Possible to split a toplogy to 2 topologies?
by Heo Paul
Hi. I installed ipa-core servers in a toplogy and the version of those are 4.9.3.
A topology : 1 <--> 2 <--> 3 <--> 4 <--> 5 <--> 6
And I'd like to disconnect agreements between 3 and 4 replicas, I expect that there should be 2 seperate topologies like the below.
A topology : 1 <--> 2 <--> 3
B topology : 4 <--> 5 <--> 6
But when I try to execute the following commands, but those all fails due to "ipa: ERROR: Server is unwilling to perform: Removal of Segment disconnects topology.Deletion not allowed."
- ipa-topologysegment-del
- ldapdelete cn=xx3.com-to-xx4.com,cn=ca,cn=topology,cn=ipa,cn=etc,dc=samsungsre,dc=com
And I also did "ipa-replica-manage del" command but some issues also occurred.
Could you guide me to disconnect replications between non-leaf replicas?
1 month, 2 weeks
Can CA system certificates be rekeyed?
by Sam Morris
Hi folks
I make use of certmonger's key_use_count to ensure that I don't use the
same private key more than once when issuing service certificates. I was
wondering what would happen if this was set on a FreeIPA server. Having
done a bit of reading I think this looks like a Very Bad Idea, but I was
wondering if someone could confirm the following:
1. It's fine to rekey the KDC/dirsrv/httpd service certificates -
there's nothing particularly special about them.
2. The Dogtag-related certificates are renewed on the CA renewal master,
and stashed into the directory in entries under
cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX so that the other servers can
retrieve them; but the private keys aren't stashed in the directory, so
transporting the new keys to the other servers would be a manual process.
3. One of these certificates is the CA certificate which you would never
want to re-key because that would cause absolute mayhem.
4. There's no way to have certmonger re-key the service certificates
(from the "IPA" CA) when renewing, but not the system certificates (from
the "dogtag-ipa-ca-renew-agent" CA); so setting key_use_count is a
really bad idea, never do it on a FreeIPA server.
Cheers,
--
Sam Morris <https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9
1 month, 2 weeks
Re: upgrade idm servers rhel 7 to 8 problems
by Natxo Asenjo
hi,
posting back to the list.
Apparently the idm server cannot find a SID of a domain when trying to
resolve the user account. It does find the user account, but there are
sids coupled to the account correspondig to a domain wich cannot be
resolved.
It took me a while but the sid of that child domain is not the one not
resolved.
It turns out, the sid of the domain not resolving is the one of the idm
realm itself., we have some idm groups mapped to the AD groups we allow in
idm for rbac, and if I look at the ipaNTSecurityIdentifier attributes of
the id groups, those are the not resolved groups.
This is unexpected (to me at least).
so we have this trust (verified on two different idm servers, same value):
ipa trust-find
---------------
1 trust matched
---------------
Realm name: domain.local
Domain NetBIOS name: DOMAIN
Domain Security Identifier: S-1-5-21-1416133915-1866970209-3316290679
Trust type: Active Directory domain
----------------------------
Number of entries returned 1
but inside this idm domain, we have some idm posix groups with the
ipantsecurityidentifier of the not resolvable domain, for instance:
S-1-5-21-1214650608-3976977395-3073169311-101072
So basically, it is not matching because of this ipantsecurityidentifier, I
think.
I do not know how to fix this at this moment, or why it has happened. Any
ideas?
1 month, 2 weeks
CA_UNREACHABLE when requesting from Ubuntu 20.04 to FreeIPA v4.11.1
by Djerk Geurts
Hi,
A month or so ago we upgraded from Fedora 37 to 39. I guess this is the first time I’m getting round to requesting a new certificate, and it’s failing from a server we use to manage several certificates for non-IPA client hosts.
