freeipa

#7164 "Vaults" does not shown in WebUI on some servers
Closed: fixed by rcritten. Opened by iluha.

Closed: fixed
Reopen Issue

We have FreeIPA setup with 3 CentOS systems.
Since update to CentOS 7.4 and FreeIPA 4.5 there is UI menu "Network Services --> Vaults" on 2 of 3 systems.

If I try to manually modify the URL replacing the hostname (https://ipa2.DOMAIN.net/ipa/ui/#/e/vaultconfig/details), following error message is produced:

Runtime error
Web UI got in unrecoverable state during "runtime" phase.
Technical details:
t is undefined
_select@https://ipa2.DOMAIN.net/ipa/ui/js/freeipa/app.js?40500:1:232226
select@https://ipa2.DOMAIN.net/ipa/ui/js/freeipa/app.js?40500:1:232493
show_facet@https://ipa2.DOMAIN.net/ipa/ui/js/freeipa/app.js?40500:1:20811
on_facet_show@https://ipa2.DOMAIN.net/ipa/ui/js/freeipa/app.js?40500:1:20396
f@https://ipa2.DOMAIN.net/ipa/ui/js/dojo/dojo.js?v=40500:1:49586
dojo/on/

Hello iluha,

Thank you for reporting the issue.

Do all vault commands work in CLI on the server where the WebUI does not work? Especially ' ipa vaultconfig-show' ?

If no, there would be some issue in KRA. And we need to investigate more.

If yes, could you please open web browser, there open developers console (F12) on network tab and reload the WebUI? Then please try to find JSON request which sends batch command with 9 commands in it. There please check the output and post it here (at least those parts which might be posted publicly, mainly the response for the last 9th command) ?

This way we will know whether the issue is in the WebUI code or not.
Thank you

Hello pvomacka,

on two of three server this command works, on the third there is an error:

ipa vaultconfig-show
ipa: ERROR: an internal error has occurred

Or a bit more verbose:

ipa -vv vaultconfig-show
ipa: INFO: trying https://ipa2.DOMAIN.net/ipa/session/json
ipa: INFO: Request: {
"id": 0,
"method": "ping",
"params": [
[],
{}
]
}
ipa: INFO: Response: {
"error": null,
"id": 0,
"principal": "USER@DOMAIN.NET",
"result": {
"messages": [
{
"code": 13001,
"data": {
"server_version": "2.228"
},
"message": "API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.228",
"name": "VersionMissing",
"type": "warning"
}
],
"summary": "IPA server version 4.5.0. API version 2.228"
},
"version": "4.5.0"
}
ipa: INFO: [try 1]: Forwarding 'vaultconfig_show/1' to json server 'https://ipa2.DOMAIN.net/ipa/session/json'
ipa: INFO: Request: {
"id": 0,
"method": "vaultconfig_show/1",
"params": [
[],
{
"version": "2.228"
}
]
}
ipa: INFO: Response: {
"error": {
"code": 903,
"data": {},
"message": "an internal error has occurred",
"name": "InternalError"
},
"id": 0,
"principal": "USER@DOMAIN.NET",
"result": null,
"version": "4.5.0"
}
ipa: ERROR: an internal error has occurred

@iluha could you run the command with -vvv?
like:

ipa -vvv vaultconfig-show

@fbarreto sure:

