freeipa

#9956 Problem with new replica
Closed: worksforme by frenaud. Opened by zacekm.

Closed: worksforme
Reopen Issue

Issue

I have problem with ipa-replica-install on re-installed server(fido3). Server was part of cluster before.
All server in cluster are AlmaLinux release 9.7, with VERSION: 4.12.2, API_VERSION: 2.254.
I'm trying add fido3.img.local

[root@fido1 ~] # ipa server-find

3 IPA servers matched

Server name: fido.img.local
Min domain level: 1
Max domain level: 1

Server name: fido1.img.local
Min domain level: 1
Max domain level: 1

Server name: fido2.img.local
Min domain level: 1
Max domain level: 1

Number of entries returned 3

Steps to Reproduce

I did:
[root@fido1 ~] # ipa server-del fido3.img.local --force --ignore-topology-disconnect
Removing fido3.img.local from replication topology, please wait...
ipa: WARNING: Forcing removal of fido3.img.local
ipa: WARNING: Ignoring topology connectivity errors.
ipa: WARNING: Failed to cleanup fido3.img.local DNS entries: no matching entry found
ipa: WARNING: You may need to manually remove them from the tree

Deleted IPA server "fido3.img.local"

[root@fido1 ~] # ipa server-find

3 IPA servers matched

Server name: fido.img.local
Min domain level: 1
Max domain level: 1

Server name: fido1.img.local
Min domain level: 1
Max domain level: 1

Server name: fido2.img.local
Min domain level: 1
Max domain level: 1

Number of entries returned 3

1.
On fido3:
ipa-server-install --uninstall -U
ipa-client-install --ntp-server=ntp.img.local --mkhomedir
Client works fine.

2.
ipa-replica-install -w xxxxxx --server=fido1.img.local --domain img.local --hostname=fido3.img.local

Actual behavior

.......
Upgrading IPA:. Estimated time: 1 minute 30 seconds
[1/10]: stopping directory server
[2/10]: saving configuration
[3/10]: disabling listeners
[4/10]: enabling DS global lock
[5/10]: disabling Schema Compat
[6/10]: starting directory server
[7/10]: upgrading server
Could not get dnaHostname entries in 60 seconds
Could not get dnaHostname entries in 60 seconds
[8/10]: stopping directory server
[9/10]: restoring configuration
[10/10]: starting directory server
Done.
Finalize replication settings
Restarting the KDC
Configuring SID generation
[1/7]: adding RID bases
RID bases already set, nothing to do
[2/7]: creating samba domain object
Samba domain object already exists
[3/7]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
[4/7]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
[5/7]: activating sidgen task
[6/7]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
[7/7]: adding fallback group
Fallback group already set, nothing to do
Done.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

no matching entry found
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Replica instalation fails, but on other servers replica looks OK:
[root@fido1 ~] # ipa server-role-find --role "IPA master"

4 server roles matched

Server name: fido.img.local
Role name: IPA master
Role status: enabled

Server name: fido1.img.local
Role name: IPA master
Role status: enabled

Server name: fido2.img.local
Role name: IPA master
Role status: enabled

Server name: fido3.img.local
Role name: IPA master
Role status: enabled

Number of entries returned 4

[root@fido1 ~] # ipa-replica-manage list
fido2.img.local: master
fido1.img.local: master
fido.img.local: master
fido3.img.local: master

Version/Release/Distribution

[root@fido3 ~] # rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.12.2-22.el9_7.1.x86_64
ipa-client-4.12.2-22.el9_7.1.x86_64
389-ds-base-2.7.0-10.el9_7.x86_64
package pki-ca is not installed
krb5-server-1.21.1-8.el9_6.x86_64

Additional info:

All servers are in the same vlan, no firewall, selinux Enforcing

End of the tmp/ipareplica-install.log:

