This may be difficult to do. We can check to see if a host is marked as a master but not if that host has a replication agreement. May need a --force flag which would spur UI changes and still let people shoot themselves in the foot.

Ah, thank goodness for the cleanup in ipa-replica-manage. We in fact can use just cn=masters!

attachment
freeipa-rcrit-961-removehost.patch

master: d4a1dc5[[BR]]
ipa-2-2: f7b28f9

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=797563