freeipa

#9289 Configure server affinity during replica installation
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

Failures have been seen during non-CA replica installation, frequently when certmonger is trying to retrieve certificates, getting CA_REJECTED:

2022-11-22T14:30:11Z DEBUG Cert request 20221122143010 failed: CA_REJECTED (Server at https://ipa.example.test/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)).)

The working assumption is that there is no affinity during installation so it is a race between the installer and replication.

At least one user in this situation was able to successfully install by doing a client promotion installation with:

  • update /etc/krb5.conf to set dns_lookup_realm = false and add a kdc to the REALM section.
  • update /etc/sssd/sssd.conf to set ipa_server = SERVER_TO_CONNECT_TO (removed srv).
  • update /etc/ipa/default.conf to set references to an IPA server to SERVER_TO_CONNECT_TO

These steps are not always successful but it they may be part of an eventual solution.

I have confirmed that modifying the settings prior to install are overwritten during the installation resulting in a correct configuration.

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2149344

Metadata Update from @rcritten:
- Issue assigned to rcritten

A question is: do we automatically switch to a server that provides the new service (CA or KRA) or fail?

My feeling is that in the promotion case we change the server because otherwise users are going to end up deleting agreements, twiddling with config files, etc.

For a non-promotion replica install (with --server) failing is fine since we prevent a bad setup.

master:

  • 45fa43540f6a436c94f0484cec6e252e99d06fa7 Configure affinity during server installation

ipa-4-9:

  • 3af7747364d184c8ef5bad8ea1654b12c529727b Configure affinity during server installation
  • 0cf6292f9c5d0cb31d57439e234a4e8640edc64f Don't assume KRB5CCNAME is in the environment in replica install

master:

  • f248b22 Don't assume KRB5CCNAME is in the environment in replica install

ipa-4-11:

  • 54a251bceaabfaf82d0a18b2614c261e2bded0c0 Configure affinity during server installation
  • 169f9abb6b9fdc11dc5d3e4ec8e6e9c3ef4dfd4f Don't assume KRB5CCNAME is in the environment in replica install

ipa-4-10:

  • 08dad8f8d75b965eb7c113a5710b0b3519df41dc Configure affinity during server installation
  • 74f664685a4e689f0fd42e253310425b97d6c4ea Don't assume KRB5CCNAME is in the environment in replica install

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to Replica installation process now happens against a chosen server, not only for Kerberos authentication but also for all IPA API and CA requests. This helps to avoid incomplete replicated details when adding a new replica to a complex topology.

master:

  • 2a95a05f9e2b965d0a5f5946d59f614d8baea8e2 Server affinity: Retain user-requested remote server

ipa-4-11:

  • d2ffa10df62bba45aa63232d3ad9a5ebf7158eea Server affinity: Retain user-requested remote server

ipa-4-10:

  • fdc27b255d39efc17123ace567d5e0a12a81dd37 Server affinity: Retain user-requested remote server

ipa-4-9:

  • 3add9ba03a0af913d03b1f5ecaa8e48e46a93f91 Server affinity: Retain user-requested remote server
Metadata
None
None
None
Low
Replica installation process now happens against a chosen server, not only for Kerberos authentication but also for all IPA API and CA requests. This helps to avoid incomplete replicated details when adding a new replica to a complex topology.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.