freeipa

#9199 [Tracker] nightly failure in ipa-winsync-migrate
Closed: duplicate by frenaud. Opened by amore.

Closed: duplicate
Reopen Issue

Issue

ipa-winsync-migrate is failing with
ipa: ERROR: The replication agreement between master.ipa.test and ad-root.ad.test could not be detected

Steps to Reproduce

  1. Install ipa-server and adtrust
  2. Establish winsync agreement between client and AD using:
    ipa-replica-manage connect --winsync --binddn 'cn=%s,cn=users,%s' % (ad.config.ad_admin_name, ad.domain.basedn), --bindpw --password --cacert cert_path, --passsync dummy ad.hostname
  3. Establish trust with AD using :
    'ipa', 'trust-add --type ad ad.test --admin Administrator@ad.test --password
  4. ipa-winsync-migrate -U --realm ad.test --server ad-root.ad.test

Actual behavior

DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd130:transport.py:557 ipa: ERROR: The replication agreement between master.ipa.test and ad-root.ad.test could not be detected
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd130:transport.py:557 The replication agreement between master.ipa.test and ad-root.ad.test could not be detected
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd130:transport.py:557 ipa: ERROR: The ipa-winsync-migrate command failed.
DEBUG ipatests.pytest_ipa.integration.host.Host.master.cmd130:transport.py:557 The ipa-winsync-migrate command failed.

Expected behavior

ipa-winsync-migrate should succeed.

Version/Release/Distribution

The full package list is available here.

Failure observed in

testing_master_testing_selinux ,
Report test_integration/test_winsyncmigrate.py::TestWinsyncMigrate::test_migration

Metadata Update from @amore:
- Issue tagged with: test-failure, tests

Initial investigations:

ipa-winsync-migrate is trying to retrieve the existing replication agreements but doesn't find any:

ipa: ERROR: The replication agreement between master.ipa.test and ad-root.ad.test could not be detected
The ipa-winsync-migrate command failed.

The logs corresponding to the same timestamp show that the search op is performed as cifs/master (in access log):

[07/Jul/2022:12:57:10.280752117 +0000] conn=45 fd=109 slot=109 SSL connection from 192.168.122.117 to 192.168.122.117
[07/Jul/2022:12:57:10.286125603 +0000] conn=45 TLS1.3 128-bit AES-GCM
[07/Jul/2022:12:57:10.344235100 +0000] conn=45 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI
[07/Jul/2022:12:57:10.349961591 +0000] conn=45 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI
[07/Jul/2022:12:57:10.353632375 +0000] conn=45 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI
[07/Jul/2022:12:57:10.355705246 +0000] conn=45 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000137018 optime=0.002076155 etime=0.002210391 dn="krbprincipalname=cifs/master.ipa.test@ipa.test,cn=services,cn=accounts,dc=ipa,dc=test"
[07/Jul/2022:12:57:10.356736925 +0000] conn=45 op=3 SRCH base="cn=mapping tree,cn=config" scope=2 filter="(&(|(&(objectClass=nsds5ReplicationAgreement)(nsDS5ReplicaRoot=dc=ipa,dc=test))(objectClass=nsDSWindowsReplicationAgreement))(nsDS5ReplicaHost=ad-root.ad.test))" attrs=ALL
[07/Jul/2022:12:57:10.359007328 +0000] conn=45 op=3 RESULT err=0 tag=101 nentries=0 wtime=0.000263647 optime=0.002271079 etime=0.002531710

Note the bind dn and nentries=0.

The test is performing the following:
- kinit admin
- ipa trust-add
- clear sssd cache, restart sssd
- ipa-winsync-migrate
The ipa-winsync-migrate command should use the TGT obtained with kinit admin but the logs show that the principal cifs/master.ipa.test@ipa.test is used instead.

This issue is similar to #9198, let's close this one as a duplicate.

Metadata Update from @frenaud:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)
Metadata
None

test-failure tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.