On Wed, Sep 04, 2019 at 03:08:30PM -0000, David Etchen via FreeIPA-users wrote:
Hi Fraser,
Thanks for replying.
I've restarted both sides like you suggested but still don't see a difference. I
can see the back off time has started again like you said.
[04/Sep/2019:15:20:12][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Failed
to retrieve key from any host.
[04/Sep/2019:15:20:12][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]:
KeyRetriever did not return a result.
[04/Sep/2019:15:20:12][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Retrying
in 15 seconds
[04/Sep/2019:15:20:27][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Running
ExternalProcessKeyRetriever
[04/Sep/2019:15:20:27][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: About to
execute command: [/usr/libexec/ipa/ipa-pki-retrieve-key, caSigningCert cert-pki-ca
dd4ea812-c044-41c0-93bf-ec376c732c93,
man-fb-ipa-01.testhost.com]
[04/Sep/2019:15:20:28][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Failed
to retrieve key from any host.
[04/Sep/2019:15:20:28][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]:
KeyRetriever did not return a result.
[04/Sep/2019:15:20:28][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Retrying
in 22 seconds
As I posted later running the command manually works and I get a reponse containing what
looks like a JSON response with certificate and wrapped_key attributeswhich corespond to
the subCA. I did have to do kinit first as I wasn't logged in with an IPA user.
I'm now puzzled as to why dogtag doesn't seem to get the response. Do you know
how I could emulate running the command as dogtag to see if it's something to do with
kerberos or something like that.
I had a quick look in the audit log just to check it wasn't selinux related but
can't find anything.
Just did some further testing, if I run the command manually I can see my traffic in
tcpdump connecting on port 443 to the master however when dogtag is supposidly running the
scripts I don't see any connection attempts. So it looks like the script isn't
actually running at least to the point where it tries to talk to the master anyway.
I dived off down the rabbit hole and thought maybe DNS isn't working for dogtag so
added an entry to /etc/hosts for the master IPA server but this didn't make any
difference.
For good measure I've disabled selinux. I'm now looking to see if I can crank up
the logging output from dogtag to see if there is anything extra it's saying.
Any ideas welcome.
Thanks
Dave
Try running:
sudo -u pkiuser /usr/libexec/ipa/ipa-pki-retrieve-key \
"caSigningCert cert-pki-ca dd4ea812-c044-41c0-93bf-ec376c732c93" \
man-fb-ipa-01.testhost.com
to run the command as pkiuser would run it.
What OS and version are you running on? There was a recent bug on
Fedora 30 with similar symptoms to what you are describing (see
https://pagure.io/freeipa/issue/7964 for details).
Cheers,
Fraser