FreeIPA replica

[Alfredo De Luca]

Hi all.
I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on
Centos 7) but I get the following error;


ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
  Cannot promote this client to a replica. Local domain 'digit.test' does
not match IPA domain 'mytestdomain.it'.

Now I know that on IPA server lev 1 you cannot add a replica from the
server so that's why I tried
1. ipa-client-install (gone well)
2. ipa-replica-install (with errors)

Any idea?



-- 
*Alfredo*

[Alfredo De Luca]

Hi all.
Any idea for this?

/Alfredo

On Tue, 31 Jul 2018, 14:52 Alfredo De Luca, <alfredo.deluca(a)gmail.com&gt;
wrote:

>  Hi all.
>  I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on
>  Centos 7) but I get the following error;
>
>
>  ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
>    Cannot promote this client to a replica. Local domain 'digit.test' does
>  not match IPA domain 'mytestdomain.it'.
>
>  Now I know that on IPA server lev 1 you cannot add a replica from the
>  server so that's why I tried
>  1. ipa-client-install (gone well)
>  2. ipa-replica-install (with errors)
>
>  Any idea?
>
>
>
>  --
>  *Alfredo*
>
>

[Alexander Bokovoy]

On ti, 31 heinä 2018, Alfredo De Luca via FreeIPA-users wrote:
> Hi all.
> I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on
> Centos 7) but I get the following error;
>
>
> ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
>   Cannot promote this client to a replica. Local domain 'digit.test' does
> not match IPA domain 'mytestdomain.it'.
>
> Now I know that on IPA server lev 1 you cannot add a replica from the
> server so that's why I tried
> 1. ipa-client-install (gone well)
> 2. ipa-replica-install (with errors) 
How did you call 'ipa-client-install'?
What options did you pass there?
Did you use 'ipa-client-install -n digit.test'?

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Alfredo De Luca]

Hi Alexander. yes I did.. these are all the options with client install

ipa-client-install --force-join --domain digit.test --server idm.digit.test
--realm MYTESTDOMAIN.IT --hostname ipa-repl.digit.test --mkhomedir -U
--principal admin --password <password>

and all went well. I can access the host with IPA users and so on....

Whatelse can I try?

Cheers





On Wed, Aug 1, 2018 at 8:16 AM Alexander Bokovoy <abokovoy(a)redhat.com&gt;
wrote:

>  On ti, 31 heinä 2018, Alfredo De Luca via FreeIPA-users wrote:
>  >Hi all.
>  >I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on
>  >Centos 7) but I get the following error;
>  >
>  >
>  >ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
>  >  Cannot promote this client to a replica. Local domain 'digit.test' does
>  >not match IPA domain 'mytestdomain.it'.
>  >
>  >Now I know that on IPA server lev 1 you cannot add a replica from the
>  >server so that's why I tried
>  >1. ipa-client-install (gone well)
>  >2. ipa-replica-install (with errors)
>  How did you call 'ipa-client-install'? What options did you pass there?
>  Did you use 'ipa-client-install -n digit.test'?
>
>  --
>  / Alexander Bokovoy
>  Sr. Principal Software Engineer
>  Security / Identity Management Engineering
>  Red Hat Limited, Finland
>  

-- 
*Alfredo*

[Alexander Bokovoy]

On ke, 01 elo 2018, Alfredo De Luca wrote:
> Hi Alexander. yes I did.. these are all the options with client
> install
>
> ipa-client-install --force-join --domain digit.test --server idm.digit.test
> --realm MYTESTDOMAIN.IT --hostname ipa-repl.digit.test --mkhomedir -U
> --principal admin --password <password>
>
> and all went well. I can access the host with IPA users and so on.... 
What was the
reason to force specifying --domain digit.test if your
realm is MYTESTDOMAIN.IT and primary DNS domain mytestdomain.it?

You should have used --domain mytestdomain.it in the first place.
According to the man page for ipa-client-install,

       --domain=DOMAIN
	      The primary DNS domain of an existing IPA deployment, e.g.
	      example.com. This DNS domain should contain the SRV
	      records generated by the IPA server installer.  Usually
	      the name is a lower-cased name of an IPA Kerberos realm
	      name.



-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Alfredo De Luca]

Thanks heaps Alexander. That made the trick.

Now if all the ipa clients point to the master and it goes down ...the
replica will do the job but ...do I need to change the DNS to add the
replica?

Cheers


On Tue, Jul 31, 2018 at 2:52 PM Alfredo De Luca <alfredo.deluca(a)gmail.com&gt;
wrote:

>  Hi all.
>  I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on
>  Centos 7) but I get the following error;
>
>
>  ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
>    Cannot promote this client to a replica. Local domain 'digit.test' does
>  not match IPA domain 'mytestdomain.it'.
>
>  Now I know that on IPA server lev 1 you cannot add a replica from the
>  server so that's why I tried
>  1. ipa-client-install (gone well)
>  2. ipa-replica-install (with errors)
>
>  Any idea?
>
>
>
>  --
>  *Alfredo*
>
>  
-- 
*Alfredo*

[Alexander Bokovoy]

On ke, 01 elo 2018, Alfredo De Luca via FreeIPA-users wrote:
> Thanks heaps Alexander. That made the trick.
>
> Now if all the ipa clients point to the master and it goes down ...the
> replica will do the job but ...do I need to change the DNS to add the
> replica? 
Read ipa-client-install man page, it has explanation. You don't really
need to specify --server option. If you did, you pinned the client to
that server. If you just use autodiscovery, --server is not needed.

> Cheers
>
>
> On Tue, Jul 31, 2018 at 2:52 PM Alfredo De Luca <alfredo.deluca(a)gmail.com&gt;
> wrote:
>
> > Hi all.
> > I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on
> > Centos 7) but I get the following error;
> >
> >
> > ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR
> >   Cannot promote this client to a replica. Local domain 'digit.test' does
> > not match IPA domain 'mytestdomain.it'.
> >
> > Now I know that on IPA server lev 1 you cannot add a replica from the
> > server so that's why I tried
> > 1. ipa-client-install (gone well)
> > 2. ipa-replica-install (with errors)
> >
> > Any idea?
> >
> >
> >
> > --
> > *Alfredo*
> >
> >
>
> -- 
> *Alfredo* 
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]...

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Alfredo De Luca]

Thanks heaps.

Cheers


On Wed, Aug 1, 2018 at 12:12 PM Alexander Bokovoy <abokovoy(a)redhat.com&gt;
wrote:

>  On ke, 01 elo 2018, Alfredo De Luca via FreeIPA-users wrote:
>  >Thanks heaps Alexander. That made the trick.
>  >
>  >Now if all the ipa clients point to the master and it goes down ...the
>  >replica will do the job but ...do I need to change the DNS to add the
>  >replica?
>  Read ipa-client-install man page, it has explanation. You don't really
>  need to specify --server option. If you did, you pinned the client to
>  that server. If you just use autodiscovery, --server is not needed.
>
>  >
>  >Cheers
>  >
>  >
>  >On Tue, Jul 31, 2018 at 2:52 PM Alfredo De Luca <alfredo.deluca(a)gmail.com
>  >
>  >wrote:
>  >
>  >> Hi all.
>  >> I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4 on
>  >> Centos 7) but I get the following error;
>  >>
>  >>
>  >> ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):
>  ERROR
>  >>   Cannot promote this client to a replica. Local domain 'digit.test'
>  does
>  >> not match IPA domain 'mytestdomain.it'.
>  >>
>  >> Now I know that on IPA server lev 1 you cannot add a replica from the
>  >> server so that's why I tried
>  >> 1. ipa-client-install (gone well)
>  >> 2. ipa-replica-install (with errors)
>  >>
>  >> Any idea?
>  >>
>  >>
>  >>
>  >> --
>  >> *Alfredo*
>  >>
>  >>
>  >
>  >--
>  >*Alfredo*
>
>  >_______________________________________________
>  >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  >To unsubscribe send an email to
>  freeipa-users-leave(a)lists.fedorahosted.org
>  >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >List Archives:
>
> https://lists.fedoraproject.org/archives/list/[e-mail]...
>
>
>  --
>  / Alexander Bokovoy
>  Sr. Principal Software Engineer
>  Security / Identity Management Engineering
>  Red Hat Limited, Finland
>  

-- 
*Alfredo*

[Alfredo De Luca]

Hi Alex et all
I wonder what I need to do on our internal DNS to point all the clients to
both master and replica without changing all the ipa clients conf.

At this stage it's too late to change the server in autodiscovery.
What should I do on the DNS server?

Cheers


On Wed, Aug 1, 2018 at 2:24 PM Alfredo De Luca <alfredo.deluca(a)gmail.com&gt;
wrote:

>  Thanks heaps.
>
>  Cheers
>
>
>  On Wed, Aug 1, 2018 at 12:12 PM Alexander Bokovoy <abokovoy(a)redhat.com&gt;
>  wrote:
>
> > On ke, 01 elo 2018, Alfredo De Luca via FreeIPA-users wrote:
> > >Thanks heaps Alexander. That made the trick.
> > >
> > >Now if all the ipa clients point to the master and it goes down ...the
> > >replica will do the job but ...do I need to change the DNS to add the
> > >replica?
> > Read ipa-client-install man page, it has explanation. You don't really
> > need to specify --server option. If you did, you pinned the client to
> > that server. If you just use autodiscovery, --server is not needed.
> >
> > >
> > >Cheers
> > >
> > >
> > >On Tue, Jul 31, 2018 at 2:52 PM Alfredo De Luca <
> > alfredo.deluca(a)gmail.com&gt;
> > >wrote:
> > >
> > >> Hi all.
> > >> I am trying to add a replica on a freeIPA Server lev 1 (version 4.5.4
> > on
> > >> Centos 7) but I get the following error;
> > >>
> > >>
> > >> ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):
> > ERROR
> > >>   Cannot promote this client to a replica. Local domain
> 'digit.test'
> > does
> > >> not match IPA domain 'mytestdomain.it'.
> > >>
> > >> Now I know that on IPA server lev 1 you cannot add a replica from the
> > >> server so that's why I tried
> > >> 1. ipa-client-install (gone well)
> > >> 2. ipa-replica-install (with errors)
> > >>
> > >> Any idea?
> > >>
> > >>
> > >>
> > >> --
> > >> *Alfredo*
> > >>
> > >>
> > >
> > >--
> > >*Alfredo*
> >
> > >_______________________________________________
> > >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > >To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > >List Archives:
> >
> https://lists.fedoraproject.org/archives/list/[e-mail]...
> >
> >
> > --
> > / Alexander Bokovoy
> > Sr. Principal Software Engineer
> > Security / Identity Management Engineering
> > Red Hat Limited, Finland
> >
>
>
>  --
>  *Alfredo*
>
>  
-- 
*Alfredo*