freeipa

#7876 Fail replica install
Closed: invalid by rcritten. Opened by umnavyzet.

Closed: invalid
Reopen Issue

Request for enhancement

Successfully deploy replication.

Issue

Fail ipa-server-install

Steps to Reproduce

  1. ipa-client-install -d --mkhomedir --domain=corp.exemple.com --server=ipa.corp.exemple.com --realm=CORP.EXAMPLE.COM --principal=admin --hostname ipa2.corp.example.com
  2. Add host ipa2.corp.example.com to host group "ipaservers"
  3. Run ~~ipa-server-instal~~ ipa-replica-install

Actual behavior

# ipa-replica-install
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR    u'ipadomainlevel'
ipapython.admintool: ERROR    The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Expected behavior

ipa-replica-install success

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

ipa2.example.com:
ipa-server-4.6.4-10.el7.centos.2.x86_64
ipa-client-4.6.4-10.el7.centos.2.x86_64
389-ds-base-1.3.8.4-22.el7_6.x86_64
pki-ca-10.5.9-6.el7.noarch
krb5-server-1.15.1-37.el7_6.x86_64

ipa.example.com:
ipa-server-4.6.4-10.el7.centos.2.x86_64
ipa-client-4.6.4-10.el7.centos.2.x86_64
389-ds-base-1.3.8.4-22.el7_6.x86_64
pki-ca-10.5.1-14.el7_5.noarch
pki-ca-10.5.9-6.el7.noarch
krb5-server-1.15.1-37.el7_6.x86_64

Additional info:

/var/log/ipareplica-install.log

2019-03-05T16:32:11Z DEBUG Logging to /var/log/ipareplica-install.log
2019-03-05T16:32:11Z DEBUG ipa-replica-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'skip_schema_check': False, 'no_ntp': False, 'setup_kra': False, 'ip_addresses': None, 'secondary_rid_base': None, 'netbios_name': None, 'mkhomedir': False, 'http_cert_files': None, 'no_pkinit': False, 'principal': None, 'no_forwarders': False, 'add_sids': False, 'keytab': None, 'ssh_trust_dns': False, 'no_msdcs': False, 'domain_name': None, 'setup_adtrust': False, 'http_cert_name': None, 'dirsrv_cert_files': None, 'no_dnssec_validation': False, 'no_reverse': False, 'pkinit_cert_files': None, 'unattended': False, 'skip_conncheck': False, 'auto_reverse': False, 'auto_forwarders': False, 'no_host_dns': False, 'dirsrv_cert_name': None, 'no_ui_redirect': False, 'dirsrv_config_file': None, 'forwarders': None, 'verbose': False, 'setup_ca': False, 'servers': None, 'pkinit_cert_name': None, 'no_ssh': False, 'enable_compat': False, 'add_agents': False, 'realm_name': None, 'force_join': False, 'no_sshd': False, 'forward_policy': None, 'rid_base': None, 'quiet': False, 'setup_dns': False, 'host_name': None, 'log_file': None, 'reverse_zones': None, 'allow_zone_overlap': False}
2019-03-05T16:32:11Z DEBUG IPA version 4.6.4-10.el7.centos.2
2019-03-05T16:32:11Z DEBUG Searching for an interface of IP address: ::1
2019-03-05T16:32:11Z DEBUG Testing local IP address: ::1/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff (interface: lo)
2019-03-05T16:32:11Z DEBUG Starting external process
2019-03-05T16:32:11Z DEBUG args=/usr/sbin/selinuxenabled
2019-03-05T16:32:11Z DEBUG Process finished, return code=1
2019-03-05T16:32:11Z DEBUG stdout=
2019-03-05T16:32:11Z DEBUG stderr=
2019-03-05T16:32:11Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2019-03-05T16:32:11Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2019-03-05T16:32:11Z DEBUG httpd is not configured
2019-03-05T16:32:11Z DEBUG kadmin is not configured
2019-03-05T16:32:11Z DEBUG dirsrv is not configured
2019-03-05T16:32:11Z DEBUG pki-tomcatd is not configured
2019-03-05T16:32:11Z DEBUG install is not configured
2019-03-05T16:32:11Z DEBUG krb5kdc is not configured
2019-03-05T16:32:11Z DEBUG ntpd is not configured
2019-03-05T16:32:11Z DEBUG named is not configured
2019-03-05T16:32:11Z DEBUG filestore is tracking no files
2019-03-05T16:32:11Z DEBUG Starting external process
2019-03-05T16:32:11Z DEBUG args=/usr/sbin/httpd -t -D DUMP_VHOSTS
2019-03-05T16:32:11Z DEBUG Process finished, return code=0
2019-03-05T16:32:11Z DEBUG stdout=VirtualHost configuration:
*:8443                 ipa2.corp.example.com (/etc/httpd/conf.d/nss.conf:81)
2019-03-05T16:32:11Z DEBUG stderr=
2019-03-05T16:32:11Z DEBUG Starting external process
2019-03-05T16:32:11Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2019-03-05T16:32:11Z DEBUG Process finished, return code=1
2019-03-05T16:32:11Z DEBUG stdout=disabled
2019-03-05T16:32:11Z DEBUG stderr=
2019-03-05T16:32:11Z DEBUG Starting external process
2019-03-05T16:32:11Z DEBUG args=/bin/systemctl is-active chronyd.service
2019-03-05T16:32:11Z DEBUG Process finished, return code=3
2019-03-05T16:32:11Z DEBUG stdout=unknown
2019-03-05T16:32:11Z DEBUG stderr=
2019-03-05T16:32:11Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2019-03-05T16:32:11Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2019-03-05T16:32:11Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2019-03-05T16:32:11Z DEBUG importing all plugin modules in ipaserver.plugins...
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.aci
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.automember
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.automount
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.baseldap
2019-03-05T16:32:11Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.baseuser
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.batch
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.ca
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.caacl
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.cert
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.certmap
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.certprofile
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.config
2019-03-05T16:32:11Z DEBUG importing plugin module ipaserver.plugins.delegation
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.dns
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.dnsserver
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.dogtag
2019-03-05T16:32:12Z DEBUG skipping plugin module ipaserver.plugins.dogtag: dogtag not selected as RA plugin
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.domainlevel
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.group
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.hbac
2019-03-05T16:32:12Z DEBUG ipaserver.plugins.hbac is not a valid plugin module
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.hbacrule
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.hbacsvc
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.hbactest
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.host
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.hostgroup
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.idrange
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.idviews
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.internal
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.join
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.ldap2
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.location
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.migration
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.misc
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.netgroup
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.otp
2019-03-05T16:32:12Z DEBUG ipaserver.plugins.otp is not a valid plugin module
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.otpconfig
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.otptoken
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.passwd
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.permission
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.ping
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.pkinit
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.privilege
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.pwpolicy
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.rabase
2019-03-05T16:32:12Z DEBUG ipaserver.plugins.rabase is not a valid plugin module
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.radiusproxy
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.realmdomains
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.role
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.schema
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.selfservice
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.server
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.serverrole
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.serverroles
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.service
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.servicedelegation
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.session
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.stageuser
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.sudo
2019-03-05T16:32:12Z DEBUG ipaserver.plugins.sudo is not a valid plugin module
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.sudocmd
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.sudorule
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.topology
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.trust
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.user
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.vault
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.virtual
2019-03-05T16:32:12Z DEBUG ipaserver.plugins.virtual is not a valid plugin module
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.whoami
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.plugins.xmlserver
2019-03-05T16:32:12Z DEBUG importing all plugin modules in ipaserver.install.plugins...
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.adtrust
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.dns
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_nis
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_referint
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_services
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness
2019-03-05T16:32:12Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt
2019-03-05T16:32:17Z DEBUG Check if ipa2.corp.example.com is a primary hostname for localhost
2019-03-05T16:32:17Z DEBUG Primary hostname for localhost: ipa2.corp.example.com
2019-03-05T16:32:17Z DEBUG Search DNS for ipa2.corp.example.com
2019-03-05T16:32:17Z DEBUG Check if ipa2.corp.example.com is not a CNAME
2019-03-05T16:32:17Z DEBUG Check reverse address of 10.208.66.6
2019-03-05T16:32:17Z DEBUG Found reverse name: ipa2.corp.example.com
2019-03-05T16:32:17Z DEBUG Check if ipa.corp.example.com is a primary hostname for localhost
2019-03-05T16:32:17Z DEBUG Primary hostname for localhost: ipa.corp.example.com
2019-03-05T16:32:17Z DEBUG Search DNS for ipa.corp.example.com
2019-03-05T16:32:17Z DEBUG Check if ipa.corp.example.com is not a CNAME
2019-03-05T16:32:17Z DEBUG Check reverse address of 10.208.66.138
2019-03-05T16:32:17Z DEBUG Found reverse name: ipa.corp.example.com
2019-03-05T16:32:17Z DEBUG Initializing principal host/ipa2.corp.example.com@CORP.EXAMPLE.COM using keytab /etc/krb5.keytab
2019-03-05T16:32:17Z DEBUG using ccache /tmp/krbcc31TIuD/ccache
2019-03-05T16:32:17Z DEBUG Attempt 1/1: success
2019-03-05T16:32:17Z DEBUG importing all plugin modules in ipaserver.plugins...
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.aci
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.automember
