<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div apple-content-edited="true"><a href="http://www.digital-district.ca/" target="_blank" style=" font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; color: rgb(17, 85, 204); background-color: rgb(255, 255, 255); font-family: Times; "><span style="color: rgb(17, 85, 204); font-family: Times; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style=" font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; color: rgb(0, 0, 0); font-family: Helvetica; "><br></div><br class="Apple-interchange-newline" style="color: rgb(17, 85, 204); font-family: Times; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><br class="Apple-interchange-newline"></span></a> </div> <br><div><div>On May 21, 2014, at 6:54 , Martin Kosek <<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 05/21/2014 09:12 AM, Davis Goodman wrote:<br><blockquote type="cite"><br><br><br><br>On May 21, 2014, at 2:45 , Martin Kosek <<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a>> wrote:<br><br><blockquote type="cite">On 05/21/2014 08:36 AM, Davis Goodman wrote:<br><blockquote type="cite">Hi,<br><br>Lately I’ve been having issues of replication between my server and my 2 replicas.<br><br>I decided I was going to delete my 2 replicas and start over keeping my master intact.<br><br>I wasn`t successfull in getting all 3 servers to replicate to each other. ( it used to work)<br><br>I tried deleting 1 replica after the other one to always keep one of the two available. <br><br>I had to delete manually the replica host on the master with a bunch of ldapdelete command which worked fine.<br><br>But after many unsuccessful trials of getting everyone to sync I decided to delete my two replicas.<br><br>I went back to my master to use the ldapdelete to remove both host`s records so that I could start over.<br><br>Unfortunately now I’m getting this error.<br><br>ldapdelete -x -D "cn=Directory Manager" -W cn=DNS,cn=freeipa02.mtl.domain.int,cn=masters,cn=ipa,cn=etc,dc=domain,dc=int<br>Enter LDAP Password: <br>ldap_delete: Server is unwilling to perform (53)<br><span class="Apple-tab-span" style="white-space:pre"> </span>additional info: database is read-only<br><br><br><br>I’m kinda stuck now with no replicas and no DNS. I could restore the backup prior to the start of the operation but with a master in read-only mode it wouldn’t of much help.<br><br>Any insights would be more than welcome.<br><br><br>Davis<br></blockquote><br>Hi Davis, did maybe some of your ipa-replica-manage crashed in a middle of an<br>operation or an upgrade was interrupted and left the database put in read only<br>mode?<br><br>You can find out with this ldapsearch:<br><br>ldapsearch -h `hostname` -D "cn=Directory Manager" -x -w kokos123 -b<br>'cn=userRoot,cn=ldbm database,cn=plugins,cn=config' -s base<br><br>Check for nsslapd-readonly, it should be put to "off" in normal operation.<br><br>Martin<br></blockquote>Ok finally managed to modify the read-only flag.<br><br>Could prepare my replicas and get them going.<br><br>Everything seems fine but I’m getting this error while setting up the replicas. Should I be concerned about this one:<br><br>Update in progress<br>Update in progress<br>Update in progress<br>Update in progress<br>Update in progress<br>Update in progress<br>Update succeeded<br> [23/31]: adding replication acis<br> [24/31]: setting Auto Member configuration<br> [25/31]: enabling S4U2Proxy delegation<br>ipa : CRITICAL Failed to load replica-s4u2proxy.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmplpfMNG -H <a href="ldap://freeipa02.mtl.ddistrict.int:389">ldap://freeipa02.mtl.ddistrict.int:389</a> -x -D cn=Directory Manager -y /tmp/tmp4Svn9k' returned non-zero exit status 20<br> [26/31]: initializing group membership<br> [27/31]: adding master entry<br> [28/31]: configuring Posix uid/gid generation<br><br><br><br>the rest seems to work fine.<br></blockquote><br>You need to check ipareplica-install.log to see the real error.<br><br>I wonder if "cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,YOUR-SUFFIX" and<br>"cn=ipa-ldap-delegation,cn=s4u2proxy,cn=etc,YOUR-SUFFIX" exist.