ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.issc.io', port=8080): Read timed out
by Ricardo Mendes
Hi,
I'm having an issue where I can't remove an host due to the error:
"Operation Error
Some entries were not deleted
Show details:
- Certificate operation cannot be completed: Unable to communicate with CMS (403)"
getcert list
Number of certificates and requests being tracked: 9.
Request ID '20210401150403':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority
subject: CN=IPA RA
expires: 2023-03-22 16:04:03 WET
key usage: digitalSignature,keyEncipherment,dataEncipherment
eku: id-kp-clientAuth
profile: caSubsystemCert
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20210401150418':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority
subject: CN=CA Audit
expires: 2023-03-22 16:03:31 WET
key usage: digitalSignature,nonRepudiation
profile: caSignedLogCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20210401150419':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority
subject: CN=OCSP Subsystem
expires: 2023-03-22 16:03:28 WET
eku: id-kp-OCSPSigning
profile: caOCSPCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20210401150420':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority
subject: CN=CA Subsystem
expires: 2023-03-22 16:03:30 WET
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-clientAuth
profile: caSubsystemCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20210401150421':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority
subject: CN=Certificate Authority
expires: 2041-04-01 16:03:26 WEST
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
profile: caCACert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20210401150422':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority
subject: CN=idm.domain.io
expires: 2023-03-22 16:03:29 WET
dns: idm.domain.io
key usage: digitalSignature,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth
profile: caServerCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20210401150440':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-IO',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-DOMAIN-IO/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-IO',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority
subject: CN=idm.domain.io
expires: 2023-04-02 16:04:42 WEST
dns: idm.domain.io
principal name: ldap/idm.domain.io(a)domain.io
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
profile: caIPAserviceCert
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv DOMAIN-IO
track: yes
auto-renew: yes
Request ID '20210401150509':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/idm.domain.io-443-RSA'
certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt'
CA: IPA
issuer: CN=Certificate Authority
subject: CN=idm.domain.io
expires: 2023-04-02 16:05:09 WEST
dns: idm.domain.io,ipa-ca.domain.io
principal name: HTTP/idm.domain.io(a)domain.io
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
profile: caIPAserviceCert
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Request ID '20210401150519':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: IPA
issuer: CN=Certificate Authority
subject: CN=idm.domain.io
expires: 2023-04-02 16:05:20 WEST
principal name: krbtgt/domain.io(a)domain.io
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-pkinit-KPKdc
profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
ski-tomcat doesn't fail to start, however I get the following errors:
-- Subject: Unit pki-tomcatd(a)pki-tomcat.service has begun start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit pki-tomcatd(a)pki-tomcat.service has begun starting up.
Feb 02 15:22:15 idm.domain.io server[8216]: Java virtual machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java
Feb 02 15:22:15 idm.domain.io server[8216]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/ant.jar:/usr/share/java/ant-laun>
Feb 02 15:22:15 idm.domain.io server[8216]: main class used: org.apache.catalina.startup.Bootstrap
Feb 02 15:22:15 idm.domain.io server[8216]: flags used: -Dcom.redhat.fips=false
Feb 02 15:22:15 idm.domain.io server[8216]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pk>
Feb 02 15:22:15 idm.domain.io server[8216]: arguments used: start
Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: pki.client: /usr/libexec/ipa/ipa-pki-wait-running:63: The subsystem in PKIConnection.__init__() has been deprecated (https:/>
Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Created connection http://idm.domain.io:8080/ca
Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Max retries exceeded with url: />
Feb 02 15:22:17 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Max retries exceeded with url: />
Feb 02 15:22:18 idm.domain.io server[8216]: WARNING: Some of the specified [protocols] are not supported by the SSL engine and have been skipped: [[TLSv1, TLSv1.1]]
Feb 02 15:22:19 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.>
Feb 02 15:22:21 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.>
Feb 02 15:22:23 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.>
Feb 02 15:22:25 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.>
Feb 02 15:22:27 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.>
Feb 02 15:22:29 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.>
Feb 02 15:22:31 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Success, subsystem ca is running!
Feb 02 15:22:31 idm.domain.io systemd[1]: Started PKI Tomcat Server pki-tomcat.
-- Subject: Unit pki-tomcatd(a)pki-tomcat.service has finished start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit pki-tomcatd(a)pki-tomcat.service has finished starting up.
--
-- The start-up result is done.
I have followed this solution as well, but it didn't made any difference. https://access.redhat.com/solutions/4796941
IPA doesn't fail, all services are running, I simply can't do any operations that involve the CMS. Any help appreciated, thank you.
Ricardo M.
2 years, 2 months
IPA WebGUI login fails with "Login failed due to an unknown reason"
by code bugs
Hello,
-IPA WebGUI login fails with "Login failed due to an unknown reason"
-After upgrading IPA, can no longer log into the WebGUI
Version/Release/Distribution
$ cat /etc/centos-release
CentOS Linux release 8.5.2111
$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base
pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64
ipa-client-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64
389-ds-base-1.4.3.23-12.module_el8.5.0+1056+b3c5a4b9.x86_64
pki-ca-10.11.2-2.module_el8.5.0+945+a81e57da.noarch
krb5-server-1.18.2-14.el8.x86_64
Additional info:
tail /var/log/httpd/error_log
[wsgi:error] [pid 8833:tid 139812622513920] [remote 10.2.3.80:51404] ipa:
INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code
may provide more information, Minor (2598844948): TGT has been revoked
further,
1. default "admin" user can IPA WebGUIlogin
2. other users cannot login IPA WebGUIlogin, but can login using cli
(kinit)
3. when i create a new user, the new user can login IPA WebGUI.
