Bug 751769 - ipa-server-install --uninstall errors out even when the newly created 389-ds instance is successfully removed.
Summary: ipa-server-install --uninstall errors out even when the newly created 389-ds ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks: 756082
TreeView+ depends on / blocked
 
Reported: 2011-11-07 14:15 UTC by Gowrishankar Rajaiyan
Modified: 2012-06-20 13:16 UTC (History)
4 users (show)

Fixed In Version: ipa-2.2.0-1.el6
Doc Type: Bug Fix
Doc Text:
Cause: IPA cannot be installed on a server with a custom LDAP server instance even though it runs on a custom port and thus does not conflict with IPA. Consequence: User cannot deploy custom LDAP instances on a machine with IPA. Fix: IPA no longer enforce that no LDAP instances exist on an IPA server. Instead, it just checks that reserved LDAP ports (389, 636) are free. Result: User can combine IPA server with custom LDAP server instances as long as they run on custom ports.
Clone Of:
Environment:
Last Closed: 2012-06-20 13:16:45 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0819 normal SHIPPED_LIVE ipa bug fix and enhancement update 2012-06-19 20:34:17 UTC

Description Gowrishankar Rajaiyan 2011-11-07 14:15:29 UTC
Description of problem:
ipa-server-install --uninstall errors out even when the newly created 389-ds instance is successfully removed. ipa-server-install --uninstall proceeds after removing "slapd-decepticons.removed" from /etc/dirsrv/.

Version-Release number of selected component (if applicable):
ipa-server-2.1.3-8.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. install ipa-server
2. [root@decepticons dirsrv]# setup-ds.pl 

==============================================================================
This program will set up the 389 Directory Server.

It is recommended that you have "root" privilege to set up the software.
Tips for using this  program:
  - Press "Enter" to choose the default and go to the next screen
  - Type "Control-B" or the word "back" then "Enter" to go back to the previous screen
  - Type "Control-C" to cancel the setup program

Would you like to continue with set up? [yes]: 

==============================================================================
Your system has been scanned for potential problems, missing patches,
etc.  The following output is a report of the items found that need to
be addressed before running this software in a production
environment.

389 Directory Server system tuning analysis version 10-AUGUST-2007.

NOTICE : System is x86_64-unknown-linux2.6.32-209.el6.x86_64 (1 processor).

WARNING: 996MB of physical memory is available on the system. 1024MB is recommended for best performance on large production system.

NOTICE : The net.ipv4.tcp_keepalive_time is set to 7200000 milliseconds
(120 minutes).  This may cause temporary server congestion from lost
client connections.

WARNING: There are only 1024 file descriptors (hard limit) available, which
limit the number of simultaneous connections.  

WARNING: There are only 1024 file descriptors (soft limit) available, which
limit the number of simultaneous connections.  

WARNING  : The warning messages above should be reviewed before proceeding.

Would you like to continue? [no]: yes

==============================================================================
Choose a setup type:

   1. Express
       Allows you to quickly set up the servers using the most
       common options and pre-defined defaults. Useful for quick
       evaluation of the products.

   2. Typical
       Allows you to specify common defaults and options.

   3. Custom
       Allows you to specify more advanced options. This is 
       recommended for experienced server administrators only.

To accept the default shown in brackets, press the Enter key.

Choose a setup type [2]: 3

==============================================================================
Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: eros.example.com.

To accept the default shown in brackets, press the Enter key.

Warning: This step may take a few minutes if your DNS servers
can not be reached or if DNS is not configured correctly.  If
you would rather not wait, hit Ctrl-C and run this program again
with the following command line option to specify the hostname:

    General.FullMachineName=your.hostname.domain.name

Computer name [decepticons.lab.eng.pnq.redhat.com]: 

==============================================================================
The server must run as a specific user in a specific group.
It is strongly recommended that this user should have no privileges
on the computer (i.e. a non-root user).  The setup procedure
will give this user/group some permissions in specific paths/files
to perform server-specific operations.

If you have not yet created a user and group for the server,
create this user and group using your native operating
system utilities.

System User [nobody]: 
System Group [nobody]: 

==============================================================================
The standard directory server network port number is 389.  However, if
you are not logged as the superuser, or port 389 is in use, the
default value will be a random unused port number greater than 1024.
If you want to use port 389, make sure that you are logged in as the
superuser, that port 389 is not in use.

Directory server network port [6908]: 1389

==============================================================================
Each instance of a directory server requires a unique identifier.
This identifier is used to name the various
instance specific files and directories in the file system,
as well as for other uses as a server instance identifier.

Directory server identifier [decepticons]: 

==============================================================================
The suffix is the root of your directory tree.  The suffix must be a valid DN.
It is recommended that you use the dc=domaincomponent suffix convention.
For example, if your domain is example.com,
you should use dc=example,dc=com for your suffix.
Setup will create this initial suffix for you,
but you may have more than one suffix.
Use the directory server utilities to create additional suffixes.

Suffix [dc=lab, dc=eng, dc=pnq, dc=redhat, dc=com]: dc=example, dc=com

==============================================================================
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and typically has a
bind Distinguished Name (DN) of cn=Directory Manager.
You will also be prompted for the password for this user.  The password must
be at least 8 characters long, and contain no spaces.
Press Control-B or type the word "back", then Enter to back up and start over.

