ipactl status shows that the services are running normally Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful
but ipa cert-show prompts an error: ipa: ERROR: Failed to authenticate to CA REST API
I can't find the relevant error in the ipa log file, does anyone know how to debug this problem?
Hi,
On Mon, Dec 12, 2022 at 8:55 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
ipactl status shows that the services are running normally Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful
but ipa cert-show prompts an error: ipa: ERROR: Failed to authenticate to CA REST API
When a user executes the command "ipa cert-show <cert number>", the process contacts httpd and then httpd needs to contact the Certificate Server. This error usually happens when the authentication step between httpd and the Certificate Server fails. Authentication is done using the certificate ra-agent stored in /var/lib/ipa/ra-agent.{pem|key} for recent versions or in the NSS database /etc/pki/pki-tomcat/alias/. The authentication may fail for multiple reasons: - the ra-agent cert is expired - the SSL server cert used by the Certificate Server is expired - the entry uid=ipara,ou=people,o=ipaca hasn't been updated
The validity of certificates can be checked using "*getcert list*": ensure that all the certificates are displayed with "status: MONITORING" and have a date "expires: xxx" that is not already past. The content of the entry uid=ipara,ou=people,o=ipaca can be checked with: *ldapsearch -x -o ldif-wrap=no -LLL -s base -h `hostname` -p 389 -b uid=ipara,ou=people,o=ipaca description usercertificate* dn: uid=ipara,ou=people,o=ipaca description: 2;22;CN=Certificate Authority,O=IPA.TEST;CN=IPA RA,O=IPA.TEST usercertificate:: MIID...JN4Q==
The field "description" must contain 2;<serial number>;<issuer>;<subject> corresponding to the ra certificate. Compare the values with the output of: (if the cert is stored in /var/lib/ipa/ra-agent.pem) *openssl x509 -nameopt RFC2253 -noout -subject -serial -issuer -in /var/lib/ipa/ra-agent.pem * subject=CN=IPA RA,O=IPA.TEST serial=16 <<< here the serial is displayed in hex format, 0x16 = 22 issuer=CN=Certificate Authority,O=IPA.TEST issuer=O = IPA.TEST, CN = Certificate Authority
or (if the cert is stored in /etc/pki/pki-tomcat/alias) *certutil -L -d /etc/pki/pki-tomcat/alias -n ipaCert*
The field "userCertificate" must contain the same cert as the file /var/lib/ipa/ra-agent.pem, minus the header and footer, or the same value as returned by the command *certutil -L -d /etc/pki/pki-tomcat/alias -n ipaCert -a*
If you see any inconsistency, please provide the output of the above commands and we'll be able to guide you how to fix the issue. HTH, flo
I can't find the relevant error in the ipa log file, does anyone know how
to debug this problem? _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi , getcert list Number of certificates and requests being tracked: 7. Request ID '20221116023302': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=IPA RA,O=WINGON.HK issued: 2022-11-16 10:33:02 HKT expires: 2024-11-05 10:33:02 HKT key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20221116023307': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=CA Audit,O=WINGON.HK issued: 2022-11-16 10:31:47 HKT expires: 2024-11-05 10:31:47 HKT key usage: digitalSignature,nonRepudiation profile: caSignedLogCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023309': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=OCSP Subsystem,O=WINGON.HK issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT eku: id-kp-OCSPSigning profile: caOCSPCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023310': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=CA Subsystem,O=WINGON.HK issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023311': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=Certificate Authority,O=WINGON.HK issued: 2022-11-16 10:31:44 HKT expires: 2042-11-16 10:31:44 HKT key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign profile: caCACert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023312': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=wocfreeipa.wingon.hk,O=WINGON.HK issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT dns: wocfreeipa.wingon.hk key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-serverAuth profile: caServerCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023354': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=wocfreeipa.wingon.hk,O=WINGON.HK issued: 2022-11-16 10:33:55 HKT expires: 2024-11-16 10:33:55 HKT dns: wocfreeipa.wingon.hk principal name: krbtgt/WINGON.HK@WINGON.HK key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes ldapsearch -x -o ldif-wrap=no -LLL -s base -h `hostname` -p 389 -b uid=ipara,ou=people,o=ipaca description usercertificate* dn: uid=ipara,ou=people,o=ipaca description: 2;7;CN=Certificate Authority,O=WINGON.HK;CN=IPA RA,O=WINGON.HK
openssl x509 -nameopt RFC2253 -noout -subject -serial -issuer -in /var/lib/ipa/ra-agent.pem subject=CN=IPA RA,O=WINGON.HK serial=07 issuer=CN=Certificate Authority,O=WINGON.HK
[root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/ -n ipaCert certutil: Could not find cert: ipaCert : PR_FILE_NOT_FOUND_ERROR: File not found [root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI
caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Server-Cert cert-pki-ca u,u,u OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com%5C, Inc.,L=Scottsdale,ST=Arizona,C=US C,,
I executed the above command as you suggested, unfortunately ipaCert* cannot be found
Hi,
On Mon, Dec 12, 2022 at 10:20 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi , getcert list Number of certificates and requests being tracked: 7. Request ID '20221116023302': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=IPA RA,O=WINGON.HK issued: 2022-11-16 10:33:02 HKT expires: 2024-11-05 10:33:02 HKT key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20221116023307': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=CA Audit,O=WINGON.HK issued: 2022-11-16 10:31:47 HKT expires: 2024-11-05 10:31:47 HKT key usage: digitalSignature,nonRepudiation profile: caSignedLogCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023309': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=OCSP Subsystem,O=WINGON.HK issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT eku: id-kp-OCSPSigning profile: caOCSPCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023310': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=CA Subsystem,O=WINGON.HK issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023311': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=Certificate Authority,O=WINGON.HK issued: 2022-11-16 10:31:44 HKT expires: 2042-11-16 10:31:44 HKT key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign profile: caCACert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023312': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=wocfreeipa.wingon.hk,O=WINGON.HK issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT dns: wocfreeipa.wingon.hk key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-serverAuth profile: caServerCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023354': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=WINGON.HK subject: CN=wocfreeipa.wingon.hk,O=WINGON.HK issued: 2022-11-16 10:33:55 HKT expires: 2024-11-16 10:33:55 HKT dns: wocfreeipa.wingon.hk principal name: krbtgt/WINGON.HK@WINGON.HK key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes
So far, looks good. All the tracked certs are still valid. One question, though: there is no tracking for httpd and ldap server certificates, does it mean that they were replaced with externally-signed server certificates using ipa-server-certinstall?
ldapsearch -x -o ldif-wrap=no -LLL -s base -h `hostname` -p 389 -b uid=ipara,ou=people,o=ipaca description usercertificate* dn: uid=ipara,ou=people,o=ipaca description: 2;7;CN=Certificate Authority,O=WINGON.HK;CN=IPA RA,O= WINGON.HK
Is there a usercertificate attribute in this entry? (maybe a copy-paste
issue but there is a * in your command, it should not be there). The value stored in this usercertificate attribute should be identical to the content of /var/lib/ipa/ra-agent.pem.
openssl x509 -nameopt RFC2253 -noout -subject -serial -issuer -in /var/lib/ipa/ra-agent.pem subject=CN=IPA RA,O=WINGON.HK serial=07 issuer=CN=Certificate Authority,O=WINGON.HK
The RA certificate and the info stored in LDAP are consistent, no issue
seen so far.
[root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/ -n ipaCert certutil: Could not find cert: ipaCert : PR_FILE_NOT_FOUND_ERROR: File not found
This error can be ignored, with your version the cert is stored in the pem file /var/lib/ipa/ra-agent.pem.
[root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Server-Cert cert-pki-ca u,u,u OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com%5C, Inc.,L=Scottsdale,ST=Arizona,C=US C,,
I executed the above command as you suggested, unfortunately ipaCert* cannot be found
Yes, this error can be ignored, you must have IPA >= 4.5.
What is the content of /var/log/pki/pki-tomcat/ca/debug? flo
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Florence Blanc-Renaud via FreeIPA-users wrote:
Hi,
On Mon, Dec 12, 2022 at 10:20 AM junhou he via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
Hi , getcert list Number of certificates and requests being tracked: 7. Request ID '20221116023302': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK> subject: CN=IPA RA,O=WINGON.HK <http://WINGON.HK> issued: 2022-11-16 10:33:02 HKT expires: 2024-11-05 10:33:02 HKT key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20221116023307': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK> subject: CN=CA Audit,O=WINGON.HK <http://WINGON.HK> issued: 2022-11-16 10:31:47 HKT expires: 2024-11-05 10:31:47 HKT key usage: digitalSignature,nonRepudiation profile: caSignedLogCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023309': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK> subject: CN=OCSP Subsystem,O=WINGON.HK <http://WINGON.HK> issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT eku: id-kp-OCSPSigning profile: caOCSPCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023310': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK> subject: CN=CA Subsystem,O=WINGON.HK <http://WINGON.HK> issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023311': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK> subject: CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK> issued: 2022-11-16 10:31:44 HKT expires: 2042-11-16 10:31:44 HKT key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign profile: caCACert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023312': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK> subject: CN=wocfreeipa.wingon.hk <http://wocfreeipa.wingon.hk>,O=WINGON.HK <http://WINGON.HK> issued: 2022-11-16 10:31:46 HKT expires: 2024-11-05 10:31:46 HKT dns: wocfreeipa.wingon.hk <http://wocfreeipa.wingon.hk> key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-serverAuth profile: caServerCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Request ID '20221116023354': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK> subject: CN=wocfreeipa.wingon.hk <http://wocfreeipa.wingon.hk>,O=WINGON.HK <http://WINGON.HK> issued: 2022-11-16 10:33:55 HKT expires: 2024-11-16 10:33:55 HKT dns: wocfreeipa.wingon.hk <http://wocfreeipa.wingon.hk> principal name: krbtgt/WINGON.HK@WINGON.HK <mailto:WINGON.HK@WINGON.HK> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yesSo far, looks good. All the tracked certs are still valid. One question, though: there is no tracking for httpd and ldap server certificates, does it mean that they were replaced with externally-signed server certificates using ipa-server-certinstall?
ldapsearch -x -o ldif-wrap=no -LLL -s base -h `hostname` -p 389 -b uid=ipara,ou=people,o=ipaca description usercertificate* dn: uid=ipara,ou=people,o=ipaca description: 2;7;CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK>;CN=IPA RA,O=WINGON.HK <http://WINGON.HK>Is there a usercertificate attribute in this entry? (maybe a copy-paste issue but there is a * in your command, it should not be there). The value stored in this usercertificate attribute should be identical to the content of /var/lib/ipa/ra-agent.pem.
openssl x509 -nameopt RFC2253 -noout -subject -serial -issuer -in /var/lib/ipa/ra-agent.pem subject=CN=IPA RA,O=WINGON.HK <http://WINGON.HK> serial=07 issuer=CN=Certificate Authority,O=WINGON.HK <http://WINGON.HK>The RA certificate and the info stored in LDAP are consistent, no issue seen so far.
[root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/ -n ipaCert certutil: Could not find cert: ipaCert : PR_FILE_NOT_FOUND_ERROR: File not foundThis error can be ignored, with your version the cert is stored in the pem file /var/lib/ipa/ra-agent.pem.
[root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/ Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Server-Cert cert-pki-ca u,u,u OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\ <http://certs.godaddy.com/repository/,O=GoDaddy.com%5C>, Inc.,L=Scottsdale,ST=Arizona,C=US C,, I executed the above command as you suggested, unfortunately ipaCert* cannot be foundYes, this error can be ignored, you must have IPA >= 4.5.
What is the content of /var/log/pki/pki-tomcat/ca/debug?
Could this be mismatch in the proxy secrets?
If you look in /etc/httpd/conf.d/ipa-pki-proxy.conf the secret should match the value in /etc/pki/pki-tomcat/server.xml for the connector.
Tomcat changed the name of the attribute and in some cases a new secret was generated for the CA and not for IPA.
See https://bugzilla.redhat.com/show_bug.cgi?id=2092015
rob
Hi , cat /etc/httpd/conf.d/ipa-pki-proxy.conf | grep secret ProxyPassMatch ajp://localhost:8009 secret=9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG ProxyPassMatch ajp://localhost:8009 secret=9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG ProxyPassMatch ajp://localhost:8009 secret=9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG ProxyPassMatch ajp://localhost:8009 secret=9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG
cat /etc/pki/pki-tomcat/server.xml | grep 8009 <!-- Define an AJP 1.3 Connector on port 8009 --> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="127.0.0.1" requiredSecret="9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG" name="Connector1"/> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="::1" requiredSecret="9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG" name="Connector2"/>
value is matched
Hi, "does it mean that they were replaced with externally-signed server certificates using ipa-server-certinstall?" yes , I replaced with externally-signed server certificates using certutil less /var/log/pki/pki-tomcat/ca/debug.2022-12-13.log 2022-12-13 08:18:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 08:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 08:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 08:23:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 08:28:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:33:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca 2022-12-13 08:33:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 08:33:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 08:33:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 08:33:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 08:38:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:43:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 08:43:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 08:43:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 08:43:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 08:48:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca 2022-12-13 08:48:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:53:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 08:53:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 08:53:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 08:53:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 08:58:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CRLIssuingPoint: Updating MasterCRL 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CASigningUnit: Getting algorithm context for SHA256withRSA RSASignatureWithSHA256Digest 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CASigningUnit: Signing Certificate 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CRLReposiotry: Updating CRL issuing point record 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: Getting crl publishing rules 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapXCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapCaCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: FileCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: true 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: type: crl 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: predicate: null 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapUserCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: Publishing CRL 130 to MasterCRL 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: Getting crl publishing rules 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapXCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapCaCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: FileCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: true 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: type: crl 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: predicate: null 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapUserCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: Publishing rules: 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: - rule: FileCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: mapper: NoMap 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: Publishing to CN=Certificate Authority,O=WINGON.HK 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: - publisher: FileBaseCRLPublisher 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: Published CRL 2022-12-13 09:03:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca 2022-12-13 09:03:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 09:03:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 09:03:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 09:03:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 09:08:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 09:13:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 09:13:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 09:13:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 09:13:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 09:18:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca
The debug log has no relevant error prompts
junhou he via FreeIPA-users wrote:
Hi, "does it mean that they were replaced with externally-signed server certificates using ipa-server-certinstall?" yes , I replaced with externally-signed server certificates using certutil less /var/log/pki/pki-tomcat/ca/debug.2022-12-13.log 2022-12-13 08:18:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 08:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 08:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 08:23:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 08:28:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:33:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca 2022-12-13 08:33:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 08:33:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 08:33:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 08:33:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:33:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 08:38:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:43:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 08:43:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 08:43:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 08:43:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:43:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 08:48:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca 2022-12-13 08:48:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:53:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 08:53:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 08:53:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 08:53:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 08:53:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 08:58:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CRLIssuingPoint: Updating MasterCRL 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CASigningUnit: Getting algorithm context for SHA256withRSA RSASignatureWithSHA256Digest 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CASigningUnit: Signing Certificate 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CRLReposiotry: Updating CRL issuing point record 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: Getting crl publishing rules 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapXCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapCaCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: FileCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: true 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: type: crl 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: predicate: null 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapUserCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: Publishing CRL 130 to MasterCRL 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: Getting crl publishing rules 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapXCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapCaCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: FileCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: true 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: type: crl 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: predicate: null 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapUserCertRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: - name: LdapCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: PublisherProcessor: enabled: false 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: Publishing rules: 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: - rule: FileCrlRule 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: mapper: NoMap 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: Publishing to CN=Certificate Authority,O=WINGON.HK 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: - publisher: FileBaseCRLPublisher 2022-12-13 09:00:00 [CRLIssuingPoint-MasterCRL] INFO: CAPublisherProcessor: Published CRL 2022-12-13 09:03:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca 2022-12-13 09:03:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 09:03:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 09:03:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 09:03:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:03:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 09:08:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 09:13:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 09:13:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 09:13:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 09:13:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 09:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 09:18:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca
The debug log has no relevant error prompts
You should watch the debug log as you try to authenticate to it.
As an example, this is what it looks like if the ipara account has an incorrect description. This is apparently not your issue, I show this only for illustration purposes.
2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1] INFO: Getting certificate 0x1 2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=ca,o=ipaca 2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1] INFO: PKIService: Response format: application/json 2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1] INFO: PKIService: Response class: CertData 2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-2] INFO: PKIRealm: Authenticating certificate chain: 2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-2] INFO: PKIRealm: - CN=IPA RA, O=EXAMPLE.TEST 2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-2] SEVERE: CertUserDBAuthentication: cannot map certificate to any user: User not found User not found at com.netscape.cmscore.usrgrp.UGSubsystem.buildUsers(UGSubsystem.java:391) at com.netscape.cmscore.usrgrp.UGSubsystem.findUsersByCert(UGSubsystem.java:249) at com.netscape.cmscore.usrgrp.ExactMatchCertUserLocator.locateUser(ExactMatchCertUserLocator.java:84) at com.netscape.cmscore.authentication.CertUserDBAuthentication.authenticate(CertUserDBAuthentication.java:193) at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:133) at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:104) at org.apache.catalina.authenticator.SSLAuthenticator.doAuthenticate(SSLAuthenticator.java:94) at org.apache.catalina.authenticator.AuthenticatorBase.authenticate(AuthenticatorBase.java:733) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:37) at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:93) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:625) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:83) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360) at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:433) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1789) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.base/java.lang.Thread.run(Thread.java:829)
2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-2] SEVERE: CertUserDBAuthentication: Cannot authenticate agent with certificate Serial 0x7 Subject DN CN=IPA RA,O=EXAMPLE.TEST. Error: User not found 2022-12-12 21:47:56 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-2] WARNING: Unable to authenticate cert chain: Invalid Credential.
Hi , I opened two windows, one to run ipa cert-show1, one to observe the debug log [root@wocfreeipa ~]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa ~]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa ~]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API
[root@wocfreeipa ~]# tail -f /var/log/pki/pki-tomcat/ca/debug.2022-12-13.log 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 11:18:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,o=ipaca 2022-12-13 11:18:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 11:22:35 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-8] INFO: Getting certificate 0x1 2022-12-13 11:22:35 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-8] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=caca 2022-12-13 11:23:06 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-9] INFO: Getting certificate 0x1 2022-12-13 11:23:06 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-9] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=caca 2022-12-13 11:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 11:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 11:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 11:23:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED)
2022-12-13 11:28:14 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1] INFO: Getting certificate 0x1 2022-12-13 11:28:14 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=ca,o=ipaca
junhou he via FreeIPA-users wrote:
Hi , I opened two windows, one to run ipa cert-show1, one to observe the debug log [root@wocfreeipa ~]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa ~]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa ~]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API
So it isn't hitting the CA at all. Check /var/log/httpd/error_log for any details.
rob
[root@wocfreeipa ~]# tail -f /var/log/pki/pki-tomcat/ca/debug.2022-12-13.log 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:13:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-13 11:18:30 [CRLIssuingPoint-MasterCRL] INFO: LDAPSession: Modifying LDAP entry cn=MasterCRL,ou=crlIssuingPoints,o=ipaca 2022-12-13 11:18:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 11:22:35 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-8] INFO: Getting certificate 0x1 2022-12-13 11:22:35 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-8] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=caca 2022-12-13 11:23:06 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-9] INFO: Getting certificate 0x1 2022-12-13 11:23:06 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-9] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=caca 2022-12-13 11:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-13 11:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-13 11:23:30 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-13 11:23:31 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-13 11:23:31 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED)
2022-12-13 11:28:14 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1] INFO: Getting certificate 0x1 2022-12-13 11:28:14 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-1] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=ca,o=ipaca
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi,
tail -f /var/log/httpd/error_log [Tue Dec 13 11:23:06.828435 2022] [:warn] [pid 12597:tid 140168279328512] [client 10.100.0.213:56124] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 11:23:06.894172 2022] [wsgi:error] [pid 12224:tid 140169472526080] [remote 10.100.0.213:56124] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Tue Dec 13 11:28:14.692546 2022] [:warn] [pid 12229:tid 140169276016384] [client 10.100.0.213:48306] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 11:28:14.759617 2022] [wsgi:error] [pid 12223:tid 140169472526080] [remote 10.100.0.213:48306] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Tue Dec 13 13:22:40.042488 2022] [:warn] [pid 12597:tid 140169393514240] [client 10.100.0.213:42292] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 13:22:40.057179 2022] [wsgi:error] [pid 12225:tid 140169472526080] [remote 10.100.0.213:42292] ipa: INFO: [jsonserver_session] admin@WINGON.HK: schema(known_fingerprints=('3f71e6ba',), version='2.170'): SchemaUpToDate [Tue Dec 13 13:22:40.389463 2022] [:warn] [pid 12597:tid 140169385121536] [client 10.100.0.213:42308] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 13:22:40.452860 2022] [wsgi:error] [pid 12223:tid 140169472526080] [remote 10.100.0.213:42308] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Tue Dec 13 13:23:07.808084 2022] [:warn] [pid 12597:tid 140168858162944] [client 10.100.0.213:45054] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 13:23:07.870276 2022] [wsgi:error] [pid 12225:tid 140169472526080] [remote 10.100.0.213:45054] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Tue Dec 13 13:24:18.612677 2022] [:warn] [pid 12597:tid 140168338077440] [client 10.100.0.213:39580] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 13:24:18.674701 2022] [wsgi:error] [pid 12224:tid 140169472526080] [remote 10.100.0.213:39580] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError
Hi,
which versions of tomcat is installed? rpm -q tomcat pki-servlet-engine
Pre 9.0.31.0, the server.xml file needs to define the secret for the connector with "requiredSecret=....". WIth 9.0.31.0 and above, the server.xml file needs to define the secret with "secret=...". flo
On Tue, Dec 13, 2022 at 6:25 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi,
tail -f /var/log/httpd/error_log [Tue Dec 13 11:23:06.828435 2022] [:warn] [pid 12597:tid 140168279328512] [client 10.100.0.213:56124] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 11:23:06.894172 2022] [wsgi:error] [pid 12224:tid 140169472526080] [remote 10.100.0.213:56124] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Tue Dec 13 11:28:14.692546 2022] [:warn] [pid 12229:tid 140169276016384] [client 10.100.0.213:48306] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 11:28:14.759617 2022] [wsgi:error] [pid 12223:tid 140169472526080] [remote 10.100.0.213:48306] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Tue Dec 13 13:22:40.042488 2022] [:warn] [pid 12597:tid 140169393514240] [client 10.100.0.213:42292] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 13:22:40.057179 2022] [wsgi:error] [pid 12225:tid 140169472526080] [remote 10.100.0.213:42292] ipa: INFO: [jsonserver_session] admin@WINGON.HK: schema(known_fingerprints=('3f71e6ba',), version='2.170'): SchemaUpToDate [Tue Dec 13 13:22:40.389463 2022] [:warn] [pid 12597:tid 140169385121536] [client 10.100.0.213:42308] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 13:22:40.452860 2022] [wsgi:error] [pid 12223:tid 140169472526080] [remote 10.100.0.213:42308] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Tue Dec 13 13:23:07.808084 2022] [:warn] [pid 12597:tid 140168858162944] [client 10.100.0.213:45054] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 13:23:07.870276 2022] [wsgi:error] [pid 12225:tid 140169472526080] [remote 10.100.0.213:45054] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Tue Dec 13 13:24:18.612677 2022] [:warn] [pid 12597:tid 140168338077440] [client 10.100.0.213:39580] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-PIt3U8)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Tue Dec 13 13:24:18.674701 2022] [wsgi:error] [pid 12224:tid 140169472526080] [remote 10.100.0.213:39580] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi , rpm -qa | grep pki krb5-pkinit-1.18.2-14.el8.x86_64 pki-base-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-base-java-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-acme-10.12.0-2.module+el8.6.0+788+76246f77.noarch python3-pki-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-servlet-4.0-api-9.0.30-3.module+el8.5.0+697+f586bb30.noarch pki-tools-10.12.0-2.module+el8.6.0+788+76246f77.x86_64 pki-servlet-engine-9.0.30-3.module+el8.5.0+697+f586bb30.noarch pki-ca-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-kra-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-server-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-symkey-10.12.0-2.module+el8.6.0+788+76246f77.x86_64 [root@wocfreeipa ~]# rpm -qa | grep tomcat tomcatjss-7.7.1-1.module+el8.6.0+788+76246f77.noarch [root@wocfreeipa ~]# [root@wocfreeipa ~]# [root@wocfreeipa ~]# ipa --version VERSION: 4.9.8, API_VERSION: 2.245
thanks, Junhou
Hi,
On Tue, Dec 13, 2022 at 11:00 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi , rpm -qa | grep pki krb5-pkinit-1.18.2-14.el8.x86_64 pki-base-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-base-java-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-acme-10.12.0-2.module+el8.6.0+788+76246f77.noarch python3-pki-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-servlet-4.0-api-9.0.30-3.module+el8.5.0+697+f586bb30.noarch pki-tools-10.12.0-2.module+el8.6.0+788+76246f77.x86_64 pki-servlet-engine-9.0.30-3.module+el8.5.0+697+f586bb30.noarch
^^ This is pre 9.0.31 so it looks like your server.xml is consistent (contains requiredSecret).
IIRC in debug mode there are additional messages in httpd's error log. You can do the following: - create a file /etc/ipa/server.conf with the following content [global] debug=True
- restart ipa to take the config change into account: ipactl restart
- launch the command that will create new logs kinit admin ipa cert-show 1
- check the content of /var/log/httpd/error_log
There is also a command that makes roughly the same call to PKI (run as root): curl -v --cert /var/lib/ipa/ra-agent.pem --key /var/lib/ipa/ra-agent.key -d 'op=displayBySerial&serialNumber=1' -k https:// `hostname`:443/ca/agent/ca/displayBySerial
If there are issues during the handshake you should be able to see error messages.
