RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2004646 - RFE: Improve error message with more detail for ipa-replica-install command
Summary: RFE: Improve error message with more detail for ipa-replica-install command
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: ipa
Version: 8.3
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Trivino
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On:
Blocks: 2089750
TreeView+ depends on / blocked
 
Reported: 2021-09-15 17:34 UTC by Hemant B Khot
Modified: 2022-11-08 10:25 UTC (History)
8 users (show)

Fixed In Version: ipa-4.9.10-1.module+el8.7.0+15691+2b2c1dd5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2089750 (view as bug list)
Environment:
Last Closed: 2022-11-08 09:35:45 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Fedora Pagure freeipa issue 9162 0 None None None 2022-05-23 11:54:00 UTC
Red Hat Issue Tracker FREEIPA-6860 0 None None None 2021-09-21 11:05:52 UTC
Red Hat Issue Tracker RHELPLAN-97288 0 None None None 2021-09-15 17:39:01 UTC
Red Hat Product Errata RHBA-2022:7540 0 None None None 2022-11-08 09:36:23 UTC

Comment 4 Hemant B Khot 2021-09-15 17:38:45 UTC
Reproducer to get into such error situation:
- Use external DNS server (we use Windows AD based DNS servers) and not the internal DNS servers of IPA
- Install a RHEL7 IPA server and have it working (we have it also AD connected, but for this case it does not matter)
- Confirm the SRV records point to RHEL7
- Install a RHEL8 server
- Switch on the external DNS the SRV records already tp point to RHEL8 server
- Install RHEL8 IPA server without the --server option to have it using the SRV records (that already point the the RHEL8 server that is  being installed)
- Run on RHEL8 ipa-server-install -uninstall to prepare to try again
- Install RHEL8 IPA server now with the --server=RHEL7-fqdn
- Now you have the failure that the replica-agreement already exists from the first installation that was failing because the SRV records were point to the not yet install RHEL8 IPA server

In our installation i found out that mentioned command on replica-agreement had to be executed on the RHEL7-IPA server where the agreement was also already created.

That means that the error is missing important information that the replica-agreement has to be deleted from the other end of the agreement.
Expected error my real-world use case, the information missing i added in <<...>>:
~~~
The ipa-replica-install command failed, exception: ScriptError: A replication agreement for this host <<new.server.example.com> already exists <<on working.server.example.com>>.
Run this command <<on workin.server.example.com to remove the replication agreement>>:
    %% ipa-replica-manage del new.server.example.com --force
~~~

Comment 6 Florence Blanc-Renaud 2021-09-20 15:07:31 UTC
Easy to fix. In ipaserver/install/server/replicainstall.py, in the method promote_check (line 1024), the installer looks for an existing replication agreement and prints an error message:

----- 8< -----
        # Check that we don't already have a replication agreement
        if replman.get_replication_agreement(config.host_name):
            msg = ("A replication agreement for this host already exists. "
                   "It needs to be removed.\n"
                   "Run this command:\n"
                   "    %% ipa-replica-manage del {host} --force"
                   .format(host=config.host_name))
            raise ScriptError(msg, rval=3)
----- >8 -----

The msg needs to be changed into "Run this command on any working server: %% ipa server-del {host} --force"
- ipa server-del instead of ipa-replica-manage del because only domain-level1 is now supported
- and the commands needs to be run on a working server, not on the host where ipa-replica-install failed

Comment 10 Trivino 2022-05-25 07:11:08 UTC
fixed upstream: https://github.com/freeipa/freeipa/pull/6274

Moving to POST.

Comment 12 Michal Polovka 2022-06-23 09:27:19 UTC
Pre-verified using automation from ipatests/test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer:test_replica_install_existing_agreement with the package ipa-server-4.9.10-1.module+el8.7.0+15691+2b2c1dd5.x86_64

Passed 	test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer::()::test_replica_install_against_server_without_ca 	
Passed 	test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer::()::test_replica_install_against_server_without_kra 	
Passed 	test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer::()::test_replica_install_against_server 	 	
Passed 	test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer::()::test_replica_install_existing_agreement

Therefore marking as verified: tested. Full test log is an attachment of this BZ.

Comment 16 Michal Polovka 2022-07-15 11:43:01 UTC
Verified using automation from ipatests/test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer:test_replica_install_existing_agreement with a package ipa-server-4.9.10-4.module+el8.7.0+15926+daa9f08b.x86_64 from the nightly repository.

Passed 	test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer::()::test_replica_install_against_server_without_ca 	
Passed 	test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer::()::test_replica_install_against_server_without_kra 		
Passed 	test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer::()::test_replica_install_against_server 	
Passed 	test_integration/test_installation.py::TestInstallReplicaAgainstSpecificServer::()::test_replica_install_existing_agreement 	

Full pytest log is an attachment of this BZ.

Marking as verified.

Comment 19 errata-xmlrpc 2022-11-08 09:35:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (idm:client and idm:DL1 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7540


Note You need to log in before you can comment on or make changes to this bug.