<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Liberation Sans">I'm attempting to migrate my IDM server
from RHEL6 to RHEL7. Ie. from IPA 3 to IPA 4. My IPA 3
installation does not manage DNS - but other than that, it's a
very basic installation on a very small set of servers (less than
50).<br>
<br>
To start the migration I run <br>
# ipa-replica-prepare ipa.peterlarsen.org <br>
<br>
(ipa is the name of the new RHEL7 server). My intention is to
setup a replica on that server, and once fully established remove
the old installation. <br>
<br>
I'm prompted for the dirsrv password and once entered it's
accepted. It also gets accepted if I use the --password=blabla
option. However, the process doesn't get far and terminates with:<br>
<br>
ipa-replica-prepare ipa.peterlarsen.org<br>
<br>
Preparing replica for ipa.peterlarsen.org from idm.peterlarsen.org<br>
preparation of replica failed: Insufficient access: Invalid
credentials<br>
Insufficient access: Invalid credentials<br>
File "/usr/sbin/ipa-replica-prepare", line 529, in
<module><br>
main()<br>
<br>
File "/usr/sbin/ipa-replica-prepare", line 391, in main<br>
update_pki_admin_password(dirman_password)<br>
<br>
File "/usr/sbin/ipa-replica-prepare", line 247, in
update_pki_admin_password<br>
bind_pw=dirman_password<br>
<br>
File "/usr/lib/python2.6/site-packages/ipalib/backend.py", line
63, in connect<br>
conn = self.create_connection(*args, **kw)<br>
<br>
File
"/usr/lib/python2.6/site-packages/ipaserver/plugins/ldap2.py",
line 846, in create_connection<br>
self.handle_errors(e)<br>
<br>
File
"/usr/lib/python2.6/site-packages/ipaserver/plugins/ldap2.py",
line 712, in handle_errors<br>
raise errors.ACIError(info="%s %s" % (info, desc))<br>
<br>
=====<br>
<br>
I'm not sure the "invalid credentials" error message can be
trusted (as it does do a successful bind initially). Here's the
log from the PKI-IPA:<br>
<br>
[03/Jan/2017:23:08:26 -0500] conn=36 fd=73 slot=73 connection from
192.168.11.xxx to 192.168.11.xxx<br>
[03/Jan/2017:23:08:26 -0500] conn=36 op=0 BIND dn="cn=Directory
Manager" method=128 version=2<br>
[03/Jan/2017:23:08:26 -0500] conn=36 op=0 RESULT err=0 tag=97
nentries=0 etime=0 dn="cn=directory manager"<br>
[03/Jan/2017:23:08:26 -0500] conn=36 op=1 SRCH
base="ou=sessions,ou=Security Domain,o=ipaca" scope=2
filter="(objectClass=securityDomainSessionEntry)" attrs="cn"<br>
[03/Jan/2017:23:08:26 -0500] conn=36 op=1 RESULT err=32 tag=101
nentries=0 etime=0<br>
[03/Jan/2017:23:08:26 -0500] conn=36 op=2 UNBIND<br>
[03/Jan/2017:23:08:26 -0500] conn=36 op=2 fd=73 closed - U1<br>
[03/Jan/2017:23:08:27 -0500] conn=6 op=40 MOD
dn="cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca"<br>
[03/Jan/2017:23:08:27 -0500] conn=6 op=40 RESULT err=0 tag=103
nentries=0 etime=0<br>
[03/Jan/2017:23:09:04 -0500] conn=37 fd=73 slot=73 SSL connection
from 192.168.11.xxx to 192.168.11.xxx<br>
[03/Jan/2017:23:09:04 -0500] conn=37 TLS1.2 256-bit AES<br>
[03/Jan/2017:23:09:04 -0500] conn=37 op=0 BIND dn="cn=directory
manager" method=128 version=3<br>
[03/Jan/2017:23:09:04 -0500] conn=37 op=0 RESULT err=49 tag=97
nentries=0 etime=0 - Invalid credentials<br>
[03/Jan/2017:23:09:04 -0500] conn=37 op=1 UNBIND<br>
[03/Jan/2017:23:09:04 -0500] conn=37 op=1 fd=73 closed - U1<br>
<br>
Looks more like a structural issue?<br>
</font>
<pre class="moz-signature" cols="72">--
Regards
Peter Larsen</pre>
</body>
</html>