all,timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 514, in result3
    resp_ctrl_classes=resp_ctrl_classes
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 521, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 106, in _ldap_call
    result = func(*args,**kwargs)
2016-07-21T14:53:07Z DEBUG The ipa-replica-install command failed, exception: UNWILLING_TO_PERFORM: {'info': 'modification of attribute nsds5replicabinddngroup is not allowed in replica entry', 'desc': 'Server is unwilling to perform'} \\
2016-07-21T14:53:07Z ERROR {'info': 'modification of attribute nsds5replicabinddngroup is not allowed in replica entry', 'desc': 'Server is unwilling to perform'} \\
2016-07-21T14:53:07Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information \\

So sum everything:

  • Master on centos 6.0 with freeipa 3.0. I cant really upgrade it
  • Trying to do a replica server on Fedora 24 with freeipa 4.3.1 with --setup-ca
  • Stuck during the ipa-replica-install at step [26/41]: setting up initial replication

Thanks,

Migration from 6.2 is not support. The preferred way is to update to 6.8 and then migrate by installing 7.x or f24 replica.

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/upgrading.html#migrating-ipa-proc

The version of 389ds you have does not support nsds5replicabinddngroup, can you update your master to the latest centos 6 packages and confirm that fixes your issue ?

I would like to update my master's package to the latest centos 6 version, but this is one issue; since its a container based vm, it is dependent of the core virtualization system which is custom made. Basically I'm limited to the most up to date version of that core system. In that case I cant update the master greater than centos 6.5 since the core system is a modified version of that centos 6.5.

So the possible approach I see, is to build a new VM instead of a container, having a similar OS version to the master and install the same freeipa build that was used on the Master as a replica. Then Update replica's vm os, and then to the latest version of freeipa (on the replica).

Once done, Promote the new replica as the new master and remove the old master. Build a New replica on Centos 7/ fedora 24 with Freeipa 4.3 to be a replica of the Newest master. And then promote the fedora24 replica to be the newest Master.

In this situation I should be able to migrate from freeipa 3.0 to freeipa 4.3 while changing the OS from a custom and locked Centos 6.5 to either fedora 24 or centos 7.

Does that make sense?

Can you try to create replica to latest centos6 from container, and then continue to F24?

Metadata Update from @fauclair:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE
Metadata
None
None
None
Normal
defect
IPA
0
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.