Ronald Wimmer via FreeIPA-users wrote:

On 08.06.20 19:24, Rob Crittenden via FreeIPA-users wrote:

Ronald Wimmer via FreeIPA-users wrote:

On 05.06.20 17:33, Ronald Wimmer via FreeIPA-users wrote:

On 05.06.20 16:24, Ronald Wimmer via FreeIPA-users wrote:

I did an IPA migration from CentOS 7 machines to OL 8.1 following the
procedure as documented in
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_identity_management/migrate-7-to-8_migrating

.

Today I found out that only four of my eight IPA servers do resolve
AD users (tested with id <AD_user> on every IPA server). The setup
procedure did not differ. (except for machine no. 1 which is the CA
renewal master)

AD users are resolved on machines 1, 5, 6 and 8. Machine 2, 3, 4 and
7 do not resolve AD users.

When upgrading we could neither keep hostnames nor IP addresses. Might
this explain the behaviour above? (could the working machines have IPs
of former trust controllers?)

I think I was panicking too early. Because the sssd-db-cache was mounted
in RAM I rebooted the IPA servers sequentially and voilà the problem
disappeared.

Is there any means of checking the IPA installation? I will try
ipa-healthcheck today.

That's the way to check the installation.

After doing a dnf install ipa-healthcheck the ipa-healthcheck command is
supposed to work? If yes, this is not the case in Oracle Linux 8.1.

That's quite a vague statement.

You're right. I should have provided more info: