Hide Forgot
Description of problem: ipa topologysuffix-verify domain ======================================================== Replication topology of suffix "domain" contains errors. ======================================================== ------------------------------------------------------------- Recommended maximum number of agreements per replica exceeded ------------------------------------------------------------- Maximum number of agreements per replica: 4 Server "p0029ipa03.unix.local" has 5 agreements with servers: i22ldap-ipa02.unix.local p0029ipa04.unix.local p00iuipa02.unix.local p029i35ipa02.unix.local p00iuipa02.unix.local the message should turn into a warning or let's disable this check since lots of customers have more than 4 agreements per replica. Version-Release number of selected component (if applicable): python2-ipaclient-4.4.0-12.el7.noarch Additional info: source code: ======================== ======================== if max_agmts_errors: textui.print_dashed(unicode(_('Recommended maximum number of ' 'agreements per replica exceeded'))) ======================== # check if suggested maximum number of agreements per replica max_agmts_errors = [] for m in master_cns: # chosen direction doesn't matter much given that 'both' is the # only allowed direction suppliers = graph.get_tails(m) if len(suppliers) > self.api.env.recommended_max_agmts: max_agmts_errors.append((m, suppliers)) ======================= # Topology plugin ('recommended_max_agmts', 4), # Recommended maximum number of replication # agreements ========================
We have recommendation in docs that max 4 replication agreements should be used https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html-single/Linux_Domain_Identity_Authentication_and_Policy_Guide/index.html#replica-topology-recommendations I'm totally against of removal this check, users should be informed that they don't follow recommendations and putting themselves to risk and inefficient replication. But to not scary people we may transform this to warning.
Upstream ticket: https://fedorahosted.org/freeipa/ticket/6533
Fixed upstream master: https://pagure.io/freeipa/c/777bf46b2da045e537724641adec4a3ab454323f ipa-4-5: https://pagure.io/freeipa/c/bccf065a881ee3e81165ca69e9a915d292d51136
version: ipa-server-4.5.4-7.el7.x86_64 Steps: 1. Install Master with 5 replica just to exceed the recommended limit. 2. $ ipa topologysuffix-verify domain Actual result: [root@master ~]# ipa topologysuffix-verify domain ------------------------------------------------------------- Recommended maximum number of agreements per replica exceeded ------------------------------------------------------------- Maximum number of agreements per replica: 4 Server "master.testrelm.test" has 5 agreements with servers: replica1.testrelm.test replica2.testrelm.test replica3.testrelm.test replica4.testrelm.test replica5.testrelm.test [root@master ~]# ipa server-find --------------------- 6 IPA servers matched --------------------- Server name: master.testrelm.test Min domain level: 0 Max domain level: 1 Server name: replica1.testrelm.test Min domain level: 0 Max domain level: 1 Server name: replica2.testrelm.test Min domain level: 0 Max domain level: 1 Server name: replica3.testrelm.test Min domain level: 0 Max domain level: 1 Server name: replica4.testrelm.test Min domain level: 0 Max domain level: 1 Server name: replica5.testrelm.test Min domain level: 0 Max domain level: 1 ---------------------------- Number of entries returned 6 ---------------------------- Warning can be seen when recommended replication agreement exceeded. Based on above observation marking the bug verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0918