We have deployed a FreeIPA server in my company and we would like to deploy a replica. I have followed the procedure to deploy it on a personal server and it worked (https://www.freeipa.org/page/V4/Replica_Setup). However, when I tried to perform the same procedure on my company's server, it didn't work.

I deployed both machines with Podman. To create the Replica host, I simply launched a Podman container from the Freeipa server without any command arguments and uninstalled it once it was running (ipa-server-install --uninstall).

Once I'd finished configuring the server, I proceeded to configure the replica. configuration as a customer has been successfully completed but when I tried to configure it as a replica it failed. I've tried executing the given commands and restarting the procedure, but I get the same error. The error indicates that the replication agreement for this host already exists, when this should not be the case. My host has never been configured as a replica before.

[root@ipa2 /]# ipa-client-install --domain=exemple.com --realm=EXEMPLE.COM --server=ipa.exemple.com --no-nisdomain
This program will set up IPA client.
Version 4.10.1

The sudo binary does not seem to be present on this system. Please consider installing sudo if required.
Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]: yes
Do you want to configure chrony with NTP server or pool address? [no]:
Client hostname: ipa2.exemple.com
DNS Domain: exemple.com
IPA Server: ipa.exemple.com
BaseDN: dc=exemple,dc=com

Continue to configure the system with these values? [no]: yes
Synchronizing time
Configuration of chrony was changed by installer.
Attempting to sync time with chronyc.
Time synchronization was successful.
User authorized to enroll computers: admin
Password for [email protected]:
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=EXEMPLE.COM
    Issuer:      CN=Certificate Authority,O=EXEMPLE.COM
    Valid From:  2023-06-13 16:19:19
    Valid Until: 2043-06-13 16:19:19

Enrolled in IPA realm EXEMPLE.COM
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Systemwide CA database updated.
SSSD enabled
Configured /etc/openldap/ldap.conf
/etc/ssh/ssh_config not found, skipping configuration
/etc/ssh/sshd_config not found, skipping configuration
Configured /etc/krb5.conf for IPA realm EXEMPLE.COM
Client configuration complete.
The ipa-client-install command was successful

[root@ipa2 /]# kinit admin
Password for [email protected]:
[root@ipa2 /]# ipa hostgroup-add-member ipaservers --hosts ipa2.exemple.com
  Host-group: ipaservers
  Description: IPA server hosts
  Member hosts: ipa.exemple.com, ipa2.exemple.com
Number of members added 1

[root@ipa2 /]# cat /var/log/ipareplica-install.log
2024-05-28T10:12:12Z DEBUG The ipa-replica-install command failed, exception: ScriptError: A replication agreement for this host already exists. It needs to be removed.
Run this command on any working server:
    %% ipa server-del ipa2.exemple.com --force
2024-05-28T10:12:12Z ERROR A replication agreement for this host already exists. It needs to be removed.
Run this command on any working server:
    %% ipa server-del ipa2.exemple.com --force
2024-05-28T10:12:12Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

1 Answer 1


I managed to delete these remaining replication agreements (potentially due to the program crash in the middle of the configuration)

ipa-replica-manage list
ipa-replica-manage list <server-fqdn>

The command ipa-replica-manage del is deprecated so we have to use ipa topologysegment-* commands.

ipa help topology # Display all topology command
ipa topologysegment-find # List all topology segments in 'domain' suffix

In output, we can see the Segment Name and we can delete it with the following command:

ipa topologysegment-del domain <segment_name>

Run an ipa uninstall on the replica host to clean up the ipa configuration (ipa-server-install). Now you can re-add your host as client and try again to promote it as replica.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .