kpi-tomcatd failing to start
by girish f
I have IPA setup long back.
Some of the certificates expired. So i went back in time and then it's working super smooth.
When i did ipa-cert-fix --> error is Server-Cert not found
I renewed kerberos kdc.key kdc.crt.
But still it's failing to start the kpi_tomcatd. When i check status of kpi-tomcatd@kpi-tomcatd it shows running, but service starts to fail when
i come back to current time and restart ipactl restart.
need urgent help please
3 weeks, 3 days
Reinitializing isolated replica with updated certificate
by William Faulk
I have an IdM replica that stopped sending its replications to the other replicas in the environment. I want to reinitialize it to hopefully resolve that replication problem. However, when confirming what data would be lost in the reinitialization, I noticed that the replica has reissued itself certificates for its own LDAP and HTTP services. These certificates are the ones found in the "userCertificate" attributes of the "krbprincipalname=ldap/isolated-replica(a)EXAMPLE.COM,cn=services,cn=accounts,dc=example,dc=com" and "krbprincipalname=HTTP/isolated-replica(a)EXAMPLE.COM,cn=services,cn=accounts,dc=example,dc=com" DNs. The other replicas show the older certificates in those multivalue entries, but not the new ones. In addition, the previous certificates have now expired.
I'm concerned about what will happen if I perform a reinitialization of this replica. Will it restart its LDAP and HTTP services with an old, expired certificate? What effect will that have on other replicas trying to connect to it? Will it still have keys for those old certificates? Will it be able to reissue its certificates again? The existence of the "ipa-cert-fix" utility implies not.
Or will it keep its new certificates? Will those certificates cause a problem when they no longer exist in the replica's own domain database?
The replica in question will still accept replications from the rest of the environment. Is it possible to get another replica to push new certificates to it, so that that new certificate will exist in the domain database after a reinitialization happens?
This is all in an IdM environment run under RHEL 7.9, so FreeIPA 4.6.8. (I'm desperately trying to dig myself out of replication problems before I upgrade. This is the next-to-last issue.)
--
William Faulk
3 weeks, 5 days
Questions about replica
by Dmitry Krasov
Hello.
just installed replica (ipa2.dom.loc), it seems works fine.
But how enrolled clients will know about this replica, if primary server will be down?
And how to make ipa2.dom.loc to work as primary server?
3 weeks, 5 days
Freel IPA on CentOS CA_UNREACHABLE Error - kerberos
by girish f
We have one new customer, they have setup of one single node of IPA on CentOS.
There certificate is expired, and everthing went down.
When we are trying to bring services up.
pki_tomcatd is not starting, another thing is
When we run command > ipactl-getcerts list
One of the certificate is shwoing CA_Unreachable and getting error:
/var/kerberos/krb5kdc/kdc.crt /var/kerberos/krb5kdc/kdc.key
enter image description here
Created new certificate and CA -> it loads certificate, new dates it shows but still says CA unreachable.
3 weeks, 5 days
when 2FA enabled, with 2 factor prompt asking doesn't work
by seojeong kim
on server side, ipauserauthtype set as password + otp.
[root@xxxxxx /]# ipa user-show ereen-test --raw | grep ipauserauthtype
ipauserauthtype: password
ipauserauthtype: otp
And I added new configuration in /etc/ssh/sshd_config on my host which is ipa client is installed.
GSSAPIAuthentication yes
And /etc/sssd/sssd.conf
[prompting/password/sshd]
password_prompt = password :
[prompting/2fa/sshd]
first_prompt = first pwd :
second_prompt = second otp :
But all the time, when I try ssh login with ereen-test, the prompt asks "password :"
I expect 2 factor asking as I configured like below
first_prompt :
second_prompt :
Is there other configuration should I set more ?
3 weeks, 6 days
Freel IPA on CentOS CA_UNREACHABLE Error - kerberos
by girish f
We have one new customer, they have setup of one single node of IPA on CentOS.
There certificate is expired, and everthing went down.
When we are trying to bring services up.
pki_tomcatd is not starting, another thing is
When we run command > ipactl-getcerts list
One of the certificate is shwoing CA_Unreachable and getting error:
/var/kerberos/krb5kdc/kdc.crt /var/kerberos/krb5kdc/kdc.key
enter image description here
Created new certificate and CA -> it loads certificate, new dates it shows but still says CA unreachable.
4 weeks, 1 day
ipa-ca-install failed
by Satish Patel
Folks,
Trying to deploy CA on a replica node and failed here without any
information. Can I restart the process again? Even log directories are
empty /var/log/pki/pki-tomcat
My OS is RockyLunux 8.9 and Master CA running on CentOS7.x
[root@ldap-vx-010103-3 ~]# ipa-ca-install
Directory Manager (existing master) password:
Run connection check to master
Connection check OK
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/28]: creating certificate server db
[2/28]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 161 seconds elapsed
Update succeeded
[3/28]: creating ACIs for admin
[4/28]: creating installation admin user
[5/28]: configuring certificate server instance
ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance
ipaserver.install.dogtaginstance: CRITICAL See the installation logs and
the following files/directories for more information:
ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
4 weeks, 1 day
502 Server Error: Proxy Error when creating CA replica on RockyLinux 8.9
by Satish Patel
Folks,
I have Master freeIPA running on CentOS 7 and now trying to migrate it to
RockyLinux 8.9 (because centos7 is EOL).
When I am running # ipa-replica-install --setup-ca I encounter following
error
Custodia uses 'ldap-vx-010101-4.site5.example.com' as master peer.
Configuring ipa-custodia
[1/4]: Generating ipa-custodia config file
[2/4]: Generating ipa-custodia keys
[3/4]: starting ipa-custodia
[4/4]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
502 Server Error: Proxy Error for url:
https://ldap-vx-010101-4.site5.example.com/ipa/keys/ca/caSigningCert%20ce...
I did google and found a similar issue but no solutions. Any idea what
could be wrong here? I have checked and all certs are updated and not
expired.
Above error isn't great to understand what is going on. I am able to use
curls etc. That means cert is updated and valid.
1 month
FreeIPA v4.11 - wsgi:ipa high cpu load
by Djerk Geurts
Hi all,
Last week, we saw CPU jump from 7% to 62% on our primary FreeIPA server (4.11.1-2.fc39) on Fedora 39. Inspecting the server shows that the wigs:ipa process runs at >95% CPU.
Has anyone else observed this, and would anyone have a solution, or be able to point me in the right direction for what might be causing this?
FreeIPA works fine and we can’t tell any adverse effects on the server apart from burning more CPU.
Thanks,
Djerk Geurts
1 month
