dogtagpki

#2676 pkispawn fails occasionally with this failure ACCESS_SESSION_ESTABLISH_FAILURE
Closed: fixed Opened by mharmsen.

Closed: fixed
Reopen Issue

pkispawn fails occasionally with this failure ACCESS_SESSION_ESTABLISH_FAILURE

Steps to Reproduce:

1. [DEFAULT]
   pki_instance_name = topology-02-CA
   pki_https_port = 20443
   pki_http_port = 20080
   pki_token_password =
   pki_admin_password =
   pki_hostname = pki1.example.com
   pki_security_domain_name = topology-02_Foobarmaster.org
   pki_security_domain_password = Secret123
   pki_client_dir = /opt/topology-02-CA
   pki_client_pkcs12_password =
   pki_backup_keys = True
   pki_backup_password =
   pki_ds_password =
   pki_ds_ldap_port = 3389
   pki_ssl_server_key_algorithm=SHA512withRSA
   pki_ssl_server_key_size=2048
   pki_ssl_server_key_type=rsa
   pki_subsystem_key_algorithm=SHA512withRSA
   pki_subsystem_key_size=2048
   pki_subsystem_key_type=rsa
   [Tomcat]
   pki_ajp_port = 20009
   pki_tomcat_server_port = 20005
   [CA]
   pki_import_admin_cert = False
   pki_ds_hostname = pki1.example.com
   pki_admin_nickname = PKI CA Administrator for Example.Org
   pki_ca_signing_key_algorithm=SHA512withRSA
   pki_ca_signing_key_size=2048
   pki_ca_signing_key_type=rsa
   pki_ca_signing_signing_algorithm=SHA512withRSA
   pki_ocsp_signing_key_algorithm=SHA512withRSA
   pki_ocsp_signing_key_size=2048
   pki_ocsp_signing_key_type=rsa
   pki_ocsp_signing_signing_algorithm=SHA512withRSA

Using the above installation file run pkispawn -s CA -f ca.cfg

Actual results:

pkispawn fails

Expected results:

pkispawn should be successful

Additional info:

03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: selftests startup
start
[03/May/2017:13:39:58][localhost-startStop-1]: SelfTestSubsystem.startup(): Do
not run selftests in pre-op mode
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: selftests startup
done
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: stats startup start
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: stats startup done
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: auths startup start
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: auths startup done
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: authz startup start
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: authz startup done
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: jobsScheduler startup
start
[03/May/2017:13:39:58][localhost-startStop-1]: CMSEngine: jobsScheduler startup
done
[03/May/2017:13:39:58][http-bio-23443-exec-1]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:00][http-bio-23443-exec-2]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:01][http-bio-23443-exec-3]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:02][http-bio-23443-exec-4]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:03][http-bio-23443-exec-5]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:05][http-bio-23443-exec-6]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:06][http-bio-23443-exec-7]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:07][http-bio-23443-exec-8]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:08][http-bio-23443-exec-9]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:09][http-bio-23443-exec-10]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:10][http-bio-23443-exec-11]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:11][http-bio-23443-exec-12]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:12][http-bio-23443-exec-13]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE
[03/May/2017:13:40:14][http-bio-23443-exec-14]: SignedAuditEventFactory:
create() message created for eventType=ACCESS_SESSION_ESTABLISH_FAILURE

Metadata Update from @mharmsen:
- Custom field component adjusted to General
- Custom field feature adjusted to ''
- Custom field origin adjusted to QE
- Custom field proposedmilestone adjusted to ''
- Custom field proposedpriority adjusted to ''
- Custom field reviewer adjusted to ''
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1447762
- Custom field type adjusted to defect
- Custom field version adjusted to ''
- Issue priority set to: critical

Metadata Update from @edewata:
- Issue priority set to: blocker (was: critical)

Endi Sukma Dewata 2017-06-02 11:29:59 EDT

The problem only happens if the randomly generated NSS database password contains a backslash character. As a workaround, specify a fixed password without backslash, for example:

[DEFAULT]
pki_pin=Secret.123

Metadata Update from @mharmsen:
- Issue close_status updated to: wontfix
- Issue set to the milestone: 10.4.7 (was: 10.4)
- Issue status updated to: Closed (was: Open)

Metadata Update from @mharmsen:
- Issue assigned to edewata

Fixed in master:

  • https://github.com/dogtagpki/pki/commit/29dbed75f1c214a065cd3bcc438d0584fd980d4f

Metadata Update from @edewata:
- Issue close_status updated to: fixed (was: wontfix)

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.4 (was: 10.4.7)
- Issue status updated to: Open (was: Closed)

Metadata Update from @mharmsen:
- Issue close_status updated to: fixed
- Issue set to the milestone: 10.4.7 (was: 10.4)
- Issue status updated to: Closed (was: Open)

Metadata Update from @mharmsen:
- Custom field fixedinversion adjusted to pki-core-10.4.7-1.fc27

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2796

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Lowest
pki-core-10.4.7-1.fc27
defect
General
''
''
QE
''
''
''
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.