Issue seen when running ipa-healthcheck. This is a self-signed CA with a default subject base.
{ "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "CRITICAL", "uuid": "e2b0a302-fba3-4240-888d-e25bc43d9f9f", "when": "20231113200248Z", "duration": "0.292754", "kw": { "exception": "'ipacasubjectdn'", "traceback": "Traceback (most recent call last): File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/core/core.py\", line 56, in run_plugin for result in plugin.check(): File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/core/plugin.py\", line 18, in wrapper for result in f(*args, **kwds): File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/ipa/certs.py\", line 1278, in check requests = get_expected_requests(self.ca, self.ds, self.serverid, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/ipa/certs.py\", line 115, in get_expected_requests issued = is_ipa_issued_cert(api, cert) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/ipa/certs.py\", line 46, in is_ipa_issued_cert return certs.is_ipa_issued_cert(myapi, cert) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File \"/usr/lib/python3.11/site-packages/ipaserver/install/certs.py\", line 138, in is_ipa_issued_cert cacert_subject = certstore.get_ca_subject( ^^^^^^^^^^^^^^^^^^^^^^^^^ File \"/usr/lib/python3.11/site-packages/ipalib/install/certstore.py\", line 397, in get_ca_subject cacert_subject = ldap.get_entry(dn)['ipacasubjectdn'][0] ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^ File \"/usr/lib/python3.11/site-packages/ipapython/ipaldap.py\", line 510, in __getitem__ return self._get_nice(name) ^^^^^^^^^^^^^^^^^^^^ File \"/usr/lib/python3.11/site-packages/ipapython/ipaldap.py\", line 477, in _get_nice name = self._get_attr_name(name) ^^^^^^^^^^^^^^^^^^^^^^^^^ File \"/usr/lib/python3.11/site-packages/ipapython/ipaldap.py\", line 473, in _get_attr_name name = self._names[name] ~~~~~~~~~~~^^^^^^ File \"/usr/lib/python3.11/site-packages/ipapython/ipautil.py\", line 657, in __getitem__ return super(CIDict, self).__getitem__(key.lower()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ KeyError: 'ipacasubjectdn' " } }
Bah not a bug in released code. I was using my experimental cache branch in IPA and that is where the issue is seen.
Metadata Update from @rcritten: - Issue close_status updated to: invalid - Issue status updated to: Closed (was: Open)