flo
pki-ca-10.12.0-2.module+el8.6.0+788+76246f77.noarch
pki-kra-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-server-10.12.0-2.module+el8.6.0+788+76246f77.noarch pki-symkey-10.12.0-2.module+el8.6.0+788+76246f77.x86_64 [root@wocfreeipa ~]# rpm -qa | grep tomcat tomcatjss-7.7.1-1.module+el8.6.0+788+76246f77.noarch [root@wocfreeipa ~]# [root@wocfreeipa ~]# [root@wocfreeipa ~]# ipa --version VERSION: 4.9.8, API_VERSION: 2.245
thanks, Junhou _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi ,
tail -f /var/log/httpd/error_log [Wed Dec 14 10:45:46.672850 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/ca.py", line 189, in set_certificate_attrs [Wed Dec 14 10:45:46.672854 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] with api.Backend.ra_lightweight_ca as ca_api: [Wed Dec 14 10:45:46.672858 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py", line 1211, in __enter__ [Wed Dec 14 10:45:46.672862 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) [Wed Dec 14 10:45:46.672867 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipalib.errors.RemoteRetrieveError: Failed to authenticate to CA REST API [Wed Dec 14 10:45:46.672874 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] [Wed Dec 14 10:45:46.673000 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Wed Dec 14 10:45:46.673047 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipa: DEBUG: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError etime=569221770 [Wed Dec 14 10:45:46.673819 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipa: DEBUG: FINAL: Hits 0 Misses 2 Size 2 [Wed Dec 14 10:45:46.673911 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipa: DEBUG: Destroyed connection context.ldap2_140175871416696 [Wed Dec 14 10:46:58.533496 2022] [:warn] [pid 15505:tid 140175805597440] [client 10.100.0.213:45502] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-sHvwu4)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Wed Dec 14 10:46:58.534621 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Wed Dec 14 10:46:58.534727 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI jsonserver_session.__call__: [Wed Dec 14 10:46:58.545384 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Created connection context.ldap2_140175871412600 [Wed Dec 14 10:46:58.545468 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI jsonserver.__call__: [Wed Dec 14 10:46:58.545505 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI WSGIExecutioner.__call__: [Wed Dec 14 10:46:58.551189 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: raw: cert_show('1', version='2.245') [Wed Dec 14 10:46:58.551663 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: cert_show(1, cacn='ipa', chain=False, all=False, raw=False, version='2.245', no_members=False) [Wed Dec 14 10:46:58.552186 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: raw: ca_is_enabled(version='2.245') [Wed Dec 14 10:46:58.552313 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ca_is_enabled(version='2.245') [Wed Dec 14 10:46:58.555552 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ra.get_certificate() [Wed Dec 14 10:46:58.556893 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: request GET https://wocfreeipa.wingon.hk:443/ca/rest/certs/1 [Wed Dec 14 10:46:58.556960 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: request body '' [Wed Dec 14 10:46:58.585446 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response status 200 [Wed Dec 14 10:46:58.587038 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response headers Date: Wed, 14 Dec 2022 02:46:58 GMT [Wed Dec 14 10:46:58.587058 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Server: Apache/2.4.37 (rocky) OpenSSL/1.1.1k mod_auth_gssapi/1.6.1 mod_nss/1.0.17 NSS/3.44 mod_wsgi/4.6.4 Python/3.6 [Wed Dec 14 10:46:58.587064 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Content-Type: application/json [Wed Dec 14 10:46:58.587069 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Vary: Accept-Encoding [Wed Dec 14 10:46:58.587073 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Transfer-Encoding: chunked [Wed Dec 14 10:46:58.587077 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.587084 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.587694 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response body (decoded): b'{"id":"0x1","IssuerDN":"CN=Certificate Authority,O=WINGON.HK","SubjectDN":"CN=Certificate Authority,O=WINGON.HK","PrettyPrint":" Certificate: \\n Data: \\n Version: v3\\n Serial Number: 0x1\\n Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11\\n Issuer: CN=Certificate Authority,O=WINGON.HK\\n Validity: \\n Not Before: Wednesday, November 16, 2022 10:31:44 AM HKT Asia/Hong_Kong\\n Not After: Sunday, November 16, 2042 10:31:44 AM HKT Asia/Hong_Kong\\n Subject: CN=Certificate Authority,O=WINGON.HK\\n Subject Public Key Info: \\n Algorithm: RSA - 1.2.840.113549.1.1.1\\n Public Key: \\n Exponent: 65537\\n Public Key Modulus: (3072 bits) :\\n BB:84:36:6D:DE:4F:B1:18:49:17:2D:66:E6:8F:E6:BB:\\n 64:CA:03:53:4E:61:32:43:86:5A:19:BF:B2:54:CB:65:\\n 12:05:FB:B9:64:52:78:1A:60:18:BE:B8:AE:16:81:54:\\n 25:9C:51:67:BF:B6:9C:A9:E0:E5:3D:01:C2:E9:FD:51:\\n 7A:0A:83:A3:2D:E1:24:FB:44:10:FE:86:4D:5E:A9:F4:\\n B8:FD:2D:CA:ED:08:7B:7A:21:81:88:CF:7D:BA:5A:1E:\\n CA:3F:50:6C:61:75:35:DE:6A:DE:C3:E4:AA:E4:7B:4B:\\n B3:80:64:F5:27:25:A3:93:EE:D2:38:0A:B8:FD:D0:31:\\n F9:86:F0:86:6F:F4:37:67:8F:60:7F:44:73:1F:07:53:\\n 8D:61:A8:5B:FD:2C:E5:B1:C3:50:9F:76:BE:FC:50:69:\\n A5:43:87:E0:93:8B:61:68:3E:80:CE:12:EB:2F:D5:29:\\n BF:4A:FF:2C:85:90:3B:AE:4F:CD:A7:21:27:31:4B:CD:\\n 36:71:62:29:A3:81:A5:4C:96:DF:A D:74:19:11:9E:13:\\n 1B:F6:2E:D1:E8:8B:64:81:0A:1B:A4:B8:2D:52:60:CE:\\n 37:C9:0B:44:78:3E:03:13:63:1D:41:1A:BD:10:C7:AC:\\n 84:F1:6E:73:31:6B:A0:AB:31:1D:C6:73:3B:FF:04:F9:\\n 11:8E:0A:3C:F2:7A:2A:75:71:D7:41:CE:0B:18:C8:F4:\\n F0:6C:F8:80:C9:29:BE:3D:6A:6D:88:2D:04:10:A2:F3:\\n D8:18:CD:0C:9C:66:A9:A6:A0:3F:9A:13:0C:6D:E5:C2:\\n 42:DD:F3:AC:3D:5A:F5:CC:81:B8:BF:7B:4B:9C:A2:7F:\\n E8:0A:AD:BD:3A:D5:AD:38:84:5E:D2:68:F3:E8:A1:01:\\n 9B:93:01:E2:73:B7:BE:5F:C8:88:E5:F4:26:6F:E5:E8:\\n EF:8D:7F:80:D4:BC:8D:A4:89:FE:D0:19:C0:A8:84:EE:\\n BB:8C:1B:C0:24:49:B2:9F:05:38:74:D9:E8:69:0A:7D\\n Extensions: \\n Identifier: Authority Key Identifier - 2.5.29.35\\n Critical: n o \\n Key Identifier: \\n 9F:19:C9:A8:E0:8A:28:CB:C4:ED:81:C0:B8:8D:A7:8D:\\n 4F:EF:59:41\\n Identifier: Basic Constraints - 2.5.29.19\\n Critical: yes \\n Is CA: yes \\n Path Length Constraint: UNLIMITED\\n Identifier: Key Usage: - 2.5.29.15\\n Critical: yes \\n Key Usage: \\n Digital Signature \\n Non Repudiation \\n Key CertSign \\n Crl Sign \\n Identifier: Subject Key Identifier - 2.5.29.14\\n Critical: no \\n Key Identifier: \\n 9F:19:C9:A8:E0:8A:28:CB:C4:ED:81:C0:B8:8D:A7:8D:\\n 4F:EF:59:41\\n Identifier: Authority Info Access: - 1.3.6.1.5.5.7.1.1\ \n Critical: no \\n Access Description: \\n Method #0: ocsp\\n Location #0: URIName: http://ipa-ca.wingon.hk/ca/ocsp%5C%5C%5C%5Cn Signature: \\n Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11\\n Signature: \\n 8A:4F:71:AC:55:7E:C5:A1:05:85:F3:C0:5D:86:57:EE:\\n 8C:A3:50:F7:A0:C6:C9:9D:8C:90:6C:1A:65:82:B3:9C:\\n 3D:58:32:4F:14:80:FF:84:AE:AC:43:5F:D7:A8:C6:1C:\\n 62:0F:BF:72:B5:C6:BC:D9:D8:D5:6F:2C:F5:FB:76:CE:\\n 73:16:87:A0:C9:4C:4E:5C:CA:FC:D9:A4:20:FF:1F:73:\\n 47:8D:7F:1A:15:0C:50:77:F3:AD:2D:F8:56:83:D9:F7:\\n 29:84:F0:24:12:0A:68:42:0B:A2:34:7F:08:4C:91:05:\\n 00:FC:49:CD:53:6F:13:9B:B5:84:BB:8A:1C:8B:5C:FD:\\n 8C:D7:07:6E:93:97:BA:02:C1:20:A1:94:67:67:9B:B6:\\n D4:C4:74:62:4A:D2:F5:04:B3:35:2 F:A1:88:52:31:65:\\n 53:03:0F:EF:A4:B0:33:7B:10:36:41:05:80:73:E3:54:\\n 0D:86:9F:1B:71:62:57:F8:E5:96:0C:2C:EF:97:93:7F:\\n F3:98:05:54:89:BD:E5:AD:EC:D7:F5:FE:C1:30:FF:E0:\\n 3D:C6:CE:9B:34:92:91:3E:98:14:8E:69:61:8D:3E:D5:\\n B7:5A:FD:B4:C5:50:4B:E1:DB:3F:BD:61:86:6A:3D:4B:\\n A4:56:4D:03:AD:7F:17:32:EB:CB:C3:BE:4D:7E:E1:F0:\\n 0E:E6:8F:E9:05:F0:CA:B2:2E:88:3C:01:CB:37:CE:21:\\n E8:5D:7D:36:27:D1:2C:3E:4A:0E:9B:94:C9:3C:60:1B:\\n 37:26:CB:84:E6:25:F0:D4:08:6F:3F:80:F5:75:C6:05:\\n B3:AA:A2:AE:4C:0D:7E:BC:B9:F5:84:C5:89:0A:D1:B5:\\n 62:56:F4:9D:C9:FA:96:89:95:50:7A:E9:48:76:38:FC:\\n 75:3D:79:9D:CB:F0:3E:78:3D:36:DA:84:56:A2:9B:97:\\n E7:DC:74:B9:AF:A1:E7:8F:EB:49:E1:3C:28:F6:A3:EF:\\n 16:E5:DD:5C:4B:A2:E4:9D:B2:AB:62:DB:C5:D9:20:7F\\n Fi ngerPrint\\n MD2:\\n 72:FA:C5:52:3D:9D:C9:F9:81:E3:47:D5:D2:4A:D3:99\\n MD5:\\n 83:78:B6:62:C4:28:DF:5C:96:AB:85:48:B0:0A:BA:56\\n SHA-1:\\n 50:5D:03:72:FE:A6:A4:BC:CE:70:3A:95:67:41:8F:40:\\n 81:17:76:4A\\n SHA-256:\\n 03:6B:AF:80:99:86:C0:AC:7D:88:7A:48:7D:11:79:4D:\\n 5E:C5:DC:C5:BE:06:F5:34:9E:AB:00:05:C3:4F:C0:3E\\n SHA-512:\\n 47:73:2F:2A:85:E6:BE:D0:F2:77:54:82:3E:02:FC:85:\\n 49:F9:26:FF:7B:F8:42:C8:3E:C0:9F:F6:BA:7D:C2:8D:\\n 2F:E2:9C:D9:38:BA:DC:AA:EE:F1:AC:48:F6:5A:C6:48:\\n 59:D5:60:46:F2:16:16:81:B1:E2:59:3F:60:94:C9:AC\\n","Encoded":"-----BEGIN CERTIFICATE-----\\nMIIEhTCCAu2gAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlXSU5HT04uSEsxHjAc\\r\\nBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYwMjMxNDRaFw00MjExMTYwMjMx\\r\\nND RaMDQxEjAQBgNVBAoMCVdJTkdPTi5ISzEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5\\r\\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAu4Q2bd5PsRhJFy1m5o/mu2TKA1NOYTJD\\r\\nhloZv7JUy2USBfu5ZFJ4GmAYvriuFoFUJZxRZ7+2nKng5T0Bwun9UXoKg6Mt4ST7RBD+hk1eqfS4\\r\\n/S3K7Qh7eiGBiM99uloeyj9QbGF1Nd5q3sPkquR7S7OAZPUnJaOT7tI4Crj90DH5hvCGb/Q3Z49g\\r\\nf0RzHwdTjWGoW/0s5bHDUJ92vvxQaaVDh+CTi2FoPoDOEusv1Sm/Sv8shZA7rk/NpyEnMUvNNnFi\\r\\nKaOBpUyW3610GRGeExv2LtHoi2SBChukuC1SYM43yQtEeD4DE2MdQRq9EMeshPFuczFroKsxHcZz\\r\\nO/8E+RGOCjzyeip1cddBzgsYyPTwbPiAySm+PWptiC0EEKLz2BjNDJxmqaagP5oTDG3lwkLd86w9\\r\\nWvXMgbi/e0ucon/oCq29OtWtOIRe0mjz6KEBm5MB4nO3vl/IiOX0Jm/l6O+Nf4DUvI2kif7QGcCo\\r\\nhO67jBvAJEmynwU4dNnoaQp9AgMBAAGjgaEwgZ4wHwYDVR0jBBgwFoAUnxnJqOCKKMvE7YHAuI2n\\r\\njU/vWUEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwHQYDVR0OBBYEFJ8ZyajgiijL\\r\\nxO2BwLiNp41P71lBMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lwYS1jYS53\\r\\naW5nb24uaGsvY2Evb2NzcDANBgkqhkiG9w0BAQsFAAOCAYEAik9xr FV+xaEFhfPAXYZX7oyjUPeg\\r\\nxsmdjJBsGmWCs5w9WDJPFID/hK6sQ1/XqMYcYg+/crXGvNnY1W8s9ft2znMWh6DJTE5cyvzZpCD/\\r\\nH3NHjX8aFQxQd/OtLfhWg9n3KYTwJBIKaEILojR/CEyRBQD8Sc1TbxObtYS7ihyLXP2M1wduk5e6\\r\\nAsEgoZRn [Wed Dec 14 10:46:58.593066 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: IPA: virtual verify retrieve certificate [Wed Dec 14 10:46:58.593525 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Cache lookup: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk [Wed Dec 14 10:46:58.593849 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Requested attrs_list ['objectclass'] [Wed Dec 14 10:46:58.595776 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: DROP: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk [Wed Dec 14 10:46:58.595866 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: DROP: not in cache cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk [Wed Dec 14 10:46:58.596087 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ADD: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk: {'entrylevelrights', 'attributelevelrights', 'objectclass'} all=False [Wed Dec 14 10:46:58.596154 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: MISS: Hits 0 Misses 1 Size 1 [Wed Dec 14 10:46:58.596400 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: raw: ca_show('ipa', chain=False, all=False, version='2.245') [Wed Dec 14 10:46:58.596538 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ca_show('ipa', rights=False, chain=False, all=False, raw=False, version='2.245') [Wed Dec 14 10:46:58.596680 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: raw: ca_is_enabled(version='2.245') [Wed Dec 14 10:46:58.596758 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ca_is_enabled(version='2.245') [Wed Dec 14 10:46:58.597793 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Cache lookup: cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk [Wed Dec 14 10:46:58.597867 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Requested attrs_list ['description', 'ipacasubjectdn', 'cn', 'ipacaid', 'ipacaissuerdn'] [Wed Dec 14 10:46:58.599055 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: DROP: cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk [Wed Dec 14 10:46:58.599146 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: DROP: not in cache cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk [Wed Dec 14 10:46:58.599368 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ADD: cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk: {'description', 'ipacasubjectdn', 'commonname', 'cn', 'ipacaid', 'ipacaissuerdn'} all=False [Wed Dec 14 10:46:58.599434 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: MISS: Hits 0 Misses 2 Size 2 [Wed Dec 14 10:46:58.600765 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: request GET https://wocfreeipa.wingon.hk:443/ca/rest/account/login [Wed Dec 14 10:46:58.600832 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: request body '' [Wed Dec 14 10:46:58.626797 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response status 401 [Wed Dec 14 10:46:58.627246 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response headers Date: Wed, 14 Dec 2022 02:46:58 GMT [Wed Dec 14 10:46:58.627257 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Server: Apache/2.4.37 (rocky) OpenSSL/1.1.1k mod_auth_gssapi/1.6.1 mod_nss/1.0.17 NSS/3.44 mod_wsgi/4.6.4 Python/3.6 [Wed Dec 14 10:46:58.627262 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Cache-Control: private [Wed Dec 14 10:46:58.627266 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Expires: Thu, 01 Jan 1970 00:00:00 GMT [Wed Dec 14 10:46:58.627271 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] WWW-Authenticate: Basic realm="Certificate Authority" [Wed Dec 14 10:46:58.627275 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Content-Type: text/html;charset=utf-8 [Wed Dec 14 10:46:58.627280 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Content-Language: en [Wed Dec 14 10:46:58.627284 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Content-Length: 669 [Wed Dec 14 10:46:58.627288 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.627294 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.627363 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 401 \xe2\x80\x93 Unauthorized</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 401 \xe2\x80\x93 Unauthorized</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The request has not been applied because it lacks valid authentication credentials for the target resource.</p><hr class="line" /><h3>Apache Tomcat/9.0.30</h3></body></html>' [Wed Dec 14 10:46:58.629455 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI wsgi_execute PublicError: Traceback (most recent call last): [Wed Dec 14 10:46:58.629481 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/rpcserver.py", line 407, in wsgi_execute [Wed Dec 14 10:46:58.629487 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] result = command(*args, **options) [Wed Dec 14 10:46:58.629491 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 471, in __call__ [Wed Dec 14 10:46:58.629496 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] return self.__do_call(*args, **options) [Wed Dec 14 10:46:58.629501 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 499, in __do_call [Wed Dec 14 10:46:58.629506 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ret = self.run(*args, **options) [Wed Dec 14 10:46:58.629510 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 821, in run [Wed Dec 14 10:46:58.629515 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] return self.execute(*args, **options) [Wed Dec 14 10:46:58.629519 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/cert.py", line 1388, in execute [Wed Dec 14 10:46:58.629524 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] chain=chain, [Wed Dec 14 10:46:58.629529 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 471, in __call__ [Wed Dec 14 10:46:58.629533 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] return self.__do_call(*args, **options) [Wed Dec 14 10:46:58.629538 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 499, in __do_call [Wed Dec 14 10:46:58.629547 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ret = self.run(*args, **options) [Wed Dec 14 10:46:58.629728 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 821, in run [Wed Dec 14 10:46:58.629734 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] return self.execute(*args, **options) [Wed Dec 14 10:46:58.629739 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/ca.py", line 252, in execute [Wed Dec 14 10:46:58.629744 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] msg = set_certificate_attrs(result['result'], options) [Wed Dec 14 10:46:58.629748 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/ca.py", line 189, in set_certificate_attrs [Wed Dec 14 10:46:58.629757 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] with api.Backend.ra_lightweight_ca as ca_api: [Wed Dec 14 10:46:58.629761 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py", line 1211, in __enter__ [Wed Dec 14 10:46:58.629766 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) [Wed Dec 14 10:46:58.629771 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipalib.errors.RemoteRetrieveError: Failed to authenticate to CA REST API [Wed Dec 14 10:46:58.629796 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.629954 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Wed Dec 14 10:46:58.630022 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError etime=84348352 [Wed Dec 14 10:46:58.630767 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: FINAL: Hits 0 Misses 2 Size 2 [Wed Dec 14 10:46:58.630882 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Destroyed connection context.ldap2_140175871412600
junhou he via FreeIPA-users wrote:
Hi ,
tail -f /var/log/httpd/error_log [Wed Dec 14 10:45:46.672850 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/ca.py", line 189, in set_certificate_attrs [Wed Dec 14 10:45:46.672854 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] with api.Backend.ra_lightweight_ca as ca_api: [Wed Dec 14 10:45:46.672858 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py", line 1211, in __enter__ [Wed Dec 14 10:45:46.672862 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) [Wed Dec 14 10:45:46.672867 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipalib.errors.RemoteRetrieveError: Failed to authenticate to CA REST API [Wed Dec 14 10:45:46.672874 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] [Wed Dec 14 10:45:46.673000 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Wed Dec 14 10:45:46.673047 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipa: DEBUG: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError etime=569221770 [Wed Dec 14 10:45:46.673819 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipa: DEBUG: FINAL: Hits 0 Misses 2 Size 2 [Wed Dec 14 10:45:46.673911 2022] [wsgi:error] [pid 15502:tid 140175850501888] [remote 10.100.0.213:47182] ipa: DEBUG: Destroyed connection context.ldap2_140175871416696 [Wed Dec 14 10:46:58.533496 2022] [:warn] [pid 15505:tid 140175805597440] [client 10.100.0.213:45502] failed to set perms (3140) on file (/run/ipa/ccaches/admin@WINGON.HK-sHvwu4)!, referer: https://wocfreeipa.wingon.hk/ipa/xml [Wed Dec 14 10:46:58.534621 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Wed Dec 14 10:46:58.534727 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI jsonserver_session.__call__: [Wed Dec 14 10:46:58.545384 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Created connection context.ldap2_140175871412600 [Wed Dec 14 10:46:58.545468 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI jsonserver.__call__: [Wed Dec 14 10:46:58.545505 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI WSGIExecutioner.__call__: [Wed Dec 14 10:46:58.551189 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: raw: cert_show('1', version='2.245') [Wed Dec 14 10:46:58.551663 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: cert_show(1, cacn='ipa', chain=False, all=False, raw=False, version='2.245', no_members=False) [Wed Dec 14 10:46:58.552186 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: raw: ca_is_enabled(version='2.245') [Wed Dec 14 10:46:58.552313 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ca_is_enabled(version='2.245') [Wed Dec 14 10:46:58.555552 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ra.get_certificate() [Wed Dec 14 10:46:58.556893 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: request GET https://wocfreeipa.wingon.hk:443/ca/rest/certs/1 [Wed Dec 14 10:46:58.556960 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: request body '' [Wed Dec 14 10:46:58.585446 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response status 200 [Wed Dec 14 10:46:58.587038 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response headers Date: Wed, 14 Dec 2022 02:46:58 GMT [Wed Dec 14 10:46:58.587058 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Server: Apache/2.4.37 (rocky) OpenSSL/1.1.1k mod_auth_gssapi/1.6.1 mod_nss/1.0.17 NSS/3.44 mod_wsgi/4.6.4 Python/3.6 [Wed Dec 14 10:46:58.587064 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Content-Type: application/json [Wed Dec 14 10:46:58.587069 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Vary: Accept-Encoding [Wed Dec 14 10:46:58.587073 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Transfer-Encoding: chunked [Wed Dec 14 10:46:58.587077 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.587084 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.587694 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response body (decoded): b'{"id":"0x1","IssuerDN":"CN=Certificate Authority,O=WINGON.HK","SubjectDN":"CN=Certificate Authority,O=WINGON.HK","PrettyPrint":" Certificate: \\n Data: \\n Version: v3\\n Serial Number: 0x1\\n Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11\\n Issuer: CN=Certificate Authority,O=WINGON.HK\\n Validity: \\n Not Before: Wednesday, November 16, 2022 10:31:44 AM HKT Asia/Hong_Kong\\n Not After: Sunday, November 16, 2042 10:31:44 AM HKT Asia/Hong_Kong\\n Subject: CN=Certificate Authority,O=WINGON.HK\\n Subject Public Key Info: \\n Algorithm: RSA - 1.2.840.113549.1.1.1\\n Public Key: \\n Exponent: 65537\\n Public Key Modulus: (3072 bits) :\\n BB:84:36:6D:DE:4F:B1:18:49:17:2D:66:E6:8F:E6:BB:\\n 64:CA:03:53:4E:61:32:43:86:5A:19:BF:B2:54:CB:65:\\n 12:05:FB:B9:64:52:78:1A:60:18:BE:B8:AE:16:81:54:\\n 25:9C:51:67:BF:B6:9C:A9:E0:E5:3D:01:C2:E9:FD:51:\\n 7A:0A:83:A3:2D:E1:24:FB:44:10:FE:86:4D:5E:A9:F4:\\n B8:FD:2D:CA:ED:08:7B:7A:21:81:88:CF:7D:BA:5A:1E:\\n CA:3F:50:6C:61:75:35:DE:6A:DE:C3:E4:AA:E4:7B:4B:\\n B3:80:64:F5:27:25:A3:93:EE:D2:38:0A:B8:FD:D0:31:\\n F9:86:F0:86:6F:F4:37:67:8F:60:7F:44:73:1F:07:53:\\n 8D:61:A8:5B:FD:2C:E5:B1:C3:50:9F:76:BE:FC:50:69:\\n A5:43:87:E0:93:8B:61:68:3E:80:CE:12:EB:2F:D5:29:\\n BF:4A:FF:2C:85:90:3B:AE:4F:CD:A7:21:27:31:4B:CD:\\n 36:71:62:29:A3:81:A5:4C:96:DF:A D:74:19:11:9E:13:\\n 1B:F6:2E:D1:E8:8B:64:81:0A:1B:A4:B8:2D:52:60:CE:\\n 37:C9:0B:44:78:3E:03:13:63:1D:41:1A:BD:10:C7:AC:\\n 84:F1:6E:73:31:6B:A0:AB:31:1D:C6:73:3B:FF:04:F9:\\n 11:8E:0A:3C:F2:7A:2A:75:71:D7:41:CE:0B:18:C8:F4:\\n F0:6C:F8:80:C9:29:BE:3D:6A:6D:88:2D:04:10:A2:F3:\\n D8:18:CD:0C:9C:66:A9:A6:A0:3F:9A:13:0C:6D:E5:C2:\\n 42:DD:F3:AC:3D:5A:F5:CC:81:B8:BF:7B:4B:9C:A2:7F:\\n E8:0A:AD:BD:3A:D5:AD:38:84:5E:D2:68:F3:E8:A1:01:\\n 9B:93:01:E2:73:B7:BE:5F:C8:88:E5:F4:26:6F:E5:E8:\\n EF:8D:7F:80:D4:BC:8D:A4:89:FE:D0:19:C0:A8:84:EE:\\n BB:8C:1B:C0:24:49:B2:9F:05:38:74:D9:E8:69:0A:7D\\n Extensions: \\n Identifier: Authority Key Identifier - 2.5.29.35\\n Critical: n o \\n Key Identifier: \\n 9F:19:C9:A8:E0:8A:28:CB:C4:ED:81:C0:B8:8D:A7:8D:\\n 4F:EF:59:41\\n Identifier: Basic Constraints - 2.5.29.19\\n Critical: yes \\n Is CA: yes \\n Path Length Constraint: UNLIMITED\\n Identifier: Key Usage: - 2.5.29.15\\n Critical: yes \\n Key Usage: \\n Digital Signature \\n Non Repudiation \\n Key CertSign \\n Crl Sign \\n Identifier: Subject Key Identifier - 2.5.29.14\\n Critical: no \\n Key Identifier: \\n 9F:19:C9:A8:E0:8A:28:CB:C4:ED:81:C0:B8:8D:A7:8D:\\n 4F:EF:59:41\\n Identifier: Authority Info Access: - 1.3.6.1.5.5.7.1.1\ \n Critical: no \\n Access Description: \\n Method #0: ocsp\\n Location #0: URIName: http://ipa-ca.wingon.hk/ca/ocsp%5C%5C%5C%5Cn Signature: \\n Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11\\n Signature: \\n 8A:4F:71:AC:55:7E:C5:A1:05:85:F3:C0:5D:86:57:EE:\\n 8C:A3:50:F7:A0:C6:C9:9D:8C:90:6C:1A:65:82:B3:9C:\\n 3D:58:32:4F:14:80:FF:84:AE:AC:43:5F:D7:A8:C6:1C:\\n 62:0F:BF:72:B5:C6:BC:D9:D8:D5:6F:2C:F5:FB:76:CE:\\n 73:16:87:A0:C9:4C:4E:5C:CA:FC:D9:A4:20:FF:1F:73:\\n 47:8D:7F:1A:15:0C:50:77:F3:AD:2D:F8:56:83:D9:F7:\\n 29:84:F0:24:12:0A:68:42:0B:A2:34:7F:08:4C:91:05:\\n 00:FC:49:CD:53:6F:13:9B:B5:84:BB:8A:1C:8B:5C:FD:\\n 8C:D7:07:6E:93:97:BA:02:C1:20:A1:94:67:67:9B:B6:\\n D4:C4:74:62:4A:D2:F5:04:B3:35:2 F:A1:88:52:31:65:\\n 53:03:0F:EF:A4:B0:33:7B:10:36:41:05:80:73:E3:54:\\n 0D:86:9F:1B:71:62:57:F8:E5:96:0C:2C:EF:97:93:7F:\\n F3:98:05:54:89:BD:E5:AD:EC:D7:F5:FE:C1:30:FF:E0:\\n 3D:C6:CE:9B:34:92:91:3E:98:14:8E:69:61:8D:3E:D5:\\n B7:5A:FD:B4:C5:50:4B:E1:DB:3F:BD:61:86:6A:3D:4B:\\n A4:56:4D:03:AD:7F:17:32:EB:CB:C3:BE:4D:7E:E1:F0:\\n 0E:E6:8F:E9:05:F0:CA:B2:2E:88:3C:01:CB:37:CE:21:\\n E8:5D:7D:36:27:D1:2C:3E:4A:0E:9B:94:C9:3C:60:1B:\\n 37:26:CB:84:E6:25:F0:D4:08:6F:3F:80:F5:75:C6:05:\\n B3:AA:A2:AE:4C:0D:7E:BC:B9:F5:84:C5:89:0A:D1:B5:\\n 62:56:F4:9D:C9:FA:96:89:95:50:7A:E9:48:76:38:FC:\\n 75:3D:79:9D:CB:F0:3E:78:3D:36:DA:84:56:A2:9B:97:\\n E7:DC:74:B9:AF:A1:E7:8F:EB:49:E1:3C:28:F6:A3:EF:\\n 16:E5:DD:5C:4B:A2:E4:9D:B2:AB:62:DB:C5:D9:20:7F\\n Fi ngerPrint\\n MD2:\\n 72:FA:C5:52:3D:9D:C9:F9:81:E3:47:D5:D2:4A:D3:99\\n MD5:\\n 83:78:B6:62:C4:28:DF:5C:96:AB:85:48:B0:0A:BA:56\\n SHA-1:\\n 50:5D:03:72:FE:A6:A4:BC:CE:70:3A:95:67:41:8F:40:\\n 81:17:76:4A\\n SHA-256:\\n 03:6B:AF:80:99:86:C0:AC:7D:88:7A:48:7D:11:79:4D:\\n 5E:C5:DC:C5:BE:06:F5:34:9E:AB:00:05:C3:4F:C0:3E\\n SHA-512:\\n 47:73:2F:2A:85:E6:BE:D0:F2:77:54:82:3E:02:FC:85:\\n 49:F9:26:FF:7B:F8:42:C8:3E:C0:9F:F6:BA:7D:C2:8D:\\n 2F:E2:9C:D9:38:BA:DC:AA:EE:F1:AC:48:F6:5A:C6:48:\\n 59:D5:60:46:F2:16:16:81:B1:E2:59:3F:60:94:C9:AC\\n","Encoded":"-----BEGIN CERTIFICATE-----\\nMIIEhTCCAu2gAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlXSU5HT04uSEsxHjAc\\r\\nBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYwMjMxNDRaFw00MjExMTYwMjMx\\r\\nND RaMDQxEjAQBgNVBAoMCVdJTkdPTi5ISzEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5\\r\\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAu4Q2bd5PsRhJFy1m5o/mu2TKA1NOYTJD\\r\\nhloZv7JUy2USBfu5ZFJ4GmAYvriuFoFUJZxRZ7+2nKng5T0Bwun9UXoKg6Mt4ST7RBD+hk1eqfS4\\r\\n/S3K7Qh7eiGBiM99uloeyj9QbGF1Nd5q3sPkquR7S7OAZPUnJaOT7tI4Crj90DH5hvCGb/Q3Z49g\\r\\nf0RzHwdTjWGoW/0s5bHDUJ92vvxQaaVDh+CTi2FoPoDOEusv1Sm/Sv8shZA7rk/NpyEnMUvNNnFi\\r\\nKaOBpUyW3610GRGeExv2LtHoi2SBChukuC1SYM43yQtEeD4DE2MdQRq9EMeshPFuczFroKsxHcZz\\r\\nO/8E+RGOCjzyeip1cddBzgsYyPTwbPiAySm+PWptiC0EEKLz2BjNDJxmqaagP5oTDG3lwkLd86w9\\r\\nWvXMgbi/e0ucon/oCq29OtWtOIRe0mjz6KEBm5MB4nO3vl/IiOX0Jm/l6O+Nf4DUvI2kif7QGcCo\\r\\nhO67jBvAJEmynwU4dNnoaQp9AgMBAAGjgaEwgZ4wHwYDVR0jBBgwFoAUnxnJqOCKKMvE7YHAuI2n\\r\\njU/vWUEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwHQYDVR0OBBYEFJ8ZyajgiijL\\r\\nxO2BwLiNp41P71lBMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lwYS1jYS53\\r\\naW5nb24uaGsvY2Evb2NzcDANBgkqhkiG9w0BAQsFAAOCAYEAik9xr FV+xaEFhfPAXYZX7oyjUPeg\\r\\nxsmdjJBsGmWCs5w9WDJPFID/hK6sQ1/XqMYcYg+/crXGvNnY1W8s9ft2znMWh6DJTE5cyvzZpCD/\\r\\nH3NHjX8aFQxQd/OtLfhWg9n3KYTwJBIKaEILojR/CEyRBQD8Sc1TbxObtYS7ihyLXP2M1wduk5e6\\r\\nAsEgoZRn [Wed Dec 14 10:46:58.593066 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: IPA: virtual verify retrieve certificate [Wed Dec 14 10:46:58.593525 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Cache lookup: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk [Wed Dec 14 10:46:58.593849 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Requested attrs_list ['objectclass'] [Wed Dec 14 10:46:58.595776 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: DROP: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk [Wed Dec 14 10:46:58.595866 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: DROP: not in cache cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk [Wed Dec 14 10:46:58.596087 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ADD: cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk: {'entrylevelrights', 'attributelevelrights', 'objectclass'} all=False [Wed Dec 14 10:46:58.596154 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: MISS: Hits 0 Misses 1 Size 1 [Wed Dec 14 10:46:58.596400 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: raw: ca_show('ipa', chain=False, all=False, version='2.245') [Wed Dec 14 10:46:58.596538 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ca_show('ipa', rights=False, chain=False, all=False, raw=False, version='2.245') [Wed Dec 14 10:46:58.596680 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: raw: ca_is_enabled(version='2.245') [Wed Dec 14 10:46:58.596758 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ca_is_enabled(version='2.245') [Wed Dec 14 10:46:58.597793 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Cache lookup: cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk [Wed Dec 14 10:46:58.597867 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Requested attrs_list ['description', 'ipacasubjectdn', 'cn', 'ipacaid', 'ipacaissuerdn'] [Wed Dec 14 10:46:58.599055 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: DROP: cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk [Wed Dec 14 10:46:58.599146 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: DROP: not in cache cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk [Wed Dec 14 10:46:58.599368 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: ADD: cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk: {'description', 'ipacasubjectdn', 'commonname', 'cn', 'ipacaid', 'ipacaissuerdn'} all=False [Wed Dec 14 10:46:58.599434 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: MISS: Hits 0 Misses 2 Size 2 [Wed Dec 14 10:46:58.600765 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: request GET https://wocfreeipa.wingon.hk:443/ca/rest/account/login [Wed Dec 14 10:46:58.600832 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: request body '' [Wed Dec 14 10:46:58.626797 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response status 401 [Wed Dec 14 10:46:58.627246 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response headers Date: Wed, 14 Dec 2022 02:46:58 GMT [Wed Dec 14 10:46:58.627257 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Server: Apache/2.4.37 (rocky) OpenSSL/1.1.1k mod_auth_gssapi/1.6.1 mod_nss/1.0.17 NSS/3.44 mod_wsgi/4.6.4 Python/3.6 [Wed Dec 14 10:46:58.627262 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Cache-Control: private [Wed Dec 14 10:46:58.627266 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Expires: Thu, 01 Jan 1970 00:00:00 GMT [Wed Dec 14 10:46:58.627271 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] WWW-Authenticate: Basic realm="Certificate Authority" [Wed Dec 14 10:46:58.627275 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Content-Type: text/html;charset=utf-8 [Wed Dec 14 10:46:58.627280 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Content-Language: en [Wed Dec 14 10:46:58.627284 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] Content-Length: 669 [Wed Dec 14 10:46:58.627288 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.627294 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.627363 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 401 \xe2\x80\x93 Unauthorized</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 401 \xe2\x80\x93 Unauthorized</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The request has not been applied because it lacks valid authentication credentials for the target resource.</p><hr class="line" /><h3>Apache Tomcat/9.0.30</h3></body></html>' [Wed Dec 14 10:46:58.629455 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: WSGI wsgi_execute PublicError: Traceback (most recent call last): [Wed Dec 14 10:46:58.629481 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/rpcserver.py", line 407, in wsgi_execute [Wed Dec 14 10:46:58.629487 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] result = command(*args, **options) [Wed Dec 14 10:46:58.629491 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 471, in __call__ [Wed Dec 14 10:46:58.629496 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] return self.__do_call(*args, **options) [Wed Dec 14 10:46:58.629501 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 499, in __do_call [Wed Dec 14 10:46:58.629506 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ret = self.run(*args, **options) [Wed Dec 14 10:46:58.629510 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 821, in run [Wed Dec 14 10:46:58.629515 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] return self.execute(*args, **options) [Wed Dec 14 10:46:58.629519 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/cert.py", line 1388, in execute [Wed Dec 14 10:46:58.629524 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] chain=chain, [Wed Dec 14 10:46:58.629529 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 471, in __call__ [Wed Dec 14 10:46:58.629533 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] return self.__do_call(*args, **options) [Wed Dec 14 10:46:58.629538 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 499, in __do_call [Wed Dec 14 10:46:58.629547 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ret = self.run(*args, **options) [Wed Dec 14 10:46:58.629728 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 821, in run [Wed Dec 14 10:46:58.629734 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] return self.execute(*args, **options) [Wed Dec 14 10:46:58.629739 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/ca.py", line 252, in execute [Wed Dec 14 10:46:58.629744 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] msg = set_certificate_attrs(result['result'], options) [Wed Dec 14 10:46:58.629748 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/ca.py", line 189, in set_certificate_attrs [Wed Dec 14 10:46:58.629757 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] with api.Backend.ra_lightweight_ca as ca_api: [Wed Dec 14 10:46:58.629761 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py", line 1211, in __enter__ [Wed Dec 14 10:46:58.629766 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) [Wed Dec 14 10:46:58.629771 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipalib.errors.RemoteRetrieveError: Failed to authenticate to CA REST API [Wed Dec 14 10:46:58.629796 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] [Wed Dec 14 10:46:58.629954 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: INFO: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError [Wed Dec 14 10:46:58.630022 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: [jsonserver_session] admin@WINGON.HK: cert_show/1('1', version='2.245'): RemoteRetrieveError etime=84348352 [Wed Dec 14 10:46:58.630767 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: FINAL: Hits 0 Misses 2 Size 2 [Wed Dec 14 10:46:58.630882 2022] [wsgi:error] [pid 15499:tid 140175850501888] [remote 10.100.0.213:45502] ipa: DEBUG: Destroyed connection context.ldap2_140175871412600
Seems to just confirm that the CA is returning a 401.
