On 12/6/18 8:59 AM, 74cmonty via FreeIPA-users wrote:
Well, then I will repeat the context...
After completing FreeIPA master (vm200; 192.168.100.200) installation I started setup of
replica (vm201; 192.168.100.201).
This means I first enrolled the replica server as a client successfully and then executed
this command:
ipa-replica-install
The installation log reports this error:
Full PKINIT configuration did not succeed
The setup will only install bits essential to the server functionality
You can enable PKINIT after the setup completed using 'ipa-pkinit-manage'
Is this an error or normal behavior of replica installation?
Hi,
1. Error message during ipa-replica-install
it is an error that was tracked in pagure ticket 7655: PKINIT
configuration fails while promoting a replica using IPA 4.7.0 [1]
In short, the replica is trying to contact itself in order to get a new
KDC cert, while it should contact the master instead. The fix is
delivered in IPA 4.7.1 and 4.7.2.
Without the fix, a KDC cert is installed but it is self-signed (issuer
shows the replica name instead of IPA CA).
2. running ipa-pkinit-manage enable afterwards:
the command reports success but does not properly replace the
self-signed KDC cert with a IPA-CA-signed KDC cert. This is tracked in
pagure ticket 7200 ipa-pkinit-manage reports a switch from local pkinit
to full pkinit configuration was successful although it was not. [2]
3. deletion of the KDC cert + re-run ipa-pkinit-manage:
Here you are seeing an error CA_UNREACHABLE, certificate issuance
failed. This is the part that needs to be investigated.
In this step, the command ipa-pkinit-manage enable contacts certmonger
in order to get a new cert. The error message shows connection to the
replica itself, but certmonger should have contacted the master as the
replica does not have any CA instance. I think this is a bug, as we can
see in ipaserver/install/krbinstance.py:
if use_dogtag_submit:
ca_args = [
paths.CERTMONGER_DOGTAG_SUBMIT,
'--ee-url', 'https://%s:8443/ca/ee/ca' % self.fqdn,
'--certfile', paths.RA_AGENT_PEM,
'--keyfile', paths.RA_AGENT_KEY,
'--cafile', paths.IPA_CA_CRT,
'--agent-submit'
The code is always connecting locally (self.fqdn) but it should check on
which host the CA is deployed.
Could you please open an issue (
https://pagure.io/freeipa/new_issue)?
Thanks,
flo
[1]
https://pagure.io/freeipa/issue/7655
[2]
https://pagure.io/freeipa/issue/7200
This is the full installation output in the console:
Configuring certificate server (pki-tomcatd)
[1/2]: configure certmonger for renewals
[2/2]: Importing RA key
Done configuring certificate server (pki-tomcatd).
Configuring Kerberos KDC (krb5kdc)
[1/1]: installing X509 Certificate for PKINIT
Full PKINIT configuration did not succeed
The setup will only install bits essential to the server functionality
You can enable PKINIT after the setup completed using 'ipa-pkinit-manage'
Done configuring Kerberos KDC (krb5kdc).
Applying LDAP updates
Upgrading IPA:. Estimated time: 1 minute 30 seconds
[1/10]: stopping directory server
[2/10]: saving configuration
[3/10]: disabling listeners
[4/10]: enabling DS global lock
[5/10]: disabling Schema Compat
[6/10]: starting directory server
[7/10]: upgrading server
[8/10]: stopping directory server
[9/10]: restoring configuration
[10/10]: starting directory server
Done.
Finalize replication settings
Restarting the KDC
And this is the output of getcert list -f /var/kerberos/krb5kdc/kdc.crt:
[root@ipa-replica ~]# getcert list -f /var/kerberos/krb5kdc/kdc.crt
Number of certificates and requests being tracked: 4.
Request ID '20181206075804':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: SelfSign
issuer: CN=ipa-replica.biszumbitterenen.de,O=BISZUMBITTERENEN.DE
subject: CN=ipa-replica.biszumbitterenen.de,O=BISZUMBITTERENEN.DE
expires: 2019-12-06 08:58:04 CET
principal name: krbtgt/BISZUMBITTERENEN.DE(a)BISZUMBITTERENEN.DE
certificate template/profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...