<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#FFFFFF"> <div class="moz-cite-prefix">On 07.12.2015 08:21, Jan Cholasta wrote: </div> <blockquote cite="mid:56653386.5020703@redhat.com" type="cite">On 2.12.2015 16:23, Jan Cholasta wrote: <blockquote type="cite">Hi, the attached patch fixes <a class="moz-txt-link-rfc2396E" href="https://fedorahosted.org/freeipa/ticket/5498"><https://fedorahosted.org/freeipa/ticket/5498></a>. Note that you still have to provide admin password in ipa-replica-install, either using --admin-password or interactively, because: a) Admin password is required for replica promotion. This will be fixed with <a class="moz-txt-link-rfc2396E" href="https://fedorahosted.org/freeipa/ticket/5401"><https://fedorahosted.org/freeipa/ticket/5401></a>. Patches are on the list: <a class="moz-txt-link-rfc2396E" href="https://www.redhat.com/archives/freeipa-devel/2015-December/msg00027.html"><https://www.redhat.com/archives/freeipa-devel/2015-December/msg00027.html></a>. </blockquote> Pushed. <blockquote type="cite"> b) Admin password is required for connection check. This will be fixed with <a class="moz-txt-link-rfc2396E" href="https://fedorahosted.org/freeipa/ticket/5497"><https://fedorahosted.org/freeipa/ticket/5497></a>. </blockquote> Martin Basti pointed out that admin password should not be asked interactively during OTP replica promotion. Fixed. Updated and rebased patch attached. <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> 1) [root@vm-058-138 ~]# ipa-replica-install --server vm-058-137.abc.idm.lab.eng.brq.redhat.com --domain abc.idm.lab.eng.brq.redhat.com --password=bubak --setup-ca Configuring client side components Password for <a class="moz-txt-link-abbreviated" href="mailto:admin@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">admin@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a>: IMO password should be asked first, before any installation begins (IMO this is for conncheck) 2) When host is not in ipaservers hostgroup. Also I would expect different error message ipa-replica-install --server vm-058-137.abc.idm.lab.eng.brq.redhat.com --domain abc.idm.lab.eng.brq.redhat.com --password=bubak --setup-ca --skip-conncheck .... step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 352, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install for nothing in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1507, in main promote_check(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 374, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1002, in promote_check conn.connect(ccache=installer._ccache) File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect conn = self.create_connection(*args, **kw) File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 199, in create_connection principal = krb_utils.get_principal(ccache_name=ccache) File "/usr/lib/python2.7/site-packages/ipalib/krb_utils.py", line 184, in get_principal raise errors.CCacheError(message=unicode(e)) 2015-12-07T16:23:40Z DEBUG The ipa-replica-install command failed, exception: CCacheError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639053): No Kerberos credentials available 2015-12-07T16:23:40Z ERROR Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639053): No Kerberos credentials available 3) This case is not handle very well: a) install client with OTP password b) install replica with the same OTP password (when host is no in ipaservers group, if host is in ipaservers group it works) ipa.ipapython.install.cli.install_tool(Replica): ERROR Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639053): No Kerberos credentials available ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information 4) This is not user friendly I used wrong OTP password, can we somehow propagate the actual error from client install to stderr? ipa.ipapython.install.cli.install_tool(Replica): ERROR Configuration of client side components failed! ipa-client-install returned: Command ''/usr/sbin/ipa-client-install' '--unattended' '--domain' 'abc.idm.lab.eng.brq.redhat.com' '--server' 'vm-058-137.abc.idm.lab.eng.brq.redhat.com' '--password' 'buba'' returned non-zero exit status 1 ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information </body> </html>