Description of problem:

I have a cu that tried to set up a trust when they set up their IPA topology, but it failed, and then they realized they did not need / want it. It gave their Primary server the adtrust controller / adtrust agent role.

This role, when enabled (and there is not actual trust set up) will cause ipa-healthcheck to continuously show errors like this:

_________________________________________________________________ 

 {
    "source": "ipahealthcheck.ipa.trust",
    "check": "IPAsidgenpluginCheck",
    "result": "ERROR",
    "uuid": "e241539a-a8bb-48a2-8751-ce43491f5caf",
    "when": "20211216115357Z",
    "duration": "0.001417",
    "kw": {
      "key": "ipa-sidgen-task",
      "error": "no such entry",
      "msg": "Error retrieving 389-ds plugin {key}: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.trust",
    "check": "IPATrustAgentMemberCheck",
    "result": "ERROR",
    "uuid": "714fd6e0-2d6c-4879-9119-90657c5c351f",
    "when": "20211216115357Z",
    "duration": "0.001182",
    "kw": {
      "key": "server.example.com",
      "group": "adtrust agents",
      "msg": "{key} is not a member of {group}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.trust",
    "check": "IPATrustControllerPrincipalCheck",
    "result": "ERROR",
    "uuid": "fd7ce7d7-4763-4fb1-8100-a234e2823672",
    "when": "20211216115357Z",
    "duration": "0.000616",
    "kw": {
      "key": "krbprincipalname=cifs/server.example.com,cn=services,cn=accounts,dc=example,dc=com",
      "error": "no such entry",
      "msg": "Error retrieving ldap entry {key}: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.trust",
    "check": "IPATrustControllerServiceCheck",
    "result": "ERROR",
    "uuid": "a6cead08-d6cd-4876-a354-5f4278fc93d2",
    "when": "20211216115357Z",
    "duration": "0.001139",
    "kw": {
      "key": "cn=ADTRUST,cn=server.example.com,cn=masters,cn=ipa,cn=etc,dc=example,dc=com",
      "error": "no such entry",
      "msg": "Error retrieving ldap entry {key}: {error}"
    }
  },
  {
    "source": "ipahealthcheck.ipa.trust",
    "check": "IPATrustControllerConfCheck",
    "result": "ERROR",
    "uuid": "fa238704-6c32-4ff1-943c-0498fa42d574",
    "when": "20211216115357Z",
    "duration": "0.359184",
    "kw": {
      "key": "net conf list",
      "error": "No section: 'global'",
      "section": "global",
      "option": "passdb backend",
      "msg": "Unable to read '{option}' in section {section} in {key} output: {error}"
    }
  }
]
_________________________________________________________________ 

The Cu understands that these errors are not hurting anything, but want them to go away.
Unfortunately the only way to get them to go away is to uninstall the server, and add it back, which they do not want to do, since this is their primary server that has a lot riding on it. They also refuse to move the CRL generation to a replica, in order to remove the problem system and add it back. 

I feel like there should be like an `ipa config-mod` command to do this


How reproducible:

Install IPA, attempt to install a trust with AD, but not complete the trust setup.


Actual results:

not able to remove the server role via commands

Expected results:

Should be able to remove the server role via commands (not having to uninstall reinstall the server)

Additional info:

https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/X645QM5OTZ5PEVPBOIUCOIVK7T2Y2SOD/

This says there is no tool to do this, and that it requires uninstall / reinstall.