From john.obaterspok at gmail.com Fri Jan 22 08:54:23 2021 Content-Type: multipart/mixed; boundary="===============6686543975717477984==" MIME-Version: 1.0 From: John Obaterspok To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Another 4.8.7 failed upgrade Date: Fri, 22 Jan 2021 09:54:00 +0100 Message-ID: --===============6686543975717477984== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, I'm stuck since about a week when I updated to latest ipa-server. It seems to be the same problem as Ian had ("FreeIPA centos8 update Failed to authenticate to CA REST API"). He seem to resolve this using a replicate which I dont have. Any ideas on how I get this to work? ipa-server-4.8.7-13.module_el8.3.0+606+1e8766d7.x86_64 centos-linux-release-8.3-1.2011.el8.noarch ... IPA version error: data needs to be upgraded (expected version '4.8.7-13.module_el8.3.0+606+1e8766d7', current version '4.8.7-12.module_el8.3.0+511+8a502f20') .... [Migrating certificate profiles to LDAP] IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API ... 2021-01-22T08:47:46Z DEBUG request GET https://ipa2.win.lan:8443/ca/rest/account/login 2021-01-22T08:47:46Z DEBUG request body '' 2021-01-22T08:47:47Z DEBUG response status 500 2021-01-22T08:47:47Z DEBUG response headers Content-Type: text/html;charset=3Dutf-8 Content-Language: en Content-Length: 2234 Date: Fri, 22 Jan 2021 08:47:47 GMT Connection: close 2021-01-22T08:47:47Z DEBUG response body (decoded): b'HTTP Status 500 \xe2\x80\x93 Internal Server Error

= HTTP Status 500 \xe2\x80\x93 Internal Server Error


Type Exception Report

Message CA subsystem unavailable. Check CA debug log.

Description The server encountered an unexpected condition that prevented it from fulfilling the request.

Exception

javax.ws.rs.ServiceUnavailableE=
xception:
CA subsystem unavailable. Check CA debug
log.\n\tcom.netscape.cms.tomcat.ProxyRealm.validateRealm(ProxyRealm.java:81=
)\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.=
java:149)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(Aut=
henticatorBase.java:530)\n\tcom.netscape.cms.tomcat.ExternalAuthenticationV=
alve.invoke(ExternalAuthenticationValve.java:82)\n\torg.apache.catalina.val=
ves.ErrorReportValve.invoke(ErrorReportValve.java:92)\n\torg.apache.catalin=
a.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678)\n\t=
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)=
\n\torg.apache.coyote.http11.Http11Processor.service(Http11Processor.java:3=
67)\n\torg.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLi=
ght.java:65)\n\torg.apache.coyote.AbstractProtocol$ConnectionHandler.proces=
s(AbstractProtocol.java:860)\n\torg.apache.tomcat.util.net.NioEndpoint$Sock=
etProcessor.doRun(NioEndpoint.java:1598)\n\torg.apache.tomcat.util.net.Sock=
etProcessorBase.run(SocketProcessorBase.java:49)\n\tjava.util.concurrent.Th=
readPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concu=
rrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apa=
che.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)=
\n\tjava.lang.Thread.run(Thread.java:748)\n

Note The full stack trace of the root cause is available in the server logs.


