Servers connected to IPA server with outdated data

Problem:

Some client servers are not receiving updated data from our IPA servers. For example, listing hosts in a specific host group on one client server shows missing hosts:

~]# ipa host-find --in-hostgroups=rhel9_hosts | grep Host | grep -i ra
  Host name: india

In contrast, the same command on another server shows additional hosts:

~]# ipa host-find --in-hostgroups=v9_hosts | grep Host | grep -i ra
  Host name: india
  Host name: rabi

Despite restarting IPA and SSSD services, the issue persists, affecting client operations.

IPA Version:

VERSION: 4.11.0, API_VERSION: 2.253

Process:

Step 1 – Process for Diagnosing and Resolving IPA Data Update Issues

1. Initial Diagnostics:

• Verify Hostgroup Membership:

  ipa hostgroup-show rhel9_hosts
  ipa hostgroup-show v9_hosts

  Confirm if the missing hosts are part of these groups.

2. Review IPA Server Logs:

• Directory Server Logs:

  ls /var/log/dirsrv/
  sudo tail -n 100 /var/log/dirsrv/slapd-*/errors

  Check for errors or warnings.

• Kerberos KDC Logs:

  sudo tail -n 100 /var/log/krb5kdc.log

  Check for any errors.

3. Check Replication Status:

• Ensure replication topology is correct:

  ipa-replica-manage list -v

• Get detailed replication status:

  ipa-replica-manage list -v <replica_server>
  ipa-csreplica-manage list -v <replica_server>

4. DNS Resolution:

• Check DNS Records:

  ipa-replica-manage list -v
  cat /etc/resolv.conf
  dig A <ipa_server_FQDN>

  Validate DNS settings and test DNS resolution for IPA servers and missing hosts.

• Test network connectivity:

  ping <ipa_server_hostname>
  telnet <ipa_server_hostname> 389

5. SSSD Configuration:

• Review Configuration Files:

  cat /etc/sssd/sssd.conf

  Compare configuration files on working and non-working nodes.

• Test SSSD Connectivity:

  kinit admin

• Clear SSSD Cache and Restart Service:

  sudo sss_cache -E
  sudo systemctl restart sssd

• Review SSSD Logs:

  sudo tail -f /var/log/sssd/sssd.log

6. Network Connectivity:

Verify network connectivity and firewall settings between client machines and the IPA server.

7. Re-enroll Client:

As a last resort, re-enroll the client machine:

ipa-client-install --force-join

8. Additional Data Collection:

If the issue persists, provide additional data such as SSSD and FreeIPA logs for further investigation.

9. Re-register Server with IPA:

• Check IPA Status:

  Ensure the IPA server is running and accessible.

• Remove Old Host Entry:

  ipa host-del <hostname>

• Re-register the Server:

  ipa-client-install --uninstall
  ipa-client-install

  Follow the prompts to reconfigure the client and register it with the IPA server.

• Verify Registration:

  ipa host-show <hostname>

• Update Configuration:

  Ensure the server’s configuration reflects the new registration.

• Restart Services:

  systemctl restart ipa-client

Solution:

After following the expert’s advice and re-registering the server with FreeIPA, the client found that the data was up-to-date again.

Conclusion:

The expert identified several potential causes for the outdated data issue, making it challenging to pinpoint the exact cause. They provided a diagnostic document to help determine if the problem was related to FreeIPA replication, DNS, SSSD configurations, or other factors. After implementing the expert’s recommendations and re-registering the server, the client confirmed that the data was now up-to-date.