Red Hat Bugzilla – Bug 1012410
Collect output of `ipa-replica-manage` in ipa module
Last modified: 2014-12-03 08:36:44 EST
Description of problem:
Please collect output from following commands (in the ipa module):
ipa-replica-manage -v list
ipa-replica-manage -v list $(hostname)
The output from command `ipa-replica-manage` is missing.
Information about replication topology is included in sosreport.
Thanks for the report. The utility of this information is clear.
Is there anything in the tool output that we would want to remove? I.e. secrets or tokens that are not of diagnostic value but that could be considered private information?
Would it be possible to paste/attach some sample output to the bug?
AFAIK there is nothing 'secret', just host names.
$ ipa-replica-manage -v list
$ ipa-replica-manage -v list $(hostname)
last init status: 0 Total update succeeded
last init ended: 2013-09-26 11:19:06+00:00
last update status: 0 Replica acquired successfully: Incremental update succeeded
last update ended: 2013-09-26 12:50:29+00:00
That's true. I am just thinking that ipa-replica-manage command won't run without Kerberos credentials. So if user does not run "kinit someuser" and enters password, ipa-replica-manage will fail to bind to LDAP server and will not collect the information.
Sosreport runs under root, right? Can we hack it to use SLAPI for Bind?
Unfortunately not. You can only specify bind DN and password.
You would need to prepare ldapsearches doing LDAPI autobind. To search for replication agreements in given replica. Aren't ldapsearches like this one in sos report already? I am not sure now if we added them or not.
> Aren't ldapsearches like this one in sos report already? I am not sure now if
> we added them or not.
Happy to make changes to capture this information but we'll need to have something that will "just work" for most configurations (or that can take a simple command line parameter that we can document).
The Debian porters added some ldapsearch stuff upstream to their ldap plug-in but this does not address replication afaik:
ldap_search = "ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// "
self.add_cmd_output("ldapsearch -x -b '' -s base 'objectclass=*'")
self.add_cmd_output(ldap_search + "-b cn=config '(!(objectClass=olcSchemaConfig))'",
self.add_cmd_output(ldap_search + "-b cn=schema,cn=config dn",
self.add_cmd_output(ldap_search + "-b cn=config '(olcAccess=*)' olcAccess olcSuffix",
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Author: Bryn M. Reeves <firstname.lastname@example.org>
Date: Sat Jun 21 15:12:52 2014 +0100
[ipa] add ipa-replica-manage output
Signed-off-by: Bryn M. Reeves <email@example.com>
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.