On Thu, Sep 05, 2019 at 10:12:10AM -0000, David Etchen via FreeIPA-users wrote:
Ahh of course sudo I was trying su.
I'm on Centos 7.6 running freeipa 4.6.4 all from the standard yum packages.
It does look to be the exact same issue as you posted about Fedora 30.
Thanks. I will need to investigate this. Maybe it was triggered by
an update of some other package...
This means that anyone running Centos 7.6 / RHEL 7.6 will be
affected by this. (See below)
As a work around if I manually imported the cert into nssdb
/etc/pki/pki-tomcat/alias would dogtag kick into life or is there
more than this required? I only ask out of interest as I'm going
to rebuild this current setup on RHEL 8 which is running IPA 4.7.1
which from what I can tell already includes the fix for this.
You need not only the certificate but also the signing key. Use
pk12util to export the cert and key from the one NSSDB, and import
into the other **with the same nickname**.
Cheers,
Fraser
> Thanks for your help on this.
> Dave
>
> The output from running comes out as
> [root@man-fb-ipa-02 ~]# sudo -u pkiuser /usr/libexec/ipa/ipa-pki-retrieve-key
"caSigningCert cert-pki-ca dd4ea812-c044-41c0-93bf-ec376c732c93"
man-fb-ipa-01.testhost.com
> Traceback (most recent call last):
> File "/usr/libexec/ipa/ipa-pki-retrieve-key", line 39, in <module>
> main()
> File "/usr/libexec/ipa/ipa-pki-retrieve-key", line 30, in main
> keyfile=client_keyfile, keytab=client_keytab,
> File "/usr/lib/python2.7/site-packages/ipaserver/secrets/client.py", line
64, in __init__
> self.kemcli = KEMClient(self._server_keys(server, realm),
> File "/usr/lib/python2.7/site-packages/ipaserver/secrets/client.py", line
27, in _server_keys
> sk = JWK(**json_decode(self.ikk.find_key(principal, KEY_USAGE_SIG)))
> File "/usr/lib/python2.7/site-packages/ipaserver/secrets/kem.py", line
225, in find_key
> return conn.get_key(usage, kid)
> File "/usr/lib/python2.7/site-packages/ipaserver/secrets/kem.py", line
71, in get_key
> conn = self.connect()
> File "/usr/lib/python2.7/site-packages/ipaserver/secrets/common.py", line
40, in connect
> conn.sasl_interactive_bind_s('', auth_tokens)
> File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 229,
in sasl_interactive_bind_s
> return
self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)
> File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 99, in
_ldap_call
> result = func(*args,**kwargs)
> LOCAL_ERROR: {'info': 'SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials
available (default cache: KEYRING:persistent:17))', 'desc': 'Local
error'}
>
> I also get the ca-show failure.
> [root@man-fb-ipa-02 ~]# ipa ca-show vpn
> ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500.