[freeipa PR#1362][opened] Travis CI failures: Revert PR#1047
by tomaskrizek
URL: https://github.com/freeipa/freeipa/pull/1362
Author: tomaskrizek
Title: #1362: Travis CI failures: Revert PR#1047
Action: opened
PR body:
"""
PR#1047 was recently merged, but it was tested 2 months ago. The Travis CI passed, because it used older docker image. Once this was merged, it started to cause failures with the new image.
It is causing failures in Travis CI in our master branch. This is an attempt to hotfix the issue. If merged, we should reopen #1047 and test it properly (rebase, fix issues etc.).
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1362/head:pr1362
git checkout pr1362
5 years, 10 months
FreeIPA Planet - migrating to OCP
by Martin Kosek
Hello all,
I have finished preparations for moving our FreeIPA Planet from the
OpenShift v2 platform (EOL Dec 31st [1]) into the new OpenShift v3
container environment.
Just like with our wiki, the FreeIPA Planet app source code is hosted
openly in FreeIPA GitHub organization [2], including a standard issue
tracker or Pull Requests ability. The proposed version of the new Planet
is running in [3].
The FreeIPA Planet container in OpenShift v3 is set to rebuild
automatically when [2] is updated, to make Planet Configuration easier
even for people not having access to our OpenShift console or to merged
Pull Requests. The Planet container is also set to rebuild every day, to
catch new blog posts.
If there are any major concerns about this migration, let me know. If
not, I will just get DNS "planet.freeipa.org" updated in next days.
[1] https://blog.openshift.com/migrate-to-v3-v2-eol/
[2] https://github.com/freeipa/freeipa-planet
[3] http://freeipa-org-planet-freeipa.b9ad.pro-us-east-1.openshiftapps.com/
--
Martin Kosek <mkosek(a)redhat.com>
Manager, Software Engineering - Identity Management Team
Red Hat, Inc.
5 years, 10 months
Re: [Freeipa-users] ipa-client-install (3.0.2 on Wheezy) fails after root certificate change via ipa-cacert-manage
by Harald Dunkel
repost on freeipa-devel:
Hi folks,
its always worth reading the code.
ipa-client-install of freeipa 3.0.2 uses
wget http://ipa1.example.de/ipa/config/ca.crt
to grab the CA certificate. It seems that ipa-cacert-manage
(CentOS 7.3) did not upgrade /usr/share/ipa/html/ca.crt on
the servers when I migrated to the new root CA. Would anybody
mind to fix?
Thanx very much
Harri
On 11/16/17 9:28 AM, Harald Dunkel via FreeIPA-users wrote:
> Hi folks,
>
> a few months ago I had replaced the externally signed root
> certificate on my servers (CentOS 7.3) using ipa-cacert-manage.
> Problem:
>
> ipa-client-install on a freshly bootstrapped Debian 7 (Wheezy,
> freeipa 3.0.2) fails. Apparently it stumbles over the old root
> certificate:
>
> # ipa-client-install --domain=example.de --realm=EXAMPLE.DE --no-ssh --no-sshd --no-ntp
> Discovery was successful!
> Hostname: pobde7i001.vs.example.de
> Realm: EXAMPLE.DE
> DNS Domain: example.de
> IPA Server: ipa1.example.de
> BaseDN: dc=example,dc=de
>
> Continue to configure the system with these values? [no]: yes
> User authorized to enroll computers: admin
> Synchronizing time with KDC...
> Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.
> Password for admin(a)EXAMPLE.DE:
> Enrolled in IPA realm EXAMPLE.DE
> Created /etc/ipa/default.conf
> Domain example.de is already configured in existing SSSD config, creating a new one.
> The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall.
> Configured /etc/sssd/sssd.conf
> Configured /etc/krb5.conf for IPA realm EXAMPLE.DE
> trying https://ipa1.example.de/ipa/xml
> cert validation failed for "CN=ipa1.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.)
> trying https://ipa2.example.de/ipa/xml
> cert validation failed for "CN=ipa2.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.)
> Cannot connect to the server due to generic error: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None): https://ipa1.example.de/ipa/xml, https://ipa2.example.de/ipa/xml
> Installation failed. Rolling back changes.
>
>
> /etc/ipa/ca.crt on the client shows it somehow picked up the old
> certificate. On the servers /etc/ipa/ca.crt is the new root cert.
> "getcert list" on the servers shows only certificates based upon
> the new root ca, too. I wonder where ipa-client-install picked up
> the unwanted certificate?
>
> Of course I tried putting the new ca.crt into place before running
> ipa-client-install, but it was overwritten.
>
> Of course there is no such problem for ipa 4.4.4 on Stretch.
>
>
> Every heplful hint is highly appreciated
> Harri
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>
5 years, 10 months
[CI] Failing Travis jobs
by Tomas Krizek
Hi,
I've noticed Travis CI started to fail on our master branch. I've
identified the following issues:
- tox tests 'test_rpcclient_context' fail with "AttributeError: 'API'
object has no attribute 'Backend'"
These were added by a recently pushed PR#1047 [1]. The tests passed for
the PR, but they were executed 2 months! ago [2]. In the mean time, the
docker image used by Travis was updated to F27, and it was therefore
never tested with this version. I guess that's the reason we're seeing
these failures.
- python2 jobs are failing
I haven't tracked down this issue, but I have a feeling it might be
related to the PR above as well. There are BytesWarnings in the httpd log.
I propose we revert PR#1047 if it is indeed causing the failures. I've
opened a revert PR [3] to trigger tests.
[1] - https://github.com/freeipa/freeipa/pull/1047
[2] -
https://travis-ci.org/freeipa/freeipa/builds/283291175?utm_source=github_...
[3] - https://github.com/freeipa/freeipa/pull/1362
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
5 years, 10 months