Early on in the thread Flo asked you to check on something in LDAP and you had a stray character (*). Did you ever double-check that?
ldapsearch -x -o ldif-wrap=no -LLL -s base -h `hostname` -p 389 -b uid=ipara,ou=people,o=ipaca description usercertificate
You want to make sure that the certificate value in /var/lib/ipa/ra-agent.pem is in the usercertificate attribute in LDAP.
The CA uses TLS client authentication to validate the cert. It also does a subject and key comparison (description) and the certificate blob itself (usercertificate).
rob
Hi , I checked again and it matches ldapsearch -x -o ldif-wrap=no -LLL -s base -h `hostname` -p 389 -b uid=ipara,ou=people,o=ipaca description usercertificate dn: uid=ipara,ou=people,o=ipaca description: 2;7;CN=Certificate Authority,O=WINGON.HK;CN=IPA RA,O=WINGON.HK usercertificate:: MIID2zCCAkOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlXSU5HT04uSEsxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYwMjMzMDJaFw0yNDExMDUwMjMzMDJaMCUxEjAQBgNVBAoMCVdJTkdPTi5ISzEPMA0GA1UEAxMGSVBBIFJBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk70qnab7kJNH3Equt/OM5BgDA/8jMLovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21JoNiFznX6PNt5+lNGHeIGV59YWMeNp7+6fOzON3obtdSLCmu+B+8IDxjO0FKPGfjeMFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZYM20qmGlyPP1XE1eoNLlqKGEv7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VDwFjhki/LlSeuT8cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPHR9/tcAd+gWVGNXB4QQIDAQABo4GGMIGDMB8GA1UdIwQYMBaAFJ8ZyajgiijLxO2BwLiNp41P71lBMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lwYS1jYS53aW5nb24uaGsvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAHNXs5jedTldgECYHyiR1dLog9MZt2LlL8CUwOV9CVV7Y6GYK7faEVqQ6asJaMt6lIbfP/5luDDP3I/IV9b0LiKN8lkVCOcQ6h5gWPni5IEc5BKeCAcrF5Val+XhnEXraSyy0Ak5sxlMlKRN0Um8vvsk2t11xYeB4edgqdU6lpr2 3p9jXVZUgdFYcEo2WG0Mf/tES8ekccdYuEUqwK+ftqn1JytbLekVl/uIB79qS5+PIjTBtm8WiC0BWtaR4M/qQPJIwczfQNj3svhtuC/PeL6yWL7j20CkPvOldvIvcyJvRfmblkWWZbjy3xRRa1o1FwjMZbN+c/DA3Fp9HWUv97h6clXb1+n6ZRhthm3R+cD7uK5wGtMzcyM/c0GhonxdCYGuBNYmGuxMv6qGFvga2K18zVi9i4zVoFz27rllTaHWAEQvsI/BSwTKkEiLjNp9XmncKiz2SbMiC0f6i6hwpbk4rmNeM1Zwvo+TTpu7iVP57pz1zMaLXPLInkbjx1A1Wg==
cat /var/lib/ipa/ra-agent.pem -----BEGIN CERTIFICATE----- MIID2zCCAkOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlXSU5H T04uSEsxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYw MjMzMDJaFw0yNDExMDUwMjMzMDJaMCUxEjAQBgNVBAoMCVdJTkdPTi5ISzEPMA0G A1UEAxMGSVBBIFJBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk 70qnab7kJNH3Equt/OM5BgDA/8jMLovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21J oNiFznX6PNt5+lNGHeIGV59YWMeNp7+6fOzON3obtdSLCmu+B+8IDxjO0FKPGfje MFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZYM20qmGlyPP1XE1eoNLlqKGEv 7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VDwFjhki/LlSe uT8cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPH R9/tcAd+gWVGNXB4QQIDAQABo4GGMIGDMB8GA1UdIwQYMBaAFJ8ZyajgiijLxO2B wLiNp41P71lBMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lw YS1jYS53aW5nb24uaGsvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBLAwEwYDVR0lBAww CgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAHNXs5jedTldgECYHyiR1dLo g9MZt2LlL8CUwOV9CVV7Y6GYK7faEVqQ6asJaMt6lIbfP/5luDDP3I/IV9b0LiKN 8lkVCOcQ6h5gWPni5IEc5BKeCAcrF5Val+XhnEXraSyy0Ak5sxlMlKRN0Um8vvsk 2t11xYeB4edgqdU6lpr23p9jXVZUgdFYcEo2WG0Mf/tES8ekccdYuEUqwK+ftqn1 JytbLekVl/uIB79qS5+PIjTBtm8WiC0BWtaR4M/qQPJIwczfQNj3svhtuC/PeL6y WL7j20CkPvOldvIvcyJvRfmblkWWZbjy3xRRa1o1FwjMZbN+c/DA3Fp9HWUv97h6 clXb1+n6ZRhthm3R+cD7uK5wGtMzcyM/c0GhonxdCYGuBNYmGuxMv6qGFvga2K18 zVi9i4zVoFz27rllTaHWAEQvsI/BSwTKkEiLjNp9XmncKiz2SbMiC0f6i6hwpbk4 rmNeM1Zwvo+TTpu7iVP57pz1zMaLXPLInkbjx1A1Wg== -----END CERTIFICATE-----
thanks, junhou
Hi,
Did you check the permissions of the ra-agent certificate files?
# ls -lZ /var/lib/ipa/ra-agent.* -r--r-----. 1 root ipaapi system_u:object_r:ipa_var_lib_t:s0 1704 May 31 2022 /var/lib/ipa/ra-agent.key -r--r-----. 1 root ipaapi system_u:object_r:ipa_var_lib_t:s0 1395 May 31 2022 /var/lib/ipa/ra-agent.pem
The files must be readable by IPA framework.
flo
On Wed, Dec 14, 2022 at 12:10 PM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi , I checked again and it matches ldapsearch -x -o ldif-wrap=no -LLL -s base -h `hostname` -p 389 -b uid=ipara,ou=people,o=ipaca description usercertificate dn: uid=ipara,ou=people,o=ipaca description: 2;7;CN=Certificate Authority,O=WINGON.HK;CN=IPA RA,O= WINGON.HK usercertificate:: MIID2zCCAkOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlXSU5HT04uSEsxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYwMjMzMDJaFw0yNDExMDUwMjMzMDJaMCUxEjAQBgNVBAoMCVdJTkdPTi5ISzEPMA0GA1UEAxMGSVBBIFJBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk70qnab7kJNH3Equt/OM5BgDA/8jMLovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21JoNiFznX6PNt5+lNGHeIGV59YWMeNp7+6fOzON3obtdSLCmu+B+8IDxjO0FKPGfjeMFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZYM20qmGlyPP1XE1eoNLlqKGEv7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VDwFjhki/LlSeuT8cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPHR9/tcAd+gWVGNXB4QQIDAQABo4GGMIGDMB8GA1UdIwQYMBaAFJ8ZyajgiijLxO2BwLiNp41P71lBMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lwYS1jYS53aW5nb24uaGsvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAHNXs5jedTldgECYHyiR1dLog9MZt2LlL8CUwOV9CVV7Y6GYK7faEVqQ6asJaMt6lIbfP/5luDDP3I/IV9b0LiKN8lkVCOcQ6h5gWPni5IEc5BKeCAcrF5Val+XhnEXraSyy0Ak5sxlMlKRN0Um8vvsk2t11xYeB4edgqdU6lpr2
3p9jXVZUgdFYcEo2WG0Mf/tES8ekccdYuEUqwK+ftqn1JytbLekVl/uIB79qS5+PIjTBtm8WiC0BWtaR4M/qQPJIwczfQNj3svhtuC/PeL6yWL7j20CkPvOldvIvcyJvRfmblkWWZbjy3xRRa1o1FwjMZbN+c/DA3Fp9HWUv97h6clXb1+n6ZRhthm3R+cD7uK5wGtMzcyM/c0GhonxdCYGuBNYmGuxMv6qGFvga2K18zVi9i4zVoFz27rllTaHWAEQvsI/BSwTKkEiLjNp9XmncKiz2SbMiC0f6i6hwpbk4rmNeM1Zwvo+TTpu7iVP57pz1zMaLXPLInkbjx1A1Wg==
cat /var/lib/ipa/ra-agent.pem -----BEGIN CERTIFICATE----- MIID2zCCAkOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlXSU5H T04uSEsxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYw MjMzMDJaFw0yNDExMDUwMjMzMDJaMCUxEjAQBgNVBAoMCVdJTkdPTi5ISzEPMA0G A1UEAxMGSVBBIFJBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk 70qnab7kJNH3Equt/OM5BgDA/8jMLovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21J oNiFznX6PNt5+lNGHeIGV59YWMeNp7+6fOzON3obtdSLCmu+B+8IDxjO0FKPGfje MFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZYM20qmGlyPP1XE1eoNLlqKGEv 7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VDwFjhki/LlSe uT8cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPH R9/tcAd+gWVGNXB4QQIDAQABo4GGMIGDMB8GA1UdIwQYMBaAFJ8ZyajgiijLxO2B wLiNp41P71lBMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lw YS1jYS53aW5nb24uaGsvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBLAwEwYDVR0lBAww CgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAHNXs5jedTldgECYHyiR1dLo g9MZt2LlL8CUwOV9CVV7Y6GYK7faEVqQ6asJaMt6lIbfP/5luDDP3I/IV9b0LiKN 8lkVCOcQ6h5gWPni5IEc5BKeCAcrF5Val+XhnEXraSyy0Ak5sxlMlKRN0Um8vvsk 2t11xYeB4edgqdU6lpr23p9jXVZUgdFYcEo2WG0Mf/tES8ekccdYuEUqwK+ftqn1 JytbLekVl/uIB79qS5+PIjTBtm8WiC0BWtaR4M/qQPJIwczfQNj3svhtuC/PeL6y WL7j20CkPvOldvIvcyJvRfmblkWWZbjy3xRRa1o1FwjMZbN+c/DA3Fp9HWUv97h6 clXb1+n6ZRhthm3R+cD7uK5wGtMzcyM/c0GhonxdCYGuBNYmGuxMv6qGFvga2K18 zVi9i4zVoFz27rllTaHWAEQvsI/BSwTKkEiLjNp9XmncKiz2SbMiC0f6i6hwpbk4 rmNeM1Zwvo+TTpu7iVP57pz1zMaLXPLInkbjx1A1Wg== -----END CERTIFICATE-----
thanks, junhou _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi,
we disable selinux ls -lZ /var/lib/ipa/ra-agent.* -rwxrwxrwx 1 root ipaapi ? 1704 Nov 16 10:33 /var/lib/ipa/ra-agent.key -rwxrwxrwx 1 root ipaapi ? 1399 Nov 16 10:33 /var/lib/ipa/ra-agent.pem
Hi,
Let's restart from scratch this investigation. When you run "ipa cert-show 1", does it trigger any log in /var/log/httpd/access_log and /var/log/httpd/ssl_request_log? On a working instance I have the following: in access_log: 10.0.138.204 - - [16/Dec/2022:09:20:32 -0500] "GET /ca/rest/certs/1 HTTP/1.1" 200 9973 10.0.138.204 - - [16/Dec/2022:09:20:32 -0500] "GET /ca/rest/account/login HTTP/1.1" 200 304 10.0.138.204 - - [16/Dec/2022:09:20:32 -0500] "GET /ca/rest/authorities/7126aa53-8759-424c-92ca-17d36df4a183/cert HTTP/1.1" 200 1158 10.0.138.204 - - [16/Dec/2022:09:20:32 -0500] "GET /ca/rest/account/logout HTTP/1.1" 204 -
in ssl_request_log: [16/Dec/2022:09:20:32 -0500] 10.0.138.204 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ca/rest/certs/1 HTTP/1.1" 9973 [16/Dec/2022:09:20:32 -0500] 10.0.138.204 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ca/rest/account/login HTTP/1.1" 304 [16/Dec/2022:09:20:32 -0500] 10.0.138.204 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ca/rest/authorities/7126aa53-8759-424c-92ca-17d36df4a183/cert HTTP/1.1" 1158 [16/Dec/2022:09:20:32 -0500] 10.0.138.204 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /ca/rest/account/logout HTTP/1.1" -
We can see the first operation that is not authenticated (ca/rest/certs/1) then the second one requires authentication (/ca/rest/account/login executed before /ca/rest/authorities/xxx). Is there a corresponding log in /var/log/pki/pki-tomcat/localhost_access_log.$DATE.txt ? When the AJP connector is properly set, the operation should also be visible here, for instance:
10.0.138.204 - - [16/Dec/2022:09:20:32 -0500] "GET /ca/rest/certs/1 HTTP/1.1" 200 9973 10.0.138.204 - ipara [16/Dec/2022:09:20:32 -0500] "GET /ca/rest/account/login HTTP/1.1" 200 304 10.0.138.204 - ipara [16/Dec/2022:09:20:32 -0500] "GET /ca/rest/authorities/7126aa53-8759-424c-92ca-17d36df4a183/cert HTTP/1.1" 200 1158 10.0.138.204 - ipara [16/Dec/2022:09:20:32 -0500] "GET /ca/rest/account/logout HTTP/1.1" 204 -
Then the logs in /var/log/pki/pki-tomcat/ca/debug.$DATE.log should show the operations with: 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] INFO: Getting certificate 0x1 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: Authenticating certificate chain: 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: - CN=IPA RA, O=IPA.TEST 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: CertUserDBAuthentication: UID ipara authenticated. 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: User ID: ipara 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: UGSubsystem: retrieving user uid=ipara,ou=People,o=ipaca 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: User DN: uid=ipara,ou=people,o=ipaca 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: Roles: 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: - Certificate Manager Agents 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: - Registration Manager Agents 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: - Security Domain Administrators 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: PKIRealm: - Enterprise ACME Administrators 2022-12-16 09:20:32 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] INFO: AAclAuthz: Granting login permission for certServer.ca.account
As the authentication is done with the RA cert, and we saw that your ra cert has serial=7, we need to ensure that the cert is valid: what is the output of ldapsearch -D cn=directory\ manager -W -b "cn=7,ou=certificateRepository, ou=ca,o=ipaca"
The output should display certStatus: VALID and userCertificate;binary should contain the same cert as /var/lib/ipa/ra-agent.pem
flo
On Thu, Dec 15, 2022 at 3:34 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi,
we disable selinux ls -lZ /var/lib/ipa/ra-agent.* -rwxrwxrwx 1 root ipaapi ? 1704 Nov 16 10:33 /var/lib/ipa/ra-agent.key -rwxrwxrwx 1 root ipaapi ? 1399 Nov 16 10:33 /var/lib/ipa/ra-agent.pem _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi, tail -f /var/log/pki/pki-tomcat/localhost_access_log.2022-12-19.txt 10.100.0.213 - - [19/Dec/2022:09:59:45 +0800] "GET /ca/rest/certs/1 HTTP/1.1" 200 9991 10.100.0.213 - - [19/Dec/2022:09:59:45 +0800] "GET /ca/rest/account/login HTTP/1.1" 401 669 10.100.0.213 - - [19/Dec/2022:10:00:01 +0800] "GET /ca/rest/certs/1 HTTP/1.1" 200 9991 10.100.0.213 - - [19/Dec/2022:10:00:01 +0800] "GET /ca/rest/account/login HTTP/1.1" 401 669 10.100.0.213 - - [19/Dec/2022:10:01:50 +0800] "GET /ca/rest/certs/1 HTTP/1.1" 200 9991 10.100.0.213 - - [19/Dec/2022:10:01:50 +0800] "GET /ca/rest/account/login HTTP/1.1" 401 669 10.100.0.213 - - [19/Dec/2022:10:03:33 +0800] "GET /ca/rest/certs/1 HTTP/1.1" 200 9991 10.100.0.213 - - [19/Dec/2022:10:03:33 +0800] "GET /ca/rest/account/login HTTP/1.1" 401 669
ldapsearch -D cn=directory\ manager -W -b "cn=7,ou=certificateRepository,
ou=ca,o=ipaca"
Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=7,ou=certificateRepository, ou=ca,o=ipaca> with scope subtree # filter: (objectclass=*) # requesting: ALL #
# 7, certificateRepository, ca, ipaca dn: cn=7,ou=certificateRepository,ou=ca,o=ipaca objectClass: top objectClass: certificateRecord serialno: 017 metaInfo: requestId:7 metaInfo: profileId:caSubsystemCert notBefore: 20221116103302Z notAfter: 20241105103302Z duration: 1162208000000 subjectName: CN=IPA RA,O=WINGON.HK issuerName: CN=Certificate Authority,O=WINGON.HK publicKeyData:: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk70qnab7kJNH3Eq ut/OM5BgDA/8jMLovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21JoNiFznX6PNt5+lNGHeIGV59YWMe Np7+6fOzON3obtdSLCmu+B+8IDxjO0FKPGfjeMFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZY M20qmGlyPP1XE1eoNLlqKGEv7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VD wFjhki/LlSeuT8cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPHR9 /tcAd+gWVGNXB4QQIDAQAB extension: 2.5.29.35 extension: 1.3.6.1.5.5.7.1.1 extension: 2.5.29.37 extension: 2.5.29.15 userCertificate;binary:: MIID2zCCAkOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDV QQKDAlXSU5HT04uSEsxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYwMj MzMDJaFw0yNDExMDUwMjMzMDJaMCUxEjAQBgNVBAoMCVdJTkdPTi5ISzEPMA0GA1UEAxMGSVBBIFJ BMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk70qnab7kJNH3Equt/OM5BgDA/8jM LovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21JoNiFznX6PNt5+lNGHeIGV59YWMeNp7+6fOzON3obt dSLCmu+B+8IDxjO0FKPGfjeMFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZYM20qmGlyPP1XE1 eoNLlqKGEv7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VDwFjhki/LlSeuT8 cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPHR9/tcAd+gWVGNXB4 QQIDAQABo4GGMIGDMB8GA1UdIwQYMBaAFJ8ZyajgiijLxO2BwLiNp41P71lBMDsGCCsGAQUFBwEBB C8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lwYS1jYS53aW5nb24uaGsvY2Evb2NzcDAOBgNVHQ8BAf 8EBAMCBLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAHNXs5jedTldgEC YHyiR1dLog9MZt2LlL8CUwOV9CVV7Y6GYK7faEVqQ6asJaMt6lIbfP/5luDDP3I/IV9b0LiKN8lkV COcQ6h5gWPni5IEc5BKeCAcrF5Val+XhnEXraSyy0Ak5sxlMlKRN0Um8vvsk2t11xYeB4edgqdU6l pr23p9jXVZUgdFYcEo2WG0Mf/tES8ekccdYuEUqwK+ftqn1JytbLekVl/uIB79qS5+PIjTBtm8WiC 0BWtaR4M/qQPJIwczfQNj3svhtuC/PeL6yWL7j20CkPvOldvIvcyJvRfmblkWWZbjy3xRRa1o1Fwj MZbN+c/DA3Fp9HWUv97h6clXb1+n6ZRhthm3R+cD7uK5wGtMzcyM/c0GhonxdCYGuBNYmGuxMv6qG Fvga2K18zVi9i4zVoFz27rllTaHWAEQvsI/BSwTKkEiLjNp9XmncKiz2SbMiC0f6i6hwpbk4rmNeM 1Zwvo+TTpu7iVP57pz1zMaLXPLInkbjx1A1Wg== version: 2 algorithmId: 1.2.840.113549.1.1.1 signingAlgorithmId: 1.2.840.113549.1.1.11 dateOfCreate: 20221116103303Z dateOfModify: 20221116103303Z certStatus: VALID autoRenew: ENABLED issuedBy: admin cn: 7
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
cat /var/lib/ipa/ra-agent.pem -----BEGIN CERTIFICATE----- MIID2zCCAkOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlXSU5H T04uSEsxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYw MjMzMDJaFw0yNDExMDUwMjMzMDJaMCUxEjAQBgNVBAoMCVdJTkdPTi5ISzEPMA0G A1UEAxMGSVBBIFJBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk 70qnab7kJNH3Equt/OM5BgDA/8jMLovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21J oNiFznX6PNt5+lNGHeIGV59YWMeNp7+6fOzON3obtdSLCmu+B+8IDxjO0FKPGfje MFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZYM20qmGlyPP1XE1eoNLlqKGEv 7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VDwFjhki/LlSe uT8cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPH R9/tcAd+gWVGNXB4QQIDAQABo4GGMIGDMB8GA1UdIwQYMBaAFJ8ZyajgiijLxO2B wLiNp41P71lBMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lw YS1jYS53aW5nb24uaGsvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBLAwEwYDVR0lBAww CgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAHNXs5jedTldgECYHyiR1dLo g9MZt2LlL8CUwOV9CVV7Y6GYK7faEVqQ6asJaMt6lIbfP/5luDDP3I/IV9b0LiKN 8lkVCOcQ6h5gWPni5IEc5BKeCAcrF5Val+XhnEXraSyy0Ak5sxlMlKRN0Um8vvsk 2t11xYeB4edgqdU6lpr23p9jXVZUgdFYcEo2WG0Mf/tES8ekccdYuEUqwK+ftqn1 JytbLekVl/uIB79qS5+PIjTBtm8WiC0BWtaR4M/qQPJIwczfQNj3svhtuC/PeL6y WL7j20CkPvOldvIvcyJvRfmblkWWZbjy3xRRa1o1FwjMZbN+c/DA3Fp9HWUv97h6 clXb1+n6ZRhthm3R+cD7uK5wGtMzcyM/c0GhonxdCYGuBNYmGuxMv6qGFvga2K18 zVi9i4zVoFz27rllTaHWAEQvsI/BSwTKkEiLjNp9XmncKiz2SbMiC0f6i6hwpbk4 rmNeM1Zwvo+TTpu7iVP57pz1zMaLXPLInkbjx1A1Wg== -----END CERTIFICATE-----
the cert is vaild, and binary contain the same cert as /var/lib/ipa/ra-agent.pem,but the logs show unauthorized
Hi,
On Mon, Dec 19, 2022 at 3:25 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi, tail -f /var/log/pki/pki-tomcat/localhost_access_log.2022-12-19.txt 10.100.0.213 - - [19/Dec/2022:09:59:45 +0800] "GET /ca/rest/certs/1 HTTP/1.1" 200 9991 10.100.0.213 - - [19/Dec/2022:09:59:45 +0800] "GET /ca/rest/account/login HTTP/1.1" 401 669 10.100.0.213 - - [19/Dec/2022:10:00:01 +0800] "GET /ca/rest/certs/1 HTTP/1.1" 200 9991 10.100.0.213 - - [19/Dec/2022:10:00:01 +0800] "GET /ca/rest/account/login HTTP/1.1" 401 669 10.100.0.213 - - [19/Dec/2022:10:01:50 +0800] "GET /ca/rest/certs/1 HTTP/1.1" 200 9991 10.100.0.213 - - [19/Dec/2022:10:01:50 +0800] "GET /ca/rest/account/login HTTP/1.1" 401 669 10.100.0.213 - - [19/Dec/2022:10:03:33 +0800] "GET /ca/rest/certs/1 HTTP/1.1" 200 9991 10.100.0.213 - - [19/Dec/2022:10:03:33 +0800] "GET /ca/rest/account/login HTTP/1.1" 401 669
As the logs show the login op, it means that the server.xml and /etc/httpd/conf.d/ipa-pki-proxy.conf
are consistent. Do you see any log in /var/log/pki/pki-tomcat/ca/debug.$DATE.log starting with a line like: [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-9] INFO: PKIRealm: Authenticating certificate chain:
The lines after this one should contain more information, like cert not revoked, the user the cert is mapped to, ... Other things that could be checked: - do multiple users map to this certificate? Look in dirsrv access log (/var/log/dirsrv/slapd-<domain>/access) for a SRCH op similar to: SRCH base="ou=People,o=ipaca" scope=2 filter="(description=2;7;CN=Certificate Authority,O=WINGON.HK;CN=IPA RA,O= WINGON.HK)" Does the corresponding RESULT line show nentries=1 or a different number of results?
