Hi all,

after an upgrade von 4.1 to 4.4 (4.4.0-14.el7.centos.7)  I have some trouble in changing replication agreements.

#ipa-replica-manage del auth4.example.com

'auth9.example.com' has no replication agreement for 'auth4.example.com'

# ipa-replica-manage del auth4.example.com --force --clean

Cleaning a master is irreversible.

This should not normally be require, so use cautiously.

Continue to clean master? [no]: yes

Re-run /sbin/ipa-replica-manage with --verbose option to get more information

Unexpected error: Insufficient access: Insufficient 'delete' privilege to delete the entry 'krbprincipalname=ldap/auth4.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com'.

I suspect some missing ACLs that probably got lost during an update, although I do not know which and how to read.

Any help would be appreciated.

Andreas Sieferlinger

Site Reliability Engineer

glomex GmbH 
A Company of ProSiebenSat.1 Media SE 

Landsberger Straße 110 
D-80339 Munich 
Germany 
Tel. +49 89 9507 8964

Executive Board: 
Michael Jaschke (CEO), Arnd Mückenberger (CFO) 

Registered Office: Unterfoehring 
HRB 224542 AG München 
VAT number DE 305765704 
Tax No. 143/314/40826