Red Hat Bugzilla – Bug 893187
Installing IPA with a single realm component sometimes fails
Last modified: 2013-02-21 04:31:53 EST
Description of problem: Installing IPA with a single component for the realm sometimes fails. It fails because dc=<component> has updates applied before cn=schema so there are objectclass violations. The one realm I've confirmed it fails with is TESTRELM. I've tried others, alphabetically before and after and it installs fine, so I'm not sure what is different about this. Normally update entries are sorted by DN such that parents are applied before children (we sort by length). And cn=schema should be a special case so it is always applied first. Version-Release number of selected component (if applicable): ipa-server-3.0.0-20.el6.x86_64 Steps to Reproduce: 1. ipa-server-install --realm=TESTRELM Actual results: Seen in ipa-server-install output near end: Applying LDAP updates ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR Update failed: Object class violation: unknown object class "nisDomainObject"
Upstream ticket: https://fedorahosted.org/freeipa/ticket/3342
Fixed upstream. master: 1d2d1e1af1660d022adca447f900403d171cba00 ipa-3-1: 41b2febff00999dc6b477f18e2ad89cd49e39532 ipa-3-0: ad2a2002457ec74a9372f4de1b6fcee37494daef Changed the DN sort routine to always sort cn=schema first.
verified using ipa-server-3.0.0-24.el6.x86_64 [root@mvarun yum.repos.d]# hostname mvarun64.testrelm.com [root@mvarun yum.repos.d]# ipa-server-install --realm=TESTRELM Server host name [mvarun64.testrelm.com]: The domain name has been determined based on the host name. . . . Please confirm the domain name [testrelm.com]: . . . Directory Manager password: Password (confirm): . . IPA admin password: Password (confirm): The IPA Master Server will be configured with: Hostname: mvarun64.testrelm.com IP address: 10.70.1.181 Domain name: testrelm.com Realm name: TESTRELM Continue to configure the system with these values? [no]: yes The following operations may take some minutes to complete. Please wait until the prompt is returned. Configuring NTP daemon (ntpd) [1/4]: stopping ntpd . . Done configuring NTP daemon (ntpd). Configuring directory server for the CA (pkids): Estimated time 30 minutes 30 seconds [1/3]: creating directory server user [2/3]: creating directory server instance [3/3]: restarting directory server Done configuring directory server for the CA (pkids). Configuring certificate server (pki-cad): Estimated time 33 minutes 30 seconds [1/21]: creating certificate server user . . [21/21]: Configure HTTP to proxy connections Done configuring certificate server (pki-cad). Configuring directory server (dirsrv): Estimated time 31 minutes [1/38]: creating directory server user . . [38/38]: configuring directory to start on boot Done configuring directory server (dirsrv). Configuring Kerberos KDC (krb5kdc): Estimated time 30 minutes 30 seconds [1/10]: adding sasl mappings to the directory . . [10/10]: configuring KDC to start on boot Done configuring Kerberos KDC (krb5kdc). Configuring kadmin [1/2]: starting kadmin [2/2]: configuring kadmin to start on boot Done configuring kadmin. Configuring ipa_memcached [1/2]: starting ipa_memcached [2/2]: configuring ipa_memcached to start on boot Done configuring ipa_memcached. Configuring the web interface (httpd): Estimated time 31 minutes [1/13]: setting mod_nss port to 443 . . [13/13]: configuring httpd to start on boot Done configuring the web interface (httpd). Applying LDAP updates Restarting the directory server Restarting the KDC Sample zone file for bind has been created in /tmp/sample.zone.dOYuEz.db Restarting the web server ============================================================================== Setup complete . . .
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html