On 07/27/2017 04:03 PM, Petros Triantafyllidis wrote:
>
>
> On 07/27/2017 04:17 PM, Florence Blanc-Renaud via FreeIPA-users wrote:
>> On 07/27/2017 11:34 AM, Petros Triantafyllidis via FreeIPA-users wrote:
>>> On 07/27/2017 11:13 AM, Florence Blanc-Renaud via FreeIPA-users wrote:
>>>> On 07/27/2017 09:17 AM, Petros Triantafyllidis via FreeIPA-users
>>>> wrote:
>>>>> Hi all,
>>>>> I would appreciate any help on my attempt to promote an
>>>>> existing client to replica. After client installation, I added
>>>>> replica-to-be to ipaservers hostgroup and then run
>>>>> "replica-install --setup-ca" but unfortunately I end up
with the
>>>>> errors below. Both master and client have
>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>> Thanks in advance,
>>>>> Petros
>>>>>
>>>>>
_____________________________________________________________________________________________________________
>>>>>
>>>>> On replica-to-be:
>>>>>
>>>>> [...]
>>>>> Done configuring ipa-otpd.
>>>>> Configuring certificate server (pki-tomcatd). Estimated time: 3
>>>>> minutes 30 seconds
>>>>> [1/26]: creating certificate server user
>>>>> [2/26]: creating certificate server db
>>>>> [3/26]: setting up initial replication
>>>>> Starting replication, please wait until this has completed.
>>>>> Update in progress, 5 seconds elapsed
>>>>> Update succeeded
>>>>>
>>>>> [4/26]: creating installation admin user
>>>>> [5/26]: setting up certificate server
>>>>> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to
>>>>> configure CA instance: Command '/usr/sbin/pkispawn -s CA -f
>>>>> /tmp/tmp6Q_ZLY' returned non-zero exit status 1
>>>>> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the
>>>>> installation logs and the following files/directories for more
>>>>> information:
>>>>> ipa.ipaserver.install.cainstance.CAInstance: CRITICAL
>>>>> /var/log/pki/pki-tomcat
>>>>> [error] RuntimeError: CA configuration failed.
>>>>> Your system may be partly configured.
>>>>> Run /usr/sbin/ipa-server-install --uninstall to clean up.
>>>>>
>>>>> ipa.ipapython.install.cli.install_tool(Replica): ERROR CA
>>>>> configuration failed.
>>>>> ipa.ipapython.install.cli.install_tool(Replica): ERROR The
>>>>> ipa-replica-install command failed. See
>>>>> /var/log/ipareplica-install.log for more information
>>>>>
>>>>>
_____________________________________________________________________________________________________________
>>>>> /var/log/ipareplica-install.log
>>>>>
>>>>> [...]
>>>>> Import complete
>>>>> ---------------
>>>>> Imported certificates in /etc/pki/pki-tomcat/alias:
>>>>>
>>>>> Certificate Nickname Trust Attributes
>>>>> SSL,S/MIME,JAR/XPI
>>>>>
>>>>> ocspSigningCert cert-pki-ca u,u,u
>>>>> subsystemCert cert-pki-ca u,u,u
>>>>> caSigningCert cert-pki-ca CTu,Cu,Cu
>>>>> auditSigningCert cert-pki-ca u,u,Pu
>>>>>
>>>>> Installation failed:
>>>>>
>>>>>
>>>>> Please check the CA logs in /var/log/pki/pki-tomcat/ca.
>>>>>
>>>>> 2017-07-27T06:57:54Z DEBUG stderr=
>>>>> 2017-07-27T06:57:54Z CRITICAL Failed to configure CA instance:
>>>>> Command '/usr/sbin/pkispawn -s CA -f /tmp/tmp6Q_ZLY' returned
>>>>> non-zero exit status 1
>>>>> 2017-07-27T06:57:54Z CRITICAL See the installation logs and the
>>>>> following files/directories for more information:
>>>>> 2017-07-27T06:57:54Z CRITICAL /var/log/pki/pki-tomcat
>>>>> 2017-07-27T06:57:54Z DEBUG Traceback (most recent call last):
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
>>>>> line 449, in start_creation
>>>>> run_step(full_msg, method)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
>>>>> line 439, in run_step
>>>>> method()
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
>>>>> line 586, in __spawn_instance
>>>>> DogtagInstance.spawn_instance(self, cfg_file)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py",
>>>>> line 181, in spawn_instance
>>>>> self.handle_setup_error(e)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py",
>>>>> line 420, in handle_setup_error
>>>>> raise RuntimeError("%s configuration failed." %
self.subsystem)
>>>>> RuntimeError: CA configuration failed.
>>>>>
>>>>> 2017-07-27T06:57:54Z DEBUG [error] RuntimeError: CA
>>>>> configuration failed.
>>>>> 2017-07-27T06:57:54Z DEBUG File
>>>>> "/usr/lib/python2.7/site-packages/ipapython/admintool.py",
line
>>>>> 171, in execute
>>>>> return_value = self.run()
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line
>>>>> 318, in run
>>>>> cfgr.run()
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 310, in run
>>>>> self.execute()
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 332, in execute
>>>>> for nothing in self._executor():
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 372, in __runner
>>>>> self._handle_exception(exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 394, in _handle_exception
>>>>> six.reraise(*exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 362, in __runner
>>>>> step()
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 359, in <lambda>
>>>>> step = lambda: next(self.__gen)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/util.py",
>>>>> line 81, in run_generator_with_yield_from
>>>>> six.reraise(*exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/util.py",
>>>>> line 59, in run_generator_with_yield_from
>>>>> value = gen.send(prev_value)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 586, in _configure
>>>>> next(executor)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 372, in __runner
>>>>> self._handle_exception(exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 449, in _handle_exception
>>>>> self.__parent._handle_exception(exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 394, in _handle_exception
>>>>> six.reraise(*exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 446, in _handle_exception
>>>>> super(ComponentBase, self)._handle_exception(exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 394, in _handle_exception
>>>>> six.reraise(*exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 362, in __runner
>>>>> step()
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/core.py",
>>>>> line 359, in <lambda>
>>>>> step = lambda: next(self.__gen)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/util.py",
>>>>> line 81, in run_generator_with_yield_from
>>>>> six.reraise(*exc_info)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/util.py",
>>>>> line 59, in run_generator_with_yield_from
>>>>> value = gen.send(prev_value)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipapython/install/common.py",
>>>>> line 63, in _install
>>>>> for nothing in self._installer(self.parent):
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py",
>>>>> line 1722, in main
>>>>> promote(self)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py",
>>>>> line 372, in decorated
>>>>> func(installer)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py",
>>>>> line 1519, in promote
>>>>> ca_cert_bundle=ca_data)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
>>>>> line 1392, in configure_replica
>>>>> self.start_creation(runtime=210)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
>>>>> line 449, in start_creation
>>>>> run_step(full_msg, method)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
>>>>> line 439, in run_step
>>>>> method()
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
>>>>> line 586, in __spawn_instance
>>>>> DogtagInstance.spawn_instance(self, cfg_file)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py",
>>>>> line 181, in spawn_instance
>>>>> self.handle_setup_error(e)
>>>>> File
>>>>>
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py",
>>>>> line 420, in handle_setup_error
>>>>> raise RuntimeError("%s configuration failed." %
self.subsystem)
>>>>>
>>>>> 2017-07-27T06:57:54Z DEBUG The ipa-replica-install command
>>>>> failed, exception: RuntimeError: CA configuration failed.
>>>>> 2017-07-27T06:57:54Z ERROR CA configuration failed.
>>>>> 2017-07-27T06:57:54Z ERROR The ipa-replica-install command
>>>>> failed. See /var/log/ipareplica-install.log for more information
>>>>>
>>>>>
_____________________________________________________________________________________________________________
>>>>>
>>>>>
>>>>> On master server:
>>>>>
>>>>> [27/Jul/2017:09:53:19.624201120 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=meTomedea.geo.auth.gr" (medea:389): Replication
bind
>>>>> with GSSAPI auth failed: LDAP error 49 (Invalid credentials) ()
>>>>> [27/Jul/2017:09:53:19.910732845 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=meTomedea.geo.auth.gr" (medea:389): Replication
bind
>>>>> with GSSAPI auth resumed
>>>>> [27/Jul/2017:09:53:21.525459152 +0300] NSMMReplicationPlugin -
>>>>> Beginning total update of replica
>>>>> "agmt="cn=meTomedea.geo.auth.gr" (medea:389)".
>>>>> [27/Jul/2017:09:53:26.923911503 +0300] NSMMReplicationPlugin -
>>>>> Finished total update of replica
"agmt="cn=meTomedea.geo.auth.gr"
>>>>> (medea:389)". Sent 719 entries.
>>>>> [27/Jul/2017:09:53:29.398775963 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=meTomedea.geo.auth.gr" (medea:389): Unable to
acquire
>>>>> replica: permission denied. The bind dn "" does not have
>>>>> permission to supply replication updates to the replica. Will
>>>>> retry later.
>>>>> [27/Jul/2017:09:53:32.746503539 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=meTomedea.geo.auth.gr" (medea:389): Unable to
acquire
>>>>> replica: permission denied. The bind dn "" does not have
>>>>> permission to supply replication updates to the replica. Will
>>>>> retry later.
>>>>> [27/Jul/2017:09:53:38.862288126 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=meTomedea.geo.auth.gr" (medea:389): Unable to
receive
>>>>> the response for a startReplication extended operation to
>>>>> consumer (Can't contact LDAP server). Will retry later.
>>>>> [27/Jul/2017:09:53:51.238616755 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=meTomedea.geo.auth.gr" (medea:389): Replication
bind
>>>>> with GSSAPI auth resumed
>>>>> [27/Jul/2017:09:54:30.937398919 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=meTomedea.geo.auth.gr" (medea:389): Unable to
receive
>>>>> the response for a startReplication extended operation to
>>>>> consumer (Can't contact LDAP server). Will retry later.