- is the ipara user a member of the right groups? ldapsearch -D "cn=directory manager" -W -b ou=Groups,o=ipaca "(&(objectClass=groupofuniquenames)(uniqueMember=uid=ipara,ou=people,o=ipaca))" cn description
flo
ldapsearch -D cn=directory\ manager -W -b "cn=7,ou=certificateRepository,
ou=ca,o=ipaca"
Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=7,ou=certificateRepository, ou=ca,o=ipaca> with scope subtree # filter: (objectclass=*) # requesting: ALL #
# 7, certificateRepository, ca, ipaca dn: cn=7,ou=certificateRepository,ou=ca,o=ipaca objectClass: top objectClass: certificateRecord serialno: 017 metaInfo: requestId:7 metaInfo: profileId:caSubsystemCert notBefore: 20221116103302Z notAfter: 20241105103302Z duration: 1162208000000 subjectName: CN=IPA RA,O=WINGON.HK issuerName: CN=Certificate Authority,O=WINGON.HK publicKeyData:: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk70qnab7kJNH3Eq
ut/OM5BgDA/8jMLovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21JoNiFznX6PNt5+lNGHeIGV59YWMe
Np7+6fOzON3obtdSLCmu+B+8IDxjO0FKPGfjeMFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZY
M20qmGlyPP1XE1eoNLlqKGEv7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VD
wFjhki/LlSeuT8cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPHR9 /tcAd+gWVGNXB4QQIDAQAB extension: 2.5.29.35 extension: 1.3.6.1.5.5.7.1.1 extension: 2.5.29.37 extension: 2.5.29.15 userCertificate;binary:: MIID2zCCAkOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDV
QQKDAlXSU5HT04uSEsxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYwMj
MzMDJaFw0yNDExMDUwMjMzMDJaMCUxEjAQBgNVBAoMCVdJTkdPTi5ISzEPMA0GA1UEAxMGSVBBIFJ
BMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk70qnab7kJNH3Equt/OM5BgDA/8jM
LovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21JoNiFznX6PNt5+lNGHeIGV59YWMeNp7+6fOzON3obt
dSLCmu+B+8IDxjO0FKPGfjeMFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZYM20qmGlyPP1XE1
eoNLlqKGEv7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VDwFjhki/LlSeuT8
cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPHR9/tcAd+gWVGNXB4
QQIDAQABo4GGMIGDMB8GA1UdIwQYMBaAFJ8ZyajgiijLxO2BwLiNp41P71lBMDsGCCsGAQUFBwEBB
C8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lwYS1jYS53aW5nb24uaGsvY2Evb2NzcDAOBgNVHQ8BAf
8EBAMCBLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAHNXs5jedTldgEC
YHyiR1dLog9MZt2LlL8CUwOV9CVV7Y6GYK7faEVqQ6asJaMt6lIbfP/5luDDP3I/IV9b0LiKN8lkV
COcQ6h5gWPni5IEc5BKeCAcrF5Val+XhnEXraSyy0Ak5sxlMlKRN0Um8vvsk2t11xYeB4edgqdU6l
pr23p9jXVZUgdFYcEo2WG0Mf/tES8ekccdYuEUqwK+ftqn1JytbLekVl/uIB79qS5+PIjTBtm8WiC
0BWtaR4M/qQPJIwczfQNj3svhtuC/PeL6yWL7j20CkPvOldvIvcyJvRfmblkWWZbjy3xRRa1o1Fwj
MZbN+c/DA3Fp9HWUv97h6clXb1+n6ZRhthm3R+cD7uK5wGtMzcyM/c0GhonxdCYGuBNYmGuxMv6qG
Fvga2K18zVi9i4zVoFz27rllTaHWAEQvsI/BSwTKkEiLjNp9XmncKiz2SbMiC0f6i6hwpbk4rmNeM 1Zwvo+TTpu7iVP57pz1zMaLXPLInkbjx1A1Wg== version: 2 algorithmId: 1.2.840.113549.1.1.1 signingAlgorithmId: 1.2.840.113549.1.1.11 dateOfCreate: 20221116103303Z dateOfModify: 20221116103303Z certStatus: VALID autoRenew: ENABLED issuedBy: admin cn: 7
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
cat /var/lib/ipa/ra-agent.pem -----BEGIN CERTIFICATE----- MIID2zCCAkOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlXSU5H T04uSEsxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMjExMTYw MjMzMDJaFw0yNDExMDUwMjMzMDJaMCUxEjAQBgNVBAoMCVdJTkdPTi5ISzEPMA0G A1UEAxMGSVBBIFJBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAweZk 70qnab7kJNH3Equt/OM5BgDA/8jMLovrMckOEuR0i7ESdbhYs7WXIRdz24Sfj21J oNiFznX6PNt5+lNGHeIGV59YWMeNp7+6fOzON3obtdSLCmu+B+8IDxjO0FKPGfje MFXnY5SgxylBPqZ7O80Toa6hr+NgFnloFzBZxZZYM20qmGlyPP1XE1eoNLlqKGEv 7dhyt+quAfos0OYwlsiQUe1x99Yh4ACtEXUiaDNgFbMrqSNmaB0VDwFjhki/LlSe uT8cf3qhasO/1uXqLVGfk1Rp6tLgpQM7Yme82xP+7mU9qb+2rmvwZEZ7IdhYtyPH R9/tcAd+gWVGNXB4QQIDAQABo4GGMIGDMB8GA1UdIwQYMBaAFJ8ZyajgiijLxO2B wLiNp41P71lBMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL2lw YS1jYS53aW5nb24uaGsvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBLAwEwYDVR0lBAww CgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAHNXs5jedTldgECYHyiR1dLo g9MZt2LlL8CUwOV9CVV7Y6GYK7faEVqQ6asJaMt6lIbfP/5luDDP3I/IV9b0LiKN 8lkVCOcQ6h5gWPni5IEc5BKeCAcrF5Val+XhnEXraSyy0Ak5sxlMlKRN0Um8vvsk 2t11xYeB4edgqdU6lpr23p9jXVZUgdFYcEo2WG0Mf/tES8ekccdYuEUqwK+ftqn1 JytbLekVl/uIB79qS5+PIjTBtm8WiC0BWtaR4M/qQPJIwczfQNj3svhtuC/PeL6y WL7j20CkPvOldvIvcyJvRfmblkWWZbjy3xRRa1o1FwjMZbN+c/DA3Fp9HWUv97h6 clXb1+n6ZRhthm3R+cD7uK5wGtMzcyM/c0GhonxdCYGuBNYmGuxMv6qGFvga2K18 zVi9i4zVoFz27rllTaHWAEQvsI/BSwTKkEiLjNp9XmncKiz2SbMiC0f6i6hwpbk4 rmNeM1Zwvo+TTpu7iVP57pz1zMaLXPLInkbjx1A1Wg== -----END CERTIFICATE-----
the cert is vaild, and binary contain the same cert as /var/lib/ipa/ra-agent.pem,but the logs show unauthorized _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi, tail -f /var/log/pki/pki-tomcat/ca/debug.2022-12-20.log 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-20 08:49:32 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-20 08:52:50 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: Getting certificate 0x1 2022-12-20 08:52:50 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:54:32 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-20 08:54:35 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-20 08:54:35 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-20 08:54:35 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED)
tail -f /var/log/dirsrv/slapd-WINGON-HK/access [20/Dec/2022:09:02:42.692704846 +0800] conn=2900 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:09:02:42.693154479 +0800] conn=2900 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000085573 optime=0.000458433 etime=0.000543125 [20/Dec/2022:09:02:42.697272544 +0800] conn=2900 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:09:02:42.698855885 +0800] conn=2900 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000073994 optime=0.001572452 etime=0.001643806 [20/Dec/2022:09:02:42.700657032 +0800] conn=2900 op=7 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:09:02:42.700962545 +0800] conn=2900 op=7 RESULT err=0 tag=120 nentries=0 wtime=0.000139301 optime=0.000318407 etime=0.000456836 [20/Dec/2022:09:02:42.705290181 +0800] conn=2900 op=8 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:09:02:42.707796203 +0800] conn=2900 op=8 RESULT err=0 tag=120 nentries=0 wtime=0.000185974 optime=0.002508316 etime=0.002691736 [20/Dec/2022:09:03:42.726943689 +0800] conn=2900 op=9 UNBIND [20/Dec/2022:09:03:42.727016226 +0800] conn=2900 op=9 fd=124 closed error - U1 [20/Dec/2022:09:04:31.059429193 +0800] conn=2901 fd=77 slot=77 connection from 10.100.0.213 to 10.100.0.213 [20/Dec/2022:09:04:31.062126284 +0800] conn=2901 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Dec/2022:09:04:31.064368644 +0800] conn=2901 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000254605 optime=0.002247116 etime=0.002500343 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:09:04:31.067358291 +0800] conn=2901 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:09:04:31.067884679 +0800] conn=2901 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000120718 optime=0.000535934 etime=0.000654762 [20/Dec/2022:09:04:31.069260735 +0800] conn=2901 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL [20/Dec/2022:09:04:31.069847504 +0800] conn=2901 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000123265 optime=0.000588648 etime=0.000709935 [20/Dec/2022:09:04:31.088542693 +0800] conn=19 op=5331 SRCH base="cn=1,ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:09:04:31.088794885 +0800] conn=19 op=5331 RESULT err=0 tag=101 nentries=1 wtime=0.000131894 optime=0.000253526 etime=0.000383435 [20/Dec/2022:09:04:31.100233153 +0800] conn=2901 op=3 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" [20/Dec/2022:09:04:31.100297979 +0800] conn=2901 op=3 RESULT err=0 tag=120 nentries=0 wtime=0.000092504 optime=0.000078842 etime=0.000169340 [20/Dec/2022:09:04:31.100582540 +0800] conn=2901 op=4 SRCH base="cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass" [20/Dec/2022:09:04:31.101301014 +0800] conn=2901 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000089696 optime=0.000718765 etime=0.000806178 - entryLevelRights: vadn [20/Dec/2022:09:04:31.103206149 +0800] conn=2901 op=5 SRCH base="cn=cas,cn=ca,dc=wingon,dc=hk" scope=2 filter="(&(cn=ipa)(objectClass=ipaca))" attrs="" [20/Dec/2022:09:04:31.103618859 +0800] conn=2901 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000094913 optime=0.000414408 etime=0.000507374 [20/Dec/2022:09:04:31.104283197 +0800] conn=2901 op=6 SRCH base="cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaCaId cn description ipaCaSubjectDN ipaCaIssuerDN" [20/Dec/2022:09:04:31.104553278 +0800] conn=2901 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000092105 optime=0.000271539 etime=0.000362000 [20/Dec/2022:09:04:31.106067554 +0800] conn=2901 op=7 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [20/Dec/2022:09:04:31.106596243 +0800] conn=2901 op=7 RESULT err=0 tag=101 nentries=1 wtime=0.000144092 optime=0.000530265 etime=0.000672601 [20/Dec/2022:09:04:31.125207280 +0800] conn=2901 op=8 UNBIND [20/Dec/2022:09:04:31.125229178 +0800] conn=2901 op=8 fd=77 closed error - U1 [20/Dec/2022:09:04:32.044788344 +0800] conn=27 op=3416 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn" [20/Dec/2022:09:04:32.045037986 +0800] conn=27 op=3416 RESULT err=32 tag=101 nentries=0 wtime=0.000131158 optime=0.000252952 etime=0.000381325 [20/Dec/2022:09:04:35.020912165 +0800] conn=19 op=5333 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="description" [20/Dec/2022:09:04:35.021127672 +0800] conn=19 op=5333 RESULT err=0 tag=101 nentries=1 wtime=0.000139714 optime=0.000220328 etime=0.000357248 [20/Dec/2022:09:04:38.153925748 +0800] conn=28 op=6829 SRCH base="ou=authorizations,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220010438+0000)" attrs="1.1" [20/Dec/2022:09:04:38.154147606 +0800] conn=28 op=6829 RESULT err=0 tag=101 nentries=0 wtime=0.000138731 optime=0.000226372 etime=0.000362267 [20/Dec/2022:09:04:38.154503158 +0800] conn=28 op=6830 SRCH base="ou=orders,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220010438+0000)" attrs="1.1" [20/Dec/2022:09:04:38.154624386 +0800] conn=28 op=6830 RESULT err=0 tag=101 nentries=0 wtime=0.000228268 optime=0.000122646 etime=0.000349204 [20/Dec/2022:09:04:38.154854286 +0800] conn=28 op=6831 SRCH base="ou=certificates,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220010438+0000)" attrs="1.1" [20/Dec/2022:09:04:38.154950593 +0800] conn=28 op=6831 RESULT err=0 tag=101 nentries=0 wtime=0.000159553 optime=0.000097292 etime=0.000255334 [20/Dec/2022:09:04:38.398853998 +0800] conn=19 op=5334 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(certStatus=INVALID)" attrs="objectClass serialno notBefore notAfter duration extension subjectName issuerName userCertificate version algorithmId signingAlgorithmId publicKeyData" [20/Dec/2022:09:04:38.399125270 +0800] conn=19 op=5334 VLV 200:0:20221220090438Z 0:0 (0) [20/Dec/2022:09:04:38.399186312 +0800] conn=19 op=5334 RESULT err=0 tag=101 nentries=0 wtime=0.000106897 optime=0.000334514 etime=0.000439629 notes=U details="Partially Unindexed Filter" [20/Dec/2022:09:04:38.400127700 +0800] conn=19 op=5335 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(certStatus=VALID)" attrs="objectClass serialno notBefore notAfter duration extension subjectName issuerName userCertificate version algorithmId signingAlgorithmId publicKeyData" [20/Dec/2022:09:04:38.400265687 +0800] conn=19 op=5335 SORT notAfter [20/Dec/2022:09:04:38.400273908 +0800] conn=19 op=5335 VLV 200:0:20221220090438Z 1:10 (0) [20/Dec/2022:09:04:38.400433546 +0800] conn=19 op=5335 RESULT err=0 tag=101 nentries=1 wtime=0.000761697 optime=0.000307959 etime=0.001067831 [20/Dec/2022:09:04:38.401553390 +0800] conn=19 op=5336 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(certStatus=REVOKED)" attrs="objectClass revokedOn serialno revInfo notAfter notBefore duration extension subjectName issuerName userCertificate version algorithmId signingAlgorithmId publicKeyData" [20/Dec/2022:09:04:38.401693292 +0800] conn=19 op=5336 VLV 200:0:20221220090438Z 0:0 (0) [20/Dec/2022:09:04:38.401734871 +0800] conn=19 op=5336 RESULT err=0 tag=101 nentries=0 wtime=0.001004479 optime=0.000183378 etime=0.001186338 notes=U details="Partially Unindexed Filter" [20/Dec/2022:09:07:01.986680374 +0800] conn=2893 op=8 UNBIND [20/Dec/2022:09:07:01.986743775 +0800] conn=2893 op=8 fd=73 closed error - U1 [20/Dec/2022:09:07:09.990796378 +0800] conn=2902 fd=73 slot=73 connection from 10.99.16.212 to 10.100.0.213 [20/Dec/2022:09:07:09.991696144 +0800] conn=2902 op=0 SRCH base="" scope=0 filter="(objectClass=*)" attrs="* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domaincontrollerfunctionality defaultnamingcontext lastusn highestcommittedusn aci" [20/Dec/2022:09:07:09.993461062 +0800] conn=2902 op=0 RESULT err=0 tag=101 nentries=1 wtime=0.000704701 optime=0.001764919 etime=0.002467783 [20/Dec/2022:09:07:10.015698288 +0800] conn=4 op=14011 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/wocfreeipa-rep.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=host/wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.016098918 +0800] conn=4 op=14011 RESULT err=0 tag=101 nentries=1 wtime=0.000305749 optime=0.000403957 etime=0.000707230 [20/Dec/2022:09:07:10.016191408 +0800] conn=4 op=14012 SRCH base="cn=ipaConfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Dec/2022:09:07:10.016264058 +0800] conn=4 op=14012 RESULT err=0 tag=101 nentries=1 wtime=0.000074145 optime=0.000073449 etime=0.000146247 [20/Dec/2022:09:07:10.016440110 +0800] conn=4 op=14013 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.016523232 +0800] conn=4 op=14013 RESULT err=0 tag=101 nentries=1 wtime=0.000165771 optime=0.000084128 etime=0.000248720 [20/Dec/2022:09:07:10.016619153 +0800] conn=4 op=14014 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.016858822 +0800] conn=4 op=14014 RESULT err=0 tag=101 nentries=1 wtime=0.000084854 optime=0.000241017 etime=0.000324497 [20/Dec/2022:09:07:10.017103462 +0800] conn=4 op=14015 SRCH base="cn=Default Host Password Policy,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:09:07:10.017187893 +0800] conn=4 op=14015 RESULT err=0 tag=101 nentries=1 wtime=0.000230849 optime=0.000085268 etime=0.000315017 [20/Dec/2022:09:07:10.020212710 +0800] conn=4 op=14016 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/wocfreeipa-rep.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=host/wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.020466417 +0800] conn=4 op=14016 RESULT err=0 tag=101 nentries=1 wtime=0.003013741 optime=0.000255802 etime=0.003267500 [20/Dec/2022:09:07:10.020591401 +0800] conn=4 op=14017 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.020669810 +0800] conn=4 op=14017 RESULT err=0 tag=101 nentries=1 wtime=0.000108579 optime=0.000079118 etime=0.000186522 [20/Dec/2022:09:07:10.020753948 +0800] conn=4 op=14018 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.020958618 +0800] conn=4 op=14018 RESULT err=0 tag=101 nentries=1 wtime=0.000073304 optime=0.000205858 etime=0.000277765 [20/Dec/2022:09:07:10.021085102 +0800] conn=4 op=14019 SRCH base="cn=Default Host Password Policy,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:09:07:10.021177866 +0800] conn=4 op=14019 RESULT err=0 tag=101 nentries=1 wtime=0.000113687 optime=0.000093503 etime=0.000205988 [20/Dec/2022:09:07:10.021564896 +0800] conn=4 op=14020 SRCH base="cn=ad,cn=trusts,dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs=ALL [20/Dec/2022:09:07:10.021654670 +0800] conn=4 op=14020 RESULT err=0 tag=101 nentries=0 wtime=0.000377619 optime=0.000090150 etime=0.000466425 [20/Dec/2022:09:07:10.021699049 +0800] conn=4 op=14021 SRCH base="dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTDomainAttrs)" attrs="ipaNTFlatName ipaNTFallbackPrimaryGroup ipaNTSecurityIdentifier" [20/Dec/2022:09:07:10.021789210 +0800] conn=4 op=14021 RESULT err=0 tag=101 nentries=1 wtime=0.000033059 optime=0.000090772 etime=0.000122672 [20/Dec/2022:09:07:10.021817723 +0800] conn=4 op=14022 SRCH base="cn=Default SMB Group,cn=groups,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=posixGroup)" attrs="ipaNTSecurityIdentifier" [20/Dec/2022:09:07:10.021878910 +0800] conn=4 op=14022 RESULT err=0 tag=101 nentries=1 wtime=0.000019217 optime=0.000061583 etime=0.000079797 [20/Dec/2022:09:07:10.021921311 +0800] conn=4 op=14023 SRCH base="cn=ad,cn=trusts,dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs="cn ipaNTTrustPartner ipaNTFlatName ipaNTTrustedDomainSID ipaNTSIDBlacklistIncoming ipaNTSIDBlacklistOutgoing ipaNTAdditionalSuffixes" [20/Dec/2022:09:07:10.021965808 +0800] conn=4 op=14023 RESULT err=0 tag=101 nentries=0 wtime=0.000033882 optime=0.000044969 etime=0.000077912 [20/Dec/2022:09:07:10.022044667 +0800] conn=4 op=14024 SRCH base="fqdn=wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Dec/2022:09:07:10.022687128 +0800] conn=4 op=14024 RESULT err=0 tag=101 nentries=1 wtime=0.000068818 optime=0.000643252 etime=0.000710490 [20/Dec/2022:09:07:10.022752877 +0800] conn=4 op=14025 SRCH base="cn=wocfreeipa-rep.wingon.hk,cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:09:07:10.022838243 +0800] conn=4 op=14025 RESULT err=0 tag=101 nentries=1 wtime=0.000054231 optime=0.000085694 etime=0.000138864 [20/Dec/2022:09:07:10.029946069 +0800] conn=5 op=14493 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.030219553 +0800] conn=5 op=14493 RESULT err=0 tag=101 nentries=1 wtime=0.000121296 optime=0.000275911 etime=0.000395201 [20/Dec/2022:09:07:10.030268251 +0800] conn=5 op=14494 SRCH base="cn=ipaConfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Dec/2022:09:07:10.030336598 +0800] conn=5 op=14494 RESULT err=0 tag=101 nentries=1 wtime=0.000031215 optime=0.000068977 etime=0.000099089 [20/Dec/2022:09:07:10.030768382 +0800] conn=5 op=14495 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=ldap/wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.030989195 +0800] conn=5 op=14495 RESULT err=0 tag=101 nentries=1 wtime=0.000421257 optime=0.000221974 etime=0.000641717 [20/Dec/2022:09:07:10.031123610 +0800] conn=5 op=14496 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.031186770 +0800] conn=5 op=14496 RESULT err=0 tag=101 nentries=1 wtime=0.000120839 optime=0.000064074 etime=0.000183859 [20/Dec/2022:09:07:10.031358975 +0800] conn=5 op=14497 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/wocfreeipa-rep.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=host/wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.031571493 +0800] conn=5 op=14497 RESULT err=0 tag=101 nentries=1 wtime=0.000161970 optime=0.000213966 etime=0.000374543 [20/Dec/2022:09:07:10.031681973 +0800] conn=5 op=14498 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.031743948 +0800] conn=5 op=14498 RESULT err=0 tag=101 nentries=1 wtime=0.000097519 optime=0.000062644 etime=0.000159085 [20/Dec/2022:09:07:10.031878773 +0800] conn=5 op=14499 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/wocfreeipa-rep.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=host/wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.032077460 +0800] conn=5 op=14499 RESULT err=0 tag=101 nentries=1 wtime=0.000124982 optime=0.000199924 etime=0.000323568 [20/Dec/2022:09:07:10.032176837 +0800] conn=5 op=14500 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.032238301 +0800] conn=5 op=14500 RESULT err=0 tag=101 nentries=1 wtime=0.000087171 optime=0.000062023 etime=0.000148123 [20/Dec/2022:09:07:10.034012232 +0800] conn=2902 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:10.036926445 +0800] conn=2902 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000064718 optime=0.002941882 etime=0.002997227, SASL bind in progress [20/Dec/2022:09:07:10.038060714 +0800] conn=2902 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:10.039499069 +0800] conn=2902 op=2 RESULT err=14 tag=97 nentries=0 wtime=0.000044218 optime=0.001441734 etime=0.001484738, SASL bind in progress [20/Dec/2022:09:07:10.040435379 +0800] conn=2902 op=3 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:10.041098083 +0800] conn=2902 op=3 RESULT err=0 tag=97 nentries=0 wtime=0.000047802 optime=0.000666679 etime=0.000712984 dn="fqdn=wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:09:07:10.042295210 +0800] conn=2902 op=4 SRCH base="cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaHost)(fqdn=wocfreeipa-rep.wingon.hk))" attrs="objectClass cn fqdn serverHostName memberOf ipaSshPubKey ipaUniqueID" [20/Dec/2022:09:07:10.042832144 +0800] conn=2902 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000149915 optime=0.000542636 etime=0.000690704 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:09:07:10.044294201 +0800] conn=2902 op=5 SRCH base="fqdn=wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass cn memberOf ipaUniqueID" [20/Dec/2022:09:07:10.046695424 +0800] conn=2902 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000256211 optime=0.002408597 etime=0.002662639 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:09:07:10.048153236 +0800] conn=2902 op=6 SRCH base="cn=sudo,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipasudocmdgrp)(entryusn>=48528))" attrs="objectClass ipaUniqueID cn member entryusn" [20/Dec/2022:09:07:10.048497184 +0800] conn=2902 op=6 RESULT err=0 tag=101 nentries=0 wtime=0.000266476 optime=0.000350088 etime=0.000614736 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:09:07:10.049804122 +0800] conn=2902 op=7 SRCH base="cn=sudo,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipasudorule)(ipaEnabledFlag=TRUE)(|(&(!(memberHost=*))(cn=defaults))(hostCategory=ALL)(memberHost=fqdn=wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk)(memberHost=cn=ipaservers,cn=hostgroups,cn=accounts,dc=wingon,dc=hk))(entryusn>=48528))" attrs="objectClass cn ipaUniqueID ipaEnabledFlag ipaSudoOpt ipaSudoRunAs ipaSudoRunAsGroup memberAllowCmd memberDenyCmd memberHost memberUser sudoNotAfter sudoNotBefore sudoOrder cmdCategory hostCategory userCategory ipaSudoRunAsUserCategory ipaSudoRunAsGroupCategory ipaSudoRunAsExtUser ipaSudoRunAsExtGroup ipaSudoRunAsExtUserGroup externalUser entryusn" [20/Dec/2022:09:07:10.049937748 +0800] conn=2902 op=7 RESULT err=0 tag=101 nentries=0 wtime=0.000160466 optime=0.000134985 etime=0.000293721 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:09:07:42.714829570 +0800] conn=2903 fd=77 slot=77 connection from 10.99.16.212 to 10.100.0.213 [20/Dec/2022:09:07:42.716410368 +0800] conn=2903 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:42.719062214 +0800] conn=2903 op=0 RESULT err=14 tag=97 nentries=0 wtime=0.000296752 optime=0.002658509 etime=0.002953744, SASL bind in progress [20/Dec/2022:09:07:42.720390029 +0800] conn=2903 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:42.721815084 +0800] conn=2903 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000144522 optime=0.001439333 etime=0.001582641, SASL bind in progress [20/Dec/2022:09:07:42.722897026 +0800] conn=2903 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:42.723744910 +0800] conn=2903 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000127640 optime=0.000859431 etime=0.000986187 dn="krbprincipalname=ldap/wocfreeipa-rep.wingon.hk@wingon.hk,cn=services,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:09:07:42.724977421 +0800] conn=2903 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [20/Dec/2022:09:07:42.726362088 +0800] conn=2903 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000221790 optime=0.001390796 etime=0.001611222 [20/Dec/2022:09:07:42.727545779 +0800] conn=2903 op=4 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [20/Dec/2022:09:07:42.728769895 +0800] conn=2903 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000121031 optime=0.001225192 etime=0.001344844 [20/Dec/2022:09:07:42.730079779 +0800] conn=2903 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:09:07:42.730775353 +0800] conn=2903 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000169992 optime=0.000719752 etime=0.000888391 [20/Dec/2022:09:07:42.734912005 +0800] conn=2903 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:09:07:42.736623538 +0800] conn=2903 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000146762 optime=0.001721900 etime=0.001866327 [20/Dec/2022:09:07:42.970121954 +0800] conn=2903 op=7 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:09:07:42.970504752 +0800] conn=2903 op=7 RESULT err=0 tag=120 nentries=0 wtime=0.000227076 optime=0.000389781 etime=0.000615871 [20/Dec/2022:09:07:42.974751272 +0800] conn=2903 op=8 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:09:07:42.977352080 +0800] conn=2903 op=8 RESULT err=0 tag=120 nentries=0 wtime=0.000134289 optime=0.002611218 etime=0.002742205
yes, the corresponding RESULT line show nentries=1 or nentries=0 of results
ldapsearch -D "cn=directory manager" -W -b ou=Groups,o=ipaca "(&(objectClass=groupofuniquenames)(uniqueMember=uid=ipara,ou=people,o=ipaca))" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=Groups,o=ipaca> with scope subtree # filter: (&(objectClass=groupofuniquenames)(uniqueMember=uid=ipara,ou=people,o=ipaca)) # requesting: ALL #
# Certificate Manager Agents, groups, ipaca dn: cn=Certificate Manager Agents,ou=groups,o=ipaca description: Agents for Certificate Manager objectClass: top objectClass: groupOfUniqueNames cn: Certificate Manager Agents uniqueMember: uid=admin,ou=People,o=ipaca uniqueMember: uid=pkidbuser,ou=People,o=ipaca uniqueMember: uid=ipara,ou=people,o=ipaca
# Registration Manager Agents, groups, ipaca dn: cn=Registration Manager Agents,ou=groups,o=ipaca description: Agents for Registration Manager objectClass: top objectClass: groupOfUniqueNames cn: Registration Manager Agents uniqueMember: uid=ipara,ou=people,o=ipaca
# Security Domain Administrators, groups, ipaca dn: cn=Security Domain Administrators,ou=groups,o=ipaca description: People who are the Security Domain administrators objectClass: top objectClass: groupOfUniqueNames cn: Security Domain Administrators uniqueMember: uid=admin,ou=People,o=ipaca uniqueMember: uid=ipara,ou=people,o=ipaca
# Enterprise ACME Administrators, groups, ipaca dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca objectClass: top objectClass: groupOfUniqueNames cn: Enterprise ACME Administrators description: ACME RA accounts uniqueMember: uid=acme-wocfreeipa.wingon.hk,ou=people,o=ipaca uniqueMember: uid=ipara,ou=People,o=ipaca
# search result search: 2 result: 0 Success
# numResponses: 5 # numEntries: 4
Hi,
On Tue, Dec 20, 2022 at 2:20 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi, tail -f /var/log/pki/pki-tomcat/ca/debug.2022-12-20.log 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:44:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-20 08:49:32 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-20 08:52:50 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: Getting certificate 0x1 2022-12-20 08:52:50 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=ca,o=ipaca
From this log it looks like the *ipa cert-show 1* op was done at 08:52:50 but the directory server logs below do not cover this timestamp. It's not possible to check with those logs if the mapping of the certificate to a user entry succeeded or failed. Do you still have the logs in /var/log/dirsrv/slapd-WINGON-HK/access (or one of the rotated logs) corresponding to this date?