Directory Manager DN [cn=Directory Manager]: 
Password: 
Password (confirm): 

==============================================================================
You may install some sample entries in this directory instance.  These
entries will be installed in a separate suffix and will not interfere
with the normal operation of the directory server.

Do you want to install the sample entries? [no]: yes

==============================================================================
You may wish to populate your new directory instance with some data.
"You may already have a file in LDIF format to use or some suggested
entries can be added.  If you want to import entries from an LDIF
file, you may type in the full path and filename at the prompt.  If
you want the setup program to add the suggested entries, type the
word suggest at the prompt.  The suggested entries are common
container entries under your specified suffix, such as ou=People and
ou=Groups, which are commonly used to hold the entries for the persons
and groups in your organization.  If you do not want to add any of
these entries, type the word none at the prompt.

Type the full path and filename, the word suggest, or the word none [suggest]: none
Your new DS instance 'decepticons' was successfully created.
Exiting . . .
Log file is '/tmp/setupm_Uo7z.log'

[root@decepticons dirsrv]#

3. [root@decepticons dirsrv]# ls -l
total 24
drwxr-xr-x. 2 root   root   4096 Oct 19 04:11 config
-rw-------  1 dirsrv dirsrv  616 Nov  7 18:59 ds.keytab
drwxr-xr-x. 2 root   root   4096 Oct 19 04:11 schema
drwxrwx---  3 nobody nobody 4096 Nov  7 19:18 slapd-decepticons
drwxrwx---  3 dirsrv dirsrv 4096 Nov  7 19:11 slapd-LAB-ENG-PNQ-REDHAT-COM
drwxrwx---  3 pkisrv dirsrv 4096 Nov  7 19:00 slapd-PKI-IPA
[root@decepticons dirsrv]# 

4. [root@decepticons dirsrv]# service dirsrv status
dirsrv decepticons (pid 24801) is running...
dirsrv LAB-ENG-PNQ-REDHAT-COM (pid 24082) is running...
dirsrv PKI-IPA (pid 24150) is running...
[root@decepticons dirsrv]#

5. [root@decepticons ~]# ipa-server-install --uninstall -U
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring CA directory server
Unconfiguring CA
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring ipa_kpasswd
Unconfiguring directory server
root        : ERROR    IPA cannot be re-installed without removing existing 389-ds instance(s)
[root@decepticons ~]# echo $?
1
[root@decepticons ~]# 

6. [root@decepticons dirsrv]# /usr/sbin/remove-ds.pl -i slapd-decepticons
Instance slapd-decepticons removed.
[root@decepticons dirsrv]# 

7. [root@decepticons dirsrv]# ls -l
total 12
drwxr-xr-x. 2 root   root   4096 Oct 19 04:11 config
drwxr-xr-x. 2 root   root   4096 Oct 19 04:11 schema
drwxrwx---  2 nobody nobody 4096 Nov  7 19:23 slapd-decepticons.removed
[root@decepticons dirsrv]#

8. [root@decepticons ~]# service dirsrv status
  *** Error: no dirsrv instances configured
[root@decepticons ~]# 

9. [root@decepticons ~]# ipa-server-install --uninstall -U
Shutting down all IPA services
Removing IPA client configuration
root        : ERROR    IPA cannot be re-installed without removing existing 389-ds instance(s)


Actual results:
ipa-server-install --uninstall fails with ERROR even when the 389-ds instance is removed successfully.

Expected results:
ipa-server-install --uninstall should be successful after removing the 389-ds instance.

Additional info:
[root@decepticons dirsrv]# mv slapd-decepticons.removed /root/

[root@decepticons ~]# ipa-server-install --uninstall -U
Shutting down all IPA services
Removing IPA client configuration
[root@decepticons ~]#

Comment 3 Martin Kosek 2011-11-07 15:16:14 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/2073

Comment 4 Rob Crittenden 2011-11-16 16:42:10 UTC
This was addressed by ticket https://fedorahosted.org/freeipa/ticket/1735. We no longer check for existing 389-ds instances.

master: 8be0d84a599be48e837d498cec45d08cbccd3a03

Comment 6 Martin Kosek 2012-04-19 12:05:45 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: IPA cannot be installed on a server with a custom LDAP server instance even though it runs on a custom port and thus does not conflict with IPA.
Consequence: User cannot deploy custom LDAP instances on a machine with IPA.
Fix: IPA no longer enforce that no LDAP instances exist on an IPA server. Instead, it just checks that reserved LDAP ports (389, 636) are free.
Result: User can combine IPA server with custom LDAP server instances as long as they run on custom ports.

Comment 7 Namita Soman 2012-05-07 15:59:24 UTC
Verified using ipa-server-2.2.0-12.el6.x86_64

Steps take:
installed ipaserver
then ran setup-ds.pl, and followed prompts to set up a ds instance as specified above
uninstalled ipa-server without uninstalling the ds insatnce - was successful.

reinstalled ipa server after ds-instance was uninstalled successfully

Comment 9 errata-xmlrpc 2012-06-20 13:16:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0819.html


Note You need to log in before you can comment on or make changes to this bug.