dogtagpki

#249 pki_ds_base_dn causing pkispawn failure
Closed: Fixed Opened by edewata.

Closed: Fixed
Reopen Issue

Running pkispawn with pki_ds_base_dn that matches the base DN of the DS will fail.

The problem was found on a test machine with hostname cs-dev.example.com, but there's actually no example.com domain on the system.

# domainname
(none)
# dnsdomainname
example.com

The DS was created with this command:

# setup-ds.pl --silent --\
        General.FullMachineName=$HOSTNAME\
        General.SuiteSpotUserID=dirsrv\
        General.SuiteSpotGroup=dirsrv\
        slapd.ServerPort=389\
        slapd.ServerIdentifier=pki-master\
        slapd.Suffix=dc=example,dc=com\
        slapd.RootDN="cn=Directory Manager"\
        slapd.RootDNPwd=Secret123
Your new DS instance 'pki-master' was successfully created.
Exiting . . .
Log file is '/tmp/setupO_6Tzp.log'

pkispawn was run with this configuration:

pki_ds_base_dn=dc=example,dc=com

It generates the following output:

# pkispawn -v -f <config file> -s CA
...
pkispawn    : JYTHON   ....... constructing PKI configuration data for 'CA'
dualkey = true
pkispawn    : JYTHON   ....... configuring PKI configuration data for 'CA'
Traceback (innermost last):
  File "/usr/lib/python2.7/site-packages/pki/deployment/configuration.jy", line 170, in ?
  File "/usr/lib/python2.7/site-packages/pki/deployment/configuration.jy", line 166, in main
  File "/usr/lib/python2.7/site-packages/pki/deployment/pkijython.py", line 581, in configure_pki_data
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:525)
    at com.netscape.cms.servlet.csadmin.CMSErrorInterceptor.handle(CMSErrorInterceptor.java:52)
    at org.jboss.resteasy.client.core.extractors.ClientErrorHandler.clientErrorHandling(ClientErrorHandler.java:49)
    at org.jboss.resteasy.client.core.extractors.BodyEntityExtractor.extractEntity(BodyEntityExtractor.java:44)
    at org.jboss.resteasy.client.core.ClientInvoker.invoke(ClientInvoker.java:120)
    at org.jboss.resteasy.client.core.ClientProxy.invoke(ClientProxy.java:88)
    at $Proxy19.configure(Unknown Source)
    at com.netscape.cms.servlet.csadmin.ConfigurationRESTClient.configure(ConfigurationRESTClient.java:45)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:601)
com.netscape.cms.servlet.base.CMSException: com.netscape.cms.servlet.base.CMSException: Error in populating databasejava.io.IOException: Failed to create the database.

The DS log shows that it fails to add cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config because it already exists:

[20/Jul/2012:14:52:09 -0500] conn=2 op=26 ADD dn="cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config"
[20/Jul/2012:14:52:09 -0500] conn=2 op=26 RESULT err=68 tag=105 nentries=0 etime=0

If the pki_ds_base_dn is left empty or set to something else (e.g. dc=test,dc=com) it will work just fine.

Changes were made to the following files to address this issue:

* pki/base/deploy/src/pkidestroy
* pki/base/deploy/src/pkispawn

RESOLVED:

commit 14243746edd14be2564b625c4a940c4723c168f1
Author: Matthew Harmsen <mharmsen@redhat.com>
Date:   Tue Jul 24 11:28:29 2012 -0700

PKI Deployment Scriptlets
- PKI TRAC Ticket #244 - Non-user-friendly message when deleting non-existen
  subsystem with pkidestroy
- PKI TRAC Ticket #246 - Incorrect parameter names in pkispawn configuration
- PKI TRAC Ticket #248 - pki_ds_database should not be a DN
- PKI TRAC Ticket #249 - pki_ds_base_dn causing pkispawn failure
- PKI TRAC Ticket #250 - Creating/removing custom instances should not requi
  http/ajp ports
- PKI TRAC Ticket #251 - Instance name may conflict with other files
- PKI TRAC Ticket #253 - Fix pki-destroy removal of
  '/var/log/pki/{pki_instance_id}' directory . . .
- PKI TRAC Ticket #254 - Dogtag 10: Fix spec file to build successfully via 
  on Fedora 17 . . .
- PKI TRAC Ticket #255 - Missing resteasy-atom-provider.jar
- PKI TRAC Ticket #260 - Dogtag 10: Change the layout of 'pki_instance_id' . . .

Metadata Update from @edewata:
- Issue assigned to mharmsen
- Issue set to the milestone: Dogtag 10.0 Alpha

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/820

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
defect
Installation/Configuration
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.