<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 21, 2014 at 12:06 PM, Martin Kosek <span dir="ltr"><<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>></span> wrote:<br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">On 05/21/2014 01:31 PM, Davis Goodman wrote:<br> ><br> ><br> ><br> ><br> > <<a href="http://www.digital-district.ca/" target="_blank">http://www.digital-district.ca/</a>><br> <div class="">><br> > On May 21, 2014, at 6:54 , Martin Kosek <<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a><br> </div><div class="">> <mailto:<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a>>> wrote:<br> ><br> >> On 05/21/2014 09:12 AM, Davis Goodman wrote:<br> >>><br> >>><br> >>><br> >>><br> >>> On May 21, 2014, at 2:45 , Martin Kosek <<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a><br> </div><div><div class="h5">>>> <mailto:<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a>>> wrote:<br> >>><br> >>>> On 05/21/2014 08:36 AM, Davis Goodman wrote:<br> >>>>> Hi,<br> >>>>><br> >>>>> Lately I’ve been having issues of replication between my server and my 2<br> >>>>> replicas.<br> >>>>><br> >>>>> I decided I was going to delete my 2 replicas and start over keeping my<br> >>>>> master intact.<br> >>>>><br> >>>>> I wasn`t successfull in getting all 3 servers to replicate to each other. (<br> >>>>> it used to work)<br> >>>>><br> >>>>> I tried deleting 1 replica after the other one to always keep one of the<br> >>>>> two available.<br> >>>>><br> >>>>> I had to delete manually the replica host on the master with a bunch of<br> >>>>> ldapdelete command which worked fine.<br> >>>>><br> >>>>> But after many unsuccessful trials of getting everyone to sync I decided to<br> >>>>> delete my two replicas.<br> >>>>><br> >>>>> I went back to my master to use the ldapdelete to remove both host`s<br> >>>>> records so that I could start over.<br> >>>>><br> >>>>> Unfortunately now I’m getting this error.<br> >>>>><br> >>>>> ldapdelete -x -D "cn=Directory Manager" -W<br> >>>>> cn=DNS,cn=<a href="http://freeipa02.mtl.domain.int" target="_blank">freeipa02.mtl.domain.int</a>,cn=masters,cn=ipa,cn=etc,dc=domain,dc=int<br> >>>>> Enter LDAP Password:<br> >>>>> ldap_delete: Server is unwilling to perform (53)<br> >>>>> additional info: database is read-only<br> >>>>><br> >>>>><br> >>>>><br> >>>>> I’m kinda stuck now with no replicas and no DNS. I could restore the backup<br> >>>>> prior to the start of the operation but with a master in read-only mode it<br> >>>>> wouldn’t of much help.<br> >>>>><br> >>>>> Any insights would be more than welcome.<br> >>>>><br> >>>>><br> >>>>> Davis<br> >>>><br> >>>> Hi Davis, did maybe some of your ipa-replica-manage crashed in a middle of an<br> >>>> operation or an upgrade was interrupted and left the database put in read only<br> >>>> mode?<br> >>>><br> >>>> You can find out with this ldapsearch:<br> >>>><br> >>>> ldapsearch -h `hostname` -D "cn=Directory Manager" -x -w kokos123 -b<br> >>>> 'cn=userRoot,cn=ldbm database,cn=plugins,cn=config' -s base<br> >>>><br> >>>> Check for nsslapd-readonly, it should be put to "off" in normal operation.<br> >>>><br> >>>> Martin<br> >>> Ok finally managed to modify the read-only flag.<br> >>><br> >>> Could prepare my replicas and get them going.