On Wed, Jun 9, 2021, at 2:32 PM, Rob Crittenden wrote:
Bret Wortman via FreeIPA-users wrote:
> Looks like we're missing an LDAP connection port?
>
> [09/Jun/2021:10:02:54][localhost-startStop-1]: LdapBoundConnFactory: init
> Property internaldb.ldapconn.port missing value
>
> Full debug log is at
https://gist.github.com/wortmanb/7782c5c0c4318c2aec17f2eea589b567
>
>
That error is expected (and ignored).
It looks like the failure is here:
[09/Jun/2021:10:02:56][http-bio-8443-exec-3]: ConfigurationUtils: GET
https://ipa1.our.net:443/ca/admin/ca/getCertChain
javax.ws.rs.ProcessingException: Unable to invoke request
...
Caused by: java.io.IOException: SocketException cannot write on socket
So I suppose make sure that communication works but given this is the
standard https port it seems like it should just work. Look on
ipa1.our.net to see if it got a connection at all, or if it logged some
error.
Nothing in the logs on
ipa1.our.net (httpd/error_log or httpd/access_log), so I tried this
after the failure:
[root@ipa2c7 ~]# curl -XGET
https://ipa1.our.net:443/ca/admin/ca/getCertChain --cacert
/etc/ipa/ca.crt
and got:
<?xml version="1.0" encoding="UTF-8"
standalone="no"?><XMLResponse><Status>0</Status><ChainBase64>MIIDwg
[..snip..] </ChainBase64></XMLResponse>
So the server is responding and the client can get the correct response, at least a few
seconds later, it can. I did note that without the --cacert on the curl, I did get an
error back but with it, I got an answer.