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.automount
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.baseldap
2019-03-05T16:32:17Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.baseuser
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.batch
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.ca
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.caacl
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.cert
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.certmap
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.certprofile
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.config
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.delegation
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.dns
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.dnsserver
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.dogtag
2019-03-05T16:32:17Z DEBUG skipping plugin module ipaserver.plugins.dogtag: dogtag not selected as RA plugin
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.domainlevel
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.group
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.hbac
2019-03-05T16:32:17Z DEBUG ipaserver.plugins.hbac is not a valid plugin module
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.hbacrule
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.hbacsvc
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.hbactest
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.host
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.hostgroup
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.idrange
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.idviews
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.internal
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.join
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.ldap2
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.location
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.migration
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.misc
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.netgroup
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.otp
2019-03-05T16:32:17Z DEBUG ipaserver.plugins.otp is not a valid plugin module
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.otpconfig
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.otptoken
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.passwd
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.permission
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.ping
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.pkinit
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.privilege
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.pwpolicy
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.rabase
2019-03-05T16:32:17Z DEBUG ipaserver.plugins.rabase is not a valid plugin module
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.radiusproxy
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.realmdomains
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.role
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.schema
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.selfservice
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.server
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.serverrole
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.serverroles
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.service
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.servicedelegation
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.session
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.stageuser
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.sudo
2019-03-05T16:32:17Z DEBUG ipaserver.plugins.sudo is not a valid plugin module
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.sudocmd
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.sudorule
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.topology
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.trust
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.user
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.vault
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.virtual
2019-03-05T16:32:17Z DEBUG ipaserver.plugins.virtual is not a valid plugin module
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.whoami
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.plugins.xmlserver
2019-03-05T16:32:17Z DEBUG importing all plugin modules in ipaserver.install.plugins...
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.adtrust
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.dns
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_nis
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_referint
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_services
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness
2019-03-05T16:32:17Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt
2019-03-05T16:32:22Z DEBUG failed to find session_cookie in persistent storage for principal 'host/ipa2.corp.example.com@CORP.EXAMPLE.COM'
2019-03-05T16:32:22Z INFO trying https://ipa.corp.example.com/ipa/json
2019-03-05T16:32:22Z DEBUG Created connection context.jsonclient_140523144619792
2019-03-05T16:32:22Z INFO [try 1]: Forwarding 'env' to json server 'https://ipa.corp.example.com/ipa/json'
2019-03-05T16:32:22Z DEBUG New HTTP connection (ipa.corp.example.com)
2019-03-05T16:32:22Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=IdaDOb6KvydbPox5ZRrLPMXLyK6EBJr4l08gb8f5n33%2bggyvsm%2fBiGZklyOkRXJorVhkagS93YkNeS%2fJ%2ftMigfYdyvih%2bN160XZW8AHCL1QSk8%2fNwdEijFlgSo2QRnyudvhVQKdd3ubvPARBFXoTUUBKfwaKXRj2EWmvpJ2YHH5ieoSG%2ba4sMon7xmefFQl6ckd%2b%2bBJs7ar188k20O9nqGnFpsrpDCRWN0ZbLnf5RoZJMytUw7h0e0O2GoTQVkQeVhPSKsM80fRJ9imaHGf4RHbZ%2f5U9%2fQyXui2axOzfcO1pUjIkmP3vE2A5LjFIAy1O;path=/ipa;httponly;secure;']'
2019-03-05T16:32:22Z DEBUG storing cookie 'ipa_session=MagBearerToken=IdaDOb6KvydbPox5ZRrLPMXLyK6EBJr4l08gb8f5n33%2bggyvsm%2fBiGZklyOkRXJorVhkagS93YkNeS%2fJ%2ftMigfYdyvih%2bN160XZW8AHCL1QSk8%2fNwdEijFlgSo2QRnyudvhVQKdd3ubvPARBFXoTUUBKfwaKXRj2EWmvpJ2YHH5ieoSG%2ba4sMon7xmefFQl6ckd%2b%2bBJs7ar188k20O9nqGnFpsrpDCRWN0ZbLnf5RoZJMytUw7h0e0O2GoTQVkQeVhPSKsM80fRJ9imaHGf4RHbZ%2f5U9%2fQyXui2axOzfcO1pUjIkmP3vE2A5LjFIAy1O;' for principal host/ipa2.corp.example.com@CORP.EXAMPLE.COM
2019-03-05T16:32:22Z INFO [try 1]: Forwarding 'env' to json server 'https://ipa.corp.example.com/ipa/json'
2019-03-05T16:32:22Z DEBUG HTTP connection keep-alive (ipa.corp.example.com)
2019-03-05T16:32:22Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=e0PafB%2fXRbh9trGrfjdFWvMaDKxaRXa0vMfRLA5J1dFFbSzFOCGRukh1MOzLsvS9K%2fMaunyIU1f%2bdq0yxwIB21oONWL%2furvMP7DA6o48PL0iYmUISl7i4QRAU2R%2fTywKjx04VlcDP3y5TNN0ulflJfuTyVf2vo33orDS5CAY0mqZGK9jkQDM6%2fravihHyxbmWDIFaFPsD1hQEFiakOcDsHwUSUGdbTLoryzubjbSxYsxqqVYKKGx3JoBE%2b%2fOKSN%2b33BTIPxjQwrZSmRu1Fg0Ok6TWwLqSOHWGLDm8v69IZDjPRN9IXq8d1I3suEHbs1D;path=/ipa;httponly;secure;']'
2019-03-05T16:32:22Z DEBUG storing cookie 'ipa_session=MagBearerToken=e0PafB%2fXRbh9trGrfjdFWvMaDKxaRXa0vMfRLA5J1dFFbSzFOCGRukh1MOzLsvS9K%2fMaunyIU1f%2bdq0yxwIB21oONWL%2furvMP7DA6o48PL0iYmUISl7i4QRAU2R%2fTywKjx04VlcDP3y5TNN0ulflJfuTyVf2vo33orDS5CAY0mqZGK9jkQDM6%2fravihHyxbmWDIFaFPsD1hQEFiakOcDsHwUSUGdbTLoryzubjbSxYsxqqVYKKGx3JoBE%2b%2fOKSN%2b33BTIPxjQwrZSmRu1Fg0Ok6TWwLqSOHWGLDm8v69IZDjPRN9IXq8d1I3suEHbs1D;' for principal host/ipa2.corp.example.com@CORP.EXAMPLE.COM
2019-03-05T16:32:22Z DEBUG Destroyed connection context.jsonclient_140523144619792
2019-03-05T16:32:22Z DEBUG Created connection context.ldap2_140523154242448
2019-03-05T16:32:23Z DEBUG flushing ldaps://ipa.corp.example.com from SchemaCache
2019-03-05T16:32:23Z DEBUG retrieving schema for SchemaCache url=ldaps://ipa.corp.example.com conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fce181cdd88>
2019-03-05T16:32:24Z DEBUG raw: domainlevel_get(version=u'2.230')
2019-03-05T16:32:24Z DEBUG domainlevel_get(version=u'2.230')
2019-03-05T16:32:24Z DEBUG Destroyed connection context.ldap2_140523154242448
2019-03-05T16:32:24Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
    return cfgr.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in run
    self.validate()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 371, in validate
    for _nothing in self._validator():
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 636, in _configure
    next(validator)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
    for unused in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 618, in main
    replica_promote_check(self)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 428, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1158, in promote_check
    domain_level = current_domain_level(remote_api)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 607, in current_domain_level
    return api.Command['domainlevel_get']()['result']
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 478, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 800, in run
    return self.execute(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipaserver/plugins/domainlevel.py", line 110, in execute
    return {'result': int(entry.single_value['ipaDomainLevel'])}
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 608, in __getitem__
    value = self._entry[name]
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 486, in __getitem__
    return self._get_nice(name)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 453, in _get_nice
    name = self._get_attr_name(name)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 449, in _get_attr_name
    name = self._names[name]
  File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 618, in __getitem__
    return super(CIDict, self).__getitem__(key.lower())
2019-03-05T16:32:24Z DEBUG The ipa-replica-install command failed, exception: KeyError: u'ipadomainlevel'
2019-03-05T16:32:24Z ERROR u'ipadomainlevel'
2019-03-05T16:32:24Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

