<div dir="ltr">Never mind. I just gave up and re-installed my original master from scratch. We're just going to accept the pain of re-enrolling all the clients and resetting all the user passwords. Whatever had gone wrong inside my database was just too much. This gets us clean again.</div>
<div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><img src="http://damascusgrp.com/item/51f7de33e4b08d2bdb8b4860?format=1500w" width="200" height="53"><br>
</div><div><a href="http://damascusgrp.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://about.me/wortmanbret" target="_blank">http://about.me/wortmanbret</a><br></div></div></div>
<br><br><div class="gmail_quote">On Mon, Sep 9, 2013 at 3:30 AM, Bret Wortman <span dir="ltr"><<a href="mailto:bret.wortman@damascusgrp.com" target="_blank">bret.wortman@damascusgrp.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">I've had some great success in the past 48 hours in recovering my system. Here's where I stand right now:<div><br></div><div>1. I successfully stood up a new replica (ipamaster7) and transferred CA authority to it from my old master (ipamaster).</div>
<div>2. I shutdown ipamaster and re-baselined it.</div><div>3. I created a new replica file from ipamaster7 for ipamaster (to transfer everything back).</div><div>4. I reinstalled the IPA software on ipamaster. I also made a small change to CS.cfg to work around my earlier CA problem.</div>
<div>5. I ran "ipa-replica-install --setup-dns --no-forwarders replica-info-ipamaster.foo.net.gpg", which ran to completion.</div><div>6. I attempted to run "ipa-ca-install replica-info-ipamaster.foo.net.gpg", which failed due to a 403 error.</div>
<div><br></div><div>/var/log/ipareplica-ca-install.log showed this:</div><div><br></div><div><div><span style="font-family:'courier new',monospace">2013-09-09T07:10:30Z DEBUG Starting external process</span><br></div>
<div><font face="courier new, monospace">2013-09-09T07:10:30Z DEBUG args=/usr/sbin/pkispawn -s CA -f /tmp/tmpyIMTdo</font></div><div><font face="courier new, monospace">2013-09-09T07:10:31Z DEBUG Process finished, return code=1</font></div>
<div><font face="courier new, monospace">2013-09-09T07:10:31Z DEBUG stdout=Loading deployment configuration from /tmp/tmpyIMTdo.</font></div><div><font face="courier new, monospace">ERROR: Unable to access security domain: 403 Client Error: Forbidden</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">2013-09-09T07:10:31Z DEBUG stderr=</font></div><div><font face="courier new, monospace">2013-09-09T07:10:31Z CRITICAL failed to configure ca instance Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpyIMTdo' returned non-zero exit status 1</font></div>
<div><font face="courier new, monospace">2013-09-09T07:10:31Z INFO File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 619, in run_script</font></div><div><font face="courier new, monospace"> return_value = main_function()</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> File "/usr/sbin/ipa-ca-install", line 182, in main</font></div><div><font face="courier new, monospace"> config, dogtag_master_ds_port, postinstall=True)</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1809, in install_replica_ca</font></div>
<div><font face="courier new, monospace"> subject_base=config.subject_base)</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> File "/usr/ib/python2.7/site-packages/ipaserver/install/cainstance.py", line625, in configure_instance</font></div>
<div><font face="courier new, monospace"> self.start_creation(runtime=210)</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 358, in start_creation</font></div>
<div><font face="courier new, monospace"> method()</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 744, in __spawn_instance</font></div>
<div><font face="courier new, monospace"> raise RuntimeError('Configuration of CA failed')</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">2013-09-09T07:10:31Z INFO The ipa-ca-install command failed, exception: RuntimeError: Configuration of CA failed</font></div>
<div><br></div><div><div dir="ltr"><div>Does this look familiar to anyone? I'd like to complete the transition back to ipamaster so that I can then finish cleaning up the dead replicas. Until I can do this, I'll have to leave ipamaster7 in place as my master.</div>
<div><br></div><div>Thanks!</div><span class="HOEnZb"><font color="#888888"><div><u><br></u></div><div><b>Bret Wortman</b></div><div><img src="http://damascusgrp.com/item/51f7de33e4b08d2bdb8b4860?format=1500w" width="200" height="53"><br>
</div><div><a href="http://damascusgrp.com/" target="_blank">http://damascusgrp.com/</a><br>
</div><div><a href="http://about.me/wortmanbret" target="_blank">http://about.me/wortmanbret</a><br></div></font></span></div></div>
</div></div>
</blockquote></div><br></div>