From tomek at pipebreaker.pl Sat Oct 2 14:38:48 2021 Content-Type: multipart/mixed; boundary="===============0803919941474741326==" MIME-Version: 1.0 From: Tomasz Torcz To: freeipa-users at lists.fedorahosted.org Subject: =?utf-8?q?=5BFreeipa-users=5D_RA_Agent_certificate_authorisation_fails_?= =?utf-8?q?=E2=80=93_how_to_debug=3F?= Date: Sat, 02 Oct 2021 16:38:34 +0200 Message-ID: --===============0803919941474741326== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, I've encountered some authentication problems with my FreeIPA installation, which I've traced to RA Agent certification auth problems. I've done typical steps to verify certs in LDAP and hit a wall. Please suggest further steps. My setup is 2 masters on Fedora 34: freeipa-server-4.9.6-2.fc34.x86_64 pki-base-10.10.6-1.fc34.noarch Steps I've done: First I noticed problems when enabling ACME: $ ipa-acme-manage enable Failed to authenticate to CA REST API The ipa-acme-manage command failed. This is caused by authentication failure (401 return code), which I confirmed using curl: $ curl -X POST https://kaitain.pipebreaker.pl:8443/acme/enable --cert /var/= lib/ipa/ra-agent.pem --key /var/lib/ipa/ra-agent.key = HTTP Status 401 =E2=80=93 Una= uthorized

= HTTP Status 401 =E2=80=93 Unauthorized


Type S= tatus Report

Description The request has not been applied beca= use it lacks valid authentication credentials for the target resource.


Apache Tomcat/9.0.52

Errors from catalina.out: 02-Oct-2021 16:29:39.618 INFO [https-jsse-nio-8443-exec-6] com.netscape.cms= .tomcat.ExternalAuthenticationValve.invoke ExternalAuthenticationValve: aut= hType: null 02-Oct-2021 16:29:39.618 INFO [https-jsse-nio-8443-exec-6] com.netscape.cms= .tomcat.ExternalAuthenticationValve.invoke ExternalAuthenticationValve: pri= ncipal: null 02-Oct-2021 16:29:39.620 INFO [https-jsse-nio-8443-exec-6] com.netscape.cms= .tomcat.AbstractPKIAuthenticator.doAuthenticate PKIAuthenticator: Authentic= ate with client certificate authentication 02-Oct-2021 16:29:39.620 INFO [https-jsse-nio-8443-exec-6] com.netscape.cms= .tomcat.ProxyRealm.authenticate Authenticating certificate chain: 02-Oct-2021 16:29:39.621 INFO [https-jsse-nio-8443-exec-6] com.netscape.cms= .tomcat.ProxyRealm.authenticate - CN=3DIPA RA,O=3DPIPEBREAKER.PL 02-Oct-2021 16:29:39.621 INFO [https-jsse-nio-8443-exec-6] com.netscape.cms= .tomcat.ProxyRealm.authenticate - CN=3DCertificate Authority,O=3DPIPEBREAKE= R.PL 02-Oct-2021 16:29:39.624 INFO [https-jsse-nio-8443-exec-6] com.netscape.cms= .tomcat.AbstractPKIAuthenticator.doAuthenticate PKIAuthenticator: Result: f= alse I've made sure that /var/lib/ipa/ra-agent.pem is the same as in LDAP. $ openssl x509 -in /var/lib/ipa/ra-agent.pem -noout -text | grep Serial Serial Number: 105 (0x69) $ ldapsearch -o ldif_wrap=3Dno -D "cn=3Ddirectory manager" -W -b o=3Dipaca = "(uid=3Dipara)" = Enter LDAP Password: = # extended LDIF # # LDAPv3 # base with scope subtree # filter: (uid=3Dipara) # requesting: ALL # # ipara, people, ipaca dn: uid=3Dipara,ou=3Dpeople,o=3Dipaca description: 2;105;CN=3DCertificate Authority,O=3DPIPEBREAKER.PL;CN=3DIPA R= A,O=3DPIPEBREAKER.PL userCertificate;binary:: cn: ipara objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: cmsuser usertype: agentType sn: ipara uid: ipara userstate: 1 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Then SNIPPED portion is the same data as in /var/lib/ipa/ra-agent.pem. This is the same certificate; serial number matches, too. Certificate is NOT expired: $ openssl x509 -in /var/lib/ipa/ra-agent.pem -noout -dates notBefore=3DJun 16 04:34:42 2021 GMT notAfter=3DJun 6 04:34:42 2023 GMT What should I do next to resolve this authentication issue? -- = Tomasz Torcz Morality must always be based on practicality. tomek(a)pipebreaker.pl =E2=80=94 Baron Vladimir Harkonnen --===============0803919941474741326==--