freeipa

#6649 ipa-client install EXIT code wrong when host already enrolled
Closed: Invalid Opened by tisc0.

Closed: Invalid
Reopen Issue

Context : [[BR]]
Trying to enroll a host already enrolled.[[BR]]

Command used :[[BR]]

/usr/sbin/ipa-client-install --principal=enroller --password=xxxx --mkhomedir --no-ntp --unattended

Output :[[BR]]

[pts-0][root@theforeman ~]#  /usr/sbin/ipa-client-install --principal=enroller --password=XXXXXXX --mkhomedir --no-ntp --unattended[[BR]]
Using existing certificate '/etc/ipa/ca.crt'.
Discovery was successful!
Client hostname: theforeman.my.domain
Realm: LAN.MY.DOMAIN
DNS Domain: lan.my.domain
IPA Server: directory2.lan.my.domain
BaseDN: dc=lan,dc=my,dc=domain
Skipping synchronizing time with NTP server.
Joining realm failed: Host is already joined.
Use --force-join option to override the host entry on the server and force client enrollment.
Installation failed. Rolling back changes.
IPA client is not configured on this system.
[pts-0][root@theforeman ~]#  echo $?
1
output expected : 3

From the man :

EXIT STATUS
       0 if the installation was successful
       1 if an error occurred
       2 if uninstalling and the client is not configured
       3 if installing and the client is already configured
       4 if an uninstall error occurred

Packages version :

ipa-admintools-4.4.0-14.el7.centos.4.noarch
ipa-client-common-4.4.0-14.el7.centos.4.noarch
ipa-client-4.4.0-14.el7.centos.4.x86_64
etc...

Thanks !

Seems correct behavior to me. Client entry existed on IPA server(was enrolled) but the to-be-client host was not configured as ipa client therefore 3 should not be returned.

It even said: IPA client is not configured on this system.

Right, the reported case does not have a specific return value. A 3 means that the client is already locally configured, not that the host is already enrolled (though that is also assumed).

It is probably possible to add a specific return value for this but I don't know what value it would add unless the automation would be able to do either a host-del or a host-disable and then re-try the installation (the return values are mostly to enable automation, after all).

Hi,
Sorry guyz, you're right, I read too fast this afternoon.[[BR]]
Indeed, it's about automation, and I guess I should simply use the option --force-join for my case (boostraping a host, possibly a broken one I reinstall and reconfigure).[[BR]]

I'll check if there are some consequences using that option.

Thanks

Closing as not a bug.

Metadata Update from @tisc0:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE
Metadata
None
None
None
Normal
defect
IPA
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.