ipa -vvv vaultconfig-show
ipa: INFO: trying https://ipa2.DOMAIN.net/ipa/json
ipa: INFO: [try 1]: Forwarding 'schema' to json server 'https://ipa2.DOMAIN.net/ipa/json'
ipa: INFO: trying https://ipa2.DOMAIN.net/ipa/session/json
ipa: INFO: Request: {
"id": 0,
"method": "ping",
"params": [
[],
{}
]
}
send: u'POST /ipa/session/json HTTP/1.1\r\nHost: ipa2.DOMAIN.net\r\nAccept-Encoding: gzip\r\nAccept-Language: lc-ctype=en-us\r\nReferer: https://ipa2.DOMAIN.net/ipa/xml\r\nCookie: ipa_session=MagBearerToken=Q8mh...TRUNCATED...QD52;\r\nUser-Agent: xmlrpclib.py/1.0.1 (by www.pythonware.com)\r\nContent-Type: application/json\r\nContent-Length: 86\r\n\r\n{\n "id": 0, \n "method": "ping", \n "params": [\n [], \n {}\n ]\n}'
reply: 'HTTP/1.1 200 Success\r\n'
header: Date: Mon, 16 Oct 2017 14:43:25 GMT
header: Server: Apache/2.4.6 (CentOS) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5
header: Set-Cookie: ipa_session=MagBearerToken=Q8mh...TRUNCATED...QD52;path=/ipa;httponly;secure;
header: X-Frame-Options: DENY
header: Content-Security-Policy: frame-ancestors 'none'
header: Vary: Accept-Encoding
header: Content-Encoding: gzip
header: Cache-Control: no-cache
header: Content-Length: 260
header: Content-Type: application/json; charset=utf-8
body: '{"result": {"messages": [{"type": "warning", "message": "API Version number was not sent, forward compatibility not guaranteed. Assuming server\'s API version, 2.228", "code": 13001, "data": {"server_version": "2.228"}, "name": "VersionMissing"}], "summary": "IPA server version 4.5.0. API version 2.228"}, "version": "4.5.0", "error": null, "id": 0, "principal": "USER@DOMAIN.NET"}'
ipa: INFO: Response: {
"error": null,
"id": 0,
"principal": "USER@DOMAIN.NET",
"result": {
"messages": [
{
"code": 13001,
"data": {
"server_version": "2.228"
},
"message": "API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.228",
"name": "VersionMissing",
"type": "warning"
}
],
"summary": "IPA server version 4.5.0. API version 2.228"
},
"version": "4.5.0"
}
ipa: INFO: [try 1]: Forwarding 'vaultconfig_show/1' to json server 'https://ipa2.DOMAIN.net/ipa/session/json'
ipa: INFO: Request: {
"id": 0,
"method": "vaultconfig_show/1",
"params": [
[],
{
"version": "2.228"
}
]
}
send: u'POST /ipa/session/json HTTP/1.1\r\nHost: ipa2.DOMAIN.net\r\nAccept-Encoding: gzip\r\nAccept-Language: lc-ctype=en-us\r\nReferer: https://ipa2.DOMAIN.net/ipa/xml\r\nCookie: ipa_session=MagBearerToken=Q8mh...TRUNCATED...QD52;\r\nUser-Agent: xmlrpclib.py/1.0.1 (by www.pythonware.com)\r\nContent-Type: application/json\r\nContent-Length: 140\r\n\r\n{\n "id": 0, \n "method": "vaultconfig_show/1", \n "params": [\n [], \n {\n "version": "2.228"\n }\n ]\n}'
reply: 'HTTP/1.1 200 Success\r\n'
header: Date: Mon, 16 Oct 2017 14:43:25 GMT
header: Server: Apache/2.4.6 (CentOS) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5
header: Set-Cookie: ipa_session=MagBearerToken=Q8mh...TRUNCATED...QD52;path=/ipa;httponly;secure;
header: X-Frame-Options: DENY
header: Content-Security-Policy: frame-ancestors 'none'
header: Vary: Accept-Encoding
header: Content-Encoding: gzip
header: Cache-Control: no-cache
header: Content-Length: 158
header: Content-Type: application/json; charset=utf-8
body: '{"result": null, "version": "4.5.0", "error": {"message": "an internal error has occurred", "code": 903, "data": {}, "name": "InternalError"}, "id": 0, "principal": "USER@DOMAIN.NET"}'
ipa: INFO: Response: {
"error": {
"code": 903,
"data": {},
"message": "an internal error has occurred",
"name": "InternalError"
},
"id": 0,
"principal": "USER@DOMAIN.NET",
"result": null,
"version": "4.5.0"
}
ipa: ERROR: an internal error has occurred

Thank you for output.

