FreeIPA-users April 2024

freeipa-users@lists.fedorahosted.org

33 participants
56 discussions

Re: upgrade idm servers rhel 7 to 8 problems
by Natxo Asenjo 04 Apr '24

04 Apr '24

hi, posting back to the list. Apparently the idm server cannot find a SID of a domain when trying to resolve the user account. It does find the user account, but there are sids coupled to the account correspondig to a domain wich cannot be resolved. It took me a while but the sid of that child domain is not the one not resolved. It turns out, the sid of the domain not resolving is the one of the idm realm itself., we have some idm groups mapped to the AD groups we allow in idm for rbac, and if I look at the ipaNTSecurityIdentifier attributes of the id groups, those are the not resolved groups. This is unexpected (to me at least). so we have this trust (verified on two different idm servers, same value): ipa trust-find --------------- 1 trust matched --------------- Realm name: domain.local Domain NetBIOS name: DOMAIN Domain Security Identifier: S-1-5-21-1416133915-1866970209-3316290679 Trust type: Active Directory domain ---------------------------- Number of entries returned 1 but inside this idm domain, we have some idm posix groups with the ipantsecurityidentifier of the not resolvable domain, for instance: S-1-5-21-1214650608-3976977395-3073169311-101072 So basically, it is not matching because of this ipantsecurityidentifier, I think. I do not know how to fix this at this moment, or why it has happened. Any ideas?

2 3

CA_UNREACHABLE when requesting from Ubuntu 20.04 to FreeIPA v4.11.1
by Djerk Geurts 03 Apr '24

03 Apr '24

Hi, A month or so ago we upgraded from Fedora 37 to 39. I guess this is the first time I’m getting round to requesting a new certificate, and it’s failing from a server we use to manage several certificates for non-IPA client hosts. Output of ipa-getcert list: Request ID '20240402190326': status: CA_UNREACHABLE ca-error: Server at https://ipa.domain.com/ipa/xml failed request, will retry: 903 (RPC failed at server. an internal error has occurred). stuck: no key pair storage: type=FILE,location='/etc/ssl/private/host.domain.com.key' certificate: type=FILE,location='/etc/ssl/certs/host.domain.com.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes The httpd log on the IPA server: [Tue Apr 02 21:03:26.989287 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ipa: ERROR: non-public: ValueError: Only single-valued attributes are supported [Tue Apr 02 21:03:26.989320 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] Traceback (most recent call last): [Tue Apr 02 21:03:26.989326 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipaserver/rpcserver.py", line 417, in wsgi_execute [Tue Apr 02 21:03:26.989330 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] result = command(*args, **options) [Tue Apr 02 21:03:26.989333 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^^^^^^^^^^^^ [Tue Apr 02 21:03:26.989337 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipalib/frontend.py", line 471, in __call__ [Tue Apr 02 21:03:26.989341 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] return self.__do_call(*args, **options) [Tue Apr 02 21:03:26.989345 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Tue Apr 02 21:03:26.989348 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipalib/frontend.py", line 499, in __do_call [Tue Apr 02 21:03:26.989353 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ret = self.run(*args, **options) [Tue Apr 02 21:03:26.989358 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^^^^^^^^^^^^^ [Tue Apr 02 21:03:26.989371 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipalib/frontend.py", line 816, in run [Tue Apr 02 21:03:26.989376 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] return self.execute(*args, **options) [Tue Apr 02 21:03:26.989381 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Tue Apr 02 21:03:26.989385 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] File "/usr/lib/python3.12/site-packages/ipaserver/plugins/cert.py", line 716, in execute [Tue Apr 02 21:03:26.989389 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ext_san = csr.extensions.get_extension_for_oid( [Tue Apr 02 21:03:26.989392 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ^^^^^^^^^^^^^^ [Tue Apr 02 21:03:26.989396 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ValueError: Only single-valued attributes are supported [Tue Apr 02 21:03:26.989527 2024] [wsgi:error] [pid 1606:tid 1957] [remote 10.2.0.92:50078] ipa: INFO: [xmlserver] host/jump.domain.com(a)DOMAIN.COM: cert_request(‘MIID**********d1A==', principal='HTTP/host.domain.com(a)DOMAIN.COM', add=True, version='2.51'): InternalError The requesting machine is allowed to manage both the host and the service. Requesting the certificate on the IPA server itself works fine. I’ve read elsewhere that this could be an incompatibility between the client and the server. Client: Ubuntu 20.04 LTS, ipa-client: v4.8.6 Server: Fedora 39, ipa-server: v4.11.1 Thanks, Djerk Geurts

3 7

Client install fails with: "Joining realm failed: JSON-RPC call failed: Timeout was reached"
by slek kus 03 Apr '24

03 Apr '24

Hi, not sure what might be an issue. Clients in the same network join just fine. The failing client is on another network. The following ports have been allowed: 53, 389, 636, 88, 464 Saw a list somewhere, mentioning 123, 80 and 443. Are these porst nessecary for the client/idm communication?