/var/log/httpd/error_log

[Tue Mar 05 16:32:22.693798 2019] [:error] [pid 20183] ipa: INFO: [jsonserver_kerb] host/ipa2.corp.учфьзду.com@CORP.EXAMPLE.COM: env((u'version',)): SUCCESS
[Tue Mar 05 16:32:22.746376 2019] [:error] [pid 20184] ipa: INFO: [jsonserver_kerb] host/ipa2.corp.учфьзду.com@CORP.EXAMPLE.COM: env((u'fips_mode',)): SUCCESS

PS: Thanks for the help.

Hi, can you tell us about the original master? What version is it?

Metadata Update from @abbra:
- Issue priority set to: critical
- Issue set to the milestone: FreeIPA 4.5.5

https://github.com/freeipa/freeipa/pull/2878

Hi, can you tell us about the original master? What version is it?
Hi, abbra.
My master is ~~ipa.example.com~~ ipa.corp.example.com

ipa-server-4.6.4-10.el7.centos.2.x86_64
ipa-client-4.6.4-10.el7.centos.2.x86_64
389-ds-base-1.3.8.4-22.el7_6.x86_64
pki-ca-10.5.1-14.el7_5.noarch
pki-ca-10.5.9-6.el7.noarch
krb5-server-1.15.1-37.el7_6.x86_64
[root@ipa ~]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
[root@ipa ~]# ipa domainlevel-get
-----------------------
Current domain level: 1
-----------------------
Edited by umnavyzet

Thanks. Can you please run one more test?

On ipa2.corp.example.com, please do

kinit -k
ldapsearch -Y GSSAPI -h ipa.example.com -b "cn=Domain Level,cn=ipa,cn=etc,dc=example,dc=com" '*'

where dc=example,dc=com is your base DN.

Like this?

[root@ipa2 ~]# kinit -k
[root@ipa2 ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com -b "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: host/ipa2.corp.example.com@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: *
#
# Domain Level, ipa, etc, corp.example.com
dn: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
objectClass: top
objectClass: nsContainer
objectClass: ipaDomainLevelConfig
objectClass: ipaConfigObject
cn: Domain Level
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1

This problem has a workaround?

So, this output shows that your cn=Domain Level entry has no ipaDomainLevel attribute. Could you please repeat this search when authenticated as admin? And please run it against both ipa2 and ipa.

I need to understand whether the entry does not have the attribute or it is an access control issue. If it doesn't have the attribute, it is unclear how `ipa domainlevel-get' could return '1' at all while the very same call from within the replica installer can fail.

ipa.copr.example.com:

[root@ipa ~]# kinit -k
[root@ipa ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com  "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: host/ipa.corp.example.com@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=corp,dc=example,dc=com> (default) with scope subtree
# filter: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
# requesting: * 
#
# search result
search: 4
result: 0 Success
# numResponses: 1
[root@ipa ~]# kinit admin
Password for admin@CORP.EXAMPLE.COM: 
[root@ipa ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com  "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: admin@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=corp,dc=example,dc=com> (default) with scope subtree
# filter: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
# requesting: * 
#
# search result
search: 4
result: 0 Success
# numResponses: 1

ipa2.corp.example.com

[root@ipa2 ~]# kinit -k
[root@ipa2 ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com  "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: host/ipa2.corp.example.com@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=corp,dc=example,dc=com> (default) with scope subtree
# filter: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
# requesting: * 
#
# search result
search: 4
result: 0 Success
# numResponses: 1
[root@ipa2 ~]# kinit admin
Password for admin@CORP.EXAMPLE.COM: 
[root@ipa2 ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com  "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: admin@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=corp,dc=example,dc=com> (default) with scope subtree
# filter: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
# requesting: * 
#
# search result
search: 4
result: 0 Success
# numResponses: 1

You missed -b before the "cn=Domain Level,..." -- it has to be there to specify the base dn of the search. As result, ldapsearch decided that the basedn is actually an LDAP filter and did not match anything.

