freeipa

#9473 IPA won't restart after adding a replica
Closed: invalid by abompard. Opened by abompard.

Closed: invalid
Reopen Issue

Issue

I have an IPA server on RHEL 8.8 with ipa-server-4.9.11-7.module+el8.8.0+19639+24a8b95c.x86_64.
I've added a replica on RHEL 9.2 with ipa-server-4.10.1-9.el9_2.x86_64.
Now my master on RHEL 8.8 won't restart, with the error I am attaching. (I'm running ipa start)

I suppose it comes from adding the replica, but I'm not certain, I don't know when IPA was last restarted on that machine.

Edited by abompard

Oct 24 14:21:12 ipa01.stg.iad2.fedoraproject.org ns-slapd[4175339]: [24/Oct/2023:14:21:12.315226832 +0000] - ERR - memberof-plugin - memberof_config - Error 53: The ipaOwner configuration attribute must be set to an attribute defined to use either the Distinguished Name or Name and Optional UID syntax. (illegal value: memberOfGroupAttr)
Oct 24 14:21:12 ipa01.stg.iad2.fedoraproject.org ns-slapd[4175339]: [24/Oct/2023:14:21:12.315820346 +0000] - ERR - memberof-plugin - memberof_postop_start - Configuration failed (Server is unwilling to perform)

Can you share the contents of dn: cn=MemberOf Plugin,cn=plugins,cn=config

You can find it in /etc/dirsrv/slapd-REALM/dse.ldif even if the server isn't running.

You might also want to compare dse.ldif and dse.ldif.startOK to see if there are any notable differences.

I think IdP-related schema is missing here.

I'm currently reinstalling that server from its replica, I'll do a full backup and then I'll be able to experiment a bit to reproduce this issue, if that helps. Sorry, I couldn't leave that host down for too long.

Any progress?

I tried reproducing it but the restart worked fine this time, so it was not caused by the RHEL9 replica being added

Metadata Update from @abompard:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.