[Freeipa-users] Re: IPA Replicate Re-Initialize fails, only one sane IPA server left

[thierry bordaz]

Hi,

At first look, I would say svgipa02 fails trigger its total update from 
svgipa01 because ipa02 fails authenticate on ipa01.
Are the logs from ipa02 ? if it is, it shows that ipa01 did not even try 
to reinit it.
Could you send the DS access/errors logs from both ipa01 and ipa02 at 
the period of time when you run 'ipa-replica-manage re-initialize' ?

best regards
thierry
On 10/15/2018 10:42 AM, Karl Dag Gursli via FreeIPA-users wrote:
>  Hi
>
>  We experienced issues with one of our IPA server(svgipa02) as it did 
>  not receive updates. It was the decided to run on svgipa02
>
>  ipa-replicate-manage re-initialize --from=svgipa01
>
>  [root@svgipa02 slapd-NO-EP-CORP-LOCAL]# date; ipa-replica-manage 
>  re-initialize --from=svgipa01.no.ep.corp.local;date
>
>  Mon Oct 15 10:33:26 CEST 2018
>
>  Directory Manager password:
>
>  Update in progress, 15 seconds elapsed
>
>  [ldaps://svgipa01.no.ep.corp.local:636] reports: Update failed! 
>  Status: [49  - LDAP error: Invalid credentials]
>
>  Mon Oct 15 10:33:52 CEST 2018
>
>  [root@svgipa02 slapd-NO-EP-CORP-LOCAL]#
>
>  From the dirsrv errors log
>
>  [15/Oct/2018:10:33:34.192011467 +0200] - DEBUG - schema-compat-plugin 
>  - searching from "cn=mapping tree,cn=config" for 
>
> "(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))"
>
>  with scope 2 (sub)
>
>  [15/Oct/2018:10:33:34.192823822 +0200] - DEBUG - cos-plugin - 
>  cos_cache_vattr_types - Failed to get class of service reference
>
>  [15/Oct/2018:10:33:34.193697399 +0200] - DEBUG - schema-compat-plugin 
>  - searching from "cn=schema" for "(objectClass=*)" with scope 0
> (base)
>
>  [15/Oct/2018:10:33:34.456582623 +0200] - DEBUG - schema-compat-plugin 
>  - searching from "cn=mapping tree,cn=config" for 
>
> "(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))"
>
>  with scope 2 (sub)
>
>  [15/Oct/2018:10:33:34.457479057 +0200] - DEBUG - cos-plugin - 
>  cos_cache_vattr_types - Failed to get class of service reference
>
>  [15/Oct/2018:10:33:34.736019484 +0200] - DEBUG - schema-compat-plugin 
>  - searching from "cn=mapping tree,cn=config" for 
>
> "(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=no,dc=ep,dc=corp,dc=local))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=svgipa01.no.ep.corp.local))"
>
>  with scope 2 (sub)
>
>  [15/Oct/2018:10:33:34.736561662 +0200] - DEBUG - cos-plugin - 
>  cos_cache_vattr_types - Failed to get class of service reference
>
>  The procedure did not finish and svgipa02 was left in an empty state
>
>  What is the producedure to solve this issue?
>
>  rgds
>
>  Karl Dag
>
>
>
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...