<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.32.2">
</HEAD>
<BODY>
Found a solution:<BR>
<BR>
The first replica I built did not have the CA replication setup. So I ran the ipa-ca-install with it's original replica file on the first replica.<BR>
<BR>
Now that system is able to generate a replica.gpg file for the new centos7 box. The new box replicated just fine and all is well with it.<BR>
<BR>
Now I can resync the ldap on the original master and fix it. Of course the weirdness is the web gui shows data for users but the system itself can't use that data. Maybe I should dig into the pam modules.<BR>
<BR>
On Wed, 2014-08-20 at 10:10 -0400, Jim Kinney wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
All,<BR>
<BR>
I'm setting up a new replicated master (CentOS7) from a CentOS 6.5 original master. I added the patch (to the freeIPA 3.3 on CentOS 7) from <A HREF="https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=8c98561c209d0ccaa692a335e3e9a10aec23ee0e">https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=8c98561c209d0ccaa692a335e3e9a10aec23ee0e</A><BR>
to handle the 2 replication IDs bug. <BR>
<BR>
The replication fails to complete. If I exclude the connection check, it fails. If I leave the connection check in place, it asks for an ssh password for the admin@<original master host>. There is no admin user on that machine. The admin user is only in freeIPA.<BR>
<BR>
Should there be an admin user account exposed? Did I find a config change between 3.0 and 3.3 releases?<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
--
<PRE>
Jim Kinney
Senior System Administrator
Department of BioMedical Informatics
Emory University
jimkinney@emory.edu
404.712.0300
bmi.emory.edu
</PRE>
</TD>
</TR>
</TABLE>
<TABLE CELLSPACING="0" CELLPADDING="0" BORDER="1">
<TR>
<TD>
<FONT SIZE="2">plain text document attachment (ATT00001)</FONT>
</TD>
</TR>
</TABLE>
<PRE>
--
Manage your subscription for the Freeipa-users mailing list:
<A HREF="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</A>
Go To <A HREF="http://freeipa.org">http://freeipa.org</A> for more info on the project
</PRE>
</BLOCKQUOTE>
<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
--
<PRE>
Jim Kinney
Senior System Administrator
Department of BioMedical Informatics
Emory University
jimkinney@emory.edu
404.712.0300
bmi.emory.edu
</PRE>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>