Re: No Login on GUI

[Christian Reiss]

Hey Angus,

thanks for replying. Allow me to reply inline:

On 06/12/2019 16:00, Angus Clarke wrote:
>  Have you checked your times are in sync within 5 minutes? 
Yes. And it's monitored.

>  Have you checked DNS is working for all node entries between all
> nodes? 
Yes. And it's monitored. Even PTR <-> A check.

>  Have you used ipactl [status|restart|stop]? 
Yes.

[root@auth1:~] # ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful

[root@auth2:~] # ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful

auth3 is down.

>    -> Do you see certain services fail and have you checked their
> logs? 
Well thats the wild thing. ipa cli (host remove, host add etc) all work 
from auth1 (which the webui does not allow access). And all changes are 
propagated to auth2. Same for the other way around.

It's just the login to auth1.

>  I'm hoping your remaining IPA server is the renewal master:
>  
>  On remaining good server:
>  kinit admin
>  ipa config-show | grep "IPA CA renewal master" 
auth1 and auth2 agree on auth1 being the IPA CA renewal master.

>  If it is then the following rebuild instructions should be ok.
>  If it is not, then you prolly need some other advice (I haven't faced 
>  that situation yet ...)
>  [...] 
The following items seem to mix my two problems.

a) auth1 web login broken,
b) auth3 needs re-setup.

Any clue on how to debug the web login (or lack thereof) issue?
Chedked httpd logs, nothing to see there in the error logs....

Cheers,
Chris.

-- 
  Christian Reiss - email(a)christian-reiss.de         /"\  ASCII Ribbon
                    support(a)alpha-labs.net           \ /    Campaign
                                                      X   against HTML
  WEB alpha-labs.net                                 / \   in eMails

  GPG Retrieval https://gpg.christian-reiss.de
  GPG ID ABCD43C5, 0x44E29126ABCD43C5
  GPG fingerprint = 9549 F537 2596 86BA 733C  A4ED 44E2 9126 ABCD 43C5

  "It's better to reign in hell than to serve in heaven.",
                                           John Milton, Paradise lost.

No Login on GUI

[Christophe TREFOIS]

Have you checked certificates ?

https://www.freeipa.org/page/Certmonger#Get_a_list_of_currently_tracked_c...
<https://www.freeipa.org/page/Certmonger#Get_a_list_of_currently_tracked_c...

Have you check Kerberos logs, Dirsv logs, Tomcat logs?

https://www.freeipa.org/page/Troubleshooting/Administration_and_Web_UI
<https://www.freeipa.org/page/Troubleshooting/Administration_and_Web_UI>
 
>  On 6 Dec 2019, at 17:29, Christian Reiss via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>  
>  Hey Angus,
>  
>  thanks for replying. Allow me to reply inline:
>  
>  On 06/12/2019 16:00, Angus Clarke wrote:
> > Have you checked your times are in sync within 5 minutes?
>  
>  Yes. And it's monitored.
>  
> > Have you checked DNS is working for all node entries between all nodes?
>  
>  Yes. And it's monitored. Even PTR <-> A check.
>  
> > Have you used ipactl [status|restart|stop]?
>  
>  Yes.
>  
>  [root@auth1:~] # ipactl status
>  Directory Service: RUNNING
>  krb5kdc Service: RUNNING
>  kadmin Service: RUNNING
>  httpd Service: RUNNING
>  ipa-custodia Service: RUNNING
>  ntpd Service: RUNNING
>  pki-tomcatd Service: RUNNING
>  ipa-otpd Service: RUNNING
>  ipa: INFO: The ipactl command was successful
>  
>  [root@auth2:~] # ipactl status
>  Directory Service: RUNNING
>  krb5kdc Service: RUNNING
>  kadmin Service: RUNNING
>  httpd Service: RUNNING
>  ipa-custodia Service: RUNNING
>  ntpd Service: RUNNING
>  pki-tomcatd Service: RUNNING
>  ipa-otpd Service: RUNNING
>  ipa: INFO: The ipactl command was successful
>  
>  auth3 is down.
>  
> >  -> Do you see certain services fail and have you checked their logs?
>  
>  Well thats the wild thing. ipa cli (host remove, host add etc) all work from auth1 (which
> the webui does not allow access). And all changes are propagated to auth2. Same for the
> other way around.
>  
>  It's just the login to auth1.
>  
> > I'm hoping your remaining IPA server is the renewal master:
> > On remaining good server:
> > kinit admin
> > ipa config-show | grep "IPA CA renewal master"
>  
>  auth1 and auth2 agree on auth1 being the IPA CA renewal master.
>  
> > If it is then the following rebuild instructions should be ok.
> > If it is not, then you prolly need some other advice (I haven't faced that
> situation yet ...)
>  > [...]
>  
>  The following items seem to mix my two problems.
>  
>  a) auth1 web login broken,
>  b) auth3 needs re-setup.
>  
>  Any clue on how to debug the web login (or lack thereof) issue?
>  Chedked httpd logs, nothing to see there in the error logs....
>  
>  Cheers,
>  Chris.
>  
>  -- 
>  Christian Reiss - email(a)christian-reiss.de         /"\  ASCII Ribbon
>                    support(a)alpha-labs.net           \ /    Campaign
>                                                      X   against HTML
>  WEB alpha-labs.net                                 / \   in eMails
>  
>  GPG Retrieval https://gpg.christian-reiss.de
>  GPG ID ABCD43C5, 0x44E29126ABCD43C5
>  GPG fingerprint = 9549 F537 2596 86BA 733C  A4ED 44E2 9126 ABCD 43C5
>  
>  "It's better to reign in hell than to serve in heaven.",
>                                           John Milton, Paradise lost.
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  
>  -----------------------------------------------------------------------------------
>  
>  This e-mail can not be trusted due to SPF/DKIM validation failed.
>  
>  -----------------------------------------------------------------------------------
>