In ipa-replica-install we infer that a replication agreement exists if the host exists. Add an explicit check instead.

What I did to test this was to break out of the installation right after replication succeeded. Then I'd run ipa-server-install --uninstall and try the replica install again.

>From 58041eea2890c182a346548673d3a6a826935d25 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <>
Date: Wed, 16 May 2012 18:11:11 -0400
Subject: [PATCH] During replication installation see if an agreement already

We were inferring that an agreement existed if the host was present
as an IPA host. This was not enough if the replica installation failed
early enough.
 install/tools/ipa-replica-install       |   28 +++++++++++++++++++++-------
 install/tools/man/ipa-replica-install.1 |   12 +++++++++---
 2 files changed, 30 insertions(+), 10 deletions(-)

diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 07b1781ee7f99cacf1a3abbd6207b95f38da1807..b82341001a5370c731455b65114b82704fa1b8a6 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -30,7 +30,7 @@ from ipapython import ipautil
 from ipaserver.install import dsinstance, installutils, krbinstance, service
 from ipaserver.install import bindinstance, httpinstance, ntpinstance, certs
 from ipaserver.install import memcacheinstance
-from ipaserver.install.replication import replica_conn_check
+from ipaserver.install.replication import replica_conn_check, ReplicationManager
 from ipaserver.install.installutils import HostnameLocalhost, resolve_host
 from ipaserver.install.installutils import ReplicaConfig, expand_replica_info, read_replica_info
 from ipaserver.install.installutils import get_host_name, BadHostError
@@ -401,21 +401,35 @@ def main():
         conn.connect(bind_dn='cn=directory manager',
+        replman = ReplicationManager(config.realm_name, config.master_host_name,
+                                     config.dirman_password)
+        found = False
             entry = conn.find_entries(u'fqdn=%s' % host, ['dn', 'fqdn'], u'%s,%s' % (api.env.container_host, api.env.basedn))
-            print "The host %s already exists on the master server. Depending on your configuration, you may perform the following:\n" % host
-            print "Remove the replication agreement, if any:"
-            print "    %% ipa-replica-manage del %s" % host
-            print "Remove the host entry:"
+            print "The host %s already exists on the master server.\nYou should remove it before proceeding:" % host
             print "    %% ipa host-del %s" % host
-            sys.exit(3)
+            found = True
+        except errors.NotFound:
+            pass
+        try:
+            (agreement_cn, agreement_dn) = replman.agreement_dn(host)
+            entry = conn.get_entry(agreement_dn, ['*'])
+            print "A replication agreement for this host already exists. It needs to be removed."
+            print "    %% ipa-replica-manage del %s" % host
+            found = True
         except errors.NotFound:
-        conn.disconnect()
+        if found:
+            sys.exit(3)
     except errors.ACIError:
         sys.exit("\nThe password provided is incorrect for LDAP server %s" % config.master_host_name)
     except errors.LDAPError:
         sys.exit("\nUnable to connect to LDAP server %s" % config.master_host_name)
+    finally:
+        if conn and conn.isconnected():
+            conn.disconnect()
+        if replman and replman.conn:
+            replman.conn.unbind_s()
     # Configure ntpd
     if options.conf_ntp:
diff --git a/install/tools/man/ipa-replica-install.1 b/install/tools/man/ipa-replica-install.1
index c41af20e056f3f161a28f50fd9b275cd777a1341..1a0f89a410b3409adbc790b114d14fee8e9e1952 100644
--- a/install/tools/man/ipa-replica-install.1
+++ b/install/tools/man/ipa-replica-install.1
@@ -1,5 +1,5 @@
 .\" A man page for ipa-replica-install
-.\" Copyright (C) 2008 Red Hat, Inc.
+.\" Copyright (C) 2008-2012 Red Hat, Inc.
 .\" This program is free software; you can redistribute it and/or modify
 .\" it under the terms of the GNU General Public License as published by
@@ -16,7 +16,7 @@
 .\" Author: Rob Crittenden <>
-.TH "ipa-replica-install" "1" "Sep 5 2011" "FreeIPA" "FreeIPA Manual Pages"
+.TH "ipa-replica-install" "1" "May 16 2012" "FreeIPA" "FreeIPA Manual Pages"
 ipa\-replica\-install \- Create an IPA replica
@@ -25,6 +25,10 @@ ipa\-replica\-install [\fIOPTION\fR]... replica_file
 Configures a new IPA server that is a replica of the server that generated it. Once it has been created it is an exact copy of the original IPA server and is an equal master. Changes made to any master are automatically replicated to other masters.
 The replica_file is created using the ipa\-replica\-prepare utility.
+If the installation fails you may need to run ipa\-server\-install \-\-uninstall before running ipa\-replica\-install again.
+The installation will fail if the host you are installing the replica on exists as a host in IPA or an existing replication agreement exists (for example, from a previously failed installation).
@@ -33,7 +37,7 @@ Install and configure a CA on this replica. If a CA is not configured then
 certificate operations will be forwarded to a master with a CA installed.
-The IP address of this server. If this address does not match the address the host resolves to and --setup-dns is not selected the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
+The IP address of this server. If this address does not match the address the host resolves to and \-\-setup\-dns is not selected the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
 \fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
 Directory Manager (existing master) password
@@ -98,3 +102,5 @@ Do not automatically create DNS SSHFP records.
 0 if the command was successful
 1 if an error occurred
+3 if the host exists in the IPA server or a replication agreement to the remote master already exists

Freeipa-devel mailing list

Reply via email to