flo
2022-12-20 08:54:32 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-20 08:54:35 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-20 08:54:35 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-20 08:54:35 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating cert status 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating invalid certs to valid 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID) 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating valid certs to expired 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-20 08:54:38 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED)
tail -f /var/log/dirsrv/slapd-WINGON-HK/access [20/Dec/2022:09:02:42.692704846 +0800] conn=2900 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:09:02:42.693154479 +0800] conn=2900 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000085573 optime=0.000458433 etime=0.000543125 [20/Dec/2022:09:02:42.697272544 +0800] conn=2900 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:09:02:42.698855885 +0800] conn=2900 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000073994 optime=0.001572452 etime=0.001643806 [20/Dec/2022:09:02:42.700657032 +0800] conn=2900 op=7 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:09:02:42.700962545 +0800] conn=2900 op=7 RESULT err=0 tag=120 nentries=0 wtime=0.000139301 optime=0.000318407 etime=0.000456836 [20/Dec/2022:09:02:42.705290181 +0800] conn=2900 op=8 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:09:02:42.707796203 +0800] conn=2900 op=8 RESULT err=0 tag=120 nentries=0 wtime=0.000185974 optime=0.002508316 etime=0.002691736 [20/Dec/2022:09:03:42.726943689 +0800] conn=2900 op=9 UNBIND [20/Dec/2022:09:03:42.727016226 +0800] conn=2900 op=9 fd=124 closed error
- U1
[20/Dec/2022:09:04:31.059429193 +0800] conn=2901 fd=77 slot=77 connection from 10.100.0.213 to 10.100.0.213 [20/Dec/2022:09:04:31.062126284 +0800] conn=2901 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Dec/2022:09:04:31.064368644 +0800] conn=2901 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000254605 optime=0.002247116 etime=0.002500343 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:09:04:31.067358291 +0800] conn=2901 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:09:04:31.067884679 +0800] conn=2901 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000120718 optime=0.000535934 etime=0.000654762 [20/Dec/2022:09:04:31.069260735 +0800] conn=2901 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL [20/Dec/2022:09:04:31.069847504 +0800] conn=2901 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000123265 optime=0.000588648 etime=0.000709935 [20/Dec/2022:09:04:31.088542693 +0800] conn=19 op=5331 SRCH base="cn=1,ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:09:04:31.088794885 +0800] conn=19 op=5331 RESULT err=0 tag=101 nentries=1 wtime=0.000131894 optime=0.000253526 etime=0.000383435 [20/Dec/2022:09:04:31.100233153 +0800] conn=2901 op=3 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" [20/Dec/2022:09:04:31.100297979 +0800] conn=2901 op=3 RESULT err=0 tag=120 nentries=0 wtime=0.000092504 optime=0.000078842 etime=0.000169340 [20/Dec/2022:09:04:31.100582540 +0800] conn=2901 op=4 SRCH base="cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass" [20/Dec/2022:09:04:31.101301014 +0800] conn=2901 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000089696 optime=0.000718765 etime=0.000806178 - entryLevelRights: vadn [20/Dec/2022:09:04:31.103206149 +0800] conn=2901 op=5 SRCH base="cn=cas,cn=ca,dc=wingon,dc=hk" scope=2 filter="(&(cn=ipa)(objectClass=ipaca))" attrs="" [20/Dec/2022:09:04:31.103618859 +0800] conn=2901 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000094913 optime=0.000414408 etime=0.000507374 [20/Dec/2022:09:04:31.104283197 +0800] conn=2901 op=6 SRCH base="cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaCaId cn description ipaCaSubjectDN ipaCaIssuerDN" [20/Dec/2022:09:04:31.104553278 +0800] conn=2901 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000092105 optime=0.000271539 etime=0.000362000 [20/Dec/2022:09:04:31.106067554 +0800] conn=2901 op=7 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [20/Dec/2022:09:04:31.106596243 +0800] conn=2901 op=7 RESULT err=0 tag=101 nentries=1 wtime=0.000144092 optime=0.000530265 etime=0.000672601 [20/Dec/2022:09:04:31.125207280 +0800] conn=2901 op=8 UNBIND [20/Dec/2022:09:04:31.125229178 +0800] conn=2901 op=8 fd=77 closed error - U1 [20/Dec/2022:09:04:32.044788344 +0800] conn=27 op=3416 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn" [20/Dec/2022:09:04:32.045037986 +0800] conn=27 op=3416 RESULT err=32 tag=101 nentries=0 wtime=0.000131158 optime=0.000252952 etime=0.000381325 [20/Dec/2022:09:04:35.020912165 +0800] conn=19 op=5333 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="description" [20/Dec/2022:09:04:35.021127672 +0800] conn=19 op=5333 RESULT err=0 tag=101 nentries=1 wtime=0.000139714 optime=0.000220328 etime=0.000357248 [20/Dec/2022:09:04:38.153925748 +0800] conn=28 op=6829 SRCH base="ou=authorizations,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220010438+0000)" attrs="1.1" [20/Dec/2022:09:04:38.154147606 +0800] conn=28 op=6829 RESULT err=0 tag=101 nentries=0 wtime=0.000138731 optime=0.000226372 etime=0.000362267 [20/Dec/2022:09:04:38.154503158 +0800] conn=28 op=6830 SRCH base="ou=orders,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220010438+0000)" attrs="1.1" [20/Dec/2022:09:04:38.154624386 +0800] conn=28 op=6830 RESULT err=0 tag=101 nentries=0 wtime=0.000228268 optime=0.000122646 etime=0.000349204 [20/Dec/2022:09:04:38.154854286 +0800] conn=28 op=6831 SRCH base="ou=certificates,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220010438+0000)" attrs="1.1" [20/Dec/2022:09:04:38.154950593 +0800] conn=28 op=6831 RESULT err=0 tag=101 nentries=0 wtime=0.000159553 optime=0.000097292 etime=0.000255334 [20/Dec/2022:09:04:38.398853998 +0800] conn=19 op=5334 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(certStatus=INVALID)" attrs="objectClass serialno notBefore notAfter duration extension subjectName issuerName userCertificate version algorithmId signingAlgorithmId publicKeyData" [20/Dec/2022:09:04:38.399125270 +0800] conn=19 op=5334 VLV 200:0:20221220090438Z 0:0 (0) [20/Dec/2022:09:04:38.399186312 +0800] conn=19 op=5334 RESULT err=0 tag=101 nentries=0 wtime=0.000106897 optime=0.000334514 etime=0.000439629 notes=U details="Partially Unindexed Filter" [20/Dec/2022:09:04:38.400127700 +0800] conn=19 op=5335 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(certStatus=VALID)" attrs="objectClass serialno notBefore notAfter duration extension subjectName issuerName userCertificate version algorithmId signingAlgorithmId publicKeyData" [20/Dec/2022:09:04:38.400265687 +0800] conn=19 op=5335 SORT notAfter [20/Dec/2022:09:04:38.400273908 +0800] conn=19 op=5335 VLV 200:0:20221220090438Z 1:10 (0) [20/Dec/2022:09:04:38.400433546 +0800] conn=19 op=5335 RESULT err=0 tag=101 nentries=1 wtime=0.000761697 optime=0.000307959 etime=0.001067831 [20/Dec/2022:09:04:38.401553390 +0800] conn=19 op=5336 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=1 filter="(certStatus=REVOKED)" attrs="objectClass revokedOn serialno revInfo notAfter notBefore duration extension subjectName issuerName userCertificate version algorithmId signingAlgorithmId publicKeyData" [20/Dec/2022:09:04:38.401693292 +0800] conn=19 op=5336 VLV 200:0:20221220090438Z 0:0 (0) [20/Dec/2022:09:04:38.401734871 +0800] conn=19 op=5336 RESULT err=0 tag=101 nentries=0 wtime=0.001004479 optime=0.000183378 etime=0.001186338 notes=U details="Partially Unindexed Filter" [20/Dec/2022:09:07:01.986680374 +0800] conn=2893 op=8 UNBIND [20/Dec/2022:09:07:01.986743775 +0800] conn=2893 op=8 fd=73 closed error - U1 [20/Dec/2022:09:07:09.990796378 +0800] conn=2902 fd=73 slot=73 connection from 10.99.16.212 to 10.100.0.213 [20/Dec/2022:09:07:09.991696144 +0800] conn=2902 op=0 SRCH base="" scope=0 filter="(objectClass=*)" attrs="* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domaincontrollerfunctionality defaultnamingcontext lastusn highestcommittedusn aci" [20/Dec/2022:09:07:09.993461062 +0800] conn=2902 op=0 RESULT err=0 tag=101 nentries=1 wtime=0.000704701 optime=0.001764919 etime=0.002467783 [20/Dec/2022:09:07:10.015698288 +0800] conn=4 op=14011 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ wocfreeipa-rep.wingon.hk@WINGON.HK )(krbPrincipalName:caseIgnoreIA5Match:=host/ wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.016098918 +0800] conn=4 op=14011 RESULT err=0 tag=101 nentries=1 wtime=0.000305749 optime=0.000403957 etime=0.000707230 [20/Dec/2022:09:07:10.016191408 +0800] conn=4 op=14012 SRCH base="cn=ipaConfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Dec/2022:09:07:10.016264058 +0800] conn=4 op=14012 RESULT err=0 tag=101 nentries=1 wtime=0.000074145 optime=0.000073449 etime=0.000146247 [20/Dec/2022:09:07:10.016440110 +0800] conn=4 op=14013 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.016523232 +0800] conn=4 op=14013 RESULT err=0 tag=101 nentries=1 wtime=0.000165771 optime=0.000084128 etime=0.000248720 [20/Dec/2022:09:07:10.016619153 +0800] conn=4 op=14014 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.016858822 +0800] conn=4 op=14014 RESULT err=0 tag=101 nentries=1 wtime=0.000084854 optime=0.000241017 etime=0.000324497 [20/Dec/2022:09:07:10.017103462 +0800] conn=4 op=14015 SRCH base="cn=Default Host Password Policy,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:09:07:10.017187893 +0800] conn=4 op=14015 RESULT err=0 tag=101 nentries=1 wtime=0.000230849 optime=0.000085268 etime=0.000315017 [20/Dec/2022:09:07:10.020212710 +0800] conn=4 op=14016 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ wocfreeipa-rep.wingon.hk@WINGON.HK )(krbPrincipalName:caseIgnoreIA5Match:=host/ wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.020466417 +0800] conn=4 op=14016 RESULT err=0 tag=101 nentries=1 wtime=0.003013741 optime=0.000255802 etime=0.003267500 [20/Dec/2022:09:07:10.020591401 +0800] conn=4 op=14017 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.020669810 +0800] conn=4 op=14017 RESULT err=0 tag=101 nentries=1 wtime=0.000108579 optime=0.000079118 etime=0.000186522 [20/Dec/2022:09:07:10.020753948 +0800] conn=4 op=14018 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.020958618 +0800] conn=4 op=14018 RESULT err=0 tag=101 nentries=1 wtime=0.000073304 optime=0.000205858 etime=0.000277765 [20/Dec/2022:09:07:10.021085102 +0800] conn=4 op=14019 SRCH base="cn=Default Host Password Policy,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:09:07:10.021177866 +0800] conn=4 op=14019 RESULT err=0 tag=101 nentries=1 wtime=0.000113687 optime=0.000093503 etime=0.000205988 [20/Dec/2022:09:07:10.021564896 +0800] conn=4 op=14020 SRCH base="cn=ad,cn=trusts,dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs=ALL [20/Dec/2022:09:07:10.021654670 +0800] conn=4 op=14020 RESULT err=0 tag=101 nentries=0 wtime=0.000377619 optime=0.000090150 etime=0.000466425 [20/Dec/2022:09:07:10.021699049 +0800] conn=4 op=14021 SRCH base="dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTDomainAttrs)" attrs="ipaNTFlatName ipaNTFallbackPrimaryGroup ipaNTSecurityIdentifier" [20/Dec/2022:09:07:10.021789210 +0800] conn=4 op=14021 RESULT err=0 tag=101 nentries=1 wtime=0.000033059 optime=0.000090772 etime=0.000122672 [20/Dec/2022:09:07:10.021817723 +0800] conn=4 op=14022 SRCH base="cn=Default SMB Group,cn=groups,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=posixGroup)" attrs="ipaNTSecurityIdentifier" [20/Dec/2022:09:07:10.021878910 +0800] conn=4 op=14022 RESULT err=0 tag=101 nentries=1 wtime=0.000019217 optime=0.000061583 etime=0.000079797 [20/Dec/2022:09:07:10.021921311 +0800] conn=4 op=14023 SRCH base="cn=ad,cn=trusts,dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs="cn ipaNTTrustPartner ipaNTFlatName ipaNTTrustedDomainSID ipaNTSIDBlacklistIncoming ipaNTSIDBlacklistOutgoing ipaNTAdditionalSuffixes" [20/Dec/2022:09:07:10.021965808 +0800] conn=4 op=14023 RESULT err=0 tag=101 nentries=0 wtime=0.000033882 optime=0.000044969 etime=0.000077912 [20/Dec/2022:09:07:10.022044667 +0800] conn=4 op=14024 SRCH base="fqdn= wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Dec/2022:09:07:10.022687128 +0800] conn=4 op=14024 RESULT err=0 tag=101 nentries=1 wtime=0.000068818 optime=0.000643252 etime=0.000710490 [20/Dec/2022:09:07:10.022752877 +0800] conn=4 op=14025 SRCH base="cn= wocfreeipa-rep.wingon.hk,cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:09:07:10.022838243 +0800] conn=4 op=14025 RESULT err=0 tag=101 nentries=1 wtime=0.000054231 optime=0.000085694 etime=0.000138864 [20/Dec/2022:09:07:10.029946069 +0800] conn=5 op=14493 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.030219553 +0800] conn=5 op=14493 RESULT err=0 tag=101 nentries=1 wtime=0.000121296 optime=0.000275911 etime=0.000395201 [20/Dec/2022:09:07:10.030268251 +0800] conn=5 op=14494 SRCH base="cn=ipaConfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Dec/2022:09:07:10.030336598 +0800] conn=5 op=14494 RESULT err=0 tag=101 nentries=1 wtime=0.000031215 optime=0.000068977 etime=0.000099089 [20/Dec/2022:09:07:10.030768382 +0800] conn=5 op=14495 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/ wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=ldap/ wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.030989195 +0800] conn=5 op=14495 RESULT err=0 tag=101 nentries=1 wtime=0.000421257 optime=0.000221974 etime=0.000641717 [20/Dec/2022:09:07:10.031123610 +0800] conn=5 op=14496 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.031186770 +0800] conn=5 op=14496 RESULT err=0 tag=101 nentries=1 wtime=0.000120839 optime=0.000064074 etime=0.000183859 [20/Dec/2022:09:07:10.031358975 +0800] conn=5 op=14497 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ wocfreeipa-rep.wingon.hk@WINGON.HK )(krbPrincipalName:caseIgnoreIA5Match:=host/ wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.031571493 +0800] conn=5 op=14497 RESULT err=0 tag=101 nentries=1 wtime=0.000161970 optime=0.000213966 etime=0.000374543 [20/Dec/2022:09:07:10.031681973 +0800] conn=5 op=14498 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.031743948 +0800] conn=5 op=14498 RESULT err=0 tag=101 nentries=1 wtime=0.000097519 optime=0.000062644 etime=0.000159085 [20/Dec/2022:09:07:10.031878773 +0800] conn=5 op=14499 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ wocfreeipa-rep.wingon.hk@WINGON.HK )(krbPrincipalName:caseIgnoreIA5Match:=host/ wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:09:07:10.032077460 +0800] conn=5 op=14499 RESULT err=0 tag=101 nentries=1 wtime=0.000124982 optime=0.000199924 etime=0.000323568 [20/Dec/2022:09:07:10.032176837 +0800] conn=5 op=14500 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:09:07:10.032238301 +0800] conn=5 op=14500 RESULT err=0 tag=101 nentries=1 wtime=0.000087171 optime=0.000062023 etime=0.000148123 [20/Dec/2022:09:07:10.034012232 +0800] conn=2902 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:10.036926445 +0800] conn=2902 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000064718 optime=0.002941882 etime=0.002997227, SASL bind in progress [20/Dec/2022:09:07:10.038060714 +0800] conn=2902 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:10.039499069 +0800] conn=2902 op=2 RESULT err=14 tag=97 nentries=0 wtime=0.000044218 optime=0.001441734 etime=0.001484738, SASL bind in progress [20/Dec/2022:09:07:10.040435379 +0800] conn=2902 op=3 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:10.041098083 +0800] conn=2902 op=3 RESULT err=0 tag=97 nentries=0 wtime=0.000047802 optime=0.000666679 etime=0.000712984 dn="fqdn= wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:09:07:10.042295210 +0800] conn=2902 op=4 SRCH base="cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaHost)(fqdn=wocfreeipa-rep.wingon.hk))" attrs="objectClass cn fqdn serverHostName memberOf ipaSshPubKey ipaUniqueID" [20/Dec/2022:09:07:10.042832144 +0800] conn=2902 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000149915 optime=0.000542636 etime=0.000690704 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:09:07:10.044294201 +0800] conn=2902 op=5 SRCH base="fqdn= wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass cn memberOf ipaUniqueID" [20/Dec/2022:09:07:10.046695424 +0800] conn=2902 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000256211 optime=0.002408597 etime=0.002662639 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:09:07:10.048153236 +0800] conn=2902 op=6 SRCH base="cn=sudo,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipasudocmdgrp)(entryusn>=48528))" attrs="objectClass ipaUniqueID cn member entryusn" [20/Dec/2022:09:07:10.048497184 +0800] conn=2902 op=6 RESULT err=0 tag=101 nentries=0 wtime=0.000266476 optime=0.000350088 etime=0.000614736 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:09:07:10.049804122 +0800] conn=2902 op=7 SRCH base="cn=sudo,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipasudorule)(ipaEnabledFlag=TRUE)(|(&(!(memberHost=*))(cn=defaults))(hostCategory=ALL)(memberHost=fqdn= wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk)(memberHost=cn=ipaservers,cn=hostgroups,cn=accounts,dc=wingon,dc=hk))(entryusn>=48528))" attrs="objectClass cn ipaUniqueID ipaEnabledFlag ipaSudoOpt ipaSudoRunAs ipaSudoRunAsGroup memberAllowCmd memberDenyCmd memberHost memberUser sudoNotAfter sudoNotBefore sudoOrder cmdCategory hostCategory userCategory ipaSudoRunAsUserCategory ipaSudoRunAsGroupCategory ipaSudoRunAsExtUser ipaSudoRunAsExtGroup ipaSudoRunAsExtUserGroup externalUser entryusn" [20/Dec/2022:09:07:10.049937748 +0800] conn=2902 op=7 RESULT err=0 tag=101 nentries=0 wtime=0.000160466 optime=0.000134985 etime=0.000293721 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:09:07:42.714829570 +0800] conn=2903 fd=77 slot=77 connection from 10.99.16.212 to 10.100.0.213 [20/Dec/2022:09:07:42.716410368 +0800] conn=2903 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:42.719062214 +0800] conn=2903 op=0 RESULT err=14 tag=97 nentries=0 wtime=0.000296752 optime=0.002658509 etime=0.002953744, SASL bind in progress [20/Dec/2022:09:07:42.720390029 +0800] conn=2903 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:42.721815084 +0800] conn=2903 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000144522 optime=0.001439333 etime=0.001582641, SASL bind in progress [20/Dec/2022:09:07:42.722897026 +0800] conn=2903 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:09:07:42.723744910 +0800] conn=2903 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000127640 optime=0.000859431 etime=0.000986187 dn="krbprincipalname=ldap/wocfreeipa-rep.wingon.hk@wingon.hk ,cn=services,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:09:07:42.724977421 +0800] conn=2903 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [20/Dec/2022:09:07:42.726362088 +0800] conn=2903 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000221790 optime=0.001390796 etime=0.001611222 [20/Dec/2022:09:07:42.727545779 +0800] conn=2903 op=4 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [20/Dec/2022:09:07:42.728769895 +0800] conn=2903 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000121031 optime=0.001225192 etime=0.001344844 [20/Dec/2022:09:07:42.730079779 +0800] conn=2903 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:09:07:42.730775353 +0800] conn=2903 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000169992 optime=0.000719752 etime=0.000888391 [20/Dec/2022:09:07:42.734912005 +0800] conn=2903 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:09:07:42.736623538 +0800] conn=2903 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000146762 optime=0.001721900 etime=0.001866327 [20/Dec/2022:09:07:42.970121954 +0800] conn=2903 op=7 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:09:07:42.970504752 +0800] conn=2903 op=7 RESULT err=0 tag=120 nentries=0 wtime=0.000227076 optime=0.000389781 etime=0.000615871 [20/Dec/2022:09:07:42.974751272 +0800] conn=2903 op=8 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:09:07:42.977352080 +0800] conn=2903 op=8 RESULT err=0 tag=120 nentries=0 wtime=0.000134289 optime=0.002611218 etime=0.002742205
yes, the corresponding RESULT line show nentries=1 or nentries=0 of results
ldapsearch -D "cn=directory manager" -W -b ou=Groups,o=ipaca "(&(objectClass=groupofuniquenames)(uniqueMember=uid=ipara,ou=people,o=ipaca))" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=Groups,o=ipaca> with scope subtree # filter: (&(objectClass=groupofuniquenames)(uniqueMember=uid=ipara,ou=people,o=ipaca)) # requesting: ALL #
# Certificate Manager Agents, groups, ipaca dn: cn=Certificate Manager Agents,ou=groups,o=ipaca description: Agents for Certificate Manager objectClass: top objectClass: groupOfUniqueNames cn: Certificate Manager Agents uniqueMember: uid=admin,ou=People,o=ipaca uniqueMember: uid=pkidbuser,ou=People,o=ipaca uniqueMember: uid=ipara,ou=people,o=ipaca
# Registration Manager Agents, groups, ipaca dn: cn=Registration Manager Agents,ou=groups,o=ipaca description: Agents for Registration Manager objectClass: top objectClass: groupOfUniqueNames cn: Registration Manager Agents uniqueMember: uid=ipara,ou=people,o=ipaca
# Security Domain Administrators, groups, ipaca dn: cn=Security Domain Administrators,ou=groups,o=ipaca description: People who are the Security Domain administrators objectClass: top objectClass: groupOfUniqueNames cn: Security Domain Administrators uniqueMember: uid=admin,ou=People,o=ipaca uniqueMember: uid=ipara,ou=people,o=ipaca
# Enterprise ACME Administrators, groups, ipaca dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca objectClass: top objectClass: groupOfUniqueNames cn: Enterprise ACME Administrators description: ACME RA accounts uniqueMember: uid=acme-wocfreeipa.wingon.hk,ou=people,o=ipaca uniqueMember: uid=ipara,ou=People,o=ipaca
# search result search: 2 result: 0 Success
# numResponses: 5 # numEntries: 4
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi , [20/Dec/2022:08:49:29.637099418 +0800] conn=2892 op=9 UNBIND [20/Dec/2022:08:49:29.637145006 +0800] conn=2892 op=9 fd=124 closed error - U1 [20/Dec/2022:08:49:32.043506909 +0800] conn=27 op=3410 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn" [20/Dec/2022:08:49:32.043782127 +0800] conn=27 op=3410 RESULT err=32 tag=101 nentries=0 wtime=0.000153439 optime=0.000279769 etime=0.000430437 [20/Dec/2022:08:49:38.148322772 +0800] conn=28 op=6817 SRCH base="ou=authorizations,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220004938+0000)" attrs="1.1" [20/Dec/2022:08:49:38.148586175 +0800] conn=28 op=6817 RESULT err=0 tag=101 nentries=0 wtime=0.000138301 optime=0.000273350 etime=0.000408659 [20/Dec/2022:08:49:38.148943213 +0800] conn=28 op=6818 SRCH base="ou=orders,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220004938+0000)" attrs="1.1" [20/Dec/2022:08:49:38.149071009 +0800] conn=28 op=6818 RESULT err=0 tag=101 nentries=0 wtime=0.000206338 optime=0.000129557 etime=0.000333928 [20/Dec/2022:08:49:38.149274125 +0800] conn=28 op=6819 SRCH base="ou=certificates,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220004938+0000)" attrs="1.1" [20/Dec/2022:08:49:38.149379198 +0800] conn=28 op=6819 RESULT err=0 tag=101 nentries=0 wtime=0.000130714 optime=0.000106250 etime=0.000235350 [20/Dec/2022:08:52:01.986729492 +0800] conn=2888 op=8 UNBIND [20/Dec/2022:08:52:01.986771904 +0800] conn=2888 op=8 fd=73 closed error - U1 [20/Dec/2022:08:52:07.702869314 +0800] conn=4 op=13990 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:07.703402545 +0800] conn=4 op=13990 RESULT err=0 tag=101 nentries=1 wtime=0.000193320 optime=0.000543635 etime=0.000734611 [20/Dec/2022:08:52:07.703507147 +0800] conn=4 op=13991 SRCH base="cn=ipaConfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Dec/2022:08:52:07.703570031 +0800] conn=4 op=13991 RESULT err=0 tag=101 nentries=1 wtime=0.000021034 optime=0.000063839 etime=0.000083694 [20/Dec/2022:08:52:07.703713585 +0800] conn=4 op=13992 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:07.703808511 +0800] conn=4 op=13992 RESULT err=0 tag=101 nentries=1 wtime=0.000023489 optime=0.000095938 etime=0.000118208 [20/Dec/2022:08:52:07.703932548 +0800] conn=4 op=13993 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:07.704164824 +0800] conn=4 op=13993 RESULT err=0 tag=101 nentries=1 wtime=0.000055700 optime=0.000233831 etime=0.000288007 [20/Dec/2022:08:52:07.704454880 +0800] conn=4 op=13994 SRCH base="cn=global_policy,cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:07.704543319 +0800] conn=4 op=13994 RESULT err=0 tag=101 nentries=1 wtime=0.000041266 optime=0.000090343 etime=0.000130370 [20/Dec/2022:08:52:09.990863586 +0800] conn=2893 fd=73 slot=73 connection from 10.99.16.212 to 10.100.0.213 [20/Dec/2022:08:52:09.991284876 +0800] conn=2893 op=0 SRCH base="" scope=0 filter="(objectClass=*)" attrs="* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domaincontrollerfunctionality defaultnamingcontext lastusn highestcommittedusn aci" [20/Dec/2022:08:52:09.992883383 +0800] conn=2893 op=0 RESULT err=0 tag=101 nentries=1 wtime=0.000306908 optime=0.001598916 etime=0.001904660 [20/Dec/2022:08:52:10.020345323 +0800] conn=5 op=14421 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/wocfreeipa-rep.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=host/wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.020685934 +0800] conn=5 op=14421 RESULT err=0 tag=101 nentries=1 wtime=0.000148639 optime=0.000343867 etime=0.000490293 [20/Dec/2022:08:52:10.020796954 +0800] conn=5 op=14422 SRCH base="cn=ipaConfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Dec/2022:08:52:10.020859631 +0800] conn=5 op=14422 RESULT err=0 tag=101 nentries=1 wtime=0.000024022 optime=0.000063922 etime=0.000086660 [20/Dec/2022:08:52:10.021013120 +0800] conn=5 op=14423 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.021076265 +0800] conn=5 op=14423 RESULT err=0 tag=101 nentries=1 wtime=0.000021565 optime=0.000064169 etime=0.000084552 [20/Dec/2022:08:52:10.021190460 +0800] conn=5 op=14424 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.021431298 +0800] conn=5 op=14424 RESULT err=0 tag=101 nentries=1 wtime=0.000054189 optime=0.000242208 etime=0.000294767 [20/Dec/2022:08:52:10.021663559 +0800] conn=5 op=14425 SRCH base="cn=Default Host Password Policy,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:10.021749877 +0800] conn=5 op=14425 RESULT err=0 tag=101 nentries=1 wtime=0.000032347 optime=0.000088078 etime=0.000119139 [20/Dec/2022:08:52:10.033772246 +0800] conn=5 op=14426 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/wocfreeipa-rep.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=host/wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.034022601 +0800] conn=5 op=14426 RESULT err=0 tag=101 nentries=1 wtime=0.011565691 optime=0.000252782 etime=0.011816585 [20/Dec/2022:08:52:10.034170111 +0800] conn=5 op=14427 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.034236031 +0800] conn=5 op=14427 RESULT err=0 tag=101 nentries=1 wtime=0.000022773 optime=0.000067234 etime=0.000088827 [20/Dec/2022:08:52:10.034349405 +0800] conn=5 op=14428 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.034560533 +0800] conn=5 op=14428 RESULT err=0 tag=101 nentries=1 wtime=0.000062169 optime=0.000212339 etime=0.000273015 [20/Dec/2022:08:52:10.034725055 +0800] conn=5 op=14429 SRCH base="cn=Default Host Password Policy,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:10.034805632 +0800] conn=5 op=14429 RESULT err=0 tag=101 nentries=1 wtime=0.000027824 optime=0.000081903 etime=0.000108561 [20/Dec/2022:08:52:10.035180909 +0800] conn=5 op=14430 SRCH base="cn=ad,cn=trusts,dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs=ALL [20/Dec/2022:08:52:10.035239166 +0800] conn=5 op=14430 RESULT err=0 tag=101 nentries=0 wtime=0.000016420 optime=0.000058741 etime=0.000073879 [20/Dec/2022:08:52:10.035287403 +0800] conn=5 op=14431 SRCH base="dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTDomainAttrs)" attrs="ipaNTFlatName ipaNTFallbackPrimaryGroup ipaNTSecurityIdentifier" [20/Dec/2022:08:52:10.035383748 +0800] conn=5 op=14431 RESULT err=0 tag=101 nentries=1 wtime=0.000017953 optime=0.000096850 etime=0.000113571 [20/Dec/2022:08:52:10.035441566 +0800] conn=5 op=14432 SRCH base="cn=Default SMB Group,cn=groups,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=posixGroup)" attrs="ipaNTSecurityIdentifier" [20/Dec/2022:08:52:10.035491471 +0800] conn=5 op=14432 RESULT err=0 tag=101 nentries=1 wtime=0.000015040 optime=0.000050416 etime=0.000064443 [20/Dec/2022:08:52:10.035545178 +0800] conn=5 op=14433 SRCH base="cn=ad,cn=trusts,dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs="cn ipaNTTrustPartner ipaNTFlatName ipaNTTrustedDomainSID ipaNTSIDBlacklistIncoming ipaNTSIDBlacklistOutgoing ipaNTAdditionalSuffixes" [20/Dec/2022:08:52:10.035587789 +0800] conn=5 op=14433 RESULT err=0 tag=101 nentries=0 wtime=0.000017675 optime=0.000043192 etime=0.000059863 [20/Dec/2022:08:52:10.035672369 +0800] conn=5 op=14434 SRCH base="fqdn=wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Dec/2022:08:52:10.036234906 +0800] conn=5 op=14434 RESULT err=0 tag=101 nentries=1 wtime=0.000033128 optime=0.000563748 etime=0.000595431 [20/Dec/2022:08:52:10.036351846 +0800] conn=5 op=14435 SRCH base="cn=wocfreeipa-rep.wingon.hk,cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:08:52:10.036415781 +0800] conn=5 op=14435 RESULT err=0 tag=101 nentries=1 wtime=0.000017116 optime=0.000064859 etime=0.000080843 [20/Dec/2022:08:52:10.054500251 +0800] conn=5 op=14436 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.054733532 +0800] conn=5 op=14436 RESULT err=0 tag=101 nentries=1 wtime=0.017673549 optime=0.000235438 etime=0.017907231 [20/Dec/2022:08:52:10.055075637 +0800] conn=5 op=14437 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=ldap/wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.055292342 +0800] conn=5 op=14437 RESULT err=0 tag=101 nentries=1 wtime=0.000052636 optime=0.000218403 etime=0.000269568 [20/Dec/2022:08:52:10.055431453 +0800] conn=5 op=14438 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.055491849 +0800] conn=5 op=14438 RESULT err=0 tag=101 nentries=1 wtime=0.000020352 optime=0.000061341 etime=0.000080566 [20/Dec/2022:08:52:10.055663216 +0800] conn=5 op=14439 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/wocfreeipa-rep.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=host/wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.055880149 +0800] conn=5 op=14439 RESULT err=0 tag=101 nentries=1 wtime=0.000048562 optime=0.000218419 etime=0.000265458 [20/Dec/2022:08:52:10.056004896 +0800] conn=5 op=14440 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.056062326 +0800] conn=5 op=14440 RESULT err=0 tag=101 nentries=1 wtime=0.000018653 optime=0.000058227 etime=0.000075792 [20/Dec/2022:08:52:10.056230702 +0800] conn=5 op=14441 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/wocfreeipa-rep.