Hi,
I've created a new IPA replica.
ipa-replica-install has completed successfully.
ipa-ca-install has completed successfully as well.
However, ipa-kra-install fails.
In the terminal the fails right here:
Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes
[1/11]: creating ACIs for admin
[2/11]: creating installation admin user
[3/11]: configuring KRA instance
Failed to configure KRA instance: Command '/usr/sbin/pkispawn -s KRA -f
/tmp/tmp0w3vD5' returned non-zero exit status 1
See the installation logs and the following files/directories for more information:
/var/log/pki/pki-tomcat
[error] RuntimeError: KRA configuration failed.
This is in /var/log/pki/pki-tomcat/kra/debug:
[12/Sep/2019:15:58:34][http-bio-8443-exec-1]: === Subsystem Configuration ===
[12/Sep/2019:15:58:34][http-bio-8443-exec-1]: SystemConfigService: validate clone URI:
https://t-idm-nbg2-1.poc.customer.de:443
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: SystemConfigService: get configuration
entries from master
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange start
host=t-idm-nbg2-1.poc.customer.de adminPort=443 eePort=443
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange content:
{xmlOutput=[true], sessionID=[5319570421915120898], type=[request]}
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: ConfigurationUtils: POST
https://t-idm-nbg2-1.poc.customer.de:443/kra/admin/kra/updateNumberRange
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: Server certificate:
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: - subject:
CN=t-idm-nbg2-1.poc.customer.de,O=poc.customer.de
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: - issuer: CN=Certificate
Authority,O=poc.customer.de
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: content from admin interface =<?xml
version="1.0" encoding="UTF-8"
standalone="no"?><XMLResponse><Status>1</Status><Error>Error:
Failed to update number range.</Error></XMLResponse>
[12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange(): status=1
java.io.IOException: Error: Failed to update number range.
I must note that in this environment there were a lot of redeployments of IPA servers,
replicating from one another, deleting the original masters etc.
And right now I have about 10 IPA servers running, out of them 2 with working KRA (this
was supposed to be the 3rd one).
I found a similar issue with an explanation how the number ranges can get depleted, but I
am not sure how I can manually resolve this (without killing the entire environment of
course):
https://pagure.io/freeipa/issue/7654
Could you guide me in the right direction please?
ipa-server 4.6.4...
---
Regards,
Dmitry Perets