Could you please repeat the search? See the original comment from you ("Like this? ...") for the working command.

ipa.copr.example.com:

[root@ipa ~]# kinit -k
[root@ipa ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com -b "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: host/ipa.corp.example.com@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: * 
#
# Domain Level, ipa, etc, corp.example.com
dn: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
objectClass: top
objectClass: nsContainer
objectClass: ipaDomainLevelConfig
objectClass: ipaConfigObject
cn: Domain Level
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1
[root@ipa ~]# kinit admin
Password for admin@CORP.EXAMPLE.COM: 
[root@ipa ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com -b "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: admin@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: * 
#
# Domain Level, ipa, etc, corp.example.com
dn: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
objectClass: top
objectClass: nsContainer
objectClass: ipaDomainLevelConfig
objectClass: ipaConfigObject
ipaDomainLevel: 1
cn: Domain Level
aci: (targetattr = "createtimestamp || entryusn || ipadomainlevel || modifytim
 estamp || objectclass")(targetfilter = "(objectclass=ipadomainlevelconfig)")(
 version 3.0;acl "permission:System: Read Domain Level";allow (compare,read,se
 arch) groupdn = "ldap:///cn=System: Read Domain Level,cn=permissions,cn=pbac,
 dc=corp,dc=example,dc=com";)
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1

ipa2.copr.example.com:

[root@ipa2 ~]# kinit -k
[root@ipa2 ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com -b  "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: host/ipa2.corp.example.com@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: * 
#
# Domain Level, ipa, etc, corp.example.com
dn: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
objectClass: top
objectClass: nsContainer
objectClass: ipaDomainLevelConfig
objectClass: ipaConfigObject
cn: Domain Level
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1
[root@ipa2 ~]# kinit admin
Password for admin@CORP.EXAMPLE.COM: 
[root@ipa2 ~]# ldapsearch -Y GSSAPI -h ipa.corp.example.com -b  "cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com" '*'
SASL/GSSAPI authentication started
SASL username: admin@CORP.EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: * 
#
# Domain Level, ipa, etc, corp.example.com
dn: cn=Domain Level,cn=ipa,cn=etc,dc=corp,dc=example,dc=com
objectClass: top
objectClass: nsContainer
objectClass: ipaDomainLevelConfig
objectClass: ipaConfigObject
ipaDomainLevel: 1
cn: Domain Level
aci: (targetattr = "createtimestamp || entryusn || ipadomainlevel || modifytim
 estamp || objectclass")(targetfilter = "(objectclass=ipadomainlevelconfig)")(
 version 3.0;acl "permission:System: Read Domain Level";allow (compare,read,se
 arch) groupdn = "ldap:///cn=System: Read Domain Level,cn=permissions,cn=pbac,
 dc=corp,dc=example,dc=com";)
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1
Edited by umnavyzet

Great, thanks. This means the issue is that domainlevel-get function is using wrong target filter which is not captured by the ACI in the case of non-admin Kerberos principal. Admin has permissions to see almost everything.

I'll update my fix to make sure domainlevel-get is using (objectclass=ipadomainlevelconfig) filter.

As to the workaround, you can run ipa-replica-install with explicit admin principal to avoid using host/... principal for promotion. Then you'd get it resolved properly:

ipa-replica-install -P admin -w ...

I get the same result.
It seems the account is ignored.

