Dear all,
we are trying to upgrade our IPA 4.4 to current 4.6.
So we did a "yum update" and then a "ipa-server-upgrade" which
miserably failes with:
ipaserver.install.server.upgrade: INFO: [Migrating certificate profiles
to LDAP]
ipalib.backend: DEBUG: Created connection context.ldap2_140564957536912
ipapython.ipaldap: DEBUG: flushing
ldapi://%2fvar%2frun%2fslapd-PLEIADES-UNI-WUPPERTAL-DE.socket from
SchemaCache
ipapython.ipaldap: DEBUG: retrieving schema for SchemaCache
url=ldapi://%2fvar%2frun%2fslapd-PLEIADES-UNI-WUPPERTAL-DE.socket
conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fd7d5efe7a0>
ipalib.backend: DEBUG: Destroyed connection context.ldap2_140564957536912
ipapython.dogtag: DEBUG: request GET
https://ipa2.pleiades.uni-wuppertal.de:8443/ca/rest/account/login
ipapython.dogtag: DEBUG: request body ''
ipapython.dogtag: DEBUG: response status 401
ipapython.dogtag: DEBUG: response headers Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Thu, 01 Jan 1970 01:00:00 CET
WWW-Authenticate: Basic realm="Certificate Authority"
Content-Type: text/html;charset=utf-8
Content-Language: en
Content-Length: 951
Date: Tue, 12 Feb 2019 10:48:51 GMT
ipapython.dogtag: DEBUG: response body '<html><head><title>Apache
Tomcat/7.0.76 - Error report</title><style><!--H1
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
H2
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;}
H3
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;}
BODY
{font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;}
P
{font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A
{color : black;}A.name {color : black;}HR {color : #525D76;}--></style>
</head><body><h1>HTTP Status 401 - </h1><HR size="1"
noshade="noshade"><p><b>type</b> Status
report</p><p><b>message</b>
<u></u></p><p><b>description</b> <u>This request
requires HTTP
authentication.</u></p><HR size="1"
noshade="noshade"><h3>Apache
Tomcat/7.0.76</h3></body></html>'
ipaserver.install.ipa_server_upgrade: ERROR: IPA server upgrade failed:
Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
ipapython.admintool: DEBUG: File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in
execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 54, in run
server.upgrade()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 2085, in upgrade
upgrade_configuration()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1952, in upgrade_configuration
ca_enable_ldap_profile_subsystem(ca)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 396, in ca_enable_ldap_profile_subsystem
cainstance.migrate_profiles_to_ldap()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1814, in migrate_profiles_to_ldap
_create_dogtag_profile(profile_id, profile_data, overwrite=False)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1820, in _create_dogtag_profile
with api.Backend.ra_certprofile as profile_api:
File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py",
line 1302, in __enter__
raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to
CA REST API'))
ipapython.admintool: DEBUG: The ipa-server-upgrade command failed,
exception: RemoteRetrieveError: Failed to authenticate to CA REST API
ipapython.admintool: ERROR: Unexpected error - see
/var/log/ipaupgrade.log for details:
RemoteRetrieveError: Failed to authenticate to CA REST API
ipapython.admintool: ERROR: The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
Unfortunately, we couldn't find anything useful in the pki-tomcat log.
Of course you see the 404:
[root@ipa2 pki-tomcat]# tail catalina.2019-02-12.log
Feb 12, 2019 11:48:16 AM com.netscape.cms.tomcat.PKIListener lifecycleEvent
INFO: PKIListener: org.apache.catalina.core.StandardServer [after_start]
Feb 12, 2019 11:48:16 AM com.netscape.cms.tomcat.PKIListener
verifySubsystems
INFO: PKIListener: Subsystem CA is running.
Feb 12, 2019 11:48:16 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 10810 ms
Feb 12, 2019 11:48:51 AM
com.netscape.cms.tomcat.AbstractPKIAuthenticator doAuthenticate
INFO: PKIAuthenticator: Authenticate with client certificate authentication
Feb 12, 2019 11:48:51 AM
com.netscape.cms.tomcat.AbstractPKIAuthenticator doAuthenticate
INFO: PKIAuthenticator: Result: false
[root@ipa2 pki-tomcat]# tail localhost_access_log.2019-02-12.txt
IP - - [12/Feb/2019:11:37:14 +0100] "GET /ca/rest/account/login
HTTP/1.1" 401 951
IP - - [12/Feb/2019:11:39:48 +0100] "POST /ca/admin/ca/getStatus
HTTP/1.1" 200 167
IP - - [12/Feb/2019:11:39:48 +0100] "POST /ca/admin/ca/getStatus
HTTP/1.1" 200 167
IP - - [12/Feb/2019:11:40:20 +0100] "GET /ca/rest/account/login
HTTP/1.1" 401 951
IP - - [12/Feb/2019:11:45:21 +0100] "POST /ca/admin/ca/getStatus
HTTP/1.1" 200 167
IP - - [12/Feb/2019:11:46:04 +0100] "POST /ca/admin/ca/getStatus
HTTP/1.1" 200 167
IP - - [12/Feb/2019:11:47:58 +0100] "POST /ca/admin/ca/getStatus
HTTP/1.1" 200 167
IP - - [12/Feb/2019:11:48:16 +0100] "POST /ca/admin/ca/getStatus
HTTP/1.1" 200 167
IP - - [12/Feb/2019:11:48:17 +0100] "POST /ca/admin/ca/getStatus
HTTP/1.1" 200 167
IP - - [12/Feb/2019:11:48:51 +0100] "GET /ca/rest/account/login
HTTP/1.1" 401 951
Any ideas would be (again) much appreciated!
Thanks a lot
Torsten
--
Dr. Torsten Harenberg harenberg(a)physik.uni-wuppertal.de
Bergische Universitaet
Fakultät 4 - Physik Tel.: +49 (0)202 439-3521
Gaussstr. 20 Fax : +49 (0)202 439-2811
42097 Wuppertal