Output of ipa-getcert list:
Request ID '20240402190326':
status: CA_UNREACHABLE
ca-error: Server at https://ipa.domain.com/ipa/xml failed request, will retry: 903 (RPC failed at server. an internal error has occurred).
stuck: no
key pair storage: type=FILE,location='/etc/ssl/private/host.domain.com.key'
certificate: type=FILE,location='/etc/ssl/certs/host.domain.com.crt'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command:
track: yes
auto-renew: yes
The httpd log on the IPA server:
[Tue Apr 02 21:03:26.989287 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ipa: ERROR: non-public: ValueError: Only single-valued attributes are supported
[Tue Apr 02 21:03:26.989320 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] Traceback (most recent call last):
[Tue Apr 02 21:03:26.989326 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipaserver/rpcserver.py", line 417, in wsgi_execute
[Tue Apr 02 21:03:26.989330 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] result = command(*args, **options)
[Tue Apr 02 21:03:26.989333 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^^^^^^^^^^^^
[Tue Apr 02 21:03:26.989337 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipalib/frontend.py", line 471, in __call__
[Tue Apr 02 21:03:26.989341 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] return self.__do_call(*args, **options)
[Tue Apr 02 21:03:26.989345 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[Tue Apr 02 21:03:26.989348 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipalib/frontend.py", line 499, in __do_call
[Tue Apr 02 21:03:26.989353 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ret = self.run(*args, **options)
[Tue Apr 02 21:03:26.989358 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^^^^^^^^^^^^^
[Tue Apr 02 21:03:26.989371 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipalib/frontend.py", line 816, in run
[Tue Apr 02 21:03:26.989376 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] return self.execute(*args, **options)
[Tue Apr 02 21:03:26.989381 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[Tue Apr 02 21:03:26.989385 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipaserver/plugins/cert.py", line 716, in execute
[Tue Apr 02 21:03:26.989389 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ext_san = csr.extensions.get_extension_for_oid(
[Tue Apr 02 21:03:26.989392 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^
[Tue Apr 02 21:03:26.989396 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ValueError: Only single-valued attributes are supported
[Tue Apr 02 21:03:26.989527 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ipa: INFO: [xmlserver] host/jump.domain.com(a)DOMAIN.COM: cert_request(‘MIID**********d1A==', principal='HTTP/host.domain.com(a)DOMAIN.COM', add=True, version='2.51'): InternalError
The requesting machine is allowed to manage both the host and the service. Requesting the certificate on the IPA server itself works fine. I’ve read elsewhere that this could be an incompatibility between the client and the server.
Client: Ubuntu 20.04 LTS, ipa-client: v4.8.6
Server: Fedora 39, ipa-server: v4.11.1
Thanks,
Djerk Geurts
1 month, 2 weeks
ACME certs fail to renew
by Antoine Gatineau
Hello,
I have a strange issue regarding acme service.
My acme certificates fail to renew. `ipa-acme-manage status`fails with
error:
Failed to authenticate to CA REST API
The ipa-acme-manage command failed.
certbot client fails with error "Failed to renew certificate
office.empire.lan with error: <Response [404]>"
$ ipa cert-show 49
Issuing CA: ipa
Certificate: "The certificate content"
Subject: CN=office.empire.lan
Subject DNS name: office.empire.lan
Issuer: CN=Certificate Authority,O=EMPIRE.LAN
Not Before: Sun Dec 24 14:05:50 2023 UTC
Not After: Sat Mar 23 14:05:50 2024 UTC
Serial number: 49
Serial number (hex): 0x31
Revoked: False
So last successful renewal was on Dec 24th. Since then I have not really
done anything appart updating.
