Request for enhancement

As freeipa user , I want to check with you if you observed that there is cert issue while start freeipa-replica within docker container.

Issue

ipa-getcert list

Number of certificates and requests being tracked: 0.

2023-01-29T05:12:39Z ERROR Upgrade failed with 'tuple' object has no attribute 'has_key'
2023-01-29T05:12:39Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 274, in upgrade
self.modified = (ld.update(self.files) or self.modified)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 966, in update
self._run_updates(all_updates)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 928, in _run_updates
self._run_update_plugin(update['plugin'])
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 903, in _run_update_plugin
restart_ds, updates = self.api.Updaterplugin_name
File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 1474, in __call
return self.execute(**options)
File "/usr/lib/python2.7/site-packages/ipaserver/install/plugins/upload_cacrt.py", line 56, in execute
server_certs = db.find_server_certs()
File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py", line 504, in find_server_certs
return self.nssdb.find_server_certs()
File "/usr/lib/python2.7/site-packages/ipapython/certdb.py", line 451, in find_server_certs
if flags.has_key:
AttributeError: 'tuple' object has no attribute 'has_key'

2023-01-29T05:12:39Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 567, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 557, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 282, in __upgrade
raise RuntimeError(e)
RuntimeError: 'tuple' object has no attribute 'has_key'

2023-01-29T05:12:39Z DEBUG [error] RuntimeError: 'tuple' object has no attribute 'has_key'

Steps to Reproduce

1. generate gpg file from freeipa master server (version: 4.6.8) with ipa-replica-prepare
2. copy the gpg file to replica server
3. start replica container
   docker run --name freeipa-replica --privileged=true --tmpfs /run --tmpfs /tmp -v /bin/systemctl:/bin/systemctl -v /sys/fs/cgroup:/sys/fs/cgroup:ro -v /mnt/data/docker-volumes/network:/etc/sysconfig/network -it --add-host $host:$ip -h $replicahost -v /mnt/data/docker-volumes/ipa-data/:/data:Z -p 53:53/udp -p 53:53 -p 8080:80 -p 443:443 -p 389:389 -p 636:636 -p 88:88 -p 464:464 -p 88:88/udp -p 464:464/udp -p 123:123/udp -p 7389:7389 -p 9443:9443 -p 9444:9444 --sysctl net.ipv6.conf.lo.disable_ipv6=0 -p 9445:9445 freeipa/freeipa-server:centos-7-4.6.8 ipa-replica-install --password=$DMPW --skip-conncheck

Actual behavior

cannot start ipa.service because of cert issue

Expected behavior

docker run command should create and start replica container

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
ipa-server-4.6.8-5.el7.centos.12.x86_64
ipa-client-4.6.8-5.el7.centos.12.x86_64
389-ds-base-1.3.10.2-17.el7_9.x86_64
pki-ca-10.5.18-24.el7_9.noarch
krb5-server-1.15.1-55.el7_9.x86_64

Additional info:

After checking code at https://github.com/freeipa/freeipa/blob/f8d8fd4ec6e9fedd75b97d80c5103fc6b0bfb2ca/ipapython/certdb.py#L409, suspect that there is cert issue.

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting