Sample Header Ad - 728x90

Help removing a failed replica from a FreeIPA setup

0 votes
2 answers
956 views
I have two FreeIPA servers in my system; ns-1 and ns-2. To my limited knowledge, ns-1 is our main ipa server and ns-2 was setup as a replica. But I may be incorrect in that regard. In my attempts to upgrade the OS on ns-2, the upgrade failed somewhere in the middle and now the machine is toast. ns-1 is still operating fine as I was holding off on upgrading that machine until ns-2 was complete. I blew away ns-2 and rebuilt a new VM in its place and now want to set it up as the new ns-2 replacement. The problem though is that ns-1 still has a record of the original ns-2 and is preventing the ipa-replica-install command from succeeding on my new ns-2. In ns-1's Web UI, it still lists ns-2 as an ipa server and displays ns-2 in the topology graph. From the ns-1 machine I've issued the following commands: # ipa-replica-manage list ns-2..: master ns-1..: master # ipa-replica-manage del --force --cleanup ns-2.. Updating DNS system records Not allowed on non-leaf entry # ldap_delete -x -h 127.0.0.1 -D 'cn=directory manager' -w 'cn=ns-2..,cn=masters,cn=ipa,cn=etc,dc=.' ldap_delete: Operation not allowed on non-leaf (66) additional info: Entry has replication conflicts as children # ipa-replica-manage dnsrange-show ns-2..: Connection failed: cannot connect to 'ldaps://ns-2..:636': Transport endpoint is not connected On my new ns-2 machine I've run the ip-client-install command successfully. And then I ran the "ipa-replica-install --setup-dns --setup-ca --no-forwarders -P " It fails because the ns-1 machine appears to believe that there's already an ns-2 machine defined. I've found the following threads that appears to have experienced the same problem, but no resolution is included: https://www.spinics.net/linux/fedora/fedora-users/msg498296.html I've tried following this documentation, but it does not explain how to resolve replicas that have "children": https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/identity_management_guide/ipa-replica-manage#repl-conflicts
Asked by dutsnekcirf (179 rep)
Dec 14, 2022, 04:49 PM
Last activity: Jun 3, 2024, 08:28 AM