[root@ipa2 ~]# ipa-replica-install -P admin -w '**************'
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR    u'ipadomainlevel'
ipapython.admintool: ERROR    The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2019-03-06T12:53:34Z DEBUG Logging to /var/log/ipareplica-install.log
2019-03-06T12:53:34Z DEBUG ipa-replica-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'skip_schema_check': False, 'no_ntp': False, 'setup_kra': False, 'ip_addresses': None, 'secondary_rid_base': None, 'netbios_name': None, 'mkhomedir': False, 'http_cert_files': None, 'no_pkinit': False, 'principal': 'admin', 'no_forwarders': False, 'add_sids': False, 'keytab': None, 'ssh_trust_dns': False, 'no_msdcs': False, 'domain_name': None, 'setup_adtrust': False, 'http_cert_name': None, 'dirsrv_cert_files': None, 'no_dnssec_validation': False, 'no_reverse': False, 'pkinit_cert_files': None, 'unattended': False, 'skip_conncheck': False, 'auto_reverse': False, 'auto_forwarders': False, 'no_host_dns': False, 'dirsrv_cert_name': None, 'no_ui_redirect': False, 'dirsrv_config_file': None, 'forwarders': None, 'verbose': True, 'setup_ca': False, 'servers': None, 'pkinit_cert_name': None, 'no_ssh': False, 'enable_compat': False, 'add_agents': False, 'realm_name': None, 'force_join': False, 'no_sshd': False, 'forward_policy': None, 'rid_base': None, 'quiet': False, 'setup_dns': False, 'host_name': None, 'log_file': None, 'reverse_zones': None, 'allow_zone_overlap': False}
2019-03-06T12:53:34Z DEBUG IPA version 4.6.4-10.el7.centos.2
2019-03-06T12:53:34Z DEBUG Searching for an interface of IP address: ::1
2019-03-06T12:53:34Z DEBUG Testing local IP address: ::1/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff (interface: lo)
2019-03-06T12:53:34Z DEBUG Starting external process
2019-03-06T12:53:34Z DEBUG args=/usr/sbin/selinuxenabled
2019-03-06T12:53:34Z DEBUG Process finished, return code=1
2019-03-06T12:53:34Z DEBUG stdout=
2019-03-06T12:53:34Z DEBUG stderr=
2019-03-06T12:53:34Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2019-03-06T12:53:34Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2019-03-06T12:53:34Z DEBUG httpd is not configured
2019-03-06T12:53:34Z DEBUG kadmin is not configured
2019-03-06T12:53:34Z DEBUG dirsrv is not configured
2019-03-06T12:53:34Z DEBUG pki-tomcatd is not configured
2019-03-06T12:53:34Z DEBUG install is not configured
2019-03-06T12:53:34Z DEBUG krb5kdc is not configured
2019-03-06T12:53:34Z DEBUG ntpd is not configured
2019-03-06T12:53:34Z DEBUG named is not configured
2019-03-06T12:53:34Z DEBUG filestore is tracking no files
2019-03-06T12:53:34Z DEBUG Starting external process
2019-03-06T12:53:34Z DEBUG args=/usr/sbin/httpd -t -D DUMP_VHOSTS
2019-03-06T12:53:34Z DEBUG Process finished, return code=0
2019-03-06T12:53:34Z DEBUG stdout=VirtualHost configuration:
*:8443                 ipa2.corp.example.com (/etc/httpd/conf.d/nss.conf:81)
2019-03-06T12:53:34Z DEBUG stderr=
2019-03-06T12:53:34Z DEBUG Starting external process
2019-03-06T12:53:34Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2019-03-06T12:53:34Z DEBUG Process finished, return code=1
2019-03-06T12:53:34Z DEBUG stdout=disabled
2019-03-06T12:53:34Z DEBUG stderr=
2019-03-06T12:53:34Z DEBUG Starting external process
2019-03-06T12:53:34Z DEBUG args=/bin/systemctl is-active chronyd.service
2019-03-06T12:53:34Z DEBUG Process finished, return code=3
2019-03-06T12:53:34Z DEBUG stdout=unknown
2019-03-06T12:53:34Z DEBUG stderr=
2019-03-06T12:53:34Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2019-03-06T12:53:34Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2019-03-06T12:53:34Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2019-03-06T12:53:34Z DEBUG importing all plugin modules in ipaserver.plugins...
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.aci
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.automember
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.automount
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.baseldap
2019-03-06T12:53:34Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.baseuser
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.batch
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.ca
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.caacl
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.cert
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.certmap
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.certprofile
2019-03-06T12:53:34Z DEBUG importing plugin module ipaserver.plugins.config
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.delegation
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.dns
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.dnsserver
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.dogtag
2019-03-06T12:53:35Z DEBUG skipping plugin module ipaserver.plugins.dogtag: dogtag not selected as RA plugin
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.domainlevel
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.group
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.hbac
2019-03-06T12:53:35Z DEBUG ipaserver.plugins.hbac is not a valid plugin module
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.hbacrule
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.hbacsvc
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.hbactest
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.host
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.hostgroup
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.idrange
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.idviews
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.internal
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.join
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.ldap2
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.location
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.migration
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.misc
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.netgroup
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.otp
2019-03-06T12:53:35Z DEBUG ipaserver.plugins.otp is not a valid plugin module
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.otpconfig
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.otptoken
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.passwd
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.permission
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.ping
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.pkinit
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.privilege
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.pwpolicy
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.rabase
2019-03-06T12:53:35Z DEBUG ipaserver.plugins.rabase is not a valid plugin module
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.radiusproxy
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.realmdomains
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.role
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.schema
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.selfservice
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.server
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.serverrole
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.serverroles
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.service
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.servicedelegation
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.session
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.stageuser
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.sudo
2019-03-06T12:53:35Z DEBUG ipaserver.plugins.sudo is not a valid plugin module
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.sudocmd
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.sudorule
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.topology
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.trust
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.user
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.vault
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.virtual
2019-03-06T12:53:35Z DEBUG ipaserver.plugins.virtual is not a valid plugin module
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.whoami
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.plugins.xmlserver
2019-03-06T12:53:35Z DEBUG importing all plugin modules in ipaserver.install.plugins...
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.adtrust
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.dns
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_nis
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_referint
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_services
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness
2019-03-06T12:53:35Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt
2019-03-06T12:53:40Z DEBUG Check if ipa2.corp.example.com is a primary hostname for localhost
2019-03-06T12:53:40Z DEBUG Primary hostname for localhost: ipa2.corp.example.com
2019-03-06T12:53:40Z DEBUG Search DNS for ipa2.corp.example.com
2019-03-06T12:53:40Z DEBUG Check if ipa2.corp.example.com is not a CNAME
2019-03-06T12:53:40Z DEBUG Check reverse address of 10.208.66.6
2019-03-06T12:53:40Z DEBUG Found reverse name: ipa2.corp.example.com
2019-03-06T12:53:40Z DEBUG Check if ipa.corp.example.com is a primary hostname for localhost
2019-03-06T12:53:40Z DEBUG Primary hostname for localhost: ipa.corp.example.com
2019-03-06T12:53:40Z DEBUG Search DNS for ipa.corp.example.com
2019-03-06T12:53:40Z DEBUG Check if ipa.corp.example.com is not a CNAME
2019-03-06T12:53:40Z DEBUG Check reverse address of 10.208.66.138
2019-03-06T12:53:40Z DEBUG Found reverse name: ipa.corp.example.com
2019-03-06T12:53:40Z DEBUG Initializing principal host/ipa2.corp.example.com@CORP.EXAMPLE.COM using keytab /etc/krb5.keytab
2019-03-06T12:53:40Z DEBUG using ccache /tmp/krbccVlu7UJ/ccache
2019-03-06T12:53:40Z DEBUG Attempt 1/1: success
2019-03-06T12:53:40Z DEBUG importing all plugin modules in ipaserver.plugins...
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.aci