I don't see any issue in ipaupgrade.log
I am running on centos stream 9
idm-jss.x86_64 5.5.0-1.el9
idm-jss-tomcat.x86_64 5.5.0-1.el9
idm-ldapjdk.noarch 5.5.0-1.el9
idm-pki-acme.noarch 11.5.0-1.el9
idm-pki-base.noarch 11.5.0-1.el9
idm-pki-ca.noarch 11.5.0-1.el9
idm-pki-java.noarch 11.5.0-1.el9
idm-pki-kra.noarch 11.5.0-1.el9
idm-pki-server.noarch 11.5.0-1.el9
idm-pki-tools.x86_64 11.5.0-1.el9
ipa-client.x86_64 4.11.0-9.el9
ipa-client-common.noarch 4.11.0-9.el9
ipa-common.noarch 4.11.0-9.el9
ipa-healthcheck.noarch 0.16-2.el9
ipa-healthcheck-core.noarch 0.16-2.el9
ipa-selinux.noarch 4.11.0-9.el9
ipa-server.x86_64 4.11.0-9.el9
ipa-server-common.noarch 4.11.0-9.el9
ipa-server-dns.noarch 4.11.0-9.el9
I have followed closely the update on centos stream 9
Running `ipa-acme-manage status` with the -d switch gives me
ipapython.ipaldap: DEBUG: retrieving schema for SchemaCache
url=ldapi://%2fvar%2frun%2fslapd-EMPIRE-LAN.socket
conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f123c07e2e0>
ipaserver.masters: DEBUG: Discovery: available servers for service 'CA'
are ipa-server-01.empire.lan, ipa-server-02.empire.lan
ipaserver.masters: DEBUG: Discovery: using ipa-server-01.empire.lan for
'CA' service
ipapython.dogtag: DEBUG: request POST
https://ipa-server-01.empire.lan:8443/acme/login
ipapython.dogtag: DEBUG: request body ''
ipapython.dogtag: DEBUG: response status 404
ipapython.dogtag: DEBUG: response headers Content-Type:
text/html;charset=utf-8
Content-Language: en
Content-Length: 765
Date: Thu, 28 Mar 2024 10:00:59 GMT
ipapython.dogtag: DEBUG: response body (decoded): b'<!doctype html><html
lang="en"><head><title>HTTP Status 404 \xe2\x80\x93 Not
Found</title><style type="text/css">body
{font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b
{color:white;background-color:#525D76;} h1 {font-size:22px;} h2
{font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a
{color:black;} .line
{height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP
Status 404 \xe2\x80\x93 Not Found</h1><hr class="line" /><p><b>Type</b>
Status Report</p><p><b>Message</b> The requested resource
[/acme/login] is not available</p><p><b>Description</b> The
origin server did not find a current representation for the target
resource or is not willing to disclose that one exists.</p><hr
class="line" /><h3>Apache Tomcat/9.0.62</h3></body></html>'
ipapython.admintool: DEBUG: File
"/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in
execute
return_value = self.run()
File
"/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py",
line 403, in run
with state as ca_api:
File
"/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py",
line 103, in __enter__
raise errors.RemoteRetrieveError(
ipapython.admintool: DEBUG: The ipa-acme-manage command failed,
exception: RemoteRetrieveError: Failed to authenticate to CA REST API
ipapython.admintool: ERROR: Failed to authenticate to CA REST API
ipapython.admintool: ERROR: The ipa-acme-manage command failed.
So it looks like the acme subsystem is not started. But logs for the
acme subsystem in /var/log/pki/pki-tomcat/acme/debug.2024-03-28.log
don't show any issue. (see attached log)
How can I go further in troubleshooting/fixing this issue?
Thanks
1 month, 2 weeks
IPA replica installation failed-SEVERE: Unable to start CA engine: Selftest failed: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
by Polavarapu Manideep Sai
Hi Team,
Any one faced this issue during replica installation
I have third party SSL certificate installed on master server
IPA Version:
[root@dir02-mex ~]# ipa --version
VERSION: 4.10.2, API_VERSION: 2.252
Certificate Expiry:
[root@dir02-mex ~]# certutil -L -d /etc/pki/pki-tomcat/alias/ -n 'Server-Cert cert-pki-ca' | egrep -i 'befor|after'
Not Before: Mon Apr 01 09:41:49 2024
Not After : Sun Mar 22 09:41:49 2026
[1/4]: Generating ipa-custodia config file
[2/4]: Generating ipa-custodia keys
[3/4]: starting ipa-custodia
[4/4]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/30]: creating certificate server db
[2/30]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 12 seconds elapsed
Update succeeded
[3/30]: creating ACIs for admin
[4/30]: creating installation admin user
[5/30]: configuring certificate server instance
Failed to configure CA instance
See the installation logs and the following files/directories for more information:
/var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
Cat /var/log/ipareplica-install.log:
DEBUG: https://dir02-mexommx.ipa.com:8443 "GET / HTTP/1.1" 302 0
DEBUG: https://dir02-mexommx.ipa.com:8443 "GET /pki HTTP/1.1" 302 None
DEBUG: https://dir02-mexommx.ipa.com:8443 "GET /pki/ HTTP/1.1" 200 3500
INFO: PKI server started
INFO: Waiting for CA subsystem
DEBUG: Starting new HTTPS connection (1): dir02-mexommx.ipa.com:8443
DEBUG: https://dir02-mexommx.ipa.com:8443 "GET /ca/admin/ca/getStatus HTTP/1.1" 404 784
2024-04-01T09:41:34Z CRITICAL Failed to configure CA instance
2024-04-01T09:41:34Z CRITICAL See the installation logs and the following files/directories for more information:
2024-04-01T09:41:34Z CRITICAL /var/log/pki/pki-tomcat
2024-04-01T09:41:34Z DEBUG Traceback (most recent call last):
File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation
run_step(full_msg, method)
File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step
method()
File "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", line 651, in __spawn_instance
DogtagInstance.spawn_instance(
File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance
self.handle_setup_error(e)
File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 604, in handle_setup_error
raise RuntimeError(
RuntimeError: CA configuration failed.