<br> >>><br> >>> Everything seems fine but I’m getting this error while setting up the<br> >>> replicas. Should I be concerned about this one:<br> >>><br> >>> Update in progress<br> >>> Update in progress<br> >>> Update in progress<br> >>> Update in progress<br> >>> Update in progress<br> >>> Update in progress<br> >>> Update succeeded<br> >>> [23/31]: adding replication acis<br> >>> [24/31]: setting Auto Member configuration<br> >>> [25/31]: enabling S4U2Proxy delegation<br> >>> ipa : CRITICAL Failed to load replica-s4u2proxy.ldif: Command<br> >>> '/usr/bin/ldapmodify -v -f /tmp/tmplpfMNG -H<br> >>> ldap://<a href="http://freeipa02.mtl.ddistrict.int:389" target="_blank">freeipa02.mtl.ddistrict.int:389</a> -x -D cn=Directory Manager -y<br> >>> /tmp/tmp4Svn9k' returned non-zero exit status 20<br> >>> [26/31]: initializing group membership<br> >>> [27/31]: adding master entry<br> >>> [28/31]: configuring Posix uid/gid generation<br> >>><br> >>><br> >>><br> >>> the rest seems to work fine.<br> >><br> >> You need to check ipareplica-install.log to see the real error.<br> >><br> >> I wonder if "cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,YOUR-SUFFIX" and<br> >> "cn=ipa-ldap-delegation,cn=s4u2proxy,cn=etc,YOUR-SUFFIX" exist.<br> >><br> >> Martin<br> >><br> ><br> > The first one is there:<br> ><br> > ldapsearch -D "cn=Directory Manager” -W -LLL -x -b<br> > cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int""<br> > dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int<br> > ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=ddistr<br> > ict,dc=int<br> > ipaAllowedTarget: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=ddistr<br> > ict,dc=int<br> > memberPrincipal: HTTP/<a href="mailto:freeipa01.prs.ddistrict.int@DDISTRICT.INT">freeipa01.prs.ddistrict.int@DDISTRICT.INT</a><br> </div></div>> <mailto:<a href="mailto:HTTP">HTTP</a>/<a href="mailto:freeipa01.prs.ddistrict.int@DDISTRICT.INT">freeipa01.prs.ddistrict.int@DDISTRICT.INT</a>><br> > memberPrincipal: HTTP/<a href="mailto:freeipa02.prs.ddistrict.int@DDISTRICT.INT">freeipa02.prs.ddistrict.int@DDISTRICT.INT</a><br> > <mailto:<a href="mailto:HTTP">HTTP</a>/<a href="mailto:freeipa02.prs.ddistrict.int@DDISTRICT.INT">freeipa02.prs.ddistrict.int@DDISTRICT.INT</a>><br> > memberPrincipal: HTTP/<a href="mailto:freeipa02.mtl.ddistrict.int@DDISTRICT.INT">freeipa02.mtl.ddistrict.int@DDISTRICT.INT</a><br> > <mailto:<a href="mailto:HTTP">HTTP</a>/<a href="mailto:freeipa02.mtl.ddistrict.int@DDISTRICT.INT">freeipa02.mtl.ddistrict.int@DDISTRICT.INT</a>><br> > memberPrincipal: HTTP/<a href="mailto:freeipa01.chr.ddistrict.int@DDISTRICT.INT">freeipa01.chr.ddistrict.int@DDISTRICT.INT</a><br> > <mailto:<a href="mailto:HTTP">HTTP</a>/<a href="mailto:freeipa01.chr.ddistrict.int@DDISTRICT.INT">freeipa01.chr.ddistrict.int@DDISTRICT.INT</a>><br> > memberPrincipal: HTTP/<a href="mailto:freeipa01.bxl.ddistrict.int@DDISTRICT.INT">freeipa01.bxl.ddistrict.int@DDISTRICT.INT</a><br> > <mailto:<a href="mailto:HTTP">HTTP</a>/<a href="mailto:freeipa01.bxl.ddistrict.int@DDISTRICT.INT">freeipa01.bxl.ddistrict.int@DDISTRICT.INT</a>><br> > memberPrincipal: HTTP/<a href="mailto:freeipa01.mtl.ddistrict.int@DDISTRICT.INT">freeipa01.mtl.ddistrict.int@DDISTRICT.INT</a><br> > <mailto:<a href="mailto:HTTP">HTTP</a>/<a href="mailto:freeipa01.mtl.ddistrict.int@DDISTRICT.INT">freeipa01.mtl.ddistrict.int@DDISTRICT.INT</a>><br> <div class="">> cn: ipa-http-delegation<br> > objectClass: ipaKrb5DelegationACL<br> > objectClass: groupOfPrincipals<br> > objectClass: top<br> ><br> ><br> > But not the second one:<br> ><br> > ldapsearch -D "cn=Directory Manager” -W -LLL -x -b<br> > cn=ipa-ldap-delegation,cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int""<br> > No such object (32)<br> > Matched DN: cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int<br> ><br> ><br> > Also what is strange is that I got the error only on one of the replicas, the<br> > other one went through without any hiccups.