[Freeipa-users] Migrate from FreeIPA 3 to 4

[Peter Larsen]

I'm attempting to migrate my IDM server from RHEL6 to RHEL7. Ie. from
IPA 3 to IPA 4. My IPA 3 installation does not manage DNS - but other
than that, it's a very basic installation on a very small set of servers
(less than 50).

To start the migration I run
# ipa-replica-prepare ipa.peterlarsen.org

(ipa is the name of the new RHEL7 server). My intention is to setup a
replica on that server, and once fully established remove the old
installation.

I'm prompted for the dirsrv password and once entered it's accepted. It
also gets accepted if I use the --password=blabla option. However, the
process doesn't get far and terminates with:

ipa-replica-prepare ipa.peterlarsen.org

Preparing replica for ipa.peterlarsen.org from idm.peterlarsen.org
preparation of replica failed: Insufficient access:  Invalid credentials
Insufficient access:  Invalid credentials
  File "/usr/sbin/ipa-replica-prepare", line 529, in <module>
    main()

  File "/usr/sbin/ipa-replica-prepare", line 391, in main
    update_pki_admin_password(dirman_password)

  File "/usr/sbin/ipa-replica-prepare", line 247, in
update_pki_admin_password
    bind_pw=dirman_password

  File "/usr/lib/python2.6/site-packages/ipalib/backend.py", line 63, in
connect
    conn = self.create_connection(*args, **kw)

  File "/usr/lib/python2.6/site-packages/ipaserver/plugins/ldap2.py",
line 846, in create_connection
    self.handle_errors(e)

  File "/usr/lib/python2.6/site-packages/ipaserver/plugins/ldap2.py",
line 712, in handle_errors
    raise errors.ACIError(info="%s %s" % (info, desc))

=====

I'm not sure the "invalid credentials" error message can be trusted (as
it does do a successful bind initially). Here's the log from the PKI-IPA:

[03/Jan/2017:23:08:26 -0500] conn=36 fd=73 slot=73 connection from
192.168.11.xxx to 192.168.11.xxx
[03/Jan/2017:23:08:26 -0500] conn=36 op=0 BIND dn="cn=Directory Manager"
method=128 version=2
[03/Jan/2017:23:08:26 -0500] conn=36 op=0 RESULT err=0 tag=97 nentries=0
etime=0 dn="cn=directory manager"
[03/Jan/2017:23:08:26 -0500] conn=36 op=1 SRCH
base="ou=sessions,ou=Security Domain,o=ipaca" scope=2
filter="(objectClass=securityDomainSessionEntry)" attrs="cn"
[03/Jan/2017:23:08:26 -0500] conn=36 op=1 RESULT err=32 tag=101
nentries=0 etime=0
[03/Jan/2017:23:08:26 -0500] conn=36 op=2 UNBIND
[03/Jan/2017:23:08:26 -0500] conn=36 op=2 fd=73 closed - U1
[03/Jan/2017:23:08:27 -0500] conn=6 op=40 MOD
dn="cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca"
[03/Jan/2017:23:08:27 -0500] conn=6 op=40 RESULT err=0 tag=103
nentries=0 etime=0
[03/Jan/2017:23:09:04 -0500] conn=37 fd=73 slot=73 SSL connection from
192.168.11.xxx to 192.168.11.xxx
[03/Jan/2017:23:09:04 -0500] conn=37 TLS1.2 256-bit AES
[03/Jan/2017:23:09:04 -0500] conn=37 op=0 BIND dn="cn=directory manager"
method=128 version=3
[03/Jan/2017:23:09:04 -0500] conn=37 op=0 RESULT err=49 tag=97
nentries=0 etime=0 - Invalid credentials
[03/Jan/2017:23:09:04 -0500] conn=37 op=1 UNBIND
[03/Jan/2017:23:09:04 -0500] conn=37 op=1 fd=73 closed - U1

Looks more like a structural issue?

-- 
Regards
  Peter Larsen

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20170103/fd49fcfc/attachment.htm>