2024-04-01T09:41:34Z DEBUG [error] RuntimeError: CA configuration failed.
2024-04-01T09:41:34Z DEBUG Removing /root/.dogtag/pki-tomcat/ca
2024-04-01T09:41:34Z DEBUG File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute
return_value = self.run()
File "/usr/lib/python3.9/site-packages/ipapython/install/cli.py", line 344, in run
return cfgr.run()
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 360, in run
return self.execute()
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 386, in execute
for rval in self._executor():
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 435, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 425, in __runner
step()
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 419, in step_next
return next(self.__gen)
File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 663, in _configure
next(executor)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 435, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 526, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 523, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 425, in __runner
step()
File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 419, in step_next
return next(self.__gen)
File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise
raise value
File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.9/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python3.9/site-packages/ipaserver/install/server/__init__.py", line 599, in main
replica_install(self)
File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated
func(installer)
File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 1345, in install
ca.install(False, config, options, custodia=custodia)
File "/usr/lib/python3.9/site-packages/ipaserver/install/ca.py", line 354, in install
install_step_0(standalone, replica_config, options, custodia=custodia)
File "/usr/lib/python3.9/site-packages/ipaserver/install/ca.py", line 422, in install_step_0
ca.configure_instance(
File "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", line 506, in configure_instance
self.start_creation(runtime=runtime)
File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation
run_step(full_msg, method)
File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step
method()
File "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", line 651, in __spawn_instance
DogtagInstance.spawn_instance(
File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance
self.handle_setup_error(e)
File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 604, in handle_setup_error
raise RuntimeError(
2024-04-01T09:41:34Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: CA configuration failed.
2024-04-01T09:41:34Z ERROR CA configuration failed.
2024-04-01T09:41:34Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
Cat /var/log/pki/pki-tomcat/ca/debug.2024-04-01.log
2024-04-01 03:41:32 [main] INFO: CMSEngine: Disabling CA subsystem
2024-04-01 03:41:32 [main] SEVERE: Unable to start CA engine: Selftest failed: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
Selftest failed: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
at com.netscape.cmscore.selftests.SelfTestSubsystem.startup(SelfTestSubsystem.java:1759)
at com.netscape.cmscore.apps.CMSEngine.startupSubsystems(CMSEngine.java:1167)
at org.dogtagpki.server.ca.CAEngine.startupSubsystems(CAEngine.java:972)
2024-04-01 03:41:32 [main] SEVERE: SelfTestSubsystem: selftest failed: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
java.lang.Exception: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
at com.netscape.cmscore.cert.CertUtils.verifySystemCertValidityByNickname(CertUtils.java:844)
at com.netscape.cmscore.apps.CMSEngine.verifySystemCertByTag(CMSEngine.java:1895)
at com.netscape.cmscore.apps.CMSEngine.verifySystemCerts(CMSEngine.java:1823)
at com.netscape.cms.selftests.common.SystemCertsVerification.runSelfTest(SystemCertsVerification.java:211)
at com.netscape.cmscore.selftests.SelfTestSubsystem.runSelfTestsAtStartup(SelfTestSubsystem.java:818)
at com.netscape.cmscore.selftests.SelfTestSubsystem.startup(SelfTestSubsystem.java:1722)
at com.netscape.cmscore.apps.CMSEngine.startupSubsystems(CMSEngine.java:1167)
at org.dogtagpki.server.ca.CAEngine.startupSubsystems(CAEngine.java:972)
at com.netscape.cmscore.apps.CMSEngine.start(CMSEngine.java:1223)
at com.netscape.cmscore.apps.PKIWebListener.contextInitialized(PKIWebListener.java:43)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4768)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5230)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:726)
at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:149)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:139)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:696)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:696)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:690)
at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1889)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)
at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:123)
at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:583)
at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:473)
at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1618)
at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:319)
at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:123)
at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:423)
at org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:366)
at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:946)
at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:835)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1396)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1386)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)
at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:145)
