From ipaupgrade.log, the CA isn't coming up?
2018-06-06T01:05:40Z DEBUG wait_for_open_ports: localhost [8080, 8443]
timeout 300
2018-06-06T01:05:40Z DEBUG waiting for port: 8080
2018-06-06T01:05:40Z DEBUG Failed to connect to port 8080 tcp on ::1
2018-06-06T01:05:40Z DEBUG Failed to connect to port 8080 tcp on 127.0.0.1
2018-06-06T01:05:41Z DEBUG SUCCESS: port: 8080
2018-06-06T01:05:41Z DEBUG waiting for port: 8443
2018-06-06T01:05:41Z DEBUG Failed to connect to port 8443 tcp on ::1
2018-06-06T01:05:41Z DEBUG Failed to connect to port 8443 tcp on 127.0.0.1
2018-06-06T01:05:42Z DEBUG SUCCESS: port: 8443
2018-06-06T01:05:42Z DEBUG Waiting until the CA is running
2018-06-06T01:05:42Z DEBUG request POST
http://vmpr-linuxidm.unix.company.com:8080/ca/admin/ca/getStatus
2018-06-06T01:05:42Z DEBUG request body ''
2018-06-06T01:05:46Z DEBUG response status 500
2018-06-06T01:05:46Z DEBUG response headers Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Language: en
Content-Length: 2208
Date: Wed, 06 Jun 2018 01:05:46 GMT
Connection: close
2018-06-06T01:05:46Z DEBUG response body '<html><head><title>Apache
Tomcat/7.0.76 - Error report</title><style><!--H1
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
H2
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;}
H3
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;}
BODY
{font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;}
P
{font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A
{color : black;}A.name {color : black;}HR {color : #525D76;}--></style>
</head><body><h1>HTTP Status 500 - Subsystem
unavailable</h1><HR size="1"
noshade="noshade"><p><b>type</b> Exception
report</p><p><b>message</b>
<u>Subsystem unavailable</u></p><p><b>description</b>
<u>The server
encountered an internal error that prevented it from fulfilling this
request.</u></p><p><b>exception</b>
<pre>javax.ws.rs.ServiceUnavailableException: Subsystem
unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:500)\n\torg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)\n\torg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087)\n\torg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.java:748)\n</pre></p><p><b>note</b>
<u>The full stack trace of the root cause is available in the Apache
Tomcat/7.0.76 logs.</u></p><HR size="1"
noshade="noshade"><h3>Apache
Tomcat/7.0.76</h3></body></html>'
2018-06-06T01:05:46Z DEBUG The CA status is: check interrupted due to
error: Retrieving CA status failed with status 500
2018-06-06T01:05:46Z DEBUG Waiting for CA to start...
2018-06-06T01:05:47Z DEBUG request POST
http://vmpr-linuxidm.unix.company.com:8080/ca/admin/ca/getStatus
2018-06-06T01:05:47Z DEBUG request body ''
2018-06-06T01:05:47Z DEBUG response status 500
2018-06-06T01:05:47Z DEBUG response headers Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Language: en
Content-Length: 2208
Date: Wed, 06 Jun 2018 01:05:47 GMT
Connection: close
I found some old bugs that don't seem to apply, like this one
https://bugzilla.redhat.com/show_bug.cgi?id=1318616
and some that do
https://pagure.io/freeipa/issue/6766
Doesn't actually fix the problem that my users can't login :/
Gah, I thought this had been fixed - it was in my upgrade of the dev server
L.
------
"The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics
is the insistence that we cannot ignore the truth, nor should we panic
about it. It is a shared consciousness that our institutions have failed
and our ecosystem is collapsing, yet we are still here — and we are
creative agents who can shape our destinies. Apocalyptic civics is the
conviction that the only way out is through, and the only way through is
together. "
*Greg Bloom* @greggish
https://twitter.com/greggish/status/873177525903609857