3 3

ACME certs fail to renew
by Antoine Gatineau 02 Apr '24

02 Apr '24

Hello, I have a strange issue regarding acme service. My acme certificates fail to renew. `ipa-acme-manage status`fails with error: Failed to authenticate to CA REST API The ipa-acme-manage command failed. certbot client fails with error "Failed to renew certificate office.empire.lan with error: <Response [404]>" $ ipa cert-show 49 Issuing CA: ipa Certificate: "The certificate content" Subject: CN=office.empire.lan Subject DNS name: office.empire.lan Issuer: CN=Certificate Authority,O=EMPIRE.LAN Not Before: Sun Dec 24 14:05:50 2023 UTC Not After: Sat Mar 23 14:05:50 2024 UTC Serial number: 49 Serial number (hex): 0x31 Revoked: False So last successful renewal was on Dec 24th. Since then I have not really done anything appart updating. I don't see any issue in ipaupgrade.log I am running on centos stream 9 idm-jss.x86_64 5.5.0-1.el9 idm-jss-tomcat.x86_64 5.5.0-1.el9 idm-ldapjdk.noarch 5.5.0-1.el9 idm-pki-acme.noarch 11.5.0-1.el9 idm-pki-base.noarch 11.5.0-1.el9 idm-pki-ca.noarch 11.5.0-1.el9 idm-pki-java.noarch 11.5.0-1.el9 idm-pki-kra.noarch 11.5.0-1.el9 idm-pki-server.noarch 11.5.0-1.el9 idm-pki-tools.x86_64 11.5.0-1.el9 ipa-client.x86_64 4.11.0-9.el9 ipa-client-common.noarch 4.11.0-9.el9 ipa-common.noarch 4.11.0-9.el9 ipa-healthcheck.noarch 0.16-2.el9 ipa-healthcheck-core.noarch 0.16-2.el9 ipa-selinux.noarch 4.11.0-9.el9 ipa-server.x86_64 4.11.0-9.el9 ipa-server-common.noarch 4.11.0-9.el9 ipa-server-dns.noarch 4.11.0-9.el9 I have followed closely the update on centos stream 9 Running `ipa-acme-manage status` with the -d switch gives me ipapython.ipaldap: DEBUG: retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-EMPIRE-LAN.socket conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f123c07e2e0> ipaserver.masters: DEBUG: Discovery: available servers for service 'CA' are ipa-server-01.empire.lan, ipa-server-02.empire.lan ipaserver.masters: DEBUG: Discovery: using ipa-server-01.empire.lan for 'CA' service ipapython.dogtag: DEBUG: request POST https://ipa-server-01.empire.lan:8443/acme/login ipapython.dogtag: DEBUG: request body '' ipapython.dogtag: DEBUG: response status 404 ipapython.dogtag: DEBUG: response headers Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 765 Date: Thu, 28 Mar 2024 10:00:59 GMT ipapython.dogtag: DEBUG: response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 404 \xe2\x80\x93 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 \xe2\x80\x93 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/acme/login] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.62</h3></body></html>' ipapython.admintool: DEBUG: File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", line 403, in run with state as ca_api: File "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", line 103, in __enter__ raise errors.RemoteRetrieveError( ipapython.admintool: DEBUG: The ipa-acme-manage command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API ipapython.admintool: ERROR: Failed to authenticate to CA REST API ipapython.admintool: ERROR: The ipa-acme-manage command failed. So it looks like the acme subsystem is not started. But logs for the acme subsystem in /var/log/pki/pki-tomcat/acme/debug.2024-03-28.log don't show any issue. (see attached log) How can I go further in troubleshooting/fixing this issue? Thanks

2 3

IPA replica installation failed-SEVERE: Unable to start CA engine: Selftest failed: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024
by Polavarapu Manideep Sai 01 Apr '24

