Hide Forgot
Description of problem: 'Unable to log in as uid=admin-replica.testrealm.test,ou=people,o=ipaca' during replica install Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. Install IPA Server on RHEL7.9 2. Install IPA replica on RHEL8.8 3. Check the message displayed on the console. Actual results: 2022-12-02T14:14:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG [3/30]: creating ACIs for admin 2022-12-02T14:14:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG [4/30]: creating installation admin user 2022-12-02T14:19:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG Unable to log in as uid=admin-replica.testrealm.test,ou=people,o=ipaca on ldap://master.testrealm.test:389 2022-12-02T14:19:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG [error] NotFound: uid=admin-replica.testrealm.test,ou=people,o=ipaca did not replicate to ldap://master.testrealm.test:389 2022-12-02T14:19:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG [hint] tune with replication_wait_timeout 2022-12-02T14:19:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG uid=admin-replica.testrealm.test,ou=people,o=ipaca did not replicate to ldap://master.testrealm.test:389 2022-12-02T14:19:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information 2022-12-02T14:19:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG Your system may be partly configured. 2022-12-02T14:19:14+0000 [ipa_pytests.qe_class.QeHost.replica.cmd22] DEBUG Run /usr/sbin/ipa-server-install --uninstall to clean up. Expected results: ipa-replica-install should be successfull. Additional info: The replica installer creates a temporary user uid=admin-replica.testrealm.test,ou=people,o=ipaca on the 8.8 replica, that gets replicated to the 7.9 master. To ensure the user is properly replicated, the installer performs a bind on the master with the password. The problem is that the user is created with a password encrypted using PBKDF2-SHA512, and if you try to do a ldap bind on the 7.9 master the op fails because this algo is not supported. As a consequence the replica installer assumes the user hasn't been replicated.
As per comment #c6 marking as VERIFIED.
Is there a workaround for this? https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/message/IHIPPVMMIWV2TL7BNLW55XII3OIQ62HK/ The above kinda works but I'm struggling to get the timing right during the ipa-replica-install for the file update.