at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:919)
at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:263)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.StandardService.startInternal(StandardService.java:432)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:927)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.startup.Catalina.start(Catalina.java:772)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:568)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:345)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:476)
Caused by: java.security.cert.CertificateNotYetValidException: NotBefore: Mon Apr 01 03:41:49 CST 2024
at org.mozilla.jss.netscape.security.x509.CertificateValidity.valid(CertificateValidity.java:302)
at org.mozilla.jss.netscape.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:494)
at org.mozilla.jss.netscape.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:466)
at com.netscape.cmscore.cert.CertUtils.verifySystemCertValidityByNickname(CertUtils.java:839)
... 54 more
2024-04-01 03:41:32 [main] SEVERE: SelfTestSubsystem: Disabling subsystem due to selftest failure: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
java.lang.Exception: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
cat /var/log/pki/pki-tomcat/ca/selftests.log:
0.main - [29/Mar/2024:03:28:24 GMT-06:00] [20] [1] CAPresence: CA is present
0.main - [29/Mar/2024:03:28:24 GMT-06:00] [20] [1] SystemCertsVerification: system certs verification failure: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Fri Mar 29 03:28:37 CST 2024
0.main - [29/Mar/2024:03:28:24 GMT-06:00] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED!
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: Initializing self test plugins:
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin logger parameters
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin instances
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin instance parameters
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading self test plugins in on-demand order
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading self test plugins in startup order
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: Self test plugins have been successfully loaded!
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: Running self test plugins specified to be executed at startup:
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] CAPresence: CA is present
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SystemCertsVerification: system certs verification failure: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Fri Mar 29 04:03:27 CST 2024
0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED!
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: Initializing self test plugins:
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin logger parameters
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin instances
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin instance parameters
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading self test plugins in on-demand order
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading self test plugins in startup order
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: Self test plugins have been successfully loaded!
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: Running self test plugins specified to be executed at startup:
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] CAPresence: CA is present
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SystemCertsVerification: system certs verification failure: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED!
________________________________
DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto.
Thank you - OnMobile Global Limited.
1 month, 2 weeks
One freeipa replica install fails, while other is going through
by D S
Hello,
I am trying to install 3 replicas agains the same master. Two out of 3 installs succeed, while the other one fails with
On replica:
Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
Check RPC connection to remote master
Execute check on remote master
ERROR: Remote master check failed with following error message(s):
an internal error has occurred
2024-03-28T09:09:28Z DEBUG Starting external process
2024-03-28T09:09:28Z DEBUG args=['/usr/sbin/ipa-client-install', '--unattended', '--uninstall']
2024-03-28T09:09:31Z DEBUG Process finished, return code=0
2024-03-28T09:09:31Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute
return_value = self.run()
File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 344, in run
return cfgr.run()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 358, in run
self.validate()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 368, in validate
for _nothing in self._validator():
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 633, in _configure
next(validator)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 597, in main
replica_promote_check(self)
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated
func(installer)
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 423, in decorated
func(installer)
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1196, in promote_check
ca_cert_file=cafile)
File "/usr/lib/python3.6/site-packages/ipaserver/install/replication.py", line 129, in replica_conn_check
"Connection check failed!"
2024-03-28T09:09:31Z DEBUG The ipa-replica-install command failed, exception: ScriptError: Connection check failed!
See /var/log/ipareplica-conncheck.log for more information.
If the check results are not valid it can be skipped with --skip-conncheck parameter.
2024-03-28T09:09:31Z ERROR Connection check failed!
See /var/log/ipareplica-conncheck.log for more information.
If the check results are not valid it can be skipped with --skip-conncheck parameter.