Could you please open /var/log/httpd/error_log (on replica where vault does not work) and try to find 'vaultconfig'? It is possible that you will see some traceback around calling the 'vaultconfig' command. Please post the traceback here if there is any.

Hello Pavel,

here is traceback:

[Mon Oct 16 16:43:23.755143 2017] [:error] [pid 22506] ipa: INFO: [jsonserver_kerb] USER@DOMAIN.NET: ping(): SUCCESS
[Mon Oct 16 16:43:25.107342 2017] [:error] [pid 22507] ipa: INFO: [jsonserver_kerb] USER@DOMAIN.NET: schema(known_fingerprints=(u'7a5de3fd',), version=u'2.170'): SchemaUpToDate
[Mon Oct 16 16:43:25.702735 2017] [:warn] [pid 22510] [client 10.0.0.22:46728] failed to set perms (3140) on file (/var/run/ipa/ccaches/USER@DOMAIN.NET)!, referer: https://ipa2.DOMAIN.net/ipa/xml
[Mon Oct 16 16:43:25.772420 2017] [:error] [pid 22506] ipa: INFO: [jsonserver_session] USER@DOMAIN.NET: ping(): SUCCESS
[Mon Oct 16 16:43:25.782659 2017] [:warn] [pid 22510] [client 10.0.0.22:46728] failed to set perms (3140) on file (/var/run/ipa/ccaches/USER@DOMAIN.NET)!, referer: https://ipa2.DOMAIN.net/ipa/xml
[Mon Oct 16 16:43:28.214165 2017] [:error] [pid 22507] ipa: ERROR: non-public: ResourceNotFoundException: KRA subsystem not found.
[Mon Oct 16 16:43:28.214191 2017] [:error] [pid 22507] Traceback (most recent call last):
[Mon Oct 16 16:43:28.214194 2017] [:error] [pid 22507]   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 367, in wsgi_execute
[Mon Oct 16 16:43:28.214196 2017] [:error] [pid 22507]     result = command(*args, **options)
[Mon Oct 16 16:43:28.214198 2017] [:error] [pid 22507]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 447, in __call__
[Mon Oct 16 16:43:28.214200 2017] [:error] [pid 22507]     return self.__do_call(*args, **options)
[Mon Oct 16 16:43:28.214202 2017] [:error] [pid 22507]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 475, in __do_call
[Mon Oct 16 16:43:28.214204 2017] [:error] [pid 22507]     ret = self.run(*args, **options)
[Mon Oct 16 16:43:28.214206 2017] [:error] [pid 22507]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 797, in run
[Mon Oct 16 16:43:28.214208 2017] [:error] [pid 22507]     return self.execute(*args, **options)
[Mon Oct 16 16:43:28.214210 2017] [:error] [pid 22507]   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/vault.py", line 998, in execute
[Mon Oct 16 16:43:28.214212 2017] [:error] [pid 22507]     transport_cert = kra_client.system_certs.get_transport_cert()
[Mon Oct 16 16:43:28.214214 2017] [:error] [pid 22507]   File "/usr/lib/python2.7/site-packages/pki/__init__.py", line 391, in handler
[Mon Oct 16 16:43:28.214216 2017] [:error] [pid 22507]     raise pki_exception
[Mon Oct 16 16:43:28.214218 2017] [:error] [pid 22507] ResourceNotFoundException: KRA subsystem not found.
[Mon Oct 16 16:43:28.214515 2017] [:error] [pid 22507] ipa: INFO: [jsonserver_session] USER@DOMAIN.NET: vaultconfig_show/1(version=u'2.228'): InternalError

Metadata Update from @abbra:
- Issue set to the milestone: FreeIPA 4.7 backlog

The error returned is that the server in question does not have a KRA installed.

In a 4.7.x master the exception is handled properly and ipa vaultconfig-show displays the error "ipa: ERROR: KRA service is not enabled"

I'm going to mark this as fixed.

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.