Apache Tomcat/9.0.30

' 2021-01-22T08:47:47Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2021-01-22T08:47:47Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value =3D self.run() File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_server_upgra= de.py", line 54, in run server.upgrade() File "/usr/lib/python3.6/site-packages/ipaserver/install/server/upgrade.p= y", line 1805, in upgrade upgrade_configuration() File "/usr/lib/python3.6/site-packages/ipaserver/install/server/upgrade.p= y", line 1670, in upgrade_configuration ca_enable_ldap_profile_subsystem(ca) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/upgrade.p= y", line 414, in ca_enable_ldap_profile_subsystem cainstance.migrate_profiles_to_ldap() File "/usr/lib/python3.6/site-packages/ipaserver/install/cainstance.py", line 1954, in migrate_profiles_to_ldap _create_dogtag_profile(profile_id, profile_data, overwrite=3DFalse) File "/usr/lib/python3.6/site-packages/ipaserver/install/cainstance.py", line 1960, in _create_dogtag_profile with api.Backend.ra_certprofile as profile_api: File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py", line 1315, in __enter__ raise errors.RemoteRetrieveError(reason=3D_('Failed to authenticate to CA REST API')) 2021-01-22T08:47:47Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API -- john --===============6686543975717477984==-- From john.obaterspok at gmail.com Mon Feb 1 20:43:16 2021 Content-Type: multipart/mixed; boundary="===============0123741630101424989==" MIME-Version: 1.0 From: John Obaterspok To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Another 4.8.7 failed upgrade Date: Mon, 01 Feb 2021 21:42:54 +0100 Message-ID: In-Reply-To: CAOscVdJCVRcb7huW-PFv3NiRAXpem0o4y9hxJy4rn28jCRmdTg@mail.gmail.com --===============0123741630101424989== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Den fre 22 jan. 2021 kl 09:54 skrev John Obaterspok : > > Hi, > > I'm stuck since about a week when I updated to latest ipa-server. It > seems to be the same problem as Ian had ("FreeIPA centos8 update > Failed to authenticate to CA REST API"). He seem to resolve this using > a replicate which I dont have. > [... snip ...] > [Migrating certificate profiles to LDAP] > IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run > command ipa-server-upgrade manually. > Unexpected error - see /var/log/ipaupgrade.log for details: > RemoteRetrieveError: Failed to authenticate to CA REST API > ... > ... > CA subsystem unavailable. Check CA debug > log.\n\tcom.netscape.cms.tomcat.ProxyRealm.validateRealm(ProxyRealm.java:= 81)\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyReal= m.java:149)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(A= uthenticatorBase.java:530)\... Strange enough, it's working just fine now after the server was restarted after dnf-automatic update and scheduled reboot. Only thing I did prior to this was to replace old ipa server name from sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg + /etc/pki/pki-tomcat/ca/CS.cfg The old server name was when I did a fedora xx to centos 8 migration using replica. I believe I followed the https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht= ml/installing_identity_management/migrate-7-to-8_migrating guide -- john --===============0123741630101424989==-- From rcritten at redhat.com Tue Feb 2 21:02:50 2021 Content-Type: multipart/mixed; boundary="===============1846386065879509790==" MIME-Version: 1.0 From: Rob Crittenden To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Another 4.8.7 failed upgrade Date: Tue, 02 Feb 2021 16:02:08 -0500 Message-ID: <078b5874-8909-0588-083e-593543997222@redhat.com> In-Reply-To: CAOscVd+2MmjfK7X=Bcj3of=bjnoMa0srfb=DgYKSw9ufXxR4vg@mail.gmail.com --===============1846386065879509790== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable John Obaterspok via FreeIPA-users wrote: > Den fre 22 jan. 2021 kl 09:54 skrev John Obaterspok : >> >> Hi, >> >> I'm stuck since about a week when I updated to latest ipa-server. It >> seems to be the same problem as Ian had ("FreeIPA centos8 update >> Failed to authenticate to CA REST API"). He seem to resolve this using >> a replicate which I dont have. >> > [... snip ...] > = >> [Migrating certificate profiles to LDAP] >> IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run >> command ipa-server-upgrade manually. >> Unexpected error - see /var/log/ipaupgrade.log for details: >> RemoteRetrieveError: Failed to authenticate to CA REST API >> ... >> > ... >> CA subsystem unavailable. Check CA debug >> log.\n\tcom.netscape.cms.tomcat.ProxyRealm.validateRealm(ProxyRealm.java= :81)\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRea= lm.java:149)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(= AuthenticatorBase.java:530)\... > = > Strange enough, it's working just fine now after the server was > restarted after dnf-automatic update and scheduled reboot. Only thing > I did prior to this was to replace old ipa server name from > sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg + > /etc/pki/pki-tomcat/ca/CS.cfg > = > The old server name was when I did a fedora xx to centos 8 migration > using replica. I believe I followed the > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/= html/installing_identity_management/migrate-7-to-8_migrating > guide Do you remember what values you changed? rob --===============1846386065879509790==-- From john.obaterspok at gmail.com Tue Feb 2 21:47:36 2021 Content-Type: multipart/mixed; boundary="===============3621240720825819635==" MIME-Version: 1.0 From: John Obaterspok To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Another 4.8.7 failed upgrade Date: Tue, 02 Feb 2021 22:47:13 +0100 Message-ID: In-Reply-To: 078b5874-8909-0588-083e-593543997222@redhat.com --===============3621240720825819635== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Den tis 2 feb. 2021 kl 22:02 skrev Rob Crittenden : > > Do you remember what values you changed? Take this with a grain of salt as I have no idea what keys I changed. But, I had the following in my vim jumplist :) /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg pki_clone_uri=3D /etc/pki/pki-tomcat/ca/CS.cfg master.ca.agent.host=3D Searching for the old replicate also reveals several hits in CS.cfg.bak for master.ca.agent.host like: pki/pki-tomcat/ca/archives/CS.cfg.bak.20201208065404:929:master.ca.agent.ho= st=3D... The current ipa server was installed from replica on 2019-12-07 so the above entry should be pretty recent -- john --===============3621240720825819635==--