freeipa

#8841 ipa-replica-install dies on remove_temp_replication_user
Closed: insufficientinfo by pcech. Opened by hillar.

Closed: insufficientinfo
Reopen Issue

Issue

ipa-replica-install dies on remove_temp_replication_user

Steps to Reproduce

# cat /etc/redhat-release 
Fedora release 34 (Thirty Four)
# ipa --version
VERSION: 4.9.3, API_VERSION: 2.240
# ipa-replica-install --version
4.9.3
# ipa-replica-install
...
Starting replication, please wait until this has completed.
Update in progress, 18 seconds elapsed
Update succeeded
  [error] NetworkError: cannot connect to 'ldapi://%2Frun%2Fslapd-IDM-LAB-LOCAL.socket': Broken pipe
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
cannot connect to 'ldapi://%2Frun%2Fslapd-IDM-LAB-LOCAL.socket': Broken pipe
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

/var/log/ipareplica-install.log

2021-05-17T07:36:03Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipa2.idm.lab.local,cn=replica,cn=dc\=idm\,dc\=lab\,dc\=local,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'], 'cn': [b'meToipa2.idm.lab.local'], 'nsDS5ReplicaHost': [b'ipa2.idm.lab.local'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=idm,dc=lab,dc=local'], 'description': [b'me to ipa2.idm.lab.local'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'19700101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (0) No replication sessions started since server startup'], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "green", "ldap_rc": "0", "ldap_rc_text": "success", "repl_rc": "0", "repl_rc_text": "replica acquired", "date": "2021-05-17T07:36:03Z", "message": "Error (0) No replication sessions started since server startup"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})]
2021-05-17T07:36:25Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1085, in error_handler
    yield
  File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1718, in delete_entry
    self.conn.delete_s(str(dn))
  File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 569, in delete_s
    return self.delete_ext_s(dn,None,None)
  File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 561, in delete_ext_s
    msgid = self.delete_ext(dn,serverctrls,clientctrls)
  File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 558, in delete_ext
    return self._ldap_call(self._l.delete_ext,dn,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
  File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 340, in _ldap_call
    reraise(exc_type, exc_value, exc_traceback)
  File "/usr/lib64/python3.9/site-packages/ldap/compat.py", line 46, in reraise
    raise exc_value
  File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 324, in _ldap_call
    result = func(*args,**kwargs)
ldap.SERVER_DOWN: {'result': -1, 'desc': "Can't contact LDAP server", 'errno': 32, 'ctrls': [], 'info': 'Broken pipe'}
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 635, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 621, in run_step
    method()
  File "/usr/lib/python3.9/site-packages/ipaserver/install/dsinstance.py", line 425, in __setup_replica
    repl.setup_promote_replication(
  File "/usr/lib/python3.9/site-packages/ipaserver/install/replication.py", line 1924, in setup_promote_replication
    self.remove_temp_replication_user(self.conn, r_hostname)
  File "/usr/lib/python3.9/site-packages/ipaserver/install/replication.py", line 1890, in remove_temp_replication_user
    conn.delete_entry(replica_binddn)
  File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1718, in delete_entry
    self.conn.delete_s(str(dn))
  File "/usr/lib64/python3.9/contextlib.py", line 135, in __exit__
    self.gen.throw(type, value, traceback)
  File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1138, in error_handler
    raise errors.NetworkError(uri=self.ldap_uri,
ipalib.errors.NetworkError: cannot connect to 'ldapi://%2Frun%2Fslapd-IDM-LAB-LOCAL.socket': Broken pipe
2021-05-17T07:36:25Z DEBUG   [error] NetworkError: cannot connect to 'ldapi://%2Frun%2Fslapd-IDM-LAB-LOCAL.socket': Broken pipe
2021-05-17T07:36:25Z DEBUG Destroyed connection context.ldap2_139625630242944
2021-05-17T07:36:25Z DEBUG Backing up system configuration file '/etc/ipa/default.conf'
2021-05-17T07:36:25Z DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index'
2021-05-17T07:36:25Z DEBUG Writing configuration file /etc/ipa/default.conf
2021-05-17T07:36:25Z DEBUG [global]
basedn = dc=idm,dc=lab,dc=local
host = ipa-test2-f34.idm.lab.local
realm = IDM.lab.local
domain = idm.lab.local
xmlrpc_uri = https://ipa-test2-f34.idm.lab.local/ipa/xml
ldap_uri = ldapi://%2Frun%2Fslapd-IDM-LAB-LOCAL.socket
mode = production
enable_ra = True
ra_plugin = dogtag
dogtag_version = 10
ca_host = ipa2.idm.lab.local
2021-05-17T07:36:25Z DEBUG   File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute
    return_value = self.run()
  File "/usr/lib/python3.9/site-packages/ipapython/install/cli.py", line 342, in run
    return cfgr.run()
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 360, in run
    return self.execute()
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 386, in execute
    for rval in self._executor():
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 431, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
    raise value
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 421, in __runner
    step()
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 418, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
    raise value
  File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 655, in _configure
    next(executor)
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 431, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 518, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
    raise value
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 515, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
    raise value
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 421, in __runner
    step()
  File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 418, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
    raise value
  File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python3.9/site-packages/ipapython/install/common.py", line 65, in _install
    for unused in self._installer(self.parent):
  File "/usr/lib/python3.9/site-packages/ipaserver/install/server/__init__.py", line 608, in main
    replica_install(self)
  File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated
    func(installer)
  File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 1253, in install
    ds = install_replica_ds(config, options, ca_enabled,
  File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 100, in install_replica_ds
    ds.create_replica(
  File "/usr/lib/python3.9/site-packages/ipaserver/install/dsinstance.py", line 393, in create_replica
    self.start_creation(runtime=30)
  File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 635, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 621, in run_step
    method()
  File "/usr/lib/python3.9/site-packages/ipaserver/install/dsinstance.py", line 425, in __setup_replica
    repl.setup_promote_replication(
  File "/usr/lib/python3.9/site-packages/ipaserver/install/replication.py", line 1924, in setup_promote_replication
    self.remove_temp_replication_user(self.conn, r_hostname)
  File "/usr/lib/python3.9/site-packages/ipaserver/install/replication.py", line 1890, in remove_temp_replication_user
    conn.delete_entry(replica_binddn)
  File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1718, in delete_entry
    self.conn.delete_s(str(dn))
  File "/usr/lib64/python3.9/contextlib.py", line 135, in __exit__
    self.gen.throw(type, value, traceback)
  File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1138, in error_handler
    raise errors.NetworkError(uri=self.ldap_uri,

