freeipa

#7031 Issue with CA replica creation
Closed: insufficientinfo Opened by danila221089.

Closed: insufficientinfo
Reopen Issue

Hello guys,
I have problems with creation freeipa master replica.

ipa --version
VERSION: 4.3.1, API_VERSION: 2.164
Master server Idp+self sign CA

I want create full replica of master server
Host for replica in domain (ipa-client-install -U --domain= --server= --password= --principal=--hostname= --no-ntp --mkhomedir)

I try to create replica:
ipa-replica-install --hostname= --domain= --server= --password=XXXXXX --principal=admin --setup-ca

Replica installation success but CA replica creation failed:

Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds
[1/23]: creating certificate server user
[2/23]: creating certificate server db
[3/23]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded

[4/23]: creating installation admin user
[5/23]: setting up certificate server
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpjnucvO' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

ipa.ipapython.install.cli.install_tool(Replica): ERROR CA configuration failed.
ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
How i can solve this issue?

Please provide logs from /var/log/pki/pki-tomcat

2017-06-22 08:02:29 pkispawn : ERROR ....... Exception from Java Configuration Servlet: 500 Server Error: Internal Server Error for url: https://vl1-ipa1.itcapital.io:8443/ca/rest/installer/configure
2017-06-22 08:02:29 pkispawn : ERROR ....... ParseError: mismatched tag: line 86, column 201: Apache Tomcat/7.0.68 (Ubuntu) - Error report

HTTP Status 500 - javax.ws.rs.ProcessingException: Unable to invoke request

type Exception report

message javax.ws.rs.ProcessingException: Unable to invoke request

description The server encountered an internal error that prevented it from fulfilling this request.

exception 

org.jboss.resteasy.spi.UnhandledException: javax.ws.rs.ProcessingException: Unable to invoke request

    org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)

    org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)

    org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)

    org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)

    org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)

    org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)

    org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)

    org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)

    javax.servlet.http.HttpServlet.service(HttpServlet.java:731)

    org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

root cause 

javax.ws.rs.ProcessingException: Unable to invoke request

    org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:287)

    org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:407)

    org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:442)

    org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.post(ClientInvocationBuilder.java:201)

    com.netscape.certsrv.client.PKIConnection.post(PKIConnection.java:463)

    com.netscape.cms.servlet.csadmin.ConfigurationUtils.post(ConfigurationUtils.java:249)

    com.netscape.cms.servlet.csadmin.ConfigurationUtils.updateNumberRange(ConfigurationUtils.java:664)

    com.netscape.cms.servlet.csadmin.ConfigurationUtils.getConfigEntriesFromMaster(ConfigurationUtils.java:564)

    org.dogtagpki.server.rest.SystemConfigService.configureClone(SystemConfigService.java:867)

    org.dogtagpki.server.rest.SystemConfigService.configureSubsystem(SystemConfigService.java:1013)

    org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.java:164)

    org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.java:121)

    sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

    java.lang.reflect.Method.invoke(Method.java:498)

    org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)

    org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:280)

    org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:234)

    org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:221)

    org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)

    org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)

    org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)

    org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)

    org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)

    javax.servlet.http.HttpServlet.service(HttpServlet.java:731)

    org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

root cause 

java.io.IOException: SocketException cannot write on socket

    org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1194)

    org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:56)

    org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(AbstractSessionOutputBuffer.java:159)

    org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSessionOutputBuffer.java:166)

    org.apache.http.impl.io.ContentLengthOutputStream.flush(ContentLengthOutputStream.java:101)

    org.apache.http.entity.ByteArrayEntity.writeTo(ByteArrayEntity.java:117)

    org.apache.http.entity.HttpEntityWrapper.writeTo(HttpEntityWrapper.java:96)

    org.apache.http.impl.client.EntityEnclosingRequestWrapper$EntityWrapper.writeTo(EntityEnclosingRequestWrapper.java:112)

    org.apache.http.impl.entity.EntitySerializer.serialize(EntitySerializer.java:117)

    org.apache.http.impl.AbstractHttpClientConnection.sendRequestEntity(AbstractHttpClientConnection.java:265)

    org.apache.http.impl.conn.ManagedClientConnectionImpl.sendRequestEntity(ManagedClientConnectionImpl.java:203)

    org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:237)

    org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:122)

    org.apache.http.impl.client.DefaultRequestDirector.tryExecute(DefaultRequestDirector.java:685)

    org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:487)

    org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:882)

    org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)

    org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55)

    org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:283)

    org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:407)

    org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:442)

    org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.post(ClientInvocationBuilder.java:201)

    com.netscape.certsrv.client.PKIConnection.post(PKIConnection.java:463)

    com.netscape.cms.servlet.csadmin.ConfigurationUtils.post(ConfigurationUtils.java:249)

    com.netscape.cms.servlet.csadmin.ConfigurationUtils.updateNumberRange(ConfigurationUtils.java:664)

    com.netscape.cms.servlet.csadmin.ConfigurationUtils.getConfigEntriesFromMaster(ConfigurationUtils.java:564)

    org.dogtagpki.server.rest.SystemConfigService.configureClone(SystemConfigService.java:867)

    org.dogtagpki.server.rest.SystemConfigService.configureSubsystem(SystemConfigService.java:1013)

    org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.java:164)

    org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.java:121)

    sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

    java.lang.reflect.Method.invoke(Method.java:498)

    org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)

    org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:280)

    org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:234)

    org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:221)

    org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)

    org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)

    org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)

    org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)

    org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)

    javax.servlet.http.HttpServlet.service(HttpServlet.java:731)

    org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

note The full stack trace of the root cause is available in the Apache Tomcat/7.0.68 (Ubuntu) logs.

Apache Tomcat/7.0.68 (Ubuntu)


2017-06-22 08:02:29 pkispawn : DEBUG ....... Error Type: ParseError
2017-06-22 08:02:29 pkispawn : DEBUG ....... Error Message: mismatched tag: line 86, column 201
2017-06-22 08:02:29 pkispawn : DEBUG ....... File "/usr/sbin/pkispawn", line 597, in main
rv = instance.spawn(deployer)
File "/usr/lib/python2.7/dist-packages/pki/server/deployment/scriptlets/configuration.py", line 246, in spawn
json.dumps(data, cls=pki.encoder.CustomTypeEncoder))
File "/usr/lib/python2.7/dist-packages/pki/server/deployment/pkihelper.py", line 3861, in configure_pki_data
root = ET.fromstring(e.response.text)
File "/usr/lib/python2.7/xml/etree/ElementTree.py", line 1311, in XML
parser.feed(text)
File "/usr/lib/python2.7/xml/etree/ElementTree.py", line 1653, in feed
self._raiseerror(v)
File "/usr/lib/python2.7/xml/etree/ElementTree.py", line 1517, in _raiseerror
raise err

i have full debug log

install.log.zip

What OS and version of packages it is, could you provide:

   $ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

IPA 4.3.1 is quite old even for f24 where is 4.3.3. Your fail is in PKI server - package pki-ca. If you don't use the latest version, did you consider updating to it?

Metadata Update from @pvoborni:
- Issue close_status updated to: insufficientinfo
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.