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=host/wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.056463992 +0800] conn=5 op=14441 RESULT err=0 tag=101 nentries=1 wtime=0.000052619 optime=0.000234983 etime=0.000285946 [20/Dec/2022:08:52:10.056592816 +0800] conn=5 op=14442 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.056651155 +0800] conn=5 op=14442 RESULT err=0 tag=101 nentries=1 wtime=0.000019182 optime=0.000059079 etime=0.000077173 [20/Dec/2022:08:52:10.058554640 +0800] conn=2893 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:10.061134122 +0800] conn=2893 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000059172 optime=0.002585693 etime=0.002643652, SASL bind in progress [20/Dec/2022:08:52:10.062668409 +0800] conn=2893 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:10.064085004 +0800] conn=2893 op=2 RESULT err=14 tag=97 nentries=0 wtime=0.000050077 optime=0.001419041 etime=0.001467480, SASL bind in progress [20/Dec/2022:08:52:10.065014341 +0800] conn=2893 op=3 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:10.065666815 +0800] conn=2893 op=3 RESULT err=0 tag=97 nentries=0 wtime=0.000041031 optime=0.000660380 etime=0.000700410 dn="fqdn=wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:10.067604557 +0800] conn=2893 op=4 SRCH base="cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaHost)(fqdn=wocfreeipa-rep.wingon.hk))" attrs="objectClass cn fqdn serverHostName memberOf ipaSshPubKey ipaUniqueID" [20/Dec/2022:08:52:10.068161053 +0800] conn=2893 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000095350 optime=0.000556958 etime=0.000650469 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:08:52:10.071342521 +0800] conn=2893 op=5 SRCH base="fqdn=wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass cn memberOf ipaUniqueID" [20/Dec/2022:08:52:10.073536868 +0800] conn=2893 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000104954 optime=0.002194820 etime=0.002297765 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:08:52:10.074690660 +0800] conn=2893 op=6 SRCH base="cn=sudo,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipasudocmdgrp)(entryusn>=48491))" attrs="objectClass ipaUniqueID cn member entryusn" [20/Dec/2022:08:52:10.074851580 +0800] conn=2893 op=6 RESULT err=0 tag=101 nentries=0 wtime=0.000076126 optime=0.000161713 etime=0.000235912 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:08:52:10.075980709 +0800] conn=2893 op=7 SRCH base="cn=sudo,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipasudorule)(ipaEnabledFlag=TRUE)(|(&(!(memberHost=*))(cn=defaults))(hostCategory=ALL)(memberHost=fqdn=wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk)(memberHost=cn=ipaservers,cn=hostgroups,cn=accounts,dc=wingon,dc=hk))(entryusn>=48491))" attrs="objectClass cn ipaUniqueID ipaEnabledFlag ipaSudoOpt ipaSudoRunAs ipaSudoRunAsGroup memberAllowCmd memberDenyCmd memberHost memberUser sudoNotAfter sudoNotBefore sudoOrder cmdCategory hostCategory userCategory ipaSudoRunAsUserCategory ipaSudoRunAsGroupCategory ipaSudoRunAsExtUser ipaSudoRunAsExtGroup ipaSudoRunAsExtUserGroup externalUser entryusn" [20/Dec/2022:08:52:10.076123960 +0800] conn=2893 op=7 RESULT err=0 tag=101 nentries=0 wtime=0.000130861 optime=0.000144629 etime=0.000273690 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:08:52:32.207041120 +0800] conn=4 op=13996 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:32.207436448 +0800] conn=4 op=13996 RESULT err=0 tag=101 nentries=1 wtime=0.000184164 optime=0.000398522 etime=0.000580416 [20/Dec/2022:08:52:32.207620899 +0800] conn=4 op=13997 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:32.207691911 +0800] conn=4 op=13997 RESULT err=0 tag=101 nentries=1 wtime=0.000025598 optime=0.000071976 etime=0.000096282 [20/Dec/2022:08:52:32.207801336 +0800] conn=4 op=13998 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:32.208021391 +0800] conn=4 op=13998 RESULT err=0 tag=101 nentries=1 wtime=0.000052053 optime=0.000221186 etime=0.000271763 [20/Dec/2022:08:52:32.208202844 +0800] conn=4 op=13999 SRCH base="cn=global_policy,cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:32.208281042 +0800] conn=4 op=13999 RESULT err=0 tag=101 nentries=1 wtime=0.000025947 optime=0.000079289 etime=0.000104134 [20/Dec/2022:08:52:32.208927398 +0800] conn=4 op=14000 MOD dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:32.211568960 +0800] conn=4 op=14000 RESULT err=0 tag=103 nentries=0 wtime=0.000025634 optime=0.002676202 etime=0.002699217 csn=63a10750000000040000 [20/Dec/2022:08:52:32.231157156 +0800] conn=2894 fd=124 slot=124 connection from 10.99.16.212 to 10.100.0.213 [20/Dec/2022:08:52:32.232013797 +0800] conn=2894 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:32.234288495 +0800] conn=2894 op=0 RESULT err=14 tag=97 nentries=0 wtime=0.000150079 optime=0.002278046 etime=0.002426942, SASL bind in progress [20/Dec/2022:08:52:32.235513263 +0800] conn=2894 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:32.236845298 +0800] conn=2894 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000037369 optime=0.001335839 etime=0.001371806, SASL bind in progress [20/Dec/2022:08:52:32.237928434 +0800] conn=2894 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:32.238454184 +0800] conn=2894 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000043487 optime=0.000527945 etime=0.000570516 dn="krbprincipalname=ldap/wocfreeipa-rep.wingon.hk@wingon.hk,cn=services,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:32.239497939 +0800] conn=2894 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [20/Dec/2022:08:52:32.240756122 +0800] conn=2894 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000097432 optime=0.001259187 etime=0.001355087 [20/Dec/2022:08:52:32.241878758 +0800] conn=2894 op=4 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [20/Dec/2022:08:52:32.243259798 +0800] conn=2894 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000074483 optime=0.001382703 etime=0.001455708 [20/Dec/2022:08:52:32.244444126 +0800] conn=2894 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:08:52:32.244844812 +0800] conn=2894 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000064757 optime=0.000409643 etime=0.000473545 [20/Dec/2022:08:52:32.249159483 +0800] conn=2894 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:08:52:32.250374739 +0800] conn=2894 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000049054 optime=0.001218454 etime=0.001265266 [20/Dec/2022:08:52:41.889724553 +0800] conn=5 op=14444 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:41.890119744 +0800] conn=5 op=14444 RESULT err=0 tag=101 nentries=1 wtime=0.000160221 optime=0.000399400 etime=0.000557213 [20/Dec/2022:08:52:41.890244009 +0800] conn=5 op=14445 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:41.890324635 +0800] conn=5 op=14445 RESULT err=0 tag=101 nentries=1 wtime=0.000103005 optime=0.000081280 etime=0.000183062 [20/Dec/2022:08:52:41.890417311 +0800] conn=5 op=14446 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:41.890647152 +0800] conn=5 op=14446 RESULT err=0 tag=101 nentries=1 wtime=0.000081474 optime=0.000231296 etime=0.000311348 [20/Dec/2022:08:52:41.890804201 +0800] conn=5 op=14447 SRCH base="cn=global_policy,cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:41.890881404 +0800] conn=5 op=14447 RESULT err=0 tag=101 nentries=1 wtime=0.000143403 optime=0.000078113 etime=0.000220491 [20/Dec/2022:08:52:42.636723558 +0800] conn=5 op=14449 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:42.637112855 +0800] conn=5 op=14449 RESULT err=0 tag=101 nentries=1 wtime=0.000169636 optime=0.000392788 etime=0.000560196 [20/Dec/2022:08:52:42.637273602 +0800] conn=5 op=14450 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:42.637392989 +0800] conn=5 op=14450 RESULT err=0 tag=101 nentries=1 wtime=0.000057304 optime=0.000121591 etime=0.000176898 [20/Dec/2022:08:52:42.637564989 +0800] conn=5 op=14451 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:42.637820305 +0800] conn=5 op=14451 RESULT err=0 tag=101 nentries=1 wtime=0.000081079 optime=0.000257073 etime=0.000336411 [20/Dec/2022:08:52:42.638067947 +0800] conn=5 op=14452 SRCH base="cn=global_policy,cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:42.638154921 +0800] conn=5 op=14452 RESULT err=0 tag=101 nentries=1 wtime=0.000059305 optime=0.000088255 etime=0.000146268 [20/Dec/2022:08:52:42.638626346 +0800] conn=5 op=14453 SRCH base="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Dec/2022:08:52:42.639725669 +0800] conn=5 op=14453 RESULT err=0 tag=101 nentries=1 wtime=0.000080443 optime=0.001101205 etime=0.001179279 [20/Dec/2022:08:52:42.640187185 +0800] conn=5 op=14454 MOD dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:42.642756394 +0800] conn=5 op=14454 RESULT err=0 tag=103 nentries=0 wtime=0.000046214 optime=0.002569881 etime=0.002613811 csn=63a1075a000000040000 [20/Dec/2022:08:52:49.488094006 +0800] conn=5 op=14455 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.488470833 +0800] conn=5 op=14455 RESULT err=0 tag=101 nentries=1 wtime=0.000157093 optime=0.000380307 etime=0.000535171 [20/Dec/2022:08:52:49.488907989 +0800] conn=5 op=14456 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.489168159 +0800] conn=5 op=14456 RESULT err=0 tag=101 nentries=1 wtime=0.000071892 optime=0.000261987 etime=0.000332048 [20/Dec/2022:08:52:49.489291527 +0800] conn=5 op=14457 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.489368891 +0800] conn=5 op=14457 RESULT err=0 tag=101 nentries=1 wtime=0.000020002 optime=0.000078100 etime=0.000096852 [20/Dec/2022:08:52:49.489551000 +0800] conn=5 op=14458 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.489784444 +0800] conn=5 op=14458 RESULT err=0 tag=101 nentries=1 wtime=0.000050301 optime=0.000234939 etime=0.000283911 [20/Dec/2022:08:52:49.489907838 +0800] conn=5 op=14459 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.489966334 +0800] conn=5 op=14459 RESULT err=0 tag=101 nentries=1 wtime=0.000018656 optime=0.000059311 etime=0.000076873 [20/Dec/2022:08:52:49.490140654 +0800] conn=5 op=14460 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.490385645 +0800] conn=5 op=14460 RESULT err=0 tag=101 nentries=1 wtime=0.000054201 optime=0.000246462 etime=0.000298996 [20/Dec/2022:08:52:49.490509791 +0800] conn=5 op=14461 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.490567976 +0800] conn=5 op=14461 RESULT err=0 tag=101 nentries=1 wtime=0.000018766 optime=0.000059023 etime=0.000076742 [20/Dec/2022:08:52:49.502954845 +0800] conn=2891 op=8 SRCH base="cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(ipaNTSecurityIdentifier=S-1-5-21-1621352465-573684049-3234178885-500)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))" attrs="objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember" [20/Dec/2022:08:52:49.503266323 +0800] conn=2891 op=8 RESULT err=0 tag=101 nentries=0 wtime=0.000119232 optime=0.000313682 etime=0.000431068 [20/Dec/2022:08:52:49.503619808 +0800] conn=2891 op=9 SRCH base="cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(ipaNTSecurityIdentifier=S-1-5-21-1621352465-573684049-3234178885-500)(objectClass=posixAccount)(uid=*)(ipaNTSecurityIdentifier=*))" attrs="objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn memberOf ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdattribute authorizedService accountexpires useraccountcontrol nsAccountLock host logindisabled loginexpirationtime loginallowedtimemap ipaSshPubKey ipaUserAuthType usercertificate;binary mail" [20/Dec/2022:08:52:49.504338874 +0800] conn=2891 op=9 RESULT err=0 tag=101 nentries=1 wtime=0.000087825 optime=0.000720696 etime=0.000806775 [20/Dec/2022:08:52:49.506016991 +0800] conn=2891 op=10 SRCH base="cn=Default Trust View,cn=views,cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:wingon.hk:ac4db316-6556-11ed-aade-0050568cee48))" attrs=ALL [20/Dec/2022:08:52:49.506233036 +0800] conn=2891 op=10 RESULT err=0 tag=101 nentries=0 wtime=0.001656902 optime=0.000216580 etime=0.001872020 [20/Dec/2022:08:52:49.524857089 +0800] conn=2895 fd=125 slot=125 connection from 10.100.0.213 to 10.100.0.213 [20/Dec/2022:08:52:49.526453626 +0800] conn=5 op=14462 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.526704890 +0800] conn=5 op=14462 RESULT err=0 tag=101 nentries=1 wtime=0.035436543 optime=0.000253370 etime=0.035688066 [20/Dec/2022:08:52:49.527116018 +0800] conn=5 op=14463 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=ldap/wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.527385120 +0800] conn=5 op=14463 RESULT err=0 tag=101 nentries=1 wtime=0.000059414 optime=0.000270825 etime=0.000328165 [20/Dec/2022:08:52:49.527514613 +0800] conn=5 op=14464 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.527577322 +0800] conn=5 op=14464 RESULT err=0 tag=101 nentries=1 wtime=0.000020653 optime=0.000063723 etime=0.000083249 [20/Dec/2022:08:52:49.527677215 +0800] conn=5 op=14465 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.527885167 +0800] conn=5 op=14465 RESULT err=0 tag=101 nentries=1 wtime=0.000044833 optime=0.000209291 etime=0.000252701 [20/Dec/2022:08:52:49.527998710 +0800] conn=5 op=14466 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.528055668 +0800] conn=5 op=14466 RESULT err=0 tag=101 nentries=1 wtime=0.000018253 optime=0.000057676 etime=0.000074875 [20/Dec/2022:08:52:49.528225172 +0800] conn=5 op=14467 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=ldap/wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.528452770 +0800] conn=5 op=14467 RESULT err=0 tag=101 nentries=1 wtime=0.000047130 optime=0.000228796 etime=0.000274314 [20/Dec/2022:08:52:49.528582893 +0800] conn=5 op=14468 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.528657241 +0800] conn=5 op=14468 RESULT err=0 tag=101 nentries=1 wtime=0.000021675 optime=0.000075366 etime=0.000095870 [20/Dec/2022:08:52:49.528737699 +0800] conn=5 op=14469 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaKrb5DelegationACL)(memberPrincipal=HTTP/wocfreeipa.wingon.hk@WINGON.HK))" attrs="objectClass memberPrincipal" [20/Dec/2022:08:52:49.528946342 +0800] conn=5 op=14469 RESULT err=0 tag=101 nentries=1 wtime=0.000023138 optime=0.000209311 etime=0.000231098 [20/Dec/2022:08:52:49.529144680 +0800] conn=5 op=14470 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.529395979 +0800] conn=5 op=14470 RESULT err=0 tag=101 nentries=1 wtime=0.000050806 optime=0.000252739 etime=0.000301948 [20/Dec/2022:08:52:49.529520417 +0800] conn=5 op=14471 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.529578243 +0800] conn=5 op=14471 RESULT err=0 tag=101 nentries=1 wtime=0.000019205 optime=0.000058676 etime=0.000076783 [20/Dec/2022:08:52:49.529678150 +0800] conn=5 op=14472 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.529889528 +0800] conn=5 op=14472 RESULT err=0 tag=101 nentries=1 wtime=0.000044447 optime=0.000212677 etime=0.000255851 [20/Dec/2022:08:52:49.530005152 +0800] conn=5 op=14473 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.530060858 +0800] conn=5 op=14473 RESULT err=0 tag=101 nentries=1 wtime=0.000017671 optime=0.000056385 etime=0.000072954 [20/Dec/2022:08:52:49.530199859 +0800] conn=5 op=14474 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.530428986 +0800] conn=5 op=14474 RESULT err=0 tag=101 nentries=1 wtime=0.000044995 optime=0.000230426 etime=0.000274012 [20/Dec/2022:08:52:49.530549346 +0800] conn=5 op=14475 SRCH base="cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.530606840 +0800] conn=5 op=14475 RESULT err=0 tag=101 nentries=1 wtime=0.000018279 optime=0.000058130 etime=0.000075356 [20/Dec/2022:08:52:49.532758492 +0800] conn=2895 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Dec/2022:08:52:49.534731861 +0800] conn=2895 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000153862 optime=0.001976947 etime=0.002129681 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:49.712276555 +0800] conn=2895 op=1 UNBIND [20/Dec/2022:08:52:49.712315443 +0800] conn=2895 op=1 fd=125 closed error - U1 [20/Dec/2022:08:52:50.054092304 +0800] conn=2896 fd=125 slot=125 connection from 10.100.0.213 to 10.100.0.213 [20/Dec/2022:08:52:50.056611957 +0800] conn=2896 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Dec/2022:08:52:50.058603263 +0800] conn=2896 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000214021 optime=0.002000265 etime=0.002213084 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:50.061270916 +0800] conn=2896 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:08:52:50.061915250 +0800] conn=2896 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000148286 optime=0.000645753 etime=0.000791691 [20/Dec/2022:08:52:50.062877341 +0800] conn=2896 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL [20/Dec/2022:08:52:50.063452183 +0800] conn=2896 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000069136 optime=0.000575594 etime=0.000642941 [20/Dec/2022:08:52:50.081855339 +0800] conn=19 op=5318 SRCH base="cn=1,ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:08:52:50.082050056 +0800] conn=19 op=5318 RESULT err=0 tag=101 nentries=1 wtime=0.000079328 optime=0.000196505 etime=0.000273764 [20/Dec/2022:08:52:50.095406104 +0800] conn=2896 op=3 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" [20/Dec/2022:08:52:50.095474423 +0800] conn=2896 op=3 RESULT err=0 tag=120 nentries=0 wtime=0.000087708 optime=0.000084261 etime=0.000170131 [20/Dec/2022:08:52:50.095683671 +0800] conn=2896 op=4 SRCH base="cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass" [20/Dec/2022:08:52:50.096598124 +0800] conn=2896 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000063023 optime=0.000914785 etime=0.000976007 - entryLevelRights: vadn [20/Dec/2022:08:52:50.098460393 +0800] conn=2896 op=5 SRCH base="cn=cas,cn=ca,dc=wingon,dc=hk" scope=2 filter="(&(cn=ipa)(objectClass=ipaca))" attrs="" [20/Dec/2022:08:52:50.098819481 +0800] conn=2896 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000088228 optime=0.000360094 etime=0.000446755 [20/Dec/2022:08:52:50.099423444 +0800] conn=2896 op=6 SRCH base="cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaCaIssuerDN cn ipaCaId ipaCaSubjectDN description" [20/Dec/2022:08:52:50.099679002 +0800] conn=2896 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000082454 optime=0.000257939 etime=0.000338566 [20/Dec/2022:08:52:50.101141986 +0800] conn=2896 op=7 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [20/Dec/2022:08:52:50.101621396 +0800] conn=2896 op=7 RESULT err=0 tag=101 nentries=1 wtime=0.000089009 optime=0.000480845 etime=0.000568114 [20/Dec/2022:08:52:50.117215381 +0800] conn=2896 op=8 UNBIND [20/Dec/2022:08:52:50.117237108 +0800] conn=2896 op=8 fd=125 closed error - U1 [20/Dec/2022:08:53:32.266556934 +0800] conn=2894 op=7 UNBIND [20/Dec/2022:08:53:32.266593638 +0800] conn=2894 op=7 fd=124 closed error - U1
thanks, Junhou
Hi,
thanks for the logs. Definitely nothing reported here related to the login attempt. I would try to increase PKI's log level by editing /var/lib/pki/pki-tomcat/conf/logging.properties (use FINE everywhere, restart pki-tomcatd, run the ipa cert-show 1 command, revert to previous log level), hoping to get more information. Otherwise reach out to PKI community through users@lists.dogtagpki.org https://lists.dogtagpki.org/archives/list/users@lists.dogtagpki.org/, they may have more ideas. flo
On Tue, Dec 20, 2022 at 9:40 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi , [20/Dec/2022:08:49:29.637099418 +0800] conn=2892 op=9 UNBIND [20/Dec/2022:08:49:29.637145006 +0800] conn=2892 op=9 fd=124 closed error
- U1
[20/Dec/2022:08:49:32.043506909 +0800] conn=27 op=3410 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn" [20/Dec/2022:08:49:32.043782127 +0800] conn=27 op=3410 RESULT err=32 tag=101 nentries=0 wtime=0.000153439 optime=0.000279769 etime=0.000430437 [20/Dec/2022:08:49:38.148322772 +0800] conn=28 op=6817 SRCH base="ou=authorizations,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220004938+0000)" attrs="1.1" [20/Dec/2022:08:49:38.148586175 +0800] conn=28 op=6817 RESULT err=0 tag=101 nentries=0 wtime=0.000138301 optime=0.000273350 etime=0.000408659 [20/Dec/2022:08:49:38.148943213 +0800] conn=28 op=6818 SRCH base="ou=orders,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220004938+0000)" attrs="1.1" [20/Dec/2022:08:49:38.149071009 +0800] conn=28 op=6818 RESULT err=0 tag=101 nentries=0 wtime=0.000206338 optime=0.000129557 etime=0.000333928 [20/Dec/2022:08:49:38.149274125 +0800] conn=28 op=6819 SRCH base="ou=certificates,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221220004938+0000)" attrs="1.1" [20/Dec/2022:08:49:38.149379198 +0800] conn=28 op=6819 RESULT err=0 tag=101 nentries=0 wtime=0.000130714 optime=0.000106250 etime=0.000235350 [20/Dec/2022:08:52:01.986729492 +0800] conn=2888 op=8 UNBIND [20/Dec/2022:08:52:01.986771904 +0800] conn=2888 op=8 fd=73 closed error - U1 [20/Dec/2022:08:52:07.702869314 +0800] conn=4 op=13990 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:07.703402545 +0800] conn=4 op=13990 RESULT err=0 tag=101 nentries=1 wtime=0.000193320 optime=0.000543635 etime=0.000734611 [20/Dec/2022:08:52:07.703507147 +0800] conn=4 op=13991 SRCH base="cn=ipaConfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Dec/2022:08:52:07.703570031 +0800] conn=4 op=13991 RESULT err=0 tag=101 nentries=1 wtime=0.000021034 optime=0.000063839 etime=0.000083694 [20/Dec/2022:08:52:07.703713585 +0800] conn=4 op=13992 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:07.703808511 +0800] conn=4 op=13992 RESULT err=0 tag=101 nentries=1 wtime=0.000023489 optime=0.000095938 etime=0.000118208 [20/Dec/2022:08:52:07.703932548 +0800] conn=4 op=13993 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:07.704164824 +0800] conn=4 op=13993 RESULT err=0 tag=101 nentries=1 wtime=0.000055700 optime=0.000233831 etime=0.000288007 [20/Dec/2022:08:52:07.704454880 +0800] conn=4 op=13994 SRCH base="cn=global_policy,cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:07.704543319 +0800] conn=4 op=13994 RESULT err=0 tag=101 nentries=1 wtime=0.000041266 optime=0.000090343 etime=0.000130370 [20/Dec/2022:08:52:09.990863586 +0800] conn=2893 fd=73 slot=73 connection from 10.99.16.212 to 10.100.0.213 [20/Dec/2022:08:52:09.991284876 +0800] conn=2893 op=0 SRCH base="" scope=0 filter="(objectClass=*)" attrs="* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domaincontrollerfunctionality defaultnamingcontext lastusn highestcommittedusn aci" [20/Dec/2022:08:52:09.992883383 +0800] conn=2893 op=0 RESULT err=0 tag=101 nentries=1 wtime=0.000306908 optime=0.001598916 etime=0.001904660 [20/Dec/2022:08:52:10.020345323 +0800] conn=5 op=14421 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ wocfreeipa-rep.wingon.hk@WINGON.HK )(krbPrincipalName:caseIgnoreIA5Match:=host/ wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.020685934 +0800] conn=5 op=14421 RESULT err=0 tag=101 nentries=1 wtime=0.000148639 optime=0.000343867 etime=0.000490293 [20/Dec/2022:08:52:10.020796954 +0800] conn=5 op=14422 SRCH base="cn=ipaConfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Dec/2022:08:52:10.020859631 +0800] conn=5 op=14422 RESULT err=0 tag=101 nentries=1 wtime=0.000024022 optime=0.000063922 etime=0.000086660 [20/Dec/2022:08:52:10.021013120 +0800] conn=5 op=14423 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.021076265 +0800] conn=5 op=14423 RESULT err=0 tag=101 nentries=1 wtime=0.000021565 optime=0.000064169 etime=0.000084552 [20/Dec/2022:08:52:10.021190460 +0800] conn=5 op=14424 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.021431298 +0800] conn=5 op=14424 RESULT err=0 tag=101 nentries=1 wtime=0.000054189 optime=0.000242208 etime=0.000294767 [20/Dec/2022:08:52:10.021663559 +0800] conn=5 op=14425 SRCH base="cn=Default Host Password Policy,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:10.021749877 +0800] conn=5 op=14425 RESULT err=0 tag=101 nentries=1 wtime=0.000032347 optime=0.000088078 etime=0.000119139 [20/Dec/2022:08:52:10.033772246 +0800] conn=5 op=14426 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ wocfreeipa-rep.wingon.hk@WINGON.HK )(krbPrincipalName:caseIgnoreIA5Match:=host/ wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.034022601 +0800] conn=5 op=14426 RESULT err=0 tag=101 nentries=1 wtime=0.011565691 optime=0.000252782 etime=0.011816585 [20/Dec/2022:08:52:10.034170111 +0800] conn=5 op=14427 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.034236031 +0800] conn=5 op=14427 RESULT err=0 tag=101 nentries=1 wtime=0.000022773 optime=0.000067234 etime=0.000088827 [20/Dec/2022:08:52:10.034349405 +0800] conn=5 op=14428 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.034560533 +0800] conn=5 op=14428 RESULT err=0 tag=101 nentries=1 wtime=0.000062169 optime=0.000212339 etime=0.000273015 [20/Dec/2022:08:52:10.034725055 +0800] conn=5 op=14429 SRCH base="cn=Default Host Password Policy,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:10.034805632 +0800] conn=5 op=14429 RESULT err=0 tag=101 nentries=1 wtime=0.000027824 optime=0.000081903 etime=0.000108561 [20/Dec/2022:08:52:10.035180909 +0800] conn=5 op=14430 SRCH base="cn=ad,cn=trusts,dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs=ALL [20/Dec/2022:08:52:10.035239166 +0800] conn=5 op=14430 RESULT err=0 tag=101 nentries=0 wtime=0.000016420 optime=0.000058741 etime=0.000073879 [20/Dec/2022:08:52:10.035287403 +0800] conn=5 op=14431 SRCH base="dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTDomainAttrs)" attrs="ipaNTFlatName ipaNTFallbackPrimaryGroup ipaNTSecurityIdentifier" [20/Dec/2022:08:52:10.035383748 +0800] conn=5 op=14431 RESULT err=0 tag=101 nentries=1 wtime=0.000017953 optime=0.000096850 etime=0.000113571 [20/Dec/2022:08:52:10.035441566 +0800] conn=5 op=14432 SRCH base="cn=Default SMB Group,cn=groups,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=posixGroup)" attrs="ipaNTSecurityIdentifier" [20/Dec/2022:08:52:10.035491471 +0800] conn=5 op=14432 RESULT err=0 tag=101 nentries=1 wtime=0.000015040 optime=0.000050416 etime=0.000064443 [20/Dec/2022:08:52:10.035545178 +0800] conn=5 op=14433 SRCH base="cn=ad,cn=trusts,dc=wingon,dc=hk" scope=2 filter="(objectClass=ipaNTTrustedDomain)" attrs="cn ipaNTTrustPartner ipaNTFlatName ipaNTTrustedDomainSID ipaNTSIDBlacklistIncoming ipaNTSIDBlacklistOutgoing ipaNTAdditionalSuffixes" [20/Dec/2022:08:52:10.035587789 +0800] conn=5 op=14433 RESULT err=0 tag=101 nentries=0 wtime=0.000017675 optime=0.000043192 etime=0.000059863 [20/Dec/2022:08:52:10.035672369 +0800] conn=5 op=14434 SRCH base="fqdn= wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Dec/2022:08:52:10.036234906 +0800] conn=5 op=14434 RESULT err=0 tag=101 nentries=1 wtime=0.000033128 optime=0.000563748 etime=0.000595431 [20/Dec/2022:08:52:10.036351846 +0800] conn=5 op=14435 SRCH base="cn= wocfreeipa-rep.wingon.hk,cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:08:52:10.036415781 +0800] conn=5 op=14435 RESULT err=0 tag=101 nentries=1 wtime=0.000017116 optime=0.000064859 etime=0.000080843 [20/Dec/2022:08:52:10.054500251 +0800] conn=5 op=14436 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.054733532 +0800] conn=5 op=14436 RESULT err=0 tag=101 nentries=1 wtime=0.017673549 optime=0.000235438 etime=0.017907231 [20/Dec/2022:08:52:10.055075637 +0800] conn=5 op=14437 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/ wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=ldap/ wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.055292342 +0800] conn=5 op=14437 RESULT err=0 tag=101 nentries=1 wtime=0.000052636 optime=0.000218403 etime=0.000269568 [20/Dec/2022:08:52:10.055431453 +0800] conn=5 op=14438 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.055491849 +0800] conn=5 op=14438 RESULT err=0 tag=101 nentries=1 wtime=0.000020352 optime=0.000061341 etime=0.000080566 [20/Dec/2022:08:52:10.055663216 +0800] conn=5 op=14439 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ wocfreeipa-rep.wingon.hk@WINGON.HK )(krbPrincipalName:caseIgnoreIA5Match:=host/ wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.055880149 +0800] conn=5 op=14439 RESULT err=0 tag=101 nentries=1 wtime=0.000048562 optime=0.000218419 etime=0.000265458 [20/Dec/2022:08:52:10.056004896 +0800] conn=5 op=14440 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.056062326 +0800] conn=5 op=14440 RESULT err=0 tag=101 nentries=1 wtime=0.000018653 optime=0.000058227 etime=0.000075792 [20/Dec/2022:08:52:10.056230702 +0800] conn=5 op=14441 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=host/ wocfreeipa-rep.wingon.hk@WINGON.HK )(krbPrincipalName:caseIgnoreIA5Match:=host/ wocfreeipa-rep.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:10.056463992 +0800] conn=5 op=14441 RESULT err=0 tag=101 nentries=1 wtime=0.000052619 optime=0.000234983 etime=0.000285946 [20/Dec/2022:08:52:10.056592816 +0800] conn=5 op=14442 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:10.056651155 +0800] conn=5 op=14442 RESULT err=0 tag=101 nentries=1 wtime=0.000019182 optime=0.000059079 etime=0.000077173 [20/Dec/2022:08:52:10.058554640 +0800] conn=2893 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:10.061134122 +0800] conn=2893 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000059172 optime=0.002585693 etime=0.002643652, SASL bind in progress [20/Dec/2022:08:52:10.062668409 +0800] conn=2893 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:10.064085004 +0800] conn=2893 op=2 RESULT err=14 tag=97 nentries=0 wtime=0.000050077 optime=0.001419041 etime=0.001467480, SASL bind in progress [20/Dec/2022:08:52:10.065014341 +0800] conn=2893 op=3 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:10.065666815 +0800] conn=2893 op=3 RESULT err=0 tag=97 nentries=0 wtime=0.000041031 optime=0.000660380 etime=0.000700410 dn="fqdn= wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:10.067604557 +0800] conn=2893 op=4 SRCH base="cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaHost)(fqdn=wocfreeipa-rep.wingon.hk))" attrs="objectClass cn fqdn serverHostName memberOf ipaSshPubKey ipaUniqueID" [20/Dec/2022:08:52:10.068161053 +0800] conn=2893 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000095350 optime=0.000556958 etime=0.000650469 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:08:52:10.071342521 +0800] conn=2893 op=5 SRCH base="fqdn= wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass cn memberOf ipaUniqueID" [20/Dec/2022:08:52:10.073536868 +0800] conn=2893 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000104954 optime=0.002194820 etime=0.002297765 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:08:52:10.074690660 +0800] conn=2893 op=6 SRCH base="cn=sudo,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipasudocmdgrp)(entryusn>=48491))" attrs="objectClass ipaUniqueID cn member entryusn" [20/Dec/2022:08:52:10.074851580 +0800] conn=2893 op=6 RESULT err=0 tag=101 nentries=0 wtime=0.000076126 optime=0.000161713 etime=0.000235912 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:08:52:10.075980709 +0800] conn=2893 op=7 SRCH base="cn=sudo,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipasudorule)(ipaEnabledFlag=TRUE)(|(&(!