2024-03-28T09:09:31Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
On master:
[Thu Mar 28 09:09:27.891561 2024] [:error] [pid 22098] ipa: ERROR: non-public: DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
[Thu Mar 28 09:09:27.891666 2024] [:error] [pid 22098] Traceback (most recent call last):
[Thu Mar 28 09:09:27.891683 2024] [:error] [pid 22098] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 369, in wsgi_execute
[Thu Mar 28 09:09:27.891694 2024] [:error] [pid 22098] result = command(*args, **options)
[Thu Mar 28 09:09:27.891705 2024] [:error] [pid 22098] File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__
[Thu Mar 28 09:09:27.891717 2024] [:error] [pid 22098] return self.__do_call(*args, **options)
[Thu Mar 28 09:09:27.891727 2024] [:error] [pid 22098] File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 478, in __do_call
[Thu Mar 28 09:09:27.891737 2024] [:error] [pid 22098] ret = self.run(*args, **options)
[Thu Mar 28 09:09:27.891748 2024] [:error] [pid 22098] File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 800, in run
[Thu Mar 28 09:09:27.891928 2024] [:error] [pid 22098] return self.execute(*args, **options)
[Thu Mar 28 09:09:27.891951 2024] [:error] [pid 22098] File "/usr/lib/python2.7/site-packages/ipaserver/plugins/server.py", line 933, in execute
[Thu Mar 28 09:09:27.891962 2024] [:error] [pid 22098] ret, stdout, _stderr = server.conncheck(keys[-1])
[Thu Mar 28 09:09:27.891973 2024] [:error] [pid 22098] File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 70, in __call__
[Thu Mar 28 09:09:27.891983 2024] [:error] [pid 22098] return self._proxy_method(*args, **keywords)
[Thu Mar 28 09:09:27.891994 2024] [:error] [pid 22098] File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, in __call__
[Thu Mar 28 09:09:27.892005 2024] [:error] [pid 22098] **keywords)
[Thu Mar 28 09:09:27.892016 2024] [:error] [pid 22098] File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line 651, in call_blocking
[Thu Mar 28 09:09:27.892026 2024] [:error] [pid 22098] message, timeout)
[Thu Mar 28 09:09:27.892037 2024] [:error] [pid 22098] DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
[Thu Mar 28 09:09:27.892955 2024] [:error] [pid 22098] ipa: INFO: [jsonserver_kerb] local_admin(a)EXAMPLE.COM: server_conncheck(u'ipamaster01.example.com', u'ipa-replica03.example.com', version=u'2.162'): InternalError
[Thu Mar 28 09:09:30.121019 2024] [:error] [pid 20997] ipa: INFO: [jsonserver_kerb] host/ipa-replica03.example.com(a)EXAMPLE.COM: host_disable(u'ipa-replica03.example.com'): SUCCESS
1 month, 2 weeks
problem with configuration replication in ipa server
by Richard Halley
Hi everyone, I'm configuring the freeipa replication as follows:
1) ipa-client-install --domain=pippo.internal --realm=PIPPO.INTERNAL -N
2) I add the client to the ipaserver host group
3) ipa-replica-install -N --setup-dns --forwarder 8.8.8.8 --forwarder 8.8.4.4 --forwarder 1.1.1.1 --setup-ca
After running ipa-replica-install I get the following error:
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR A replication agreement for this host already exists. It needs to be removed.
Run this command:
%% ipa-replica-manage del pluto.pippo.internal --force
ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
I would like to point out that I have attempted the configuration several times without success.
Before proceeding with the uninstall commands of the client and the replica on the replica server, I delete the replica on the server (which fails because it does not find any replica) and then proceed with deleting the client.
In the replication log file I have the following error:
2024-03-28T12:05:10Z DEBUG The ipa-replica-install command failed, exception: ScriptError: A replication agreement for this host already exists. It needs to be removed.
Run this command:
%% ipa-replica-manage del pluto.pippo.internal --force
2024-03-28T12:05:10Z ERROR A replication agreement for this host already exists. It needs to be removed.
Run this command:
%% ipa-replica-manage del pluto.pippo.internal --force
2024-03-28T12:05:10Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
I can't understand where the problem is.
Could it be something dirty in LDAP?
Thank you very much
1 month, 2 weeks