<br> <br> </div>Ok, I think I misguided you with the second DN, the real DN should be<br> "cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=ddistrict,dc=int", see<br> /usr/share/ipa/replica-s4u2proxy.ldif for the LDIF that is being loaded.<br> <br> The key here is to check the error message of ldapmodify that was run on the<br> failing replica, try to search in /var/log/ipareplica-install.log.<br> <span class=""><font color="#888888"><br> Martin<br> </font></span></blockquote></div><br>Hi Martin,</div><div class="gmail_extra"><br></div><div class="gmail_extra">Finally got back on this problem.</div><div class="gmail_extra"><br></div><div class="gmail_extra">I seem to have a huge mess in my replication agreements between my servers.</div> <div class="gmail_extra">if I run the "ipa-replica-manage list-ruv on my master which is freeipa01.prs,</div><div class="gmail_extra"><br></div><div class="gmail_extra">I get this:</div><div class="gmail_extra">[root@freeipa01 ~]# ipa-replica-manage list-ruv</div> <div class="gmail_extra"><a href="http://freeipa01.prs.ddistrict.int:389">freeipa01.prs.ddistrict.int:389</a>: 4</div><div class="gmail_extra"><a href="http://freeipa01.mtl.ddistrict.int:389">freeipa01.mtl.ddistrict.int:389</a>: 16</div> <div class="gmail_extra"><a href="http://freeipa01.mtl.ddistrict.int:389">freeipa01.mtl.ddistrict.int:389</a>: 13</div><div class="gmail_extra"><a href="http://freeipa01.mtl.ddistrict.int:389">freeipa01.mtl.ddistrict.int:389</a>: 12</div> <div class="gmail_extra"><a href="http://freeipa01.bxl.ddistrict.int:389">freeipa01.bxl.ddistrict.int:389</a>: 10</div><div class="gmail_extra"><a href="http://freeipa01.chr.ddistrict.int:389">freeipa01.chr.ddistrict.int:389</a>: 8</div> <div class="gmail_extra"><a href="http://freeipa01.mtl.ddistrict.int:389">freeipa01.mtl.ddistrict.int:389</a>: 6</div><div class="gmail_extra"><a href="http://freeipa02.prs.ddistrict.int:389">freeipa02.prs.ddistrict.int:389</a>: 3</div> <div class="gmail_extra"><a href="http://freeipa01.chr.ddistrict.int:389">freeipa01.chr.ddistrict.int:389</a>: 9</div><div class="gmail_extra"><a href="http://freeipa02.mtl.ddistrict.int:389">freeipa02.mtl.ddistrict.int:389</a>: 17</div> <div class="gmail_extra"><a href="http://freeipa02.mtl.ddistrict.int:389">freeipa02.mtl.ddistrict.int:389</a>: 7</div><div class="gmail_extra"><a href="http://freeipa02.mtl.ddistrict.int:389">freeipa02.mtl.ddistrict.int:389</a>: 11</div> <div class="gmail_extra"><a href="http://freeipa02.mtl.ddistrict.int:389">freeipa02.mtl.ddistrict.int:389</a>: 14</div><div class="gmail_extra"><a href="http://freeipa02.mtl.ddistrict.int:389">freeipa02.mtl.ddistrict.int:389</a>: 15</div> <div class="gmail_extra">[root@freeipa01 ~]# </div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">I've tried to do the ipa-replica-manage clean-ruv on all ID's relating to freeipa02.mtl which is the one I'm having the most problems with and would like to start from scratch.</div> <div class="gmail_extra"><br></div><div class="gmail_extra">running the ipa-replica-manage list-clean-ruv gives me this:</div><div class="gmail_extra"><br></div><div class="gmail_extra">[root@freeipa01 slapd-DDISTRICT-INT]# ipa-replica-manage list-clean-ruv</div> <div class="gmail_extra">CLEANALLRUV tasks</div><div class="gmail_extra">RID 11: Not all replicas online, retrying in 160 seconds...