01 Apr '24

Hi Team, Any one faced this issue during replica installation I have third party SSL certificate installed on master server IPA Version: [root@dir02-mex ~]# ipa --version VERSION: 4.10.2, API_VERSION: 2.252 Certificate Expiry: [root@dir02-mex ~]# certutil -L -d /etc/pki/pki-tomcat/alias/ -n 'Server-Cert cert-pki-ca' | egrep -i 'befor|after' Not Before: Mon Apr 01 09:41:49 2024 Not After : Sun Mar 22 09:41:49 2026 [1/4]: Generating ipa-custodia config file [2/4]: Generating ipa-custodia keys [3/4]: starting ipa-custodia [4/4]: configuring ipa-custodia to start on boot Done configuring ipa-custodia. Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/30]: creating certificate server db [2/30]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 12 seconds elapsed Update succeeded [3/30]: creating ACIs for admin [4/30]: creating installation admin user [5/30]: configuring certificate server instance Failed to configure CA instance See the installation logs and the following files/directories for more information: /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. CA configuration failed. The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information Cat /var/log/ipareplica-install.log: DEBUG: https://dir02-mexommx.ipa.com:8443 "GET / HTTP/1.1" 302 0 DEBUG: https://dir02-mexommx.ipa.com:8443 "GET /pki HTTP/1.1" 302 None DEBUG: https://dir02-mexommx.ipa.com:8443 "GET /pki/ HTTP/1.1" 200 3500 INFO: PKI server started INFO: Waiting for CA subsystem DEBUG: Starting new HTTPS connection (1): dir02-mexommx.ipa.com:8443 DEBUG: https://dir02-mexommx.ipa.com:8443 "GET /ca/admin/ca/getStatus HTTP/1.1" 404 784 2024-04-01T09:41:34Z CRITICAL Failed to configure CA instance 2024-04-01T09:41:34Z CRITICAL See the installation logs and the following files/directories for more information: 2024-04-01T09:41:34Z CRITICAL /var/log/pki/pki-tomcat 2024-04-01T09:41:34Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", line 651, in __spawn_instance DogtagInstance.spawn_instance( File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 604, in handle_setup_error raise RuntimeError( RuntimeError: CA configuration failed. 2024-04-01T09:41:34Z DEBUG [error] RuntimeError: CA configuration failed. 2024-04-01T09:41:34Z DEBUG Removing /root/.dogtag/pki-tomcat/ca 2024-04-01T09:41:34Z DEBUG File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.9/site-packages/ipapython/install/cli.py", line 344, in run return cfgr.run() File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 435, in __runner exc_handler(exc_info) File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise raise value File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 425, in __runner step() File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 419, in step_next return next(self.__gen) File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise raise value File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 663, in _configure next(executor) File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 435, in __runner exc_handler(exc_info) File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 526, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise raise value File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 523, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise raise value File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 425, in __runner step() File "/usr/lib/python3.9/site-packages/ipapython/install/core.py", line 419, in step_next return next(self.__gen) File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.9/site-packages/six.py", line 709, in reraise raise value File "/usr/lib/python3.9/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.9/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.9/site-packages/ipaserver/install/server/__init__.py", line 599, in main replica_install(self) File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated func(installer) File "/usr/lib/python3.9/site-packages/ipaserver/install/server/replicainstall.py", line 1345, in install ca.install(False, config, options, custodia=custodia) File "/usr/lib/python3.9/site-packages/ipaserver/install/ca.py", line 354, in install install_step_0(standalone, replica_config, options, custodia=custodia) File "/usr/lib/python3.9/site-packages/ipaserver/install/ca.py", line 422, in install_step_0 ca.configure_instance( File "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", line 506, in configure_instance self.start_creation(runtime=runtime) File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.9/site-packages/ipaserver/install/cainstance.py", line 651, in __spawn_instance DogtagInstance.spawn_instance( File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 604, in handle_setup_error raise RuntimeError( 2024-04-01T09:41:34Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: CA configuration failed. 2024-04-01T09:41:34Z ERROR CA configuration failed. 2024-04-01T09:41:34Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information Cat /var/log/pki/pki-tomcat/ca/debug.2024-04-01.log 2024-04-01 03:41:32 [main] INFO: CMSEngine: Disabling CA subsystem 2024-04-01 03:41:32 [main] SEVERE: Unable to start CA engine: Selftest failed: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024 Selftest failed: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024 at com.netscape.cmscore.selftests.SelfTestSubsystem.startup(SelfTestSubsystem.java:1759) at com.netscape.cmscore.apps.CMSEngine.startupSubsystems(CMSEngine.java:1167) at org.dogtagpki.server.ca.CAEngine.startupSubsystems(CAEngine.java:972) 2024-04-01 03:41:32 [main] SEVERE: SelfTestSubsystem: selftest failed: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024 java.lang.Exception: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024 at com.netscape.cmscore.cert.CertUtils.verifySystemCertValidityByNickname(CertUtils.java:844) at com.netscape.cmscore.apps.CMSEngine.verifySystemCertByTag(CMSEngine.java:1895) at com.netscape.cmscore.apps.CMSEngine.verifySystemCerts(CMSEngine.java:1823) at com.netscape.cms.selftests.common.SystemCertsVerification.runSelfTest(SystemCertsVerification.java:211) at com.netscape.cmscore.selftests.SelfTestSubsystem.runSelfTestsAtStartup(SelfTestSubsystem.java:818) at com.netscape.cmscore.selftests.SelfTestSubsystem.startup(SelfTestSubsystem.java:1722) at com.netscape.cmscore.apps.CMSEngine.startupSubsystems(CMSEngine.java:1167) at org.dogtagpki.server.ca.CAEngine.startupSubsystems(CAEngine.java:972) at com.netscape.cmscore.apps.CMSEngine.start(CMSEngine.java:1223) at com.netscape.cmscore.apps.PKIWebListener.contextInitialized(PKIWebListener.java:43) at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4768) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5230) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:726) at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:149) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:139) at java.base/java.security.AccessController.doPrivileged(AccessController.java:318) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:696) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:696) at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:690) at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1889) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:123) at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:583) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:473) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1618) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:319) at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:123) at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:423) at org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:366) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:946) at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:835) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1396) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1386) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:145) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:919) at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:263) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardService.startInternal(StandardService.java:432) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:927) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.startup.Catalina.start(Catalina.java:772) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:345) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:476) Caused by: java.security.cert.CertificateNotYetValidException: NotBefore: Mon Apr 01 03:41:49 CST 2024 at org.mozilla.jss.netscape.security.x509.CertificateValidity.valid(CertificateValidity.java:302) at org.mozilla.jss.netscape.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:494) at org.mozilla.jss.netscape.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:466) at com.netscape.cmscore.cert.CertUtils.verifySystemCertValidityByNickname(CertUtils.java:839) ... 54 more 2024-04-01 03:41:32 [main] SEVERE: SelfTestSubsystem: Disabling subsystem due to selftest failure: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024 java.lang.Exception: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024 cat /var/log/pki/pki-tomcat/ca/selftests.log: 0.main - [29/Mar/2024:03:28:24 GMT-06:00] [20] [1] CAPresence: CA is present 0.main - [29/Mar/2024:03:28:24 GMT-06:00] [20] [1] SystemCertsVerification: system certs verification failure: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Fri Mar 29 03:28:37 CST 2024 0.main - [29/Mar/2024:03:28:24 GMT-06:00] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED! 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: Initializing self test plugins: 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin logger parameters 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin instances 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin instance parameters 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading self test plugins in on-demand order 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: loading self test plugins in startup order 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: Self test plugins have been successfully loaded! 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: Running self test plugins specified to be executed at startup: 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] CAPresence: CA is present 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SystemCertsVerification: system certs verification failure: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Fri Mar 29 04:03:27 CST 2024 0.main - [29/Mar/2024:04:03:13 GMT-06:00] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED! 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: Initializing self test plugins: 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin logger parameters 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin instances 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading all self test plugin instance parameters 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading self test plugins in on-demand order 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: loading self test plugins in startup order 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: Self test plugins have been successfully loaded! 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: Running self test plugins specified to be executed at startup: 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] CAPresence: CA is present 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SystemCertsVerification: system certs verification failure: Invalid certificate Server-Cert cert-pki-ca: NotBefore: Mon Apr 01 03:41:49 CST 2024 0.main - [01/Apr/2024:03:41:32 GMT-06:00] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED! ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

