[Freeipa-users] Re: ipa-kra-install fails: Failed to update number range.

[Fraser Tweedale]

On Thu, Sep 12, 2019 at 03:33:26PM -0000, Dmitry Perets via FreeIPA-users wrote:
>  Hi,
>  
>  I've created a new IPA replica. 
>  ipa-replica-install has completed successfully.
>  ipa-ca-install has completed successfully as well.
>  However, ipa-kra-install fails.
>  
>  In the terminal the fails right here:
>  
>  Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes
>    [1/11]: creating ACIs for admin
>    [2/11]: creating installation admin user
>    [3/11]: configuring KRA instance
>  Failed to configure KRA instance: Command '/usr/sbin/pkispawn -s KRA -f
> /tmp/tmp0w3vD5' returned non-zero exit status 1
>  See the installation logs and the following files/directories for more information:
>    /var/log/pki/pki-tomcat
>    [error] RuntimeError: KRA configuration failed.
>  
>  This is in /var/log/pki/pki-tomcat/kra/debug:
>  
>  [12/Sep/2019:15:58:34][http-bio-8443-exec-1]: === Subsystem Configuration ===
>  [12/Sep/2019:15:58:34][http-bio-8443-exec-1]: SystemConfigService: validate clone URI:
> https://t-idm-nbg2-1.poc.customer.de:443
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: SystemConfigService: get configuration
> entries from master
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange start
> host=t-idm-nbg2-1.poc.customer.de adminPort=443 eePort=443
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange content:
> {xmlOutput=[true], sessionID=[5319570421915120898], type=[request]}
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: ConfigurationUtils: POST
> https://t-idm-nbg2-1.poc.customer.de:443/kra/admin/kra/updateNumberRange
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: Server certificate:
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]:  - subject:
> CN=t-idm-nbg2-1.poc.customer.de,O=poc.customer.de
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]:  - issuer: CN=Certificate
> Authority,O=poc.customer.de
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: content from admin interface =<?xml
> version="1.0" encoding="UTF-8"
> standalone="no"?><XMLResponse><Status>1</Status><Error>Error:
> Failed to update number range.</Error></XMLResponse>
>  [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange(): status=1
>  java.io.IOException: Error: Failed to update number range.
>  
>  I must note that in this environment there were a lot of redeployments of IPA servers,
> replicating from one another, deleting the original masters etc.
>  And right now I have about 10 IPA servers running, out of them 2 with working KRA (this
> was supposed to be the 3rd one).
>  I found a similar issue with an explanation how the number ranges can get depleted, but I
> am not sure how I can manually resolve this (without killing the entire environment of
> course):
>  https://pagure.io/freeipa/issue/7654
>  
>  Could you guide me in the right direction please?
>  
>  ipa-server 4.6.4...
>   
It may be an instance of:
https://bugzilla.redhat.com/show_bug.cgi?id=1748766

Can you please provide the kra/CS.cfg and KRA debug log from
t-idm-nbg2-1.poc.customer.de.  That will help confirm if it is the
above issue.

What operating system and Dogtag package versions are you using?

Thanks,
Fraser