>>>>> [27/Jul/2017:09:56:03.537114454 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=meTomedea.geo.auth.gr" (medea:389): Replication
bind
>>>>> with GSSAPI auth resumed
>>>>> [27/Jul/2017:09:56:04.495965497 +0300] NSMMReplicationPlugin -
>>>>> agmt="cn=caTomedea.geo.auth.gr" (medea:389): The remote
replica
>>>>> has a different database generation ID than the local database.
>>>>> You may have to reinitialize the remote replica, or the local
>>>>> replica.
>>>>> [27/Jul/2017:09:56:06.236968406 +0300] NSMMReplicationPlugin -
>>>>> Beginning total update of replica
>>>>> "agmt="cn=caTomedea.geo.auth.gr" (medea:389)".
>>>>> [27/Jul/2017:09:56:10.494727689 +0300] NSMMReplicationPlugin -
>>>>> Finished total update of replica
"agmt="cn=caTomedea.geo.auth.gr"
>>>>> (medea:389)". Sent 159 entries.
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>> To unsubscribe send an email to
>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>
>>>> Hi Petros,
>>>>
>>>> there is no need to add the replica-to-be to the ipaservers
>>>> hostgroup as it will be done automatically during
>>>> ipa-replica-install.
>>>>
>>>> To diagnose the install issue, can you post the logs relevant to
>>>> the CA installation? They are:
>>>> /var/log/pki/pki-ca-spawn.$TIME_OF_INSTALLATION.log
>>>> /var/log/pki/pki-tomcat/catalina.$TIME_OF_INSTALLATION.log
>>>> /var/log/pki/pki-tomcat/ca/system
>>>> /var/log/pki/pki-tomcat/ca/debug
>>>>
>>>> Flo
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email to
>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>
>>> Hi Flo,
>>> Thanks for responding. I attach the files as requested.
>>> /var/log/pki/pki-tomcat/catalina.$TIME_OF_INSTALLATION.log was
>>> empty and therefore excluded.
>>>
>>> Regards,
>>> Petros
>>>
>>>
>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to
>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>
>> Hi,
>>
>> the /var/log/pki-tomcat/ca/debug log shows that the replica Dogtag
>> instance failed to POST
>>
https://fidias.geo.auth.gr:443/ca/admin/ca/updateNumberRange
>>
>> You may find more info on the master's Dogtag log (same file but on
>> the host fidias.geo.auth.gr). The relevant logs would start with
>> UpdateNumberRange: initializing...
>> or
>> CMSServlet:service() uri = /ca/admin/ca/updateNumberRange
>>
>> HTH,
>> Flo
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>
> I am not sure I understand this and how I am supposed to resolve it.
> Indeed, master's apache reports:
> "POST /ca/admin/ca/updateNumberRange HTTP/1.1" 500 5478
>
> while the /var/log/pki-tomcat/ca/debug shows the following:
>
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> CMSServlet:service() uri = /ca/admin/ca/updateNumberRange
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> CMSServlet::service() param name='xmlOutput' value='true'
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> CMSServlet::service() param name='sessionID'
value='1129328291888586443'
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> CMSServlet::service() param name='type' value='request'
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]: CMSServlet:
> caUpdateNumberRange start to service.
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> UpdateNumberRange: processing...
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> UpdateNumberRange process: authentication starts
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]: IP: 155.207.61.84
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]: AuthMgrName:
> TokenAuth
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]: CMSServlet: no
> client certificate found
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> TokenAuthentication: start
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> TokenAuthentication: content={hostname=[155.207.61.84],
> sessionID=[1129328291888586443]}
> [27/Jul/2017:09:56:34][ajp-bio-127.0.0.1-8009-exec-5]:
> ConfigurationUtils: POST
>
https://fidias.geo.auth.gr:443/ca/admin/ca/tokenAuthenticate
>
> What is so obvious that I can't see? Any hint?
>
> Petros
Hi,
I was looking for any error message between
UpdateNumberRange: processing...
and
UpdateNumberRange: Sending response
or
UpdateNumberRange: Failed to update number range
If I recall well, this is related to assigning ranges of serial Ids
for certificates delivered by the replica (each CA instance uses its
own range to avoid delivering certificates with the same serial id on
a master or replica).
Flo
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
Hi again,
Sorry, but I am not sure that I can follow. I can't recognize
anything erroneous related to UpdateNumberRange apart the entries I
listed before. From a previous attempt though, there is also an extra
line which might be helpful:
[26/Jul/2017:12:48:04][ajp-bio-127.0.0.1-8009-exec-11]:
UpdateNumberRange: initializing...
[26/Jul/2017:12:48:04][ajp-bio-127.0.0.1-8009-exec-11]: according to
ccMode, authorization for servlet: caUpdateNumberRange is LDAP based,
not XML {1}, use default authz mgr: {2}.
[26/Jul/2017:12:48:04][ajp-bio-127.0.0.1-8009-exec-11]:
UpdateNumberRange: done initializing...
Petros