Petar Kozić via FreeIPA-users wrote:
I have strange problem on replication server.
I set master server and I generate and set Let's encrypt.
On replica server I do same step but when I try to install pk12 I get
error about invalid credentials.
For private key unlock password I using weak pass which I set in the
proces of generated pk12 in step before.
Directory Manager password is right, because when I do:
ldapsearch -x -D "cn=directory manager" -w mypassword -s base -b ""
"objectclass=*"
I get this, which mean DM pass is ok.
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: objectclass=*
# requesting: ALL
#
.
.
.
.
lastusn: 2382
changeLog: cn=changelog
firstchangenumber: 0
lastchangenumber: 0
ipatopologypluginversion: 1.0
ipatopologyismanaged: on
ipaDomainLevel: 1
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
When I try to install cert:
ipa-server-certinstall -w /path/to/.pk12
I get this error:
ipalib.plugable: DEBUG: importing plugin module ipaserver.plugins.xmlserver
ipapython.admintool: DEBUG: File
"/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 174, in
execute
return_value = self.run()
File
"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
line 110, in run
api.Backend.ldap2.connect(bind_pw=self.options.dirman_password)
File "/usr/lib/python2.7/dist-packages/ipalib/backend.py", line 69, in
connect
conn = self.create_connection(*args, **kw)
File "/usr/lib/python2.7/dist-packages/ipaserver/plugins/ldap2.py",
line 175, in create_connection
client_controls=clientctrls)
File "/usr/lib/python2.7/dist-packages/ipapython/ipaldap.py", line
1142, in simple_bind
bind_dn, bind_password, server_controls, client_controls)
File "/usr/lib/python2.7/contextlib.py", line 35, in __exit__
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/dist-packages/ipapython/ipaldap.py", line
1030, in error_handler
raise errors.ACIError(info="%s %s" % (info, desc))
ipapython.admintool: DEBUG: The ipa-server-certinstall command failed,
exception: ACIError: Insufficient access: Invalid credentials
ipapython.admintool: ERROR: Insufficient access: Invalid credentials
ipapython.admintool: ERROR: The ipa-server-certinstall command failed.
I'm guessing that you're running 4.6.something...
I don't have a 4.6 install handy but my 4.7+ it prompts for DM and then
the pin for the PKCS#12 file.
Hard to say other than you typed the DM password in wrong. It is just
doing a simple bind here. You might check the 389-ds access log to see
what it logged but it's likely something like:
[27/Dec/2019:21:25:19.929737344 -0500] conn=133590 op=0 BIND
dn="cn=directory manager" method=128 version=3
[27/Dec/2019:21:25:19.951792182 -0500] conn=133590 op=0 RESULT err=49
tag=97 nentries=0 etime=0.0022220750 - Invalid credentials
[27/Dec/2019:21:25:19.998492817 -0500] conn=133590 op=1 UNBIND
Which is bad password.
Note that the log is buffered so you may have to wait a bit for the log
msg to appear.
rob