freeipa

#9628 ipa-server-install fails with --token-password-file option.
Closed: fixed by rcritten. Opened by sumenon.

Closed: fixed
Reopen Issue

Issue

ipa-server-install fails with --token-password-file option.

Steps to Reproduce

  1. Create a token password file e.g /tmp/test.txt
    TOKEN_PASSWORD=123456
  2. Install IPA server with --token-password-file option

root@server:~# ipa-server-install -a $ADMIN_PASSWORD -p $DM_PASSWORD -r FEDORA41.TEST -n fedora41.test -U --random-serial-numbers --token-name=ipa_token --token-library-path=/usr/lib64/pkcs11/libsofthsm2.so --token-password-file=/root/test.txt --setup-dns --forwarder= --setup-kra

Warning: skipping DNS resolution of host server.fedora41.test
write() argument must be str, not None
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Actual behavior

ipa-server-install fails

Expected behavior

ipa-server-install should pass with --token-password-file option

Version/Release/Distribution

freeipa-server-4.12.1-1.fc41.x86_64
389-ds-base-3.1.0-10.fc41.x86_64
dogtag-pki-ca-11.5.0-3.fc41.1.noarch
krb5-server-1.21.2-5.fc40.x86_64

Additional info:

ipa-server-install log
ipaserver-install.log

 
2024-07-11T10:06:29Z DEBUG Starting external process
2024-07-11T10:06:29Z DEBUG args=['/usr/bin/modutil', '-dbdir', 'sql:/tmp/tmpzejjg_v6', '-nocertdb', '-add', 'test', '-libfile', '/usr/lib64/pkcs11/libsofthsm2.so', '-force']
2024-07-11T10:06:29Z DEBUG Process finished, return code=22
2024-07-11T10:06:29Z DEBUG stdout=
WARNING: Manually adding a module while p11-kit is enabled could cause
duplicate module registration in your security database. It is suggested 
to configure the module through p11-kit configuration file instead.
Type 'q <enter>' to abort, or <enter> to continue: 
2024-07-11T10:06:29Z DEBUG stderr=ERROR: Failed to add module "test". Probable cause : "Unknown PKCS #11 error.".
2024-07-11T10:06:29Z DEBUG Starting external process
2024-07-11T10:06:29Z DEBUG args=['/usr/bin/modutil', '-dbdir', 'sql:/tmp/tmpzejjg_v6', '-list', '-force']
2024-07-11T10:06:29Z DEBUG Process finished, return code=0
2024-07-11T10:06:29Z DEBUG stdout=
Listing of PKCS #11 Modules
-----------------------------------------------------------
  1. NSS Internal PKCS #11 Module
       uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.101
     slots: 2 slots attached
    status: loaded
     slot: NSS Internal Cryptographic Services
    token: NSS Generic Crypto Services
      uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
     slot: NSS User Private Key and Certificate Services
    token: NSS Certificate DB
      uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
  2. p11-kit-proxy
    library name: p11-kit-proxy.so
       uri: pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
     slots: 3 slots attached
    status: loaded
     slot: SoftHSM slot ID 0x6b72a14f
    token: OpenDNSSEC
      uri: pkcs11:token=OpenDNSSEC;manufacturer=SoftHSM%20project;serial=22759cff6b72a14f;model=SoftHSM%20v2
     slot: SoftHSM slot ID 0x75dd1ede
    token: ipa_token
      uri: pkcs11:token=ipa_token;manufacturer=SoftHSM%20project;serial=a6532f9975dd1ede;model=SoftHSM%20v2
     slot: SoftHSM slot ID 0x2
    token: 
      uri: pkcs11:manufacturer=SoftHSM%20project;model=SoftHSM%20v2
-----------------------------------------------------------

tasks.configure_pkcs11_modules should disable implicit softhsm2 import via p11-kit-proxy. However, the hsm_validator() is called very early, when this is not yet done, so the following override file is not generated:

# cat /etc/pkcs11/modules/softhsm2.module 
# created by IPA installer
module: /usr/lib64/pkcs11/libsofthsm2.so
disable-in: p11-kit-proxy

I think a solution would be here to call tasks.configure_pkcs11_modules() within hsm_validator() within the context of that temporary DB.

The token-password option will be fixed via ticket https://pagure.io/freeipa/issue/9603

The hsm_validator should work whether p11-kit has been disabled or not. It just doesn't assume that the module is enabled so tries to add it using modutil but doesn't consider it a blocker if that fails.

Metadata Update from @frenaud:
- Issue tagged with: test-failure

Metadata Update from @frenaud:
- Issue untagged with: test-failure

I'm going to mark this as done. The referenced PR is merged and the validator is otherwise functioning ok.

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.