<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>HI Simo and all,</div><div><br></div><div> Thanks for your reply.</div><div><br></div><div>do you mean restarting ipa service on ipa master like 'service ipa restart'? or run 'kdestroy' on ipamaster to remove kerberos tickets? It will be great if you could elaborate on this: like which IPA replica Kerberos principal, replica Kerberos tickets are involved, and where they are stored.</div><div><br></div><div>Thanks.</div><div><br></div><div>--David</div><div><br></div><div><br></div><div><br></div><div>-</div><div><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Simo Sorce <simo@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> David Copperfield <cao2dan@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, May 8, 2012 6:08 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] IPA replica server rebuilding failed with 'Invalid credentials' error.<br> </font> </div> <br> On Mon, 2012-05-07 at 20:38 -0700, David Copperfield wrote:<br>> I have a IPA replica server with disk problems, and then it is<br>> reimaged and rebuild. But when the IPA replica function is rebuilt, it<br>> reports the following problem:<br>> <br>> <br>> [root@ipareplica02 ipa]# ipa-replica-install<br>> --no-ntp /var/lib/ipa/replica-info-ipareplica02.example.com.gpg<br>> <br>> ...<br>> [21/29]: setting up initial replication<br>> Starting replication, please wait until this has completed.<br>> [<a target="_blank" href="http://ipamaster.example.com">ipamaster.example.com</a>] reports: Update failed! Status: [49 - LDAP<br>> error: Invalid credentials]<br>> ...<br>> <br>> <br>> Before I run the replica rebuilding step on IPA replica, I already run<br>> 'ipa-replica-manage disconn <a target="_blank" href="http://ipareplica01.example.com">ipareplica01.example.com</a>' on IPA master,<br>> and delete the host entry for ipareplica02 as well.<br>> <br>> <br>> Did I missed any steps above? Please help. Thanks.<br><br>Due to the way kerberos ticket are built you need to restart the master<br>this replica was replicating to before you rebuild a replica with the<br>exact same name.<br>This is because krb tickets are cached but you will change the long term<br>key with a full reinstall, so the current master will have a ticket the<br>replica cannot decrypt.<br><br>Simo.<br><br>-- <br>Simo Sorce * Red Hat, Inc * New York<br><br><br><br> </div> </div> </div></body></html>