freeipa

#9927 Random failure in ipa-replica-install: corrupt entry
Opened by frenaud. Modified

Open
Close Issue

Issue

The installation of an ipa replica randomly fails with a corrupt replication agreement entry.
I already saw the error a few times, but it happens rarely and I want to log the issue as it could be related to a memory corruption.
The issue was seen when testing IPA master branch with the copr repo @pki/master enabled.

Steps to Reproduce

Seen in this run: https://idm-artifacts.psi.redhat.com/idm-ci/freeipa_upstream_nightly/Nightly-latest-pki/master/2026-01-24_11-19/pki/test_cert/1/report.html?sort=result

Actual behavior

ipa-replica-install fails in the final step that is upgrading the server:

...
Configuring Kerberos KDC (krb5kdc)
  [1/1]: installing X509 Certificate for PKINIT
Done configuring Kerberos KDC (krb5kdc).
Applying LDAP updates
Upgrading IPA:. Estimated time: 1 minute 30 seconds
  [1/10]: stopping directory server
  [2/10]: saving configuration
  [3/10]: disabling listeners
  [4/10]: enabling DS global lock
  [5/10]: disabling Schema Compat
  [6/10]: starting directory server
  [7/10]: upgrading server
Upgrade failed with attribute "mntryid" not allowed
  [error] RuntimeError: attribute "mntryid" not allowed
  [cleanup]: stopping directory server
  [cleanup]: restoring configuration
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
Update failed: attribute "mntryid" not allowed
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
Exit code: 1

Expected behavior

Should complete successfully

Version/Release/Distribution

389-ds-base-3.1.3-10.fc43.x86_64
dogtag-pki-server-11.10.0~alpha1^20260123091436.487a56cd-1.fc43.noarch
freeipa-server-4.14.0.dev202601230909+gitbcd6e9a2f-0.fc43.x86_64

I discussed the issue with tbordaz (from 389ds team) and he suspects it may be the same issue as https://github.com/389ds/389-ds-base/issues/7108

7108 was fixed in 389-ds-base-3.1.4-4.fc43 that reached the stable repo Jan 27.
I will keep on monitoring our nightly tests and check if it happens again with the new 389 ds version.

Metadata Update from @frenaud:
- Issue tagged with: tracker
Metadata
None

test-failure tracker

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.