freeipa

#6463 DL1 replica install can fail due to replication-related race conditions
Closed: Invalid Opened by mbabinsk.

Closed: Invalid
Reopen Issue

In DL! replica installation can sometimes fail during the [10/20]: setting up ssl step witht he following traceback shown in debug mode:

<SNIP>
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 888, in install
    api_instance=remote_api)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 179, in install_http
    ca_is_configured=ca_is_configured, promote=promote)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 190, in create_instance
    self.start_creation(runtime=60)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 476, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 466, in run_step
    method()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 366, in __setup_ssl
    self.add_cert_to_service()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 341, in add_cert_to_service
    entry = self.admin_conn.get_entry(dn)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1473, in get_entry
    size_limit=size_limit
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1297, in get_entries
    base_dn=base_dn, scope=scope, filter=filter, attrs_list=attrs_list)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1429, in find_entries
    break
  File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__
    self.gen.throw(type, value, traceback)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 960, in error_handler
    raise errors.NotFound(reason=arg_desc or 'no such entry')
ipa.ipapython.install.cli.install_tool(Replica): DEBUG    The ipa-replica-install command failed, exception: NotFound: no such entry
ipa.ipapython.install.cli.install_tool(Replica): ERROR    no such entry
ipa.ipapython.install.cli.install_tool(Replica): ERROR    The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

The root cause is that the HTTP service principal is added to the remote master first and then there is an attempt to add certificate blob to the service entry. using local LDAP connection.

If, however, the entry is not replicated from the master in time, the entry DN is not found, hence the crash.

We should fix the code to either use local LDAP for service principal addition (this is not a problem since local DS w/ LDAPI is already up and running) or we should wait for the replicated entry to pop up in the local LDAP tree before continuing with subsequent steps.

Since the bug originates in the code added during replica promotion implementation, all version of FreeIPA since 4.3.0 may be affected by this race condition.

Actually the state described in the ticket is impossible to achieve with the current code and there must have been some environmental issue causing this. Closing as invalid.

Metadata Update from @mbabinsk:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.4.3
Metadata
None
None
None
Low
defect
IPA
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.