</div><div class="gmail_extra">RID 17: Not all replicas online, retrying in 640 seconds...</div> <div class="gmail_extra">RID 7: Waiting to process all the updates from the deleted replica...</div><div class="gmail_extra"><br></div><div class="gmail_extra">No abort CLEANALLRUV tasks running</div><div class="gmail_extra"> [root@freeipa01 slapd-DDISTRICT-INT]# </div><div class="gmail_extra"><br></div><div class="gmail_extra">I'm kinda stuck in a loop and not sure which way to go.</div><div class="gmail_extra"><br></div><div class="gmail_extra"> I'm also stuck with a orphaned user in the WebUI which I see but can not delete, giving me the user doesn't exist.</div><div class="gmail_extra"><br></div><div class="gmail_extra">If I do an ldapsearch it seems incomplete:</div> <div class="gmail_extra"><div class="gmail_extra">[root@freeipa01 ~]# ldapsearch -xLLL -D "cn=directory manager" -w XXXXXXX -b dc=ddistrict,dc=int | grep -i arobitaille</div><div class="gmail_extra">dn: cn=arobitaille,cn=groups,cn=compat,dc=ddistrict,dc=int</div> <div class="gmail_extra">cn: arobitaille</div><div class="gmail_extra">memberUid: arobitaille</div><div class="gmail_extra">dn: uid=arobitaille,cn=users,cn=compat,dc=ddistrict,dc=int</div><div class="gmail_extra">homeDirectory: /home/arobitaille</div> <div class="gmail_extra">uid: arobitaille</div><div class="gmail_extra">member: nsuniqueid=08165a01-dd3311e3-8982f534-a4dfcf64+uid=arobitaille,cn=user</div><div class="gmail_extra">member: nsuniqueid=08165a01-dd3311e3-8982f534-a4dfcf64+uid=arobitaille,cn=user</div> <div class="gmail_extra">dn: nsuniqueid=08165a01-dd3311e3-8982f534-a4dfcf64+uid=arobitaille,cn=users,cn</div><div class="gmail_extra">homeDirectory: /home/arobitaille</div><div class="gmail_extra">mepManagedEntry: cn=arobitaille,cn=groups,cn=accounts,dc=ddistrict,dc=int</div> <div class="gmail_extra">mail: <a href="mailto:arobitaille@digital-district.ca">arobitaille@digital-district.ca</a></div><div class="gmail_extra">krbPrincipalName: <a href="mailto:arobitaille@DDISTRICT.INT">arobitaille@DDISTRICT.INT</a></div> <div class="gmail_extra">uid: arobitaille</div><div class="gmail_extra">dn: cn=arobitaille+nsuniqueid=08165a02-dd3311e3-8982f534-a4dfcf64,cn=groups,cn</div><div class="gmail_extra">cn: arobitaille</div><div class="gmail_extra"> description: User private group for arobitaille</div><div class="gmail_extra">mepManagedBy: uid=arobitaille,cn=users,cn=accounts,dc=ddistrict,dc=int</div></div><div class="gmail_extra"><div><br></div><div><br></div><div> <br> </div>-- <br><div dir="ltr"><span><font color="#888888"><div dir="ltr" style="color:rgb(34,34,34)"> <br></div><div dir="ltr" style="color:rgb(34,34,34)"><br></div><div dir="ltr" style="color:rgb(34,34,34)"><table style="font-family:Times" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-left:0px;font-size:8pt" valign="top"> <span style="font-family:Arial,sans-serif;font-size:9pt;font-weight:bold">Davis Goodman</span><br><span color="#B9B9B9" style="margin-top:0px;margin-bottom:0px;font-family:Arial,sans-serif;font-size:8pt">Directeur Informatique <font color="#B9B9B9" size="1"> |</font> IT Manager<br> </span></td> </tr></tbody></table><a href="http://www.digital-district.ca/" style="color:rgb(17,85,204);font-family:Times;font-size:medium" target="_blank"><img src="http://www.digital-district.fr/ddca/logo_dd_small.png" alt="Digital-District" title="Digital-District" align="middle" border="0" vspace="2"></a><table style="font-family:Times" cellpadding="2" cellspacing="1"> </table></div></font></span><br></div> </div></div>