[Freeipa-users] CA replicas different views???

2015-09-01 Thread Janelle

Hello,

I am very confused. I have a couple of data centers and as expected, I 
have setup CA replicas in each DC. However, this is what makes me 
nervous/afraid of my configs. In one data  center, which sitting on a 
master and issuing:


(as seen from ipa006.example.com)
ipa-csreplica-manage list

I see

ipa002.example.com: master

BUT as seen from ipa010.example.com

ipa002.example.com: CA not configured

How is this possible???

~Janelle

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project


Re: [Freeipa-users] CA replicas different views???

2015-09-01 Thread Rob Crittenden

Janelle wrote:

Hello,

I am very confused. I have a couple of data centers and as expected, I
have setup CA replicas in each DC. However, this is what makes me
nervous/afraid of my configs. In one data  center, which sitting on a
master and issuing:

(as seen from ipa006.example.com)
ipa-csreplica-manage list

I see

ipa002.example.com: master

BUT as seen from ipa010.example.com

ipa002.example.com: CA not configured

How is this possible???

~Janelle



It may be an indication of a replication problem. This data is stored in 
cn=masters,cn=ipa,cn=etc,$SUFFIX


It looks for cn=CA for a given host to see if it has the service 
configured. I would start by looking in that subtree on both hosts.


rob

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project