2 2

problem with configuration replication in ipa server
by Richard Halley 01 Apr '24

01 Apr '24

Hi everyone, I'm configuring the freeipa replication as follows: 1) ipa-client-install --domain=pippo.internal --realm=PIPPO.INTERNAL -N 2) I add the client to the ipaserver host group 3) ipa-replica-install -N --setup-dns --forwarder 8.8.8.8 --forwarder 8.8.4.4 --forwarder 1.1.1.1 --setup-ca After running ipa-replica-install I get the following error: Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR A replication agreement for this host already exists. It needs to be removed. Run this command: %% ipa-replica-manage del pluto.pippo.internal --force ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information I would like to point out that I have attempted the configuration several times without success. Before proceeding with the uninstall commands of the client and the replica on the replica server, I delete the replica on the server (which fails because it does not find any replica) and then proceed with deleting the client. In the replication log file I have the following error: 2024-03-28T12:05:10Z DEBUG The ipa-replica-install command failed, exception: ScriptError: A replication agreement for this host already exists. It needs to be removed. Run this command: %% ipa-replica-manage del pluto.pippo.internal --force 2024-03-28T12:05:10Z ERROR A replication agreement for this host already exists. It needs to be removed. Run this command: %% ipa-replica-manage del pluto.pippo.internal --force 2024-03-28T12:05:10Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information I can't understand where the problem is. Could it be something dirty in LDAP? Thank you very much

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2024