(memberHost=*))(cn=defaults))(hostCategory=ALL)(memberHost=fqdn= wocfreeipa-rep.wingon.hk,cn=computers,cn=accounts,dc=wingon,dc=hk)(memberHost=cn=ipaservers,cn=hostgroups,cn=accounts,dc=wingon,dc=hk))(entryusn>=48491))" attrs="objectClass cn ipaUniqueID ipaEnabledFlag ipaSudoOpt ipaSudoRunAs ipaSudoRunAsGroup memberAllowCmd memberDenyCmd memberHost memberUser sudoNotAfter sudoNotBefore sudoOrder cmdCategory hostCategory userCategory ipaSudoRunAsUserCategory ipaSudoRunAsGroupCategory ipaSudoRunAsExtUser ipaSudoRunAsExtGroup ipaSudoRunAsExtUserGroup externalUser entryusn" [20/Dec/2022:08:52:10.076123960 +0800] conn=2893 op=7 RESULT err=0 tag=101 nentries=0 wtime=0.000130861 optime=0.000144629 etime=0.000273690 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1 [20/Dec/2022:08:52:32.207041120 +0800] conn=4 op=13996 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:32.207436448 +0800] conn=4 op=13996 RESULT err=0 tag=101 nentries=1 wtime=0.000184164 optime=0.000398522 etime=0.000580416 [20/Dec/2022:08:52:32.207620899 +0800] conn=4 op=13997 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:32.207691911 +0800] conn=4 op=13997 RESULT err=0 tag=101 nentries=1 wtime=0.000025598 optime=0.000071976 etime=0.000096282 [20/Dec/2022:08:52:32.207801336 +0800] conn=4 op=13998 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:32.208021391 +0800] conn=4 op=13998 RESULT err=0 tag=101 nentries=1 wtime=0.000052053 optime=0.000221186 etime=0.000271763 [20/Dec/2022:08:52:32.208202844 +0800] conn=4 op=13999 SRCH base="cn=global_policy,cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:32.208281042 +0800] conn=4 op=13999 RESULT err=0 tag=101 nentries=1 wtime=0.000025947 optime=0.000079289 etime=0.000104134 [20/Dec/2022:08:52:32.208927398 +0800] conn=4 op=14000 MOD dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:32.211568960 +0800] conn=4 op=14000 RESULT err=0 tag=103 nentries=0 wtime=0.000025634 optime=0.002676202 etime=0.002699217 csn=63a10750000000040000 [20/Dec/2022:08:52:32.231157156 +0800] conn=2894 fd=124 slot=124 connection from 10.99.16.212 to 10.100.0.213 [20/Dec/2022:08:52:32.232013797 +0800] conn=2894 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:32.234288495 +0800] conn=2894 op=0 RESULT err=14 tag=97 nentries=0 wtime=0.000150079 optime=0.002278046 etime=0.002426942, SASL bind in progress [20/Dec/2022:08:52:32.235513263 +0800] conn=2894 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:32.236845298 +0800] conn=2894 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000037369 optime=0.001335839 etime=0.001371806, SASL bind in progress [20/Dec/2022:08:52:32.237928434 +0800] conn=2894 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [20/Dec/2022:08:52:32.238454184 +0800] conn=2894 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000043487 optime=0.000527945 etime=0.000570516 dn="krbprincipalname=ldap/wocfreeipa-rep.wingon.hk@wingon.hk ,cn=services,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:32.239497939 +0800] conn=2894 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [20/Dec/2022:08:52:32.240756122 +0800] conn=2894 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000097432 optime=0.001259187 etime=0.001355087 [20/Dec/2022:08:52:32.241878758 +0800] conn=2894 op=4 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [20/Dec/2022:08:52:32.243259798 +0800] conn=2894 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000074483 optime=0.001382703 etime=0.001455708 [20/Dec/2022:08:52:32.244444126 +0800] conn=2894 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Dec/2022:08:52:32.244844812 +0800] conn=2894 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000064757 optime=0.000409643 etime=0.000473545 [20/Dec/2022:08:52:32.249159483 +0800] conn=2894 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Dec/2022:08:52:32.250374739 +0800] conn=2894 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000049054 optime=0.001218454 etime=0.001265266 [20/Dec/2022:08:52:41.889724553 +0800] conn=5 op=14444 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:41.890119744 +0800] conn=5 op=14444 RESULT err=0 tag=101 nentries=1 wtime=0.000160221 optime=0.000399400 etime=0.000557213 [20/Dec/2022:08:52:41.890244009 +0800] conn=5 op=14445 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:41.890324635 +0800] conn=5 op=14445 RESULT err=0 tag=101 nentries=1 wtime=0.000103005 optime=0.000081280 etime=0.000183062 [20/Dec/2022:08:52:41.890417311 +0800] conn=5 op=14446 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:41.890647152 +0800] conn=5 op=14446 RESULT err=0 tag=101 nentries=1 wtime=0.000081474 optime=0.000231296 etime=0.000311348 [20/Dec/2022:08:52:41.890804201 +0800] conn=5 op=14447 SRCH base="cn=global_policy,cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:41.890881404 +0800] conn=5 op=14447 RESULT err=0 tag=101 nentries=1 wtime=0.000143403 optime=0.000078113 etime=0.000220491 [20/Dec/2022:08:52:42.636723558 +0800] conn=5 op=14449 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:42.637112855 +0800] conn=5 op=14449 RESULT err=0 tag=101 nentries=1 wtime=0.000169636 optime=0.000392788 etime=0.000560196 [20/Dec/2022:08:52:42.637273602 +0800] conn=5 op=14450 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:42.637392989 +0800] conn=5 op=14450 RESULT err=0 tag=101 nentries=1 wtime=0.000057304 optime=0.000121591 etime=0.000176898 [20/Dec/2022:08:52:42.637564989 +0800] conn=5 op=14451 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:42.637820305 +0800] conn=5 op=14451 RESULT err=0 tag=101 nentries=1 wtime=0.000081079 optime=0.000257073 etime=0.000336411 [20/Dec/2022:08:52:42.638067947 +0800] conn=5 op=14452 SRCH base="cn=global_policy,cn=WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration ipaPwdMaxRepeat ipaPwdMaxSequence ipaPwdDictCheck ipaPwdUserCheck" [20/Dec/2022:08:52:42.638154921 +0800] conn=5 op=14452 RESULT err=0 tag=101 nentries=1 wtime=0.000059305 optime=0.000088255 etime=0.000146268 [20/Dec/2022:08:52:42.638626346 +0800] conn=5 op=14453 SRCH base="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Dec/2022:08:52:42.639725669 +0800] conn=5 op=14453 RESULT err=0 tag=101 nentries=1 wtime=0.000080443 optime=0.001101205 etime=0.001179279 [20/Dec/2022:08:52:42.640187185 +0800] conn=5 op=14454 MOD dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:42.642756394 +0800] conn=5 op=14454 RESULT err=0 tag=103 nentries=0 wtime=0.000046214 optime=0.002569881 etime=0.002613811 csn=63a1075a000000040000 [20/Dec/2022:08:52:49.488094006 +0800] conn=5 op=14455 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.488470833 +0800] conn=5 op=14455 RESULT err=0 tag=101 nentries=1 wtime=0.000157093 optime=0.000380307 etime=0.000535171 [20/Dec/2022:08:52:49.488907989 +0800] conn=5 op=14456 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/ wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/ wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.489168159 +0800] conn=5 op=14456 RESULT err=0 tag=101 nentries=1 wtime=0.000071892 optime=0.000261987 etime=0.000332048 [20/Dec/2022:08:52:49.489291527 +0800] conn=5 op=14457 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.489368891 +0800] conn=5 op=14457 RESULT err=0 tag=101 nentries=1 wtime=0.000020002 optime=0.000078100 etime=0.000096852 [20/Dec/2022:08:52:49.489551000 +0800] conn=5 op=14458 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.489784444 +0800] conn=5 op=14458 RESULT err=0 tag=101 nentries=1 wtime=0.000050301 optime=0.000234939 etime=0.000283911 [20/Dec/2022:08:52:49.489907838 +0800] conn=5 op=14459 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.489966334 +0800] conn=5 op=14459 RESULT err=0 tag=101 nentries=1 wtime=0.000018656 optime=0.000059311 etime=0.000076873 [20/Dec/2022:08:52:49.490140654 +0800] conn=5 op=14460 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.490385645 +0800] conn=5 op=14460 RESULT err=0 tag=101 nentries=1 wtime=0.000054201 optime=0.000246462 etime=0.000298996 [20/Dec/2022:08:52:49.490509791 +0800] conn=5 op=14461 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.490567976 +0800] conn=5 op=14461 RESULT err=0 tag=101 nentries=1 wtime=0.000018766 optime=0.000059023 etime=0.000076742 [20/Dec/2022:08:52:49.502954845 +0800] conn=2891 op=8 SRCH base="cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(ipaNTSecurityIdentifier=S-1-5-21-1621352465-573684049-3234178885-500)(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))" attrs="objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember" [20/Dec/2022:08:52:49.503266323 +0800] conn=2891 op=8 RESULT err=0 tag=101 nentries=0 wtime=0.000119232 optime=0.000313682 etime=0.000431068 [20/Dec/2022:08:52:49.503619808 +0800] conn=2891 op=9 SRCH base="cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(ipaNTSecurityIdentifier=S-1-5-21-1621352465-573684049-3234178885-500)(objectClass=posixAccount)(uid=*)(ipaNTSecurityIdentifier=*))" attrs="objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn memberOf ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdattribute authorizedService accountexpires useraccountcontrol nsAccountLock host logindisabled loginexpirationtime loginallowedtimemap ipaSshPubKey ipaUserAuthType usercertificate;binary mail" [20/Dec/2022:08:52:49.504338874 +0800] conn=2891 op=9 RESULT err=0 tag=101 nentries=1 wtime=0.000087825 optime=0.000720696 etime=0.000806775 [20/Dec/2022:08:52:49.506016991 +0800] conn=2891 op=10 SRCH base="cn=Default Trust View,cn=views,cn=accounts,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:wingon.hk:ac4db316-6556-11ed-aade-0050568cee48))" attrs=ALL [20/Dec/2022:08:52:49.506233036 +0800] conn=2891 op=10 RESULT err=0 tag=101 nentries=0 wtime=0.001656902 optime=0.000216580 etime=0.001872020 [20/Dec/2022:08:52:49.524857089 +0800] conn=2895 fd=125 slot=125 connection from 10.100.0.213 to 10.100.0.213 [20/Dec/2022:08:52:49.526453626 +0800] conn=5 op=14462 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/ WINGON.HK@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/ WINGON.HK@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.526704890 +0800] conn=5 op=14462 RESULT err=0 tag=101 nentries=1 wtime=0.035436543 optime=0.000253370 etime=0.035688066 [20/Dec/2022:08:52:49.527116018 +0800] conn=5 op=14463 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/ wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=ldap/ wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.527385120 +0800] conn=5 op=14463 RESULT err=0 tag=101 nentries=1 wtime=0.000059414 optime=0.000270825 etime=0.000328165 [20/Dec/2022:08:52:49.527514613 +0800] conn=5 op=14464 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.527577322 +0800] conn=5 op=14464 RESULT err=0 tag=101 nentries=1 wtime=0.000020653 optime=0.000063723 etime=0.000083249 [20/Dec/2022:08:52:49.527677215 +0800] conn=5 op=14465 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=HTTP/ wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=HTTP/ wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.527885167 +0800] conn=5 op=14465 RESULT err=0 tag=101 nentries=1 wtime=0.000044833 optime=0.000209291 etime=0.000252701 [20/Dec/2022:08:52:49.527998710 +0800] conn=5 op=14466 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.528055668 +0800] conn=5 op=14466 RESULT err=0 tag=101 nentries=1 wtime=0.000018253 optime=0.000057676 etime=0.000074875 [20/Dec/2022:08:52:49.528225172 +0800] conn=5 op=14467 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/ wocfreeipa.wingon.hk@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=ldap/ wocfreeipa.wingon.hk@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.528452770 +0800] conn=5 op=14467 RESULT err=0 tag=101 nentries=1 wtime=0.000047130 optime=0.000228796 etime=0.000274314 [20/Dec/2022:08:52:49.528582893 +0800] conn=5 op=14468 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.528657241 +0800] conn=5 op=14468 RESULT err=0 tag=101 nentries=1 wtime=0.000021675 optime=0.000075366 etime=0.000095870 [20/Dec/2022:08:52:49.528737699 +0800] conn=5 op=14469 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaKrb5DelegationACL)(memberPrincipal=HTTP/ wocfreeipa.wingon.hk@WINGON.HK))" attrs="objectClass memberPrincipal" [20/Dec/2022:08:52:49.528946342 +0800] conn=5 op=14469 RESULT err=0 tag=101 nentries=1 wtime=0.000023138 optime=0.000209311 etime=0.000231098 [20/Dec/2022:08:52:49.529144680 +0800] conn=5 op=14470 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.529395979 +0800] conn=5 op=14470 RESULT err=0 tag=101 nentries=1 wtime=0.000050806 optime=0.000252739 etime=0.000301948 [20/Dec/2022:08:52:49.529520417 +0800] conn=5 op=14471 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.529578243 +0800] conn=5 op=14471 RESULT err=0 tag=101 nentries=1 wtime=0.000019205 optime=0.000058676 etime=0.000076783 [20/Dec/2022:08:52:49.529678150 +0800] conn=5 op=14472 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.529889528 +0800] conn=5 op=14472 RESULT err=0 tag=101 nentries=1 wtime=0.000044447 optime=0.000212677 etime=0.000255851 [20/Dec/2022:08:52:49.530005152 +0800] conn=5 op=14473 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.530060858 +0800] conn=5 op=14473 RESULT err=0 tag=101 nentries=1 wtime=0.000017671 optime=0.000056385 etime=0.000072954 [20/Dec/2022:08:52:49.530199859 +0800] conn=5 op=14474 SRCH base="dc=wingon,dc=hk" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias= admin@WINGON.HK)(krbPrincipalName:caseIgnoreIA5Match:=admin@WINGON.HK)))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge uid nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxT..." [20/Dec/2022:08:52:49.530428986 +0800] conn=5 op=14474 RESULT err=0 tag=101 nentries=1 wtime=0.000044995 optime=0.000230426 etime=0.000274012 [20/Dec/2022:08:52:49.530549346 +0800] conn=5 op=14475 SRCH base="cn= WINGON.HK,cn=kerberos,dc=wingon,dc=hk" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [20/Dec/2022:08:52:49.530606840 +0800] conn=5 op=14475 RESULT err=0 tag=101 nentries=1 wtime=0.000018279 optime=0.000058130 etime=0.000075356 [20/Dec/2022:08:52:49.532758492 +0800] conn=2895 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Dec/2022:08:52:49.534731861 +0800] conn=2895 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000153862 optime=0.001976947 etime=0.002129681 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:49.712276555 +0800] conn=2895 op=1 UNBIND [20/Dec/2022:08:52:49.712315443 +0800] conn=2895 op=1 fd=125 closed error
- U1
[20/Dec/2022:08:52:50.054092304 +0800] conn=2896 fd=125 slot=125 connection from 10.100.0.213 to 10.100.0.213 [20/Dec/2022:08:52:50.056611957 +0800] conn=2896 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Dec/2022:08:52:50.058603263 +0800] conn=2896 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000214021 optime=0.002000265 etime=0.002213084 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [20/Dec/2022:08:52:50.061270916 +0800] conn=2896 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:08:52:50.061915250 +0800] conn=2896 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000148286 optime=0.000645753 etime=0.000791691 [20/Dec/2022:08:52:50.062877341 +0800] conn=2896 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL [20/Dec/2022:08:52:50.063452183 +0800] conn=2896 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000069136 optime=0.000575594 etime=0.000642941 [20/Dec/2022:08:52:50.081855339 +0800] conn=19 op=5318 SRCH base="cn=1,ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(objectClass=*)" attrs=ALL [20/Dec/2022:08:52:50.082050056 +0800] conn=19 op=5318 RESULT err=0 tag=101 nentries=1 wtime=0.000079328 optime=0.000196505 etime=0.000273764 [20/Dec/2022:08:52:50.095406104 +0800] conn=2896 op=3 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" [20/Dec/2022:08:52:50.095474423 +0800] conn=2896 op=3 RESULT err=0 tag=120 nentries=0 wtime=0.000087708 optime=0.000084261 etime=0.000170131 [20/Dec/2022:08:52:50.095683671 +0800] conn=2896 op=4 SRCH base="cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass" [20/Dec/2022:08:52:50.096598124 +0800] conn=2896 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000063023 optime=0.000914785 etime=0.000976007 - entryLevelRights: vadn [20/Dec/2022:08:52:50.098460393 +0800] conn=2896 op=5 SRCH base="cn=cas,cn=ca,dc=wingon,dc=hk" scope=2 filter="(&(cn=ipa)(objectClass=ipaca))" attrs="" [20/Dec/2022:08:52:50.098819481 +0800] conn=2896 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000088228 optime=0.000360094 etime=0.000446755 [20/Dec/2022:08:52:50.099423444 +0800] conn=2896 op=6 SRCH base="cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="ipaCaIssuerDN cn ipaCaId ipaCaSubjectDN description" [20/Dec/2022:08:52:50.099679002 +0800] conn=2896 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000082454 optime=0.000257939 etime=0.000338566 [20/Dec/2022:08:52:50.101141986 +0800] conn=2896 op=7 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [20/Dec/2022:08:52:50.101621396 +0800] conn=2896 op=7 RESULT err=0 tag=101 nentries=1 wtime=0.000089009 optime=0.000480845 etime=0.000568114 [20/Dec/2022:08:52:50.117215381 +0800] conn=2896 op=8 UNBIND [20/Dec/2022:08:52:50.117237108 +0800] conn=2896 op=8 fd=125 closed error
- U1
[20/Dec/2022:08:53:32.266556934 +0800] conn=2894 op=7 UNBIND [20/Dec/2022:08:53:32.266593638 +0800] conn=2894 op=7 fd=124 closed error
- U1
thanks, Junhou _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi, [root@wocfreeipa conf]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa conf]# cat /var/lib/pki/pki-tomcat/conf/logging.properties | grep FINE 1catalina.org.apache.juli.FileHandler.level = FINE 2localhost.org.apache.juli.FileHandler.level = FINE 3manager.org.apache.juli.FileHandler.level = FINE 4host-manager.org.apache.juli.FileHandler.level = FINE java.util.logging.ConsoleHandler.level = FINE .level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = FINE org.mozilla.jss.level = FINE org.dogtagpki.level = FINE com.netscape.level = FINE netscape.level = FINE [root@wocfreeipa conf]#
tail -f /var/log/pki/pki-tomcat/ca/debug.2022-12-22.log 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-22 08:38:17 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-22 08:38:49 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] INFO: Getting certificate 0x1 2022-12-22 08:38:49 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=ca,o=ipaca
tail -f /var/log/dirsrv/slapd-WINGON-HK/access [22/Dec/2022:08:38:17.233886267 +0800] conn=19 op=21 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="description" [22/Dec/2022:08:38:17.234010458 +0800] conn=19 op=21 RESULT err=0 tag=101 nentries=1 wtime=0.014734052 optime=0.000125838 etime=0.014858013 [22/Dec/2022:08:38:17.847746019 +0800] conn=27 op=8 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn" [22/Dec/2022:08:38:17.847992778 +0800] conn=27 op=8 RESULT err=32 tag=101 nentries=0 wtime=0.000158299 optime=0.000259281 etime=0.000414694 [22/Dec/2022:08:38:19.598578843 +0800] conn=28 op=13 SRCH base="ou=authorizations,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.598863277 +0800] conn=28 op=13 RESULT err=0 tag=101 nentries=0 wtime=0.000157043 optime=0.000287685 etime=0.000440875 [22/Dec/2022:08:38:19.599268909 +0800] conn=28 op=14 SRCH base="ou=orders,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.599396932 +0800] conn=28 op=14 RESULT err=0 tag=101 nentries=0 wtime=0.000379314 optime=0.000128884 etime=0.000506447 [22/Dec/2022:08:38:19.601650121 +0800] conn=28 op=15 SRCH base="ou=certificates,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.601790342 +0800] conn=28 op=15 RESULT err=0 tag=101 nentries=0 wtime=0.002236364 optime=0.000142754 etime=0.002376855 [22/Dec/2022:08:38:23.202178746 +0800] conn=42 fd=117 slot=117 connection from 10.99.16.212 to 10.100.0.213 [22/Dec/2022:08:38:23.203751921 +0800] conn=42 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.206551310 +0800] conn=42 op=0 RESULT err=14 tag=97 nentries=0 wtime=0.000344548 optime=0.002794049 etime=0.003136691, SASL bind in progress [22/Dec/2022:08:38:23.207866158 +0800] conn=42 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.209540560 +0800] conn=42 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000149285 optime=0.001684787 etime=0.001832976, SASL bind in progress [22/Dec/2022:08:38:23.210611657 +0800] conn=42 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.211258671 +0800] conn=42 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000128945 optime=0.000663926 etime=0.000791870 dn="krbprincipalname=ldap/wocfreeipa-rep.wingon.hk@wingon.hk,cn=services,cn=accounts,dc=wingon,dc=hk" [22/Dec/2022:08:38:23.212523743 +0800] conn=42 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [22/Dec/2022:08:38:23.213906216 +0800] conn=42 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000264956 optime=0.001388203 etime=0.001651902 [22/Dec/2022:08:38:23.215132145 +0800] conn=42 op=4 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [22/Dec/2022:08:38:23.216723816 +0800] conn=42 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000159669 optime=0.001596932 etime=0.001755369 [22/Dec/2022:08:38:23.217967046 +0800] conn=42 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [22/Dec/2022:08:38:23.218703628 +0800] conn=42 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000182814 optime=0.000749303 etime=0.000931176 [22/Dec/2022:08:38:23.222687297 +0800] conn=42 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [22/Dec/2022:08:38:23.224177305 +0800] conn=42 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000158357 optime=0.001488320 etime=0.001640472 [22/Dec/2022:08:38:49.307392953 +0800] conn=43 fd=121 slot=121 connection from 10.100.0.213 to 10.100.0.213 [22/Dec/2022:08:38:49.309912944 +0800] conn=43 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [22/Dec/2022:08:38:49.311877794 +0800] conn=43 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000234961 optime=0.001969243 etime=0.002203214 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [22/Dec/2022:08:38:49.321041547 +0800] conn=43 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [22/Dec/2022:08:38:49.321543659 +0800] conn=43 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000129599 optime=0.000504156 etime=0.000632090 [22/Dec/2022:08:38:49.322646358 +0800] conn=43 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL [22/Dec/2022:08:38:49.323086920 +0800] conn=43 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000081437 optime=0.000441018 etime=0.000520830 [22/Dec/2022:08:38:49.323798035 +0800] conn=43 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [22/Dec/2022:08:38:49.324181733 +0800] conn=43 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000081926 optime=0.000384241 etime=0.000464637 [22/Dec/2022:08:38:49.347011565 +0800] conn=19 op=23 SRCH base="cn=1,ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(objectClass=*)" attrs=ALL [22/Dec/2022:08:38:49.347206355 +0800] conn=19 op=23 RESULT err=0 tag=101 nentries=1 wtime=0.000096368 optime=0.000196426 etime=0.000290580 [22/Dec/2022:08:38:49.365442853 +0800] conn=43 op=4 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" [22/Dec/2022:08:38:49.365513662 +0800] conn=43 op=4 RESULT err=0 tag=120 nentries=0 wtime=0.000094022 optime=0.000081234 etime=0.000173235 [22/Dec/2022:08:38:49.365762008 +0800] conn=43 op=5 SRCH base="cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass" [22/Dec/2022:08:38:49.366479995 +0800] conn=43 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000093224 optime=0.000719504 etime=0.000810644 - entryLevelRights: vadn [22/Dec/2022:08:38:49.368369619 +0800] conn=43 op=6 SRCH base="cn=cas,cn=ca,dc=wingon,dc=hk" scope=2 filter="(&(cn=ipa)(objectClass=ipaca))" attrs="" [22/Dec/2022:08:38:49.368729116 +0800] conn=43 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000103659 optime=0.000361339 etime=0.000463243 [22/Dec/2022:08:38:49.369339524 +0800] conn=43 op=7 SRCH base="cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="description ipaCaIssuerDN ipaCaSubjectDN ipaCaId cn" [22/Dec/2022:08:38:49.369580767 +0800] conn=43 op=7 RESULT err=0 tag=101 nentries=1 wtime=0.000068199 optime=0.000242285 etime=0.000309020 [22/Dec/2022:08:38:49.370906130 +0800] conn=43 op=8 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [22/Dec/2022:08:38:49.371330577 +0800] conn=43 op=8 RESULT err=0 tag=101 nentries=1 wtime=0.000076944 optime=0.000424999 etime=0.000500342 [22/Dec/2022:08:38:49.405392008 +0800] conn=43 op=9 UNBIND [22/Dec/2022:08:38:49.405422974 +0800] conn=43 op=9 fd=121 closed error - U1
Hi,
the FINE logs should be visible in the journal. flo
On Thu, Dec 22, 2022 at 5:20 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi, [root@wocfreeipa conf]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa conf]# cat /var/lib/pki/pki-tomcat/conf/logging.properties | grep FINE 1catalina.org.apache.juli.FileHandler.level = FINE 2localhost.org.apache.juli.FileHandler.level = FINE 3manager.org.apache.juli.FileHandler.level = FINE 4host-manager.org.apache.juli.FileHandler.level = FINE java.util.logging.ConsoleHandler.level = FINE .level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = FINE org.mozilla.jss.level = FINE org.dogtagpki.level = FINE com.netscape.level = FINE netscape.level = FINE [root@wocfreeipa conf]#
tail -f /var/log/pki/pki-tomcat/ca/debug.2022-12-22.log 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-22 08:38:17 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-22 08:38:49 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] INFO: Getting certificate 0x1 2022-12-22 08:38:49 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=ca,o=ipaca
tail -f /var/log/dirsrv/slapd-WINGON-HK/access [22/Dec/2022:08:38:17.233886267 +0800] conn=19 op=21 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="description" [22/Dec/2022:08:38:17.234010458 +0800] conn=19 op=21 RESULT err=0 tag=101 nentries=1 wtime=0.014734052 optime=0.000125838 etime=0.014858013 [22/Dec/2022:08:38:17.847746019 +0800] conn=27 op=8 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn" [22/Dec/2022:08:38:17.847992778 +0800] conn=27 op=8 RESULT err=32 tag=101 nentries=0 wtime=0.000158299 optime=0.000259281 etime=0.000414694 [22/Dec/2022:08:38:19.598578843 +0800] conn=28 op=13 SRCH base="ou=authorizations,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.598863277 +0800] conn=28 op=13 RESULT err=0 tag=101 nentries=0 wtime=0.000157043 optime=0.000287685 etime=0.000440875 [22/Dec/2022:08:38:19.599268909 +0800] conn=28 op=14 SRCH base="ou=orders,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.599396932 +0800] conn=28 op=14 RESULT err=0 tag=101 nentries=0 wtime=0.000379314 optime=0.000128884 etime=0.000506447 [22/Dec/2022:08:38:19.601650121 +0800] conn=28 op=15 SRCH base="ou=certificates,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.601790342 +0800] conn=28 op=15 RESULT err=0 tag=101 nentries=0 wtime=0.002236364 optime=0.000142754 etime=0.002376855 [22/Dec/2022:08:38:23.202178746 +0800] conn=42 fd=117 slot=117 connection from 10.99.16.212 to 10.100.0.213 [22/Dec/2022:08:38:23.203751921 +0800] conn=42 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.206551310 +0800] conn=42 op=0 RESULT err=14 tag=97 nentries=0 wtime=0.000344548 optime=0.002794049 etime=0.003136691, SASL bind in progress [22/Dec/2022:08:38:23.207866158 +0800] conn=42 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.209540560 +0800] conn=42 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000149285 optime=0.001684787 etime=0.001832976, SASL bind in progress [22/Dec/2022:08:38:23.210611657 +0800] conn=42 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.211258671 +0800] conn=42 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000128945 optime=0.000663926 etime=0.000791870 dn="krbprincipalname=ldap/wocfreeipa-rep.wingon.hk@wingon.hk ,cn=services,cn=accounts,dc=wingon,dc=hk" [22/Dec/2022:08:38:23.212523743 +0800] conn=42 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [22/Dec/2022:08:38:23.213906216 +0800] conn=42 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000264956 optime=0.001388203 etime=0.001651902 [22/Dec/2022:08:38:23.215132145 +0800] conn=42 op=4 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [22/Dec/2022:08:38:23.216723816 +0800] conn=42 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000159669 optime=0.001596932 etime=0.001755369 [22/Dec/2022:08:38:23.217967046 +0800] conn=42 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [22/Dec/2022:08:38:23.218703628 +0800] conn=42 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000182814 optime=0.000749303 etime=0.000931176 [22/Dec/2022:08:38:23.222687297 +0800] conn=42 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [22/Dec/2022:08:38:23.224177305 +0800] conn=42 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000158357 optime=0.001488320 etime=0.001640472 [22/Dec/2022:08:38:49.307392953 +0800] conn=43 fd=121 slot=121 connection from 10.100.0.213 to 10.100.0.213 [22/Dec/2022:08:38:49.309912944 +0800] conn=43 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [22/Dec/2022:08:38:49.311877794 +0800] conn=43 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000234961 optime=0.001969243 etime=0.002203214 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [22/Dec/2022:08:38:49.321041547 +0800] conn=43 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [22/Dec/2022:08:38:49.321543659 +0800] conn=43 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000129599 optime=0.000504156 etime=0.000632090 [22/Dec/2022:08:38:49.322646358 +0800] conn=43 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL [22/Dec/2022:08:38:49.323086920 +0800] conn=43 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000081437 optime=0.000441018 etime=0.000520830 [22/Dec/2022:08:38:49.323798035 +0800] conn=43 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [22/Dec/2022:08:38:49.324181733 +0800] conn=43 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000081926 optime=0.000384241 etime=0.000464637 [22/Dec/2022:08:38:49.347011565 +0800] conn=19 op=23 SRCH base="cn=1,ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(objectClass=*)" attrs=ALL [22/Dec/2022:08:38:49.347206355 +0800] conn=19 op=23 RESULT err=0 tag=101 nentries=1 wtime=0.000096368 optime=0.000196426 etime=0.000290580 [22/Dec/2022:08:38:49.365442853 +0800] conn=43 op=4 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" [22/Dec/2022:08:38:49.365513662 +0800] conn=43 op=4 RESULT err=0 tag=120 nentries=0 wtime=0.000094022 optime=0.000081234 etime=0.000173235 [22/Dec/2022:08:38:49.365762008 +0800] conn=43 op=5 SRCH base="cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass" [22/Dec/2022:08:38:49.366479995 +0800] conn=43 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000093224 optime=0.000719504 etime=0.000810644 - entryLevelRights: vadn [22/Dec/2022:08:38:49.368369619 +0800] conn=43 op=6 SRCH base="cn=cas,cn=ca,dc=wingon,dc=hk" scope=2 filter="(&(cn=ipa)(objectClass=ipaca))" attrs="" [22/Dec/2022:08:38:49.368729116 +0800] conn=43 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000103659 optime=0.000361339 etime=0.000463243 [22/Dec/2022:08:38:49.369339524 +0800] conn=43 op=7 SRCH base="cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="description ipaCaIssuerDN ipaCaSubjectDN ipaCaId cn" [22/Dec/2022:08:38:49.369580767 +0800] conn=43 op=7 RESULT err=0 tag=101 nentries=1 wtime=0.000068199 optime=0.000242285 etime=0.000309020 [22/Dec/2022:08:38:49.370906130 +0800] conn=43 op=8 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [22/Dec/2022:08:38:49.371330577 +0800] conn=43 op=8 RESULT err=0 tag=101 nentries=1 wtime=0.000076944 optime=0.000424999 etime=0.000500342 [22/Dec/2022:08:38:49.405392008 +0800] conn=43 op=9 UNBIND [22/Dec/2022:08:38:49.405422974 +0800] conn=43 op=9 fd=121 closed error - U1
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Florence Blanc-Renaud via FreeIPA-users wrote:
Hi,
the FINE logs should be visible in the journal.
