<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:Calibri;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi folks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">As the subject suggests, we're converting from FreeIPA 3.0.0 on CentOS 6 to 4.2.0 on CentOS 7. The way we're doing it is to create FreeIPA replicas in CentOS 7 and then hope to promote one of them to the CA
master. I'm running into two problems:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The first is that when we create a replica in FreeIPA 4.2.0 with the —setup-ca option, that portion fails. Here's a snippet of the output:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> [1/23]: creating certificate server user<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> [2/23]: configuring certificate server instance<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpqPeYOW'' returned non-zero exit status
1<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki-ca-install.log<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> [error] RuntimeError: CA configuration failed.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">Your system may be partly configured.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">Run /usr/sbin/ipa-server-install --uninstall to clean up.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Second, I've tried a "trick" where I run an ipa-backup on the 4.2.0 replica and then restore it, hoping to convince the server that it's now a master. When I try to run ipa-replica-prepare, it quickly exits
with the mysterious "no such entry" error:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">[root@ipa ~]# ipa-replica-prepare ipa4test.example.local --ip-address 10.55.10.36<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">Directory Manager (existing master) password:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">Preparing replica for ipa4test.example.local from ipa.example.local<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">no such entry<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Ideas, suggestions, and help are very welcome!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Dan<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><a href="http://www.high5games.com/"><span style="font-size:18.0pt;font-family:"Times New Roman";color:blue;text-decoration:none"><img border="0" width="220" height="50" id="_x0000_i1025" src="cid:image001.jpg@01D1BC03.6DD03360"></span></a><span style="font-size:15.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b>Daniel Alex Finkelstein</b>| Senior Dev Ops Engineer<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><u><span style="color:blue"><a href="mailto:Dan.Finkelstein@h5g.com"><span style="color:blue">Dan.Finkelstein@h5g.com</span></a></span></u> | 212.604.3447<span style="font-size:15.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">One World Trade Center, New York, NY 10007<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt"><a href="http://www.high5games.com/"><span style="color:blue">www.high5games.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">Play
<a href="https://apps.facebook.com/highfivecasino/"><span style="color:blue">High 5 Casino</span></a> and
<a href="https://apps.facebook.com/shakethesky/"><span style="color:blue">Shake the Sky</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">Follow us on: <a href="http://www.facebook.com/high5games"><span style="color:blue">Facebook</span></a>, <a href="https://twitter.com/High5Games"><span style="color:blue">Twitter</span></a>, <a href="http://www.youtube.com/High5Games"><span style="color:blue">YouTube</span></a>, <a href="http://www.linkedin.com/company/1072533?trk=tyah"><span style="color:blue">Linkedin</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt">This message and any attachments may contain confidential or privileged information and are only for the use of the intended recipient of this message. If you are not the intended recipient, please notify
the sender by return email, and delete or destroy this and all copies of this message and all attachments. Any unauthorized disclosure, use, distribution, or reproduction of this message or any attachments is prohibited and may be unlawful.</span></i><o:p></o:p></p>
</div>
</body>
</html>