it appears your suspician was correct
/var/log/httpd/error_log from the new replica [10.1.132.31]:
[Thu Dec 06 08:17:17.119449 2018] [auth_gssapi:error] [pid 31454] [client
10.1.132.31:43394] Failed to unseal session data!, referer:
https://ef-idm03.production.efilm.com/ipa/xml
[Thu Dec 06 08:17:17.119476 2018] [auth_gssapi:error] [pid 31454] [client
10.1.132.31:43394] NO AUTH DATA Client did not send any authentication headers, referer:
https://ef-idm03.production.efilm.com/ipa/xml
[Thu Dec 06 08:17:17.131578 2018] [wsgi:error] [pid 31446] [remote 10.1.132.31:43394]
mod_wsgi (pid=31446): Failed to exec Python script file
'/usr/share/ipa/wsgi.py'.
[Thu Dec 06 08:17:17.131653 2018] [wsgi:error] [pid 31446] [remote 10.1.132.31:43394]
mod_wsgi (pid=31446): Exception occurred processing WSGI script
'/usr/share/ipa/wsgi.py'.
[Thu Dec 06 08:17:17.131802 2018] [wsgi:error] [pid 31446] [remote 10.1.132.31:43394]
Traceback (most recent call last):
[Thu Dec 06 08:17:17.131848 2018] [wsgi:error] [pid 31446] [remote 10.1.132.31:43394]
File "/usr/share/ipa/wsgi.py", line 26, in <module>
[Thu Dec 06 08:17:17.131855 2018] [wsgi:error] [pid 31446] [remote 10.1.132.31:43394]
from ipaplatform.paths import paths
[Thu Dec 06 08:17:17.131890 2018] [wsgi:error] [pid 31446] [remote 10.1.132.31:43394]
ModuleNotFoundError: No module named 'ipaplatform'
/var/log/httpd/error_log from the first replica:
[Thu Dec 06 08:17:17.138321 2018] [:warn] [pid 14292] [client 10.1.132.31:44768] failed to
set perms (3140) on file (/var/run/ipa/ccaches/grant(a)PRODUCTION.EFILM.COM)!, referer:
https://ef-idm01.production.efilm.com/ipa/xml
[Thu Dec 06 08:17:17.154228 2018] [:error] [pid 13610] ipa: INFO: [jsonserver_session]
grant(a)PRODUCTION.EFILM.COM: ping(): SUCCESS
[Thu Dec 06 08:17:17.165320 2018] [:warn] [pid 14292] [client 10.1.132.31:44768] failed to
set perms (3140) on file (/var/run/ipa/ccaches/grant(a)PRODUCTION.EFILM.COM)!, referer:
https://ef-idm01.production.efilm.com/ipa/xml
[Thu Dec 06 08:17:17.178384 2018] [:error] [pid 13609] ipa: INFO: [jsonserver_session]
grant(a)PRODUCTION.EFILM.COM: command_defaults/1(u'user_add/1',
params=(u'cn',), kw={u'givenname': u'Wiki', u'sn':
u'User22'}, version=u'2.228'): SUCCESS
[Thu Dec 06 08:17:43.935632 2018] [:warn] [pid 14292] [client 10.1.132.31:44768] failed to
set perms (3140) on file (/var/run/ipa/ccaches/grant(a)PRODUCTION.EFILM.COM)!, referer:
https://ef-idm01.production.efilm.com/ipa/xml
[Thu Dec 06 08:17:44.109673 2018] [:error] [pid 13610] ipa: INFO: [jsonserver_session]
grant(a)PRODUCTION.EFILM.COM: user_add/1(u'wikiuser22', givenname=u'Wiki',
sn=u'User22', homedirectory=u'/home/wikiuser22',
loginshell=u'/bin/tcsh', mail=(u'grant.janssen(a)efilm.com',),
userpassword=u'********', gidnumber=1110, version=u'2.228'): SUCCESS
I see an indication of “NO AUTH DATA”, but I can pull a ticket on the replica:
grant@ef-idm03:~[20181206-13:59][#9]$ kinit
Password for grant(a)PRODUCTION.EFILM.COM: ********
grant@ef-idm03:~[20181206-13:59][#10]$ klist
Ticket cache: KEYRING:persistent:555:555
Default principal: grant(a)PRODUCTION.EFILM.COM
Valid starting Expires Service principal
12/06/2018 13:59:56 12/07/2018 13:59:54
krbtgt/PRODUCTION.EFILM.COM(a)PRODUCTION.EFILM.COM
grant@ef-idm03:~[20181206-13:59][#11]$
I found a reference on the mod_wsgi as it relates to IPA.
https://pagure.io/freeipa/issue/7161
The new server is a build vs the older ones upgraded to 4.5 so perhaps I have a library
tug-o-war.
original master:
grant@ef-idm01:~[20181206-14:15][#764]$ ipa --version
VERSION: 4.5.0, API_VERSION: 2.228
grant@ef-idm01:~[20181206-14:15][#765]$ rpm -qa | grep mod_wsgi
mod_wsgi-3.4-12.el7_0.x86_64
grant@ef-idm01:~[20181206-14:15][#766]$
replica:
grant@ef-idm03:~[20181206-14:15][#16]$ ipa --version
VERSION: 4.5.0, API_VERSION: 2.228
grant@ef-idm03:~[20181206-14:15][#17]$ rpm -qa | grep mod_wsgi
python36u-mod_wsgi-4.6.2-1.ius.el7.x86_64
grant@ef-idm03:~[20181206-14:15][#18]$
do you suppose that removing python36u and installing mod_wsgi-3.4-12 would remedy this
issue?
should I manually add the dnarange to idm03?
thank you
- grant
On Dec 6, 2018, at 13:35, Rob Crittenden <rcritten(a)redhat.com>
wrote:
Ok, so this confirms the ipa-replica-manage output. These are the
starting values which means that this server may have never allocated a
user (even though you added one).
If you want to get to the bottom of which master added the user find the
user_add in /var/log/httpd/error_log on one of the masters. I suspect it
was not idm03.
rob
This e-mail and any attachments are intended only for use by the addressee(s) named
herein and may contain confidential information. If you are not the intended recipient of
this e-mail, you are hereby notified any dissemination, distribution or copying of this
email and any attachments is strictly prohibited. If you receive this email in error,
please immediately notify the sender by return email and permanently delete the original,
any copy and any printout thereof. The integrity and security of e-mail cannot be
guaranteed.