Issue

When a replica is installed (ipa-replica-install) some segments are created masterToreplica and replicaToMaster. One of the instance (replica or master) will merge the segments: one of the segment becomes bi-directionnal, the status (ipaReplTopoSegmentStatus) of the other segment is set to 'obsolete' and segment entry is deleted (becomes a tombstone).

The other instance will catch the segment deletion and may decide to delete the underlying replica agreement if the status differs from 'obsolete'.

Because of the 389-ds issue https://pagure.io/389-ds-base/issue/49619, the segment status may contains several values (e.g. 'autogen' and 'obsolete'). Because of DS implementation if it contains several values, 'obsolete' will never be the first value.

In order to harden topology plugin (ipa_topo_post_del), from a replica running an DS version where 49619 is not fixed., it should check all status value rather the first one.

Steps to Reproduce

The problem is dynamic but may happen one time out of 2
1. install a master
2. install client + replica

Actual behavior

See FREEIPA-921
monitoring the replication agreement masterToReplica, at some point the RA appears then disappeared (it is deleted)

Expected behavior

THe replica agreement should remain

Version/Release/Distribution

It can happen against any version <= 4.5 (DS 1.3.7.5)

Additional info: