<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt"><div><span>Lukas</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>Perhaps I should explain the design a bit and see if FreeIPA even supports this.Our replica is in a separate network and all the appropriate ports are opened between the master and the replica. The "replica" got created successfully and is in sync with the master (except the CA services which I mentioned earlier)</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>Now,when I try to run ipa-client-install on
hosts in the new network using the replica, it complains that about "Cannot contact any KDC for realm".</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>I am wondering it my hosts in the new network are trying to access the "master" for certificates since the replica does not have any CA services running? I couldn't find any obvious proof of this even running the install in a debug mode. Do I need to open ports between the new hosts and the master for CA services?</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span> </span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue',
Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>At this point I cannot disable or move the master, it needs to function in its location but I need </span></div><div></div><div> </div><div>Shreeraj<br>----------------------------------------------------------------------------------------</div><div><br><br></div><div>Change is the only Constant !</div><div class="yahoo_quoted" style="display: block;"> <br> <br> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> On Saturday, February 8, 2014 1:29 AM, Lukas Slebodnik <lslebodn@redhat.com> wrote:<br> </font> </div> <div class="y_msg_container">On (06/02/14 18:33), Shree wrote:<div
class="yqt8040830931" id="yqtfd97938"><br clear="none">>First of all, the ipa-replica-install did not allow me to use the --setup-ca<br clear="none">> option complaining that a cert already exists, replicate creation was<br clear="none">> successful after I skipped the option.<br clear="none">>Seems like the replica is one except <br clear="none">>1) There is no CA Service running on the replica (which I guess is expected)<br clear="none">>and<br clear="none">>2) I am unable to run ipa-client-install successfully on any clients using<br clear="none">> the replica. (I don't have the option of using the primary master as it is<br clear="none">> configured in a segregated environment. Only the master and replica are<br clear="none">> allowed to sync.<br clear="none">>Debug shows it fails at <br clear="none">><br clear="none">>ipa : DEBUG stderr=kinit:
Cannot contact any KDC for realm 'mydomainname.com' while getting initial credentials</div><br clear="none">><br clear="none">><br clear="none"><br clear="none">I was not able to install replica witch CA on fedora 20,<br clear="none">Bug is already reported <a shape="rect" href="https://fedorahosted.org/pki/ticket/816" target="_blank">https://fedorahosted.org/pki/ticket/816</a><br clear="none"><br clear="none">Guys from dogtag found a workaround<br clear="none"><a shape="rect" href="https://fedorahosted.org/pki/ticket/816#comment:12" target="_blank">https://fedorahosted.org/pki/ticket/816#comment:12</a><br clear="none"><br clear="none">Does it work for you?<br clear="none"><br clear="none">LS<div class="yqt8040830931" id="yqtfd40503"><br clear="none"></div><br><br></div> </div> </div> </div> </div></body></html>