On 2/22/19 12:14 AM, Kat via FreeIPA-users wrote:
Hi all -
Trying to add a new replica and client install is fine, but replica
install goes all along until it hits:
Configuring ipa-custodia
[1/4]: Generating ipa-custodia config file
[2/4]: Generating ipa-custodia keys
[3/4]: starting ipa-custodia
[4/4]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR 406 Client Error: Failed to validate
message: No recipient matched the provided key["Failed:
[ValueError('Decryption failed.',)]"]
ipapython.admintool: ERROR The ipa-replica-install command failed.
See /var/log/ipareplica-install.log for more information
If I check in the custodia-log on the master it is replicating from I see:
2019-02-21 17:59:25 - SimpleCredsAuth-[auth:simple] - PASS: '22565'
authenticated as '48, 48'
2019-02-21 17:59:25 - SimpleHeaderAuth-[auth:header] - PASS: '22565'
authenticated as '(null)'
2019-02-21 17:59:25 - IPAKEMKeys-[authz:kemkeys] - PASS: '22565'
authorized for '/keys'
2019-02-21 17:59:25 - Secrets-[/keys] - DENIED:
'(null)' requested key 'ca/caSigningCert cert-pki-ca'
Any thoughts?
I don't have a lot of knowledge re. custodia, but the recent versions of
IPA include a fix in ipa-server-upgrade that checks if any keys are
missing and re-creates them (please see
https://pagure.io/freeipa/issue/6893).
HTH,
flo
thanks
K
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...