Some time ago I implemented a modification of the RHEL8 IPA (v4.9.13) schema to attempt to alias the ‘member’ attribute with the attribute ‘uniqueMember’. This was in attempt to get vCenter group matching to work for authentication.

This was my modification

dn: cn=schema
changetype: modify
add: attributeTypes
attributeTypes: ( 2.5.4.31 NAME ( 'member' 'uniqueMember' )  SUP distinguishedName EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 'RFC 4519' 'user defined' ) )

I implemented this with the ipa-ldap-updater command.
This seemed to work well for quite some time, authentication worked in vCenter, IPA seemed happy to chug along.

However, now I’m attempting to introduce a replica to the environment, while running the ipa-replica-install it will get to this point in the installation and fail.

Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
  [1/30]: creating certificate server db
  [2/30]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded

  [3/30]: creating ACIs for admin
  [4/30]: creating installation admin user
  [error] OBJECT_CLASS_VIOLATION: {'msgtype': 103, 'msgid': 26, 'result': 65, 'desc': 'Object class violation', 'ctrls': [], 'info': 'attribute "member" not allowedn'}
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

{'msgtype': 103, 'msgid': 26, 'result': 65, 'desc': 'Object class violation', 'ctrls': [], 'info': 'attribute "member" not allowedn'}
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

I’ve attempted to delete/revert my schema modification in a few ways but seem to be missing something, i’ll either break it completely or it seems to work but the next time I run the ipa-replica-install command it will stop at attempting to connect to the CA.
In the pki-tomcat/ca debug log on the master I’ll see something like

SEVERE: ipara is not in this group Registration Manager Agents

but this only happens after I attempt to delete my schema modification.

I’m looking for a way to correctly revert my schema modification to get IPA healthy again so I can join the replica.