replica install: fix thin client regression

Fix a regression introduced by commit
3157eec28f.

https://fedorahosted.org/freeipa/ticket/4739
https://fedorahosted.org/freeipa/ticket/5985

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>

ipaserver/install/server/replicainstall.py

@@ -1310,14 +1310,18 @@ def promote(installer):
     ccache = os.environ['KRB5CCNAME']
     remote_api = installer._remote_api
     conn = remote_api.Backend.ldap2
+    if installer._add_to_ipaservers:
         try:
             conn.connect(ccache=installer._ccache)
 
-        if installer._add_to_ipaservers:
             remote_api.Command['hostgroup_add_member'](
                 u'ipaservers',
                 host=[unicode(api.env.host)],
             )
+        finally:
+            if conn.isconnected():
+                conn.disconnect()
+            os.environ['KRB5CCNAME'] = ccache
 
     # Save client file and merge in server directives
     target_fname = paths.IPA_DEFAULT_CONF
@@ -1342,6 +1346,9 @@ def promote(installer):
         ntp = ntpinstance.NTPInstance()
         ntp.create_instance()
 
+    try:
+        conn.connect(ccache=ccache)
+
         # Configure dirsrv
         ds = install_replica_ds(config, options, installer._ca_enabled,
                                 remote_api,
@@ -1360,7 +1367,6 @@ def promote(installer):
     finally:
         if conn.isconnected():
             conn.disconnect()
-        os.environ['KRB5CCNAME'] = ccache
 
         # Create the management framework config file
         # do this regardless of the state of DS installation. Even if it fails,