2026-03-11T12:54:44Z DEBUG AD Trusts are not enabled on this server
2026-03-11T12:54:44Z DEBUG update_entry modlist [(1, 'ipaconfigstring', [b'configuredService']), (0, 'ipaconfigstring', [b'enabledService'])]
2026-03-11T12:54:44Z DEBUG Set service ['KDC'] for fido3.img.local to enabledService
2026-03-11T12:54:44Z DEBUG update_entry modlist [(1, 'ipaconfigstring', [b'configuredService']), (0, 'ipaconfigstring', [b'enabledService'])]
2026-03-11T12:54:44Z DEBUG Set service ['KPASSWD'] for fido3.img.local to enabledService
2026-03-11T12:54:44Z DEBUG update_entry modlist [(1, 'ipaconfigstring', [b'configuredService']), (0, 'ipaconfigstring', [b'enabledService'])]
2026-03-11T12:54:44Z DEBUG Set service ['HTTP'] for fido3.img.local to enabledService
2026-03-11T12:54:44Z DEBUG update_entry modlist [(1, 'ipaconfigstring', [b'configuredService']), (0, 'ipaconfigstring', [b'enabledService'])]
2026-03-11T12:54:44Z DEBUG Set service ['OTPD'] for fido3.img.local to enabledService
2026-03-11T12:54:44Z DEBUG update_entry modlist [(1, 'ipaconfigstring', [b'configuredService']), (0, 'ipaconfigstring', [b'enabledService'])]
2026-03-11T12:54:44Z DEBUG Set service ['KEYS'] for fido3.img.local to enabledService
2026-03-11T12:54:44Z DEBUG raw: dns_update_system_records(version='2.254')
2026-03-11T12:54:44Z DEBUG dns_update_system_records(dry_run=False, all=False, raw=False, version='2.254')
2026-03-11T12:54:44Z DEBUG raw: server_find(None, version='2.254', no_members=False, servrole='IPA master')
2026-03-11T12:54:44Z DEBUG server_find(None, all=False, raw=False, version='2.254', no_members=False, pkey_only=False, servrole=('IPA master',))
2026-03-11T12:54:44Z DEBUG raw: server_role_find(None, server_server=None, role_servrole='IPA master', status='enabled', include_master=True, version='2.254')
2026-03-11T12:54:44Z DEBUG server_role_find(None, server_server=None, role_servrole='IPA master', status='enabled', include_master=True, all=False, raw=False, version='2.254')
2026-03-11T12:54:44Z DEBUG File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 219, in execute
return_value = self.run()
File "/usr/lib/python3.9/site-packages/ipapython/install/cli.py", line 343, in run
return cfgr.run()
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 360, in run
return self.execute()
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 386, in execute
for rval in self._executor():
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 435, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 425, in __runner
step()
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 419, in step_next
return next(self.__gen)
File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 663, in _configure
next(executor)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 435, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 526, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 523, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 425, in __runner
step()
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 419, in step_next
return next(self.__gen)
File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.9/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python3.9/site-packages/ipaserver/install/server/init.py", line 687, in main
replica_install(self)
File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 387, in decorated
func(installer)
File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 1483, in install
api.Command.dns_update_system_records()
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 477, in call
return self.__do_call(args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 544, in __do_call
ret = self.run(*args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 885, in run
return self.execute(args, options)
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/dns.py", line 4568, in execute
system_records = IPASystemRecords(self.api)
File "/usr/lib/python3.9/site-packages/ipaserver/dns_data_management.py", line 97, in init
self.__init_data(all_servers=all_servers)
File "/usr/lib/python3.9/site-packages/ipaserver/dns_data_management.py", line 124, in __init_data
servers = self.api_instance.Command.server_find(kwargs)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 477, in call
return self.__do_call(args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 544, in __do_call
ret = self.run(*args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 885, in run
return self.execute(args, options)
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/baseldap.py", line 2154, in execute
(filter, base_dn, scope) = callback(
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/server.py", line 407, in pre_callback
servrole_filter = self._get_enabled_servrole_filter(
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/server.py", line 354, in _get_enabled_servrole_filter
enabled_masters = _get_masters_with_enabled_servrole(
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/server.py", line 344, in _get_masters_with_enabled_servrole
role_status = self.api.Command.server_role_find(
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 477, in call
return self.__do_call(args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 544, in __do_call
ret = self.run(*args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 885, in run
return self.execute(args, *options)
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/serverrole.py", line 158, in execute
role_status = self.obj.backend.server_role_search(
File "/usr/lib/python3.9/site-packages/ipaserver/plugins/serverroles.py", line 132, in server_role_search
role_status = found_role.status(self.api, server=server_server)
File "/usr/lib/python3.9/site-packages/ipaserver/servroles.py", line 562, in status
return super(ServiceBasedRole, self).status(
File "/usr/lib/python3.9/site-packages/ipaserver/servroles.py", line 222, in status
self._fill_in_absent_masters(ldap2, api_instance, result))
File "/usr/lib/python3.9/site-packages/ipaserver/servroles.py", line 175, in _fill_in_absent_masters
all_masters = ldap2.get_entries(
File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1473, in get_entries
entries, truncated = self.find_entries(
File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1617, in find_entries
raise errors.EmptyResult(reason='no matching entry found')

2026-03-11T12:54:44Z DEBUG The ipa-replica-install command failed, exception: EmptyResult: no matching entry found
2026-03-11T12:54:44Z ERROR no matching entry found
2026-03-11T12:54:44Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Hi @zacekm

If you need help with a deployment issue, please use the freeipa-users mailing list. This issue tracker is used for bug tracking only.

Do all your server have the 389-ds-base-2.7.0-10.el9_7.x86_64 version installed? This version includes a fix related to an indexes issue that could break the replication.

Metadata Update from @frenaud:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)

Hi frenaud,

All servers are running 389-ds-base-2.7.0-10. I managed to solve the issue using a dirty hack to bypass the check:

I modified /usr/lib/python3.9/site-packages/ipapython/ipaldap.py:
1616 if not res and not truncated:
1617 #raise errors.EmptyResult(reason='no matching entry found')
1618 True

With this modification, ipa-replica-install finished successfully. However, after the installation, ipa server-find returned an empty result, which was consistent with the previous errors and suggested that the local LDAP database was not properly initialized during the replica promotion.

I fixed this by running:
ipa-replica-manage re-initialize --from fido.img.local

After the re-initialization, everything started working perfectly. ipa server-find now correctly shows all 4 masters (including the new one) and ldap changes are replicated both way.
No idea what could went wrong with initial replication during ipa-replica-install, no errors were logged.

Regards,
Michal
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.