RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 952688 - When deleting a replica that is not in the primary domain, its DNS records are not removed
Summary: When deleting a replica that is not in the primary domain, its DNS records ar...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-04-16 13:14 UTC by Dmitri Pal
Modified: 2014-06-18 00:08 UTC (History)
3 users (show)

Fixed In Version: ipa-3.2.1-1.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 13:16:16 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Dmitri Pal 2013-04-16 13:14:08 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3563

Normally, all forward and reverse DNS records of a replica are removed when it is deleted. However, when a replica (say server.subdomain.example.com) is not in the primary domain (say example.com), its forward records are not removed when it is deleted. This is because !BindInstance.remove_master_dns_records always uses the primary domain when removing forward records (in my example, it would try to remove server.example.com instead of server.subdomain.example.com).
Comment 1 Martin Kosek 2013-04-18 06:06:26 UTC 
Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/692fe7cbf743038880e411b357461eb852282905
ipa-3-1: https://fedorahosted.org/freeipa/changeset/4d32af421a0e368a08d56c96386474dd6b32e2a4
Comment 4 Michael Gregg 2014-01-14 23:42:53 UTC 
Verified against ipa-server-3.3.3-10.el7.x86_64

On Master, create a new test domain (testsub.$DOMAIN): 

[root@nightcrawler ~]# ipa dnszone-add --name-server=nightcrawler.testrelm.com. testsub.$DOMAIN
Administrator e-mail address [hostmaster.testsub.testrelm.com.]: ^C
ipa: ERROR: Could not get Administrator e-mail address interactively
[root@nightcrawler ~]# 
[root@nightcrawler ~]# ipa dnszone-add --name-server=nightcrawler.testrelm.com. --admin-email=hostmaster.testsub.testrelm.com. testsub.$DOMAIN
  Zone name: testsub.testrelm.com
  Authoritative nameserver: nightcrawler.testrelm.com.
  Administrator e-mail address: hostmaster.testsub.testrelm.com.
  SOA serial: 1389742183
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self
                      * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;
[root@nightcrawler ~]# ipa-replica-prepare --ip-address=10.16.96.113 cloud-qe-2.testsub.$DOMAIN 
Directory Manager (existing master) password: 

Preparing replica for cloud-qe-2.testsub.testrelm.com from nightcrawler.testrelm.com
<snip>
The ipa-replica-prepare command was successful
[root@nightcrawler ~]# scp /var/lib/ipa/replica-info-cloud-qe-2.testsub.testrelm.com.gpg cloud-qe-2.testsub.testrelm.com:/tmp/.
The authenticity of host 'cloud-qe-2.testsub.testrelm.com (<no hostip for proxy command>)' can't be established.
ECDSA key fingerprint is 2a:1e:ff:a2:66:96:f5:9f:3c:57:8c:65:40:2c:f0:28.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'cloud-qe-2.testsub.testrelm.com' (ECDSA) to the list of known hosts.
replica-info-cloud-qe-2.testsub.testrelm.com.gpg                                       100%   37KB  37.2KB/s   00:00    
[root@nightcrawler ~]# 


On the Slave. Join the host to that new domain: 
[root@cloud-qe-2 ~]# ipa-replica-install /tmp/replica-info-cloud-qe-2.testsub.testrelm.com.gpg 
WARNING: conflicting time&date synchronization service 'chronyd' will
be disabled in favor of ntpd

Directory Manager (existing master) password: 
<snip>
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Restarting the web server
You have new mail in /var/spool/mail/root


Back on the Master, delete the replica:

[root@nightcrawler ~]# ipa-replica-manage del cloud-qe-2.testsub.testrelm.com
Deleting a master is irreversible.
To reconnect to the remote master you will need to prepare a new replica file
and re-install.
Continue to delete? [no]: yes
Deleting replication agreements between cloud-qe-2.testsub.testrelm.com and nightcrawler.testrelm.com
ipa: INFO: Setting agreement cn=meTonightcrawler.testrelm.com,cn=replica,cn=dc\=testrelm\,dc\=com,cn=mapping tree,cn=config schedule to 2358-2359 0 to force synch
ipa: INFO: Deleting schedule 2358-2359 0 from agreement cn=meTonightcrawler.testrelm.com,cn=replica,cn=dc\=testrelm\,dc\=com,cn=mapping tree,cn=config
ipa: INFO: Replication Update in progress: TRUE: status: 0 Replica acquired successfully: Incremental update started: start: 0: end: 0
ipa: INFO: Replication Update in progress: FALSE: status: 0 Replica acquired successfully: Incremental update succeeded: start: 0: end: 0
Unable to remove agreement on cloud-qe-2.testsub.testrelm.com: cannot connect to 'ldaps://cloud-qe-2.testsub.testrelm.com:636': 
Forcing removal on 'nightcrawler.testrelm.com'
Any DNA range on 'cloud-qe-2.testsub.testrelm.com' will be lost



Check for the dns entry:
[root@nightcrawler ~]# ipa dnsrecord-find testsub.testrelm.com cloud-qe-2
  Record name: @
  NS record: nightcrawler.testrelm.com., cloud-qe-2.testrelm.com.
----------------------------
Number of entries returned 1
----------------------------

cloud-qe-2.testsub.testrelm.com was not returned.
Comment 5 Ludek Smid 2014-06-13 13:16:16 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.