freeipa

#6245 replica installation advertises --force option which is not supported by ipa-replica-install
Opened by ofayans. Modified

Open
Close Issue

Replica installation under domain level 1 in our lab suffers from 2 issues.

  1. When I try to install the replica without client installation with the following command:

    ipa-replica-install --server vm-185.example.test -n dom-185.example.test -r DOM-185.EXAMPLE.TEST -U -w ''

I get some other error:

In unattended mode without a One Time Password (OTP) or without --ca-cert-file
You must specify --force to retrieve the CA cert using HTTP
Cannot obtain CA certificate
HTTP certificate download requires --force
Installation failed. Rolling back changes.

Now the most funny thing is: when I do add '--force' to ipa-replica-install command arguments, it does not recognize it:

# ipa-replica-install --server vm-185.example.test -n dom-185.example.test -r DOM-185.EXAMPLE.TEST -U -w '<admin_pass>' --force
WARNING: yacc table file version is out of date
Usage: ipa-replica-install [options] [REPLICA_FILE]
ipa-replica-install: error: no such option: --force

I used the packages built from master branch at 2016.08.21

ipareplica-install.log from the direct replica installation (no client was previously installed)
ipareplica-install.log_clientless

ipareplica-install.log from promotion of the previously installed client
ipareplica-install.log

Client logs are missing so it is unclear what happened. We need to reproduce this first.

modifying the ticket just into the second issue, the first issue is just a configuration problem(as said on triage)

For the record this was the first issue:

  1. When I install client first and then promote it to replica without specifying '--server' option, like this:

    ipa-replica-install -w '' -U --setup-ca -r DOM-185.EXAMPLE.TEST

The installation fails with the error:

ipa.ipapython.install.cli.install_tool(Replica): ERROR    The host name vm-185.dom-185.example.test does not match the primary host name vm-185.example.test. Please check /etc/hosts or DNS name resolution

Metadata Update from @ofayans:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5 backlog

This ticket is very unclear and the clarification even less so.

The original problem seems real. The client installer could run and not be able to negotiate getting the CA cert and very well could spit out the error message including --force which is not actually a valid option in a replica installation.

Without logs it isn't possible to figure out why the client installer tried to fall back to HTTP.

I don't understand what the first versus the second issues are. If the "first" issue provoked the error message then it is completely related.

Metadata Update from @rcritten:
- Issue close_status updated to: None
Metadata
None
None
None
Normal
defect
IPA
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.