2 years, 2 months
IPA to IPA migration - lot more groups - why?
by lejeczek
Hi guys.
I migrate:
-> $ ipa migrate-ds --bind-dn="cn=Directory Manager"
--user-container=cn=users,cn=accounts
--group-container=cn=groups,cn=accounts
--group-objectclass=posixgroup --with-compat ldap://10.0.0.16
and I end up, according to 'group-find', having a lot more -
one for each user - extra groups which do not exist(or don't
show up?) on the source IPA domain.
Why is that? Is that a symptom of a problem? Is it safe to
remove those extra groups?
many thanks, L
2 years, 2 months
Rawhide upgrade dirsrv startup failure workaround
by Harry G. Coin
When 'upgrading' using Rawhide, (instead of a fresh install), you might
notice ns-slapd / dirsrv fails to start. Do this to work around it:
#mkdir /dev/shm/slapd-<your kerberos domain with - instead of .>
#chown dirsrv:dirsrv /dev/shm/slapd-<your kerberos domain with - instead
of .>
#systemctl restart ipa
2 years, 2 months
Group permissions failing on group with ipaNTSecurityIdentifier attribute
by Scott Serr
Hello,
I have an IPA cluster of 5 servers, running version 4.9.6-10. The
system was put in production Feb 2021 and has been updated several
times. These updates have sometimes not gone well:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
I'll try to keep this concise. A user was not able to access an NFS
share provided by our EMC Isilon. They were a member of the group that
owned the directory/share. But not always, it depended upon what Isilon
IP was mounted. After many hours of troubleshooting, we found the group
was newly created and different than our old groups.
The group had an attribute we are not yet familiar with:
ipaNTSecurityIdentifier
The group also had an objectClass none of our others have: ipaNTGroupAttrs
This brought to my attention an issue I saw last week when trying to add
an IPA replica to our cluster. This is new prompting that I have not
seen before while setting up replicas:
WARNING: 1755 existing users or groups do not have a SID identifier
assigned.
Installer can run a task to have ipa-sidgen Directory Server plugin generate
the SID identifier for all these users. Please note, in case of a high
number of users and groups, the operation might lead to high replication
traffic and performance degradation. Refer to ipa-adtrust-install(1) man
page
for details.
Do you want to run the ipa-sidgen task? [no]:
----
I'm trying to understand the thread "Login failed due to an unknown
reason"
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
where Alexander explains how to fix SIDs. Also there is a thread: IPA
WebGUI login fails with "Login failed due to an unknown reason".
Are SIDs now required? An aside, in one of my install-replica attempts
last week I was asked to provide a NetBIOS name. :(
My IPA cluster is now wanting to do these SMB/AD sorts of things. Newly
created groups now have ipaNTSecurityIdentifier, which causes permission
issues when mounting NFS on our Isilon. Are we forced down this road or
do I have something misconfigured that is "half-way" doing AD? I'd like
to learn about the big picture.
Thank you,
Scott Serr
2 years, 2 months
Accidentally deleted NS record
by Nikolay Sukhno
FreeIPA 4.9.6 One Server.
I made a big mistake - accidentally deleted NS record from my dns zone and reload named.
Zone configured via dyndb
Now the dns server is not starting - zone company.local/IN: has no NS records
If I try to add ns record from command line
ipa dnsrecord-add gisw.ru @ --ns-hostname=vm-it-ipa1.company.local.
ipa: ERROR: All nameservers failed to answer the query vm-it-ipa1.company.local.ru. IN A: Server 127.0.0.1 UDP port 53 answered SERVFAIL
I'm stumped....
2 years, 2 months
Short names in named dyndb module
by Nikolay Sukhno
I understand that short names in DNS are not what you need
The DNS suffix is substituted on the client side from the resolv.conf, tcp\ip settings etc.
But in my infrastructure there are some strings for short names and I would like the dns server to supply the suffix itself.
There is no problem in the "classic" bind - the first short name found in the zones and return fdqn.
But when using dindb as part of FreeIPA this doesn't happen.
Maybe there is some kind of workround?
2 years, 2 months
AD groups detected only on one ipa server
by iulian roman
Hi everybody,
I have an IPA setup with AD trust and when I added a new group in AD it is detected only on one ipa server (I have 2 ipa servers in replication mode).
getent group correctly returns the group only on one IPA server, therefore only the ipa clients enrolled to that ipa server can see the group.
In the sssd logs I can see the following error:
[ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null).
If i try to add the AD group as external to a IPA group , by executing: ipa group-add-member ad_group --external "infosec(a)example.local"
, I get the following error:
member group: infosec(a)example.local: trusted domain object not found
Any idea how can I solve or troubleshoot it?
2 years, 2 months