<br><br>Martin<br><br></blockquote></div><br><div><div style="color: rgb(34, 34, 34); font-family: arial; font-size: small;">The first one is there:</div><div style="color: rgb(34, 34, 34); font-family: arial; font-size: small;"><br></div><div style="color: rgb(34, 34, 34); font-family: arial; font-size: small;"><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">ldapsearch -D "cn=Directory Manager” -W -LLL -x -b cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int""</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=ddistr</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);"> ict,dc=int</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">ipaAllowedTarget: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=ddistr</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);"> ict,dc=int</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">memberPrincipal: <a href="mailto:HTTP/freeipa01.prs.ddistrict.int@DDISTRICT.INT">HTTP/freeipa01.prs.ddistrict.int@DDISTRICT.INT</a></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">memberPrincipal: <a href="mailto:HTTP/freeipa02.prs.ddistrict.int@DDISTRICT.INT">HTTP/freeipa02.prs.ddistrict.int@DDISTRICT.INT</a></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">memberPrincipal: <a href="mailto:HTTP/freeipa02.mtl.ddistrict.int@DDISTRICT.INT">HTTP/freeipa02.mtl.ddistrict.int@DDISTRICT.INT</a></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">memberPrincipal: <a href="mailto:HTTP/freeipa01.chr.ddistrict.int@DDISTRICT.INT">HTTP/freeipa01.chr.ddistrict.int@DDISTRICT.INT</a></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">memberPrincipal: <a href="mailto:HTTP/freeipa01.bxl.ddistrict.int@DDISTRICT.INT">HTTP/freeipa01.bxl.ddistrict.int@DDISTRICT.INT</a></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">memberPrincipal: <a href="mailto:HTTP/freeipa01.mtl.ddistrict.int@DDISTRICT.INT">HTTP/freeipa01.mtl.ddistrict.int@DDISTRICT.INT</a></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">cn: ipa-http-delegation</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">objectClass: ipaKrb5DelegationACL</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">objectClass: groupOfPrincipals</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">objectClass: top</div><br></div><div style="color: rgb(34, 34, 34); font-family: arial; font-size: small;"><br></div><div style="color: rgb(34, 34, 34); font-family: arial; font-size: small;">But not the second one:</div><div style="color: rgb(34, 34, 34); font-family: arial; font-size: small;"><br></div><div style="color: rgb(34, 34, 34); font-family: arial; font-size: small;"><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">ldapsearch -D "cn=Directory Manager” -W -LLL -x -b cn=ipa-ldap-delegation,cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int""</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">No such object (32)</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">Matched DN: cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">Also what is strange is that I got the error only on one of the replicas, the other one went through without any hiccups.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">Thanks for the help.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 254, 254);">Davis</div></div><span style="color: rgb(34, 34, 34); font-family: arial; font-size: small; background-color: rgb(255, 255, 255);">-- </span><br style="color: rgb(34, 34, 34); font-family: arial; font-size: small;"><div dir="ltr" style="color: rgb(34, 34, 34); font-family: arial; font-size: small;"><font color="#888888"><div dir="ltr" style="color: rgb(34, 34, 34);"><br></div><div dir="ltr" style="color: rgb(34, 34, 34);"><br></div><div dir="ltr" style="color: rgb(34, 34, 34);"><table border="0" cellpadding="0" cellspacing="0" style="font-family: Times;"><tbody><tr><td valign="top" style="font-family: arial, sans-serif; margin: 0px; padding-left: 0px; font-size: 8pt;"><span style="font-family: Arial, sans-serif; font-size: 9pt; font-weight: bold;">Davis Goodman</span><br><span color="#B9B9B9" style="margin-top: 0px; margin-bottom: 0px; font-family: Arial, sans-serif; font-size: 8pt;">Directeur Informatique <font color="#B9B9B9" size="1"> |</font> IT Manager<br></span></td></tr></tbody></table><a href="http://www.digital-district.ca/" target="_blank" style="color: rgb(17, 85, 204); font-family: Times;"><img alt="Digital-District" title="Digital-District" align="middle" border="0" vspace="2" apple-inline="yes" id="7474A8C5-16CA-477F-96BA-34969DF3EC1E" height="25" width="236" apple-width="yes" apple-height="yes" src="cid:FDEF0FBF-331A-4C46-9A6D-700754D672C6@mtl.ddistrict.int"></a><table cellpadding="2" cellspacing="1" style="font-family: Times;"></table><table border="0" cellpadding="0" cellspacing="0" style="font-family: Times; position: static; z-index: auto;"><tbody><tr><td valign="top" style="font-family: arial, sans-serif; margin: 0px; padding-left: 0px; font-size: 8pt;"><span style="font-family: Arial; font-size: 8pt;">5605 Avenue de Gaspé, Suite 408 <font color="#B9B9B9" size="1">|</font> Montréal, QC H2T 2A4 <br>Tél: +1 (514) 360-3253 x104 Cell: +1 (514) 994-7360 <br><br></span></td></tr></tbody></table></div></font></div></div></body></html>