Let me add that tail may not be the best way to collect the logs.
389-ds by default has a 30-second buffer, so depending on timing the associated searches may or may not be included in the tail.
Similarly with PKI it often tries to proceed on error so the last error is not always relevant.
So collecting by time can be more effective, e.g. I ran ipa cert-show 1 at 08:32:33 UTC and it completed 5 seconds later so collect the logging between those times, perhaps with a bit more time at the end to account for logging that might happen after the command(s) execute.
rob
flo
On Thu, Dec 22, 2022 at 5:20 AM junhou he via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
Hi, [root@wocfreeipa conf]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa conf]# cat /var/lib/pki/pki-tomcat/conf/logging.properties | grep FINE 1catalina.org.apache.juli.FileHandler.level = FINE 2localhost.org.apache.juli.FileHandler.level = FINE 3manager.org.apache.juli.FileHandler.level = FINE 4host-manager.org.apache.juli.FileHandler.level = FINE java.util.logging.ConsoleHandler.level = FINE .level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = FINE org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = FINE org.mozilla.jss.level = FINE org.dogtagpki.level = FINE com.netscape.level = FINE netscape.level = FINE [root@wocfreeipa conf]# tail -f /var/log/pki/pki-tomcat/ca/debug.2022-12-22.log 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID) 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: CertStatusUpdateTask: Updating revoked certs to expired 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca,o=ipaca 2022-12-22 08:38:17 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED) 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Updating serial number counter 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking serial number ranges 2022-12-22 08:38:17 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: Checking request ID ranges 2022-12-22 08:38:17 [Timer-0] INFO: SessionTimer: checking security domain sessions 2022-12-22 08:38:49 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] INFO: Getting certificate 0x1 2022-12-22 08:38:49 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-3] INFO: LDAPSession: reading cn=1,ou=certificateRepository, ou=ca,o=ipaca tail -f /var/log/dirsrv/slapd-WINGON-HK/access [22/Dec/2022:08:38:17.233886267 +0800] conn=19 op=21 SRCH base="ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="description" [22/Dec/2022:08:38:17.234010458 +0800] conn=19 op=21 RESULT err=0 tag=101 nentries=1 wtime=0.014734052 optime=0.000125838 etime=0.014858013 [22/Dec/2022:08:38:17.847746019 +0800] conn=27 op=8 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn" [22/Dec/2022:08:38:17.847992778 +0800] conn=27 op=8 RESULT err=32 tag=101 nentries=0 wtime=0.000158299 optime=0.000259281 etime=0.000414694 [22/Dec/2022:08:38:19.598578843 +0800] conn=28 op=13 SRCH base="ou=authorizations,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.598863277 +0800] conn=28 op=13 RESULT err=0 tag=101 nentries=0 wtime=0.000157043 optime=0.000287685 etime=0.000440875 [22/Dec/2022:08:38:19.599268909 +0800] conn=28 op=14 SRCH base="ou=orders,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.599396932 +0800] conn=28 op=14 RESULT err=0 tag=101 nentries=0 wtime=0.000379314 optime=0.000128884 etime=0.000506447 [22/Dec/2022:08:38:19.601650121 +0800] conn=28 op=15 SRCH base="ou=certificates,ou=acme,o=ipaca" scope=2 filter="(acmeExpires<=20221222003819+0000)" attrs="1.1" [22/Dec/2022:08:38:19.601790342 +0800] conn=28 op=15 RESULT err=0 tag=101 nentries=0 wtime=0.002236364 optime=0.000142754 etime=0.002376855 [22/Dec/2022:08:38:23.202178746 +0800] conn=42 fd=117 slot=117 connection from 10.99.16.212 to 10.100.0.213 [22/Dec/2022:08:38:23.203751921 +0800] conn=42 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.206551310 +0800] conn=42 op=0 RESULT err=14 tag=97 nentries=0 wtime=0.000344548 optime=0.002794049 etime=0.003136691, SASL bind in progress [22/Dec/2022:08:38:23.207866158 +0800] conn=42 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.209540560 +0800] conn=42 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000149285 optime=0.001684787 etime=0.001832976, SASL bind in progress [22/Dec/2022:08:38:23.210611657 +0800] conn=42 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [22/Dec/2022:08:38:23.211258671 +0800] conn=42 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000128945 optime=0.000663926 etime=0.000791870 dn="krbprincipalname=ldap/wocfreeipa-rep.wingon.hk@wingon.hk <mailto:wocfreeipa-rep.wingon.hk@wingon.hk>,cn=services,cn=accounts,dc=wingon,dc=hk" [22/Dec/2022:08:38:23.212523743 +0800] conn=42 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [22/Dec/2022:08:38:23.213906216 +0800] conn=42 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000264956 optime=0.001388203 etime=0.001651902 [22/Dec/2022:08:38:23.215132145 +0800] conn=42 op=4 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [22/Dec/2022:08:38:23.216723816 +0800] conn=42 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000159669 optime=0.001596932 etime=0.001755369 [22/Dec/2022:08:38:23.217967046 +0800] conn=42 op=5 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [22/Dec/2022:08:38:23.218703628 +0800] conn=42 op=5 RESULT err=0 tag=120 nentries=0 wtime=0.000182814 optime=0.000749303 etime=0.000931176 [22/Dec/2022:08:38:23.222687297 +0800] conn=42 op=6 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [22/Dec/2022:08:38:23.224177305 +0800] conn=42 op=6 RESULT err=0 tag=120 nentries=0 wtime=0.000158357 optime=0.001488320 etime=0.001640472 [22/Dec/2022:08:38:49.307392953 +0800] conn=43 fd=121 slot=121 connection from 10.100.0.213 to 10.100.0.213 [22/Dec/2022:08:38:49.309912944 +0800] conn=43 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [22/Dec/2022:08:38:49.311877794 +0800] conn=43 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000234961 optime=0.001969243 etime=0.002203214 dn="uid=admin,cn=users,cn=accounts,dc=wingon,dc=hk" [22/Dec/2022:08:38:49.321041547 +0800] conn=43 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs=ALL [22/Dec/2022:08:38:49.321543659 +0800] conn=43 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000129599 optime=0.000504156 etime=0.000632090 [22/Dec/2022:08:38:49.322646358 +0800] conn=43 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL [22/Dec/2022:08:38:49.323086920 +0800] conn=43 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000081437 optime=0.000441018 etime=0.000520830 [22/Dec/2022:08:38:49.323798035 +0800] conn=43 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [22/Dec/2022:08:38:49.324181733 +0800] conn=43 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000081926 optime=0.000384241 etime=0.000464637 [22/Dec/2022:08:38:49.347011565 +0800] conn=19 op=23 SRCH base="cn=1,ou=certificateRepository,ou=ca,o=ipaca" scope=0 filter="(objectClass=*)" attrs=ALL [22/Dec/2022:08:38:49.347206355 +0800] conn=19 op=23 RESULT err=0 tag=101 nentries=1 wtime=0.000096368 optime=0.000196426 etime=0.000290580 [22/Dec/2022:08:38:49.365442853 +0800] conn=43 op=4 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" [22/Dec/2022:08:38:49.365513662 +0800] conn=43 op=4 RESULT err=0 tag=120 nentries=0 wtime=0.000094022 optime=0.000081234 etime=0.000173235 [22/Dec/2022:08:38:49.365762008 +0800] conn=43 op=5 SRCH base="cn=retrieve certificate,cn=virtual operations,cn=etc,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="objectClass" [22/Dec/2022:08:38:49.366479995 +0800] conn=43 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000093224 optime=0.000719504 etime=0.000810644 - entryLevelRights: vadn [22/Dec/2022:08:38:49.368369619 +0800] conn=43 op=6 SRCH base="cn=cas,cn=ca,dc=wingon,dc=hk" scope=2 filter="(&(cn=ipa)(objectClass=ipaca))" attrs="" [22/Dec/2022:08:38:49.368729116 +0800] conn=43 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000103659 optime=0.000361339 etime=0.000463243 [22/Dec/2022:08:38:49.369339524 +0800] conn=43 op=7 SRCH base="cn=ipa,cn=cas,cn=ca,dc=wingon,dc=hk" scope=0 filter="(objectClass=*)" attrs="description ipaCaIssuerDN ipaCaSubjectDN ipaCaId cn" [22/Dec/2022:08:38:49.369580767 +0800] conn=43 op=7 RESULT err=0 tag=101 nentries=1 wtime=0.000068199 optime=0.000242285 etime=0.000309020 [22/Dec/2022:08:38:49.370906130 +0800] conn=43 op=8 SRCH base="cn=masters,cn=ipa,cn=etc,dc=wingon,dc=hk" scope=2 filter="(&(&(objectClass=ipaConfigObject)(cn=CA))(|(ipaConfigString=enabledService)(ipaConfigString=hiddenService)))" attrs="ipaConfigString" [22/Dec/2022:08:38:49.371330577 +0800] conn=43 op=8 RESULT err=0 tag=101 nentries=1 wtime=0.000076944 optime=0.000424999 etime=0.000500342 [22/Dec/2022:08:38:49.405392008 +0800] conn=43 op=9 UNBIND [22/Dec/2022:08:38:49.405422974 +0800] conn=43 op=9 fd=121 closed error - U1 _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi, [root@wocfreeipa ~]# date Fri Dec 23 08:26:00 HKT 2022 [root@wocfreeipa ~]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa ~]#journactl -f Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Counting up[ajp-nio-0:0:0:0:0:0:0:1-8009-Acceptor] latch=4 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Processing socket [org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]] with status [OPEN_READ] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Found processor [null] for socket [org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Popped processor [org.apache.coyote.ajp.AjpProcessor@2bcc40ac] from cache Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Received 347 18 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@7854aa3a:org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]], Read from buffer: [347] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: ExternalAuthenticationValve: authType: null Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: ExternalAuthenticationValve: principal: null Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Security checking request GET /ca/rest/certs/1 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: No applicable constraint located Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Not subject to any constraint Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@7854aa3a:org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]], Status in: [OPEN_READ], State out: [OPEN] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Pushed Processor [org.apache.coyote.ajp.AjpProcessor@2bcc40ac] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Registered read interest for [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@7854aa3a:org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Processing socket [org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]] with status [OPEN_READ] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Found processor [null] for socket [org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Popped processor [org.apache.coyote.ajp.AjpProcessor@2bcc40ac] from cache Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Received 332 18 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6f3b8006:org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]], Read from buffer: [332] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: ExternalAuthenticationValve: authType: null Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: ExternalAuthenticationValve: principal: null Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Security checking request GET /ca/rest/account/login Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/account/login --> true Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/account/login --> true Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Calling hasUserDataPermission() Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: User data constraint already satisfied Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Calling authenticate() Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: PKIAuthenticator: Authenticating with BASIC authentication Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: PKIAuthenticator: Fallback auth header: WWW-Authenticate=Basic realm="Certificate Authority" Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: PKIAuthenticator: Fallback auth return code: 401 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: PKIAuthenticator: Result: false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Failed authenticate() test Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6f3b8006:org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]], Status in: [OPEN_READ], State out: [OPEN] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Pushed Processor [org.apache.coyote.ajp.AjpProcessor@2bcc40ac] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Registered read interest for [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6f3b8006:org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]] Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755206102 sessioncount 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755206102 sessioncount 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755206102 sessioncount 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755206102 sessioncount 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755266112 sessioncount 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755266112 sessioncount 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755266112 sessioncount 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755266112 sessioncount 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755326123 sessioncount 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755326123 sessioncount 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755326123 sessioncount 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755326123 sessioncount 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0
Hi,
On Fri, Dec 23, 2022 at 1:40 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi, [root@wocfreeipa ~]# date Fri Dec 23 08:26:00 HKT 2022 [root@wocfreeipa ~]# ipa cert-show 1 ipa: ERROR: Failed to authenticate to CA REST API [root@wocfreeipa ~]#journactl -f Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Counting up[ajp-nio-0:0:0:0:0:0:0:1-8009-Acceptor] latch=4 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Processing socket [org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]] with status [OPEN_READ] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Found processor [null] for socket [org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Popped processor [org.apache.coyote.ajp.AjpProcessor@2bcc40ac] from cache Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Received 347 18 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Socket: [ org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@7854aa3a :org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]], Read from buffer: [347] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: ExternalAuthenticationValve: authType: null Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: ExternalAuthenticationValve: principal: null Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Security checking request GET /ca/rest/certs/1 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/certs/1 --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: No applicable constraint located Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Not subject to any constraint Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Socket: [ org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@7854aa3a :org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]], Status in: [OPEN_READ], State out: [OPEN] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Pushed Processor [org.apache.coyote.ajp.AjpProcessor@2bcc40ac] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Registered read interest for [org.apache.tomcat.util.net .NioEndpoint$NioSocketWrapper@7854aa3a :org.apache.tomcat.util.net.NioChannel@76935a98:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:33486]] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Processing socket [org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]] with status [OPEN_READ] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Found processor [null] for socket [org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Popped processor [org.apache.coyote.ajp.AjpProcessor@2bcc40ac] from cache Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Received 332 18 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Socket: [ org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6f3b8006 :org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]], Read from buffer: [332] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: ExternalAuthenticationValve: authType: null Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: ExternalAuthenticationValve: principal: null Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Security checking request GET /ca/rest/account/login Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/account/login --> true Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Admin Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Security Domain Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Audit]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Account Services]' against GET /rest/account/login --> true Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Authority Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Profile Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Agent Services]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Checking constraint 'SecurityConstraint[Self Tests]' against GET /rest/account/login --> false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Calling hasUserDataPermission() Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: User data constraint already satisfied
The lines below show that the connection doesn't go through Client Cert authentication but falls back to BASIC:
Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Calling authenticate() Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: PKIAuthenticator: Authenticating with BASIC authentication Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: PKIAuthenticator: Fallback auth header: WWW-Authenticate=Basic realm="Certificate Authority" Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: PKIAuthenticator: Fallback auth return code: 401 Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: INFO: PKIAuthenticator: Result: false Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Failed authenticate() test
I'm running out of ideas (we already checked the client cert permissions). Did you change anything in PKI configuration that could explain why the client cert is not received by PKI? For instance in /etc/httpd/conf.d/ipa-pki-proxy.conf the section relative to /rest must contain: <LocationMatch "^/(ca|kra|pki)/rest/"> SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate * SSLVerifyClient optional* ProxyPassMatch ajp://localhost:8009 secret=3BgdY1fO62vbxIJWwNS6T2ZZvkwm4wT95lryJqxEr1G2 ProxyPassReverse ajp://localhost:8009 </LocationMatch>
You also mentioned that the http cert was replaced by an externally-signed one. Which steps did you follow? Did you use ipa-cacert-manage install to add the external CA + ipa-server-certinstall ?
flo
Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Socket: [ org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@6f3b8006 :org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]], Status in: [OPEN_READ], State out: [OPEN] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Pushed Processor [org.apache.coyote.ajp.AjpProcessor@2bcc40ac] Dec 23 08:26:03 wocfreeipa.wingon.hk server[26465]: FINE: Registered read interest for [org.apache.tomcat.util.net .NioEndpoint$NioSocketWrapper@6f3b8006 :org.apache.tomcat.util.net.NioChannel@61fc6249:java.nio.channels.SocketChannel[connected local=localhost/127.0.0.1:8009 remote=/0:0:0:0:0:0:0:1:60836]] Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755206102 sessioncount 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755206102 sessioncount 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755206102 sessioncount 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755206102 sessioncount 0 Dec 23 08:26:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:26:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755266112 sessioncount 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755266112 sessioncount 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755266112 sessioncount 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755266112 sessioncount 0 Dec 23 08:27:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:27:56 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:06 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:16 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:26 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:36 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ROOT.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /usr/share/pki/server/webapps/ROOT Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[] reload resource /usr/share/pki/server/webapps/ROOT/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/pki.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /usr/share/pki/server/webapps/pki Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/pki] reload resource /usr/share/pki/server/webapps/pki/WEB-INF/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/acme.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /usr/share/pki/acme/webapps/acme Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/acme] reload resource /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/pki/pki-tomcat/Catalina/localhost/ca.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /usr/share/pki/ca/webapps/ca Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] redeploy resource /etc/tomcat/context.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /var/lib/pki/pki-tomcat/conf/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Checking context[/ca] reload resource /usr/share/pki/ca/webapps/ca/WEB-INF/tomcat-web.xml Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755326123 sessioncount 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755326123 sessioncount 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755326123 sessioncount 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: Start expire sessions StandardManager at 1671755326123 sessioncount 0 Dec 23 08:28:46 wocfreeipa.wingon.hk server[26465]: FINE: End expire sessions StandardManager processingTime 0 expired sessions: 0 _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi, I did not change anything in /etc/httpd/conf.d/ipa-pki-proxy.conf # matches for REST API of CA, KRA, and PKI <LocationMatch "^/(ca|kra|pki)/rest/"> SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate SSLVerifyClient optional ProxyPassMatch ajp://localhost:8009 secret=9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG ProxyPassReverse ajp://localhost:8009 </LocationMatch>
[root@wocfreeipa ~]# certutil -L -d /etc/httpd/alias/
Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI
WINGON.HK IPA CA CT,C,C Go Daddy Secure Certificate Authority - G2 - GoDaddy.com, Inc. CT,C,C Go Daddy Root Certificate Authority - G2 - The Go Daddy Group, Inc. CT,C,C Go Daddy Class 2 Certification Authority - The Go Daddy Group, Inc. CT,C,C Server-Cert u,u,u [root@wocfreeipa ~]# certutil -d /etc/httpd/alias/ -O -n Server-Cert "Go Daddy Class 2 Certification Authority - The Go Daddy Group, Inc." [OU=Go Daddy Class 2 Certification Authority,O="The Go Daddy Group, Inc.",C=US]
"Go Daddy Root Certificate Authority - G2 - The Go Daddy Group, Inc." [CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US]
"Go Daddy Secure Certificate Authority - G2 - GoDaddy.com, Inc." [CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=%22GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US]
"Server-Cert" [CN=*.wingon.hk]
[root@wocfreeipa ~]# certutil -L -d /etc/dirsrv/slapd-WINGON-HK/
Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI
CN=*.wingon.hk u,u,u WINGON.HK IPA CA CT,C,C OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com%5C, Inc.,L=Scottsdale,ST=Arizona,C=US C,, [root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI
caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Server-Cert cert-pki-ca u,u,u OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com%5C, Inc.,L=Scottsdale,ST=Arizona,C=US C,,
I use ipa-cacert-manage install to add the external CA
Hi,
On Tue, Jan 3, 2023 at 9:20 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi, I did not change anything in /etc/httpd/conf.d/ipa-pki-proxy.conf # matches for REST API of CA, KRA, and PKI <LocationMatch "^/(ca|kra|pki)/rest/"> SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate SSLVerifyClient optional ProxyPassMatch ajp://localhost:8009 secret=9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG ProxyPassReverse ajp://localhost:8009
</LocationMatch>
[root@wocfreeipa ~]# certutil -L -d /etc/httpd/alias/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
WINGON.HK IPA CA CT,C,C Go Daddy Secure Certificate Authority - G2 - GoDaddy.com, Inc. CT,C,C Go Daddy Root Certificate Authority - G2 - The Go Daddy Group, Inc. CT,C,C Go Daddy Class 2 Certification Authority - The Go Daddy Group, Inc. CT,C,C Server-Cert u,u,u
^^ I'm surprised that your http cert is stored in /etc/httpd/alias. With IPA 4.9.8, httpd is using mod_ssl instead of mod_nss. The config file /etc/httpd/conf.d/ssl.conf should setup the following: SSLCertificateFile /var/lib/ipa/certs/httpd.crt SSLCertificateKeyFile /var/lib/ipa/private/httpd.key SSLCACertificateFile /etc/ipa/ca.crt
instead of using /etc/httpd/conf.d/nss.conf with the NSS database.
Do you have a config file /etc/httpd/conf.d/ssl.conf or /etc/httpd/conf.d/nss.conf? What is the output of "httpd -M"?
The server cert seems to be a wildcard cert, can you flo
[root@wocfreeipa ~]# certutil -d /etc/httpd/alias/ -O -n Server-Cert "Go Daddy Class 2 Certification Authority - The Go Daddy Group, Inc." [OU=Go Daddy Class 2 Certification Authority,O="The Go Daddy Group, Inc.",C=US]
"Go Daddy Root Certificate Authority - G2 - The Go Daddy Group, Inc." [CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US]
"Go Daddy Secure Certificate Authority - G2 - GoDaddy.com, Inc."[CN=Go Daddy Secure Certificate Authority - G2,OU= http://certs.godaddy.com/repository/,O=%22GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US]
"Server-Cert" [CN=*.wingon.hk][root@wocfreeipa ~]# certutil -L -d /etc/dirsrv/slapd-WINGON-HK/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
CN=*.wingon.hk u,u,u WINGON.HK IPA CA CT,C,C OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com%5C, Inc.,L=Scottsdale,ST=Arizona,C=US C,, [root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Server-Cert cert-pki-ca u,u,u OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com%5C, Inc.,L=Scottsdale,ST=Arizona,C=US C,,
I use ipa-cacert-manage install to add the external CA _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Sorry, hit send too soon.
On Tue, Jan 3, 2023 at 1:53 PM Florence Blanc-Renaud flo@redhat.com wrote:
Hi,
On Tue, Jan 3, 2023 at 9:20 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi, I did not change anything in /etc/httpd/conf.d/ipa-pki-proxy.conf # matches for REST API of CA, KRA, and PKI <LocationMatch "^/(ca|kra|pki)/rest/"> SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate SSLVerifyClient optional ProxyPassMatch ajp://localhost:8009 secret=9YiPRrt1izX7zjQ2PLQwyIkLdEKMwArNdEEuyPHiHVCG ProxyPassReverse ajp://localhost:8009
</LocationMatch>
[root@wocfreeipa ~]# certutil -L -d /etc/httpd/alias/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
WINGON.HK IPA CA CT,C,C Go Daddy Secure Certificate Authority - G2 - GoDaddy.com, Inc. CT,C,C Go Daddy Root Certificate Authority - G2 - The Go Daddy Group, Inc. CT,C,C Go Daddy Class 2 Certification Authority - The Go Daddy Group, Inc. CT,C,C Server-Cert u,u,u
^^ I'm surprised that your http cert is stored in /etc/httpd/alias. With IPA 4.9.8, httpd is using mod_ssl instead of mod_nss. The config file /etc/httpd/conf.d/ssl.conf should setup the following: SSLCertificateFile /var/lib/ipa/certs/httpd.crt SSLCertificateKeyFile /var/lib/ipa/private/httpd.key SSLCACertificateFile /etc/ipa/ca.crt
instead of using /etc/httpd/conf.d/nss.conf with the NSS database.
Do you have a config file /etc/httpd/conf.d/ssl.conf or /etc/httpd/conf.d/nss.conf? What is the output of "httpd -M"?
The server cert seems to be a wildcard cert, can you
Can you show the server cert pem file? I remember issues with wildcard certs as the recommended way is to add SAN extensions IIRC.
flo
[root@wocfreeipa ~]# certutil -d /etc/httpd/alias/ -O -n Server-Cert "Go Daddy Class 2 Certification Authority - The Go Daddy Group, Inc." [OU=Go Daddy Class 2 Certification Authority,O="The Go Daddy Group, Inc.",C=US]
"Go Daddy Root Certificate Authority - G2 - The Go Daddy Group, Inc." [CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US]
"Go Daddy Secure Certificate Authority - G2 - GoDaddy.com, Inc."[CN=Go Daddy Secure Certificate Authority - G2,OU= http://certs.godaddy.com/repository/,O=%22GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US]
"Server-Cert" [CN=*.wingon.hk][root@wocfreeipa ~]# certutil -L -d /etc/dirsrv/slapd-WINGON-HK/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
CN=*.wingon.hk u,u,u WINGON.HK IPA CA CT,C,C OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com%5C, Inc.,L=Scottsdale,ST=Arizona,C=US C,, [root@wocfreeipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Server-Cert cert-pki-ca u,u,u OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group, Inc.,C=US C,, CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com, Inc.,L=Scottsdale,ST=Arizona,C=US C,, NSS Certificate DB:NSS Certificate DB:CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com%5C, Inc.,L=Scottsdale,ST=Arizona,C=US C,,
I use ipa-cacert-manage install to add the external CA _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi,
when I use mod_ssl everything works fine, thanks a lot for your help!!!
thanks
On Wed, Jan 4, 2023 at 4:05 AM junhou he via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi,
when I use mod_ssl everything works fine, thanks a lot for your help!!!
Thanks for letting us know, I must say I'm relieved we finally found the root cause :) flo
thanks _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
freeipa-users@lists.fedorahosted.org
-
Florence Blanc-Renaud -
junhou he -
Rob Crittenden