<div dir="ltr">Thanks David. I installed both the master and replica IPA servers with third-party certificates(Verisign), but I doubt that could be the issue, because I had no problem to run the same ipa-client-install command on a RHEL7 machine(of course, the --hostname used a different hostname of the server). And I had no problem to run the ipa-client-install command with --server=<master> on such RHEL6 machine. So what could cause the LDAP communication failed during the client enrollment with the replica? Is there a way I can troubleshoot this by running some commands? So far I did telnet to check the open ports, as well as run the ldapsearch towards the replica. Thanks again!<div> <div class="gmail_extra"> <div class="gmail_quote">On Tue, Dec 13, 2016 at 8:46 AM, David Kupka <<a href="mailto:dkupka@redhat.com" target="_blank">dkupka@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 13/12/16 05:44, beeth beeth wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I have two IPA servers <a href="http://ipaprd1.example.com" rel="noreferrer" target="_blank">ipaprd1.example.com</a> and <a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a>, running ipa 4.4 on RHEL7. When I tried to install/configure the client on a RHEL6 system(called ipadev6), I had issue when I tried to enroll it with the replica(ipaprd2), while no issue with the primary(ipaprd1): # ipa-client-install --domain=<a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a> --server=<a href="http://ipaprd1.example.com" rel="noreferrer" target="_blank">ipaprd1.example.com</a> --server=<a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a> --hostname=<a href="http://ipadev6.example.com" rel="noreferrer" target="_blank">ipadev6.example.com</a> LDAP Error: Protocol error: unsupported extended operation Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no] Then I tried to run ipa-client-install to enroll with the replica(ipaprd2), with debug mode, I got this: # ipa-client-install --domain=<a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a> --server=<a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a> --hostname=<a href="http://ipadev6.example.com" rel="noreferrer" target="_blank">ipadev6.example.com</a> -d /usr/sbin/ipa-client-install was invoked with options: {'domain': ' <a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a>', 'force': False, 'realm_name': None, 'krb5_offline_passwords': True, 'primary': False, 'mkhomedir': False, 'create_sshfp': True, 'conf_sshd': True, 'conf_ntp': True, 'on_master': False, 'ntp_server': None, 'nisdomain': None, 'no_nisdomain': False, 'principal': None, 'hostname': '<a href="http://ipadev6.example.com" rel="noreferrer" target="_blank">ipadev6.example.com</a>', 'no_ac': False, 'unattended': None, 'sssd': True, 'trust_sshfp': False, 'kinit_attempts': 5, 'dns_updates': False, 'conf_sudo': True, 'conf_ssh': True, 'force_join': False, 'ca_cert_file': None, 'server': ['<a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a>'], 'prompt_password': False, 'permit': False, 'debug': True, 'preserve_sssd': False, 'uninstall': False} missing options might be asked for interactively later Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' [IPA Discovery] Starting IPA discovery with domain=<a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a>, servers=[' <a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a>'], hostname=<a href="http://ipadev6.example.com" rel="noreferrer" target="_blank">ipadev6.example.com</a> Server and domain forced [Kerberos realm search] Search DNS for TXT record of _<a href="http://kerberos.ipa.example.com" rel="noreferrer" target="_blank">kerberos.ipa.example.com</a>. No DNS record found Search DNS for SRV record of _kerberos._<a href="http://udp.ipa.example.com" rel="noreferrer" target="_blank">udp.ipa.example.com</a>. No DNS record found SRV record for KDC not found! Domain: <a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a> [LDAP server check] Verifying that <a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a> (realm None) is an IPA server Init LDAP connection with: ldap://<a href="http://ipaprd2.example.com:389" rel="noreferrer" target="_blank">ipaprd2.example.com:389</a> LDAP Error: Protocol error: unsupported extended operation Discovery result: UNKNOWN_ERROR; server=None, domain=<a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a>, kdc=None, basedn=None Validated servers: will use discovered domain: <a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a> IPA Server not found [IPA Discovery] Starting IPA discovery with domain=<a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a>, servers=[' <a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a>'], hostname=<a href="http://ipadev6.example.com" rel="noreferrer" target="_blank">ipadev6.example.com</a> Server and domain forced [Kerberos realm search] Search DNS for TXT record of _<a href="http://kerberos.ipa.example.com" rel="noreferrer" target="_blank">kerberos.ipa.example.com</a>. No DNS record found Search DNS for SRV record of _kerberos._<a href="http://udp.ipa.example.com" rel="noreferrer" target="_blank">udp.ipa.example.com</a>. No DNS record found SRV record for KDC not found! Domain: <a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a> [LDAP server check] Verifying that <a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a> (realm None) is an IPA server Init LDAP connection with: ldap://<a href="http://ipaprd2.example.com:389" rel="noreferrer" target="_blank">ipaprd2.example.com:389</a> LDAP Error: Protocol error: unsupported extended operation Discovery result: UNKNOWN_ERROR; server=None, domain=<a href="http://ipa.example.com" rel="noreferrer" target="_blank">ipa.example.com</a>, kdc=None, basedn=None Validated servers: Failed to verify that <a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a> is an IPA Server. This may mean that the remote server is not up or is not reachable due to network or firewall settings. Please make sure the following ports are opened in the firewall settings: TCP: 80, 88, 389 UDP: 88 (at least one of TCP/UDP ports 88 has to be open) Also note that following ports are necessary for ipa-client working properly after enrollment: TCP: 464 UDP: 464, 123 (if NTP enabled) (<a href="http://ipaprd2.example.com" rel="noreferrer" target="_blank">ipaprd2.example.com</a>: Provided as option) Installation failed. Rolling back changes. IPA client is not configured on this system. I double checked the services running on the replica, all looked well: ports are listening, and I could telnet the ports from the client(ipadev6). I could run "ldapserach" command to talk to the replica(ipaprd2) from this client(ipadev6), with pulling out all the LDAP records. Also, I have another test box running RHEL7, and no issue at all to run the exact same ipa-client-install command on that RHEL7 box. So could there be a bug on the ipa-client software on RHEL6, to talk to IPA sever running on RHEL7? Please advise. Thank you! Best regards, Beeth </blockquote></div></div> Hello Beeth, I've tried to reproduce the problem you described with 7.3 (ipa-server 4.4.0-12) on master and replica and 6.9 (ipa-client 3.0.0-51) on client and it worked for me as expected. I've done these steps: [master] # ipa-server-install -a Secret123 -p Secret123 --domain example.test --realm EXAMPLE.TEST --setup-dns --auto-forwarders -U [replica] # ipa-client-install -p admin -w Secret123 --domain example.test --server master.example.test -U [replica] # ipa-replica-install [client] # ipa-client-install -p admin -w Secret123 --domain example.test --server replica.example.test -U [client] # id admin Is there anything you've done differently? -- David Kupka </blockquote></div> </div></div></div>