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.automember
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.automount
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.baseldap
2019-03-06T12:53:40Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.baseuser
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.batch
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.ca
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.caacl
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.cert
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.certmap
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.certprofile
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.config
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.delegation
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.dns
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.dnsserver
2019-03-06T12:53:40Z DEBUG importing plugin module ipaserver.plugins.dogtag
2019-03-06T12:53:41Z DEBUG skipping plugin module ipaserver.plugins.dogtag: dogtag not selected as RA plugin
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.domainlevel
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.group
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.hbac
2019-03-06T12:53:41Z DEBUG ipaserver.plugins.hbac is not a valid plugin module
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.hbacrule
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.hbacsvc
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.hbactest
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.host
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.hostgroup
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.idrange
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.idviews
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.internal
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.join
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.ldap2
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.location
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.migration
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.misc
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.netgroup
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.otp
2019-03-06T12:53:41Z DEBUG ipaserver.plugins.otp is not a valid plugin module
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.otpconfig
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.otptoken
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.passwd
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.permission
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.ping
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.pkinit
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.privilege
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.pwpolicy
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.rabase
2019-03-06T12:53:41Z DEBUG ipaserver.plugins.rabase is not a valid plugin module
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.radiusproxy
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.realmdomains
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.role
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.schema
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.selfservice
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.server
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.serverrole
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.serverroles
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.service
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.servicedelegation
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.session
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.stageuser
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.sudo
2019-03-06T12:53:41Z DEBUG ipaserver.plugins.sudo is not a valid plugin module
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.sudocmd
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.sudorule
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.topology
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.trust
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.user
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.vault
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.virtual
2019-03-06T12:53:41Z DEBUG ipaserver.plugins.virtual is not a valid plugin module
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.whoami
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.plugins.xmlserver
2019-03-06T12:53:41Z DEBUG importing all plugin modules in ipaserver.install.plugins...
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.adtrust
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.dns
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_nis
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_referint
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_services
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness
2019-03-06T12:53:41Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt
2019-03-06T12:53:46Z DEBUG failed to find session_cookie in persistent storage for principal 'host/ipa2.corp.example.com@CORP.EXAMPLE.COM'
2019-03-06T12:53:46Z INFO trying https://ipa.corp.example.com/ipa/json
2019-03-06T12:53:46Z DEBUG Created connection context.jsonclient_140692834444944
2019-03-06T12:53:46Z INFO [try 1]: Forwarding 'env' to json server 'https://ipa.corp.example.com/ipa/json'
2019-03-06T12:53:46Z DEBUG New HTTP connection (ipa.corp.example.com)
2019-03-06T12:53:46Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=jeasWUfkkNOpU%2bJY4%2bKAg6uONKkNEXO2U7DtbhT2MN72yP2M577IBwKcjEIxUgLrI%2b8z46neWYqHScFcZm5EmDGOm3jeuFgcBoevlwh8dS%2buki2lFlYbjI1GoI35EJpsIk4BwSg5ZG9ncZT%2fC6L4UYg%2bRLF%2bY2GCC1RN9L14fSn7yQvaMU9IIJrIdiiPqDM%2fCZ97J9xz2utEH11kdulc2xYGeN8BfoP2L0iu2YhTvS8mbc0GY9oA5YPHiPMXZ3jVNHVyNznUeUDd22tdSEtDzBRs8pZsHDQbK4BQY6w4B7rTwB7P4Hx1YZvMLh8h8hiY;path=/ipa;httponly;secure;']'
2019-03-06T12:53:46Z DEBUG storing cookie 'ipa_session=MagBearerToken=jeasWUfkkNOpU%2bJY4%2bKAg6uONKkNEXO2U7DtbhT2MN72yP2M577IBwKcjEIxUgLrI%2b8z46neWYqHScFcZm5EmDGOm3jeuFgcBoevlwh8dS%2buki2lFlYbjI1GoI35EJpsIk4BwSg5ZG9ncZT%2fC6L4UYg%2bRLF%2bY2GCC1RN9L14fSn7yQvaMU9IIJrIdiiPqDM%2fCZ97J9xz2utEH11kdulc2xYGeN8BfoP2L0iu2YhTvS8mbc0GY9oA5YPHiPMXZ3jVNHVyNznUeUDd22tdSEtDzBRs8pZsHDQbK4BQY6w4B7rTwB7P4Hx1YZvMLh8h8hiY;' for principal host/ipa2.corp.example.com@CORP.EXAMPLE.COM
2019-03-06T12:53:46Z INFO [try 1]: Forwarding 'env' to json server 'https://ipa.corp.example.com/ipa/json'
2019-03-06T12:53:46Z DEBUG HTTP connection keep-alive (ipa.corp.example.com)
2019-03-06T12:53:46Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=OnOYTSQDueUctRZIEs9FiyA%2bkUJnJLTLZI5uhAk1WokHEpZ7OK9rWwwe7xeYiZU2Tl0%2fOrr1Q2RjRo7J2Alfe5pjWDskVwuh6RpCIvScB2c0NgeK3v8o1AD77FrWoCabqpOYfVCKiftr7K0Mjv8h4unahzBGSif0%2buHGHv1MTDpsBDRgFcGD752XEifYScZKsr4SUKfqZNg6VMYLj%2bhx%2bZ%2bbVCJt9hv2hHNyOCt8o6NI6sBiwsV66vLRF6bIm39rKBGMINwA24lrxqRoa3lHzlLHbnjtQSeF4W7wZAYXGbGk5bqgrhwJCljhchhk0ED2;path=/ipa;httponly;secure;']'
2019-03-06T12:53:46Z DEBUG storing cookie 'ipa_session=MagBearerToken=OnOYTSQDueUctRZIEs9FiyA%2bkUJnJLTLZI5uhAk1WokHEpZ7OK9rWwwe7xeYiZU2Tl0%2fOrr1Q2RjRo7J2Alfe5pjWDskVwuh6RpCIvScB2c0NgeK3v8o1AD77FrWoCabqpOYfVCKiftr7K0Mjv8h4unahzBGSif0%2buHGHv1MTDpsBDRgFcGD752XEifYScZKsr4SUKfqZNg6VMYLj%2bhx%2bZ%2bbVCJt9hv2hHNyOCt8o6NI6sBiwsV66vLRF6bIm39rKBGMINwA24lrxqRoa3lHzlLHbnjtQSeF4W7wZAYXGbGk5bqgrhwJCljhchhk0ED2;' for principal host/ipa2.corp.example.com@CORP.EXAMPLE.COM
2019-03-06T12:53:46Z DEBUG Destroyed connection context.jsonclient_140692834444944
2019-03-06T12:53:46Z DEBUG Created connection context.ldap2_140692844059728
2019-03-06T12:53:46Z DEBUG flushing ldaps://ipa.corp.example.com from SchemaCache
2019-03-06T12:53:46Z DEBUG retrieving schema for SchemaCache url=ldaps://ipa.corp.example.com conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7ff59a6a4cf8>
2019-03-06T12:53:47Z DEBUG raw: domainlevel_get(version=u'2.230')
2019-03-06T12:53:47Z DEBUG domainlevel_get(version=u'2.230')
2019-03-06T12:53:47Z DEBUG Destroyed connection context.ldap2_140692844059728
2019-03-06T12:53:47Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
    return cfgr.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in run
    self.validate()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 371, in validate
    for _nothing in self._validator():
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 636, in _configure
    next(validator)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
    for unused in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 618, in main
    replica_promote_check(self)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 428, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1158, in promote_check
    domain_level = current_domain_level(remote_api)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 607, in current_domain_level
    return api.Command['domainlevel_get']()['result']
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 478, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 800, in run
    return self.execute(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipaserver/plugins/domainlevel.py", line 110, in execute
    return {'result': int(entry.single_value['ipaDomainLevel'])}
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 608, in __getitem__
    value = self._entry[name]
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 486, in __getitem__
    return self._get_nice(name)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 453, in _get_nice
    name = self._get_attr_name(name)
  File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 449, in _get_attr_name
    name = self._names[name]
  File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 618, in __getitem__
    return super(CIDict, self).__getitem__(key.lower())
2019-03-06T12:53:47Z DEBUG The ipa-replica-install command failed, exception: KeyError: u'ipadomainlevel'
2019-03-06T12:53:47Z ERROR u'ipadomainlevel'
2019-03-06T12:53:47Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Thanks for the help, abbra.

