Martin Kosek wrote:
On Wed, 2012-05-16 at 18:25 -0400, Rob Crittenden wrote:
In ipa-replica-install we infer that a replication agreement exists if
the host exists. Add an explicit check instead.
What I did to test this was to break out of the installation right after
replication succeeded. Then I'd run ipa-server-install --uninstall and
try the replica install again.
I was also able to reproduce the issue by installing master and replica,
then deleting the replica host entry and running the ipa-replica-install
The patch works fine, I would just improve the following notice:
$ ipa-replica-install INFO_FILE
A replication agreement for this host already exists. It needs to be
% ipa-replica-manage del vm-098.idm.lab.bos.redhat.com
... and add "--force" flag to the recommended command. Otherwise, user
will receive an error as obviously the replica is not alive anymore.
Maybe we could also suggest that this should be run on a master machine
so that users don't try to run it on a replica.
Good idea, updated.
>From ca18d01ea4b63594ca40cebddae999c1e2142a7b Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcrit...@redhat.com>
Date: Wed, 16 May 2012 18:11:11 -0400
Subject: [PATCH] During replication installation see if an agreement already
We were inferring that an agreement existed if the host was present
as an IPA host. This was not enough if the replica installation failed
install/tools/ipa-replica-install | 28 +++++++++++++++++++++-------
install/tools/man/ipa-replica-install.1 | 12 +++++++++---
2 files changed, 30 insertions(+), 10 deletions(-)
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 07b1781ee7f99cacf1a3abbd6207b95f38da1807..83c1324215433a83c81650bfcf2cd860b86772d4 100755
@@ -30,7 +30,7 @@ from ipapython import ipautil
from ipaserver.install import dsinstance, installutils, krbinstance, service
from ipaserver.install import bindinstance, httpinstance, ntpinstance, certs
from ipaserver.install import memcacheinstance
-from ipaserver.install.replication import replica_conn_check
+from ipaserver.install.replication import replica_conn_check, ReplicationManager
from ipaserver.install.installutils import HostnameLocalhost, resolve_host
from ipaserver.install.installutils import ReplicaConfig, expand_replica_info, read_replica_info
from ipaserver.install.installutils import get_host_name, BadHostError
@@ -401,21 +401,35 @@ def main():
+ replman = ReplicationManager(config.realm_name, config.master_host_name,
+ found = False
entry = conn.find_entries(u'fqdn=%s' % host, ['dn', 'fqdn'], u'%s,%s' % (api.env.container_host, api.env.basedn))
- print "The host %s already exists on the master server. Depending on your configuration, you may perform the following:\n" % host
- print "Remove the replication agreement, if any:"
- print " %% ipa-replica-manage del %s" % host
- print "Remove the host entry:"
+ print "The host %s already exists on the master server.\nYou should remove it before proceeding:" % host
print " %% ipa host-del %s" % host
+ found = True
+ except errors.NotFound:
+ (agreement_cn, agreement_dn) = replman.agreement_dn(host)
+ entry = conn.get_entry(agreement_dn, ['*'])
+ print "A replication agreement for this host already exists. It needs to be removed. Run this on the master that generated the info file:"
+ print " %% ipa-replica-manage del %s --force" % host
+ found = True
+ if found:
sys.exit("\nThe password provided is incorrect for LDAP server %s" % config.master_host_name)
sys.exit("\nUnable to connect to LDAP server %s" % config.master_host_name)
+ if conn and conn.isconnected():
+ if replman and replman.conn:
# Configure ntpd
diff --git a/install/tools/man/ipa-replica-install.1 b/install/tools/man/ipa-replica-install.1
index c41af20e056f3f161a28f50fd9b275cd777a1341..1a0f89a410b3409adbc790b114d14fee8e9e1952 100644
@@ -1,5 +1,5 @@
.\" A man page for ipa-replica-install
-.\" Copyright (C) 2008 Red Hat, Inc.
+.\" Copyright (C) 2008-2012 Red Hat, Inc.
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
@@ -16,7 +16,7 @@
.\" Author: Rob Crittenden <rcrit...@redhat.com>
-.TH "ipa-replica-install" "1" "Sep 5 2011" "FreeIPA" "FreeIPA Manual Pages"
+.TH "ipa-replica-install" "1" "May 16 2012" "FreeIPA" "FreeIPA Manual Pages"
ipa\-replica\-install \- Create an IPA replica
@@ -25,6 +25,10 @@ ipa\-replica\-install [\fIOPTION\fR]... replica_file
Configures a new IPA server that is a replica of the server that generated it. Once it has been created it is an exact copy of the original IPA server and is an equal master. Changes made to any master are automatically replicated to other masters.
The replica_file is created using the ipa\-replica\-prepare utility.
+If the installation fails you may need to run ipa\-server\-install \-\-uninstall before running ipa\-replica\-install again.
+The installation will fail if the host you are installing the replica on exists as a host in IPA or an existing replication agreement exists (for example, from a previously failed installation).
.SS "BASIC OPTIONS"
@@ -33,7 +37,7 @@ Install and configure a CA on this replica. If a CA is not configured then
certificate operations will be forwarded to a master with a CA installed.
-The IP address of this server. If this address does not match the address the host resolves to and --setup-dns is not selected the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
+The IP address of this server. If this address does not match the address the host resolves to and \-\-setup\-dns is not selected the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
Directory Manager (existing master) password
@@ -98,3 +102,5 @@ Do not automatically create DNS SSHFP records.
0 if the command was successful
1 if an error occurred
+3 if the host exists in the IPA server or a replication agreement to the remote master already exists
Freeipa-devel mailing list