Actual behavior

replication installation fails

Version/Release/Distribution

freeipa-server-4.9.3-2.fc34.x86_64
freeipa-client-4.9.3-2.fc34.x86_64
389-ds-base-2.0.3-3.fc34.x86_64
pki-ca-10.10.5-6.fc34.noarch
krb5-server-1.19.1-3.fc34.x86_64

Additional info:

it worked before with version 4.8..

Hi @hillar
can you check if 389-ds coredumped? You should be able to see a trace in the journal.
If the stack trace mentions csnset_purge you may have hit an issue in 389-ds: https://github.com/389ds/389-ds-base/issues/4670

And this issue would be a duplicate of https://pagure.io/freeipa/issue/8756

if 389-ds coredumped?

yes

If the stack trace mentions csnset_purge

no

Hi @hillar
there are 2 ways to move forward:
- you can paste the stack trace in this ticket and we will check if it's an issue that we already saw and follow up with 389-ds team
or
- you can directly open an issue against 389-ds at New bug report and we will close this ticket, tracking will be done in 389-ds project. They will need the stack trace and the commands that triggered the coredump.
Both ways work for us.

Thank you taking your time and submitting this request for FreeIPA.
I am afraid, this bug is stale now. So I am about close it.
FreeIPA Product Owner

Metadata Update from @pcech:
- Issue close_status updated to: insufficientinfo
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.