Access to DL information is protected by an ACI in cn=Domain Level,cn=ipa,cn=etc,$SUFFIX:

(targetattr = "createtimestamp || entryusn || ipadomainlevel || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipadomainlevelconfig)")(version 3.0;acl "permission:System: Read Domain Level";allow (compare,read,search) userdn = "ldap:///all";)

By default, all authenticated users are allowed to access the ipadomainlevel field. I just tried to access the ipadomainlevel attribute with a host keytab, non-admin user, and DS' keytab. All users were successfully able to read ipadomainlevel.

# kdestroy -A
# kinit -kt /etc/dirsrv/ds.keytab ldap/$(hostname)
# ldapsearch -h $(hostname) -b 'cn=Domain Level,cn=ipa,cn=etc,dc=ipa,dc=example' ipadomainlevel
SASL/GSSAPI authentication started
SASL username: ldap/master.ipa.example@IPA.EXAMPLE
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=Domain Level,cn=ipa,cn=etc,dc=ipa,dc=example> with scope subtree
# filter: (objectclass=*)
# requesting: ipadomainlevel 
#
# Domain Level, ipa, etc, ipa.example
dn: cn=Domain Level,cn=ipa,cn=etc,dc=ipa,dc=example
ipadomainlevel: 1
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1

I don't understand why you are unable to read the attribute.

@cheimes I think there was some bug in 389-ds regarding ACI parsing that was fixed later and we get affected by it in 4.6 but not in 4.7+

I found a problem.
RBAC permissions have been edited.
Most likely this is a mistake of one of the employees.

Abbra and Cheimes thanks for the help.

Metadata Update from @rcritten:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

master:

  • b9dc975777f9f84dff20c5a79915d380e6aaaf0f domainlevel-get: fix various issues when running as non-admin

ipa-4-6:

  • 4c123cd920fcdc1ad9b1783f7c36e5377eb62731 domainlevel-get: fix various issues when running as non-admin

ipa-4-7:

  • 556bf2f9789d8b9cf2ba378f1efe4d161ba80c3c domainlevel-get: fix various issues when running as non-admin

ipa-4-5:

  • 84b41123fbf9ec7dcb9abc3e446bd2dcd826e602 domainlevel-get: fix various issues when running as non-admin
Metadata
None
None
None
None
Lowest
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.