freeipa

#5349 IPA client forced join leaves data behind
Closed: Fixed Opened by maartens.

Closed: Fixed
Reopen Issue

I recently experienced a problem with the IPA certificate request process. The request was continually rejected. This happened only when the host had been recreated. When the host entry had been formally removed from IPA, it succeeds. The conclusion is that some data about the host was not removed during the IPA forced join process.

The following steps were taken once a working IPA server is already in place:

1.

On new client server, install the ipa client and force join to the domain:

ipa-client-install --domain=<domain> --enable-dns-updates --mkhomedir -p <ipa join user> -w <ipa join passwd> --realm=<ipa krb realm> --server=<hostname>.<domain> --unattended --force-join

Ensure certmonger is running

systemctl start certmonger

Request a key and certificate:

ipa-getcert request -f /etc/pki/tls/<hostname>.crt -k /etc/pki/tls/<hostname>.key

All works correctly up to this point, both certificate key and cert are created.

2.

Recreate the client server. Rerun client install with forced join to the domain:

ipa-client-install --domain=<domain> --enable-dns-updates --mkhomedir -p <ipa join user> -w <ipa join passwd> --realm=<ipa krb realm> --server=<hostname>.<domain> --unattended --force-join

Get the new key and certificate:

ipa-getcert request -f /etc/pki/tls/<hostname>.crt -k /etc/pki/tls/<hostname>.key

At this point it fails. Only the key is created.

$ ipa-getcert list
Request ID '20151006120000':
    status: CA_REJECTED
    ca-error: Server at https://myipa/ipa/xml denied our request, giving up: 2100 (RPC failed at server.  Insufficient access: not allowed to perform this command).
    stuck: yes
    key pair storage: type=FILE,location='/etc/pki/tls/myserver.key'
    certificate: type=FILE,location='/etc/pki/tls/myserver.crt'
    CA: IPA
    issuer: 
    subject: 
    expires: unknown
    pre-save command: 
    post-save command: 
    track: yes
    auto-renew: yes

Remove the client host from IPA:

ipa host-del <client-hostname>

Remove failed request:

ipa-getcert stop-tracking -i <name>

Retry certificate request:

ipa-getcert request -f /etc/pki/tls/<hostname>.crt -k /etc/pki/tls/<hostname>.key

This time both certificate and key are created successfully.

The following was missed out - it is the first step in section 4, as the client server should be joined to the domain again:

ipa-join -w <ipa join passwd> -h <hostname>.<domain> -s <ipa-hostname>.<domain> -f

Hello maartens. Thanks for the bug report.

Is a member of administrator group? If not what roles/privileges does he have?

Do you see any certificate-related issues in httpd/error_log, e.g. CertificateOperationError?

Yes the is a member of the administrator group.

I would need to reproduce the problem to have a look at the httpd error_log, as that environment no longer exists. I'll report back once I get a chance to do that.

This is what we see in the error_log (there's no sign of a CertificateOperationError):

[Thu Oct 15 10:39:42.702061 2015] [:error] [pid 4891] ipa: INFO: [xmlserver] host/@: cert_request(u'', principal=u'host/@', add=True, version=u'2.51'): ACIError

Any update on this?

Can we provide any more logs to help you replicate it?

I assume that and are the same.

The log entry in comment 5 doesn't show context. Could you enable debug logging:

$ cat /etc/ipaserver.conf 
[global]
debug=True

And send the whole log part of cert_request call.

You can also check pki logs.
in /var/log/pki/ directory if there is something relevant

I can replicate this problem without IPA client force-join.

It looks like the first certificate request succeeds, and all subsequent ones fail, for a particular server. Error message is identical.

    ca-error: Server at https://jt-ipa.james.tooling.nubeslab.io/ipa/xml denied our request, giving up: 2100 (RPC failed at server.  Insufficient access: not allowed to perform this command).

Invalidating the previously issued certificate has no effect. The only solution I have that works is "remove from IPA and rejoin".

I've enabled debug and run another join - httpd error_log attached.

httpd error_log
error_log

It might be related to the fact that the hostname in the subject and SAN isn't fully-qualified: jt-ovpn

httpd error_log - with fqdn request
error_log.2

I'm using the exact same certmonger command to generate the certificate. It works the first time, but not the second time.

ipa-getcert request -f /etc/pki/tls/`hostname`.crt -k /etc/pki/tls/`hostname`.key

certmonger by default uses the hostname for the csr, not the fqdn - which is a little odd, but works for us at the moment.

Forcing it to use the FQDN everywhere gives the same result

[root@jt-ovpn ~]# ipa-getcert request -f /etc/pki/tls/test-`facter fqdn`.crt -k /etc/pki/tls/test-`facter fqdn`.key -D `facter fqdn` -K "host/`facter fqdn`@JAMES.TOOLING.NUBESLAB.IO" -N `facter fqdn`
New signing request "20151113091701" added.
[root@jt-ovpn ~]# getcert list
Number of certificates and requests being tracked: 1.
Request ID '20151113091701':
    status: CA_REJECTED
    ca-error: Server at https://jt-ipa.james.tooling.nubeslab.io/ipa/xml denied our request, giving up: 2100 (RPC failed at server.  Insufficient access: not allowed to perform this command).
    stuck: yes
    key pair storage: type=FILE,location='/etc/pki/tls/test-jt-ovpn.james.tooling.nubeslab.io.key'
    certificate: type=FILE,location='/etc/pki/tls/test-jt-ovpn.james.tooling.nubeslab.io.crt'
    CA: IPA
    issuer: 
    subject: 
    expires: unknown
    pre-save command: 
    post-save command: 
    track: yes
    auto-renew: yes

I've added the logs showing this.

I've set up a demo box for you for this problem.

Drop me an email with your SSH public key, and I'll add you to the system.

The client has 4 certificates requested through Certmonger.

[root@client ~]# getcert list
Number of certificates and requests being tracked: 4.
Request ID '20151214162108':
    status: MONITORING
    stuck: no
    key pair storage: type=FILE,location='/etc/pki/tls/foo.key'
    certificate: type=FILE,location='/etc/pki/tls/foo.crt'
    CA: IPA
    issuer: CN=Certificate Authority,O=LOCAL
    subject: CN=client,O=LOCAL
    expires: 2015-12-16 10:53:55 UTC
    dns: client
    principal name: host/client@LOCAL
    key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
    eku: id-kp-serverAuth,id-kp-clientAuth
    pre-save command: 
    post-save command: 
    track: yes
    auto-renew: yes
Request ID '20151214162153':
    status: CA_REJECTED
    ca-error: Server at https://ipa.local/ipa/xml denied our request, giving up: 2100 (RPC failed at server.  Insufficient access: not allowed to perform this command).
    stuck: yes
    key pair storage: type=FILE,location='/etc/pki/tls/same_install_2nd_cert.key'
    certificate: type=FILE,location='/etc/pki/tls/same_install_2nd_cert.crt'
    CA: IPA
    issuer: 
    subject: 
    expires: unknown
    pre-save command: 
    post-save command: 
    track: yes
    auto-renew: yes
Request ID '20151214162319':
    status: CA_REJECTED
    ca-error: Server at https://ipa.local/ipa/xml denied our request, giving up: 2100 (RPC failed at server.  Insufficient access: not allowed to perform this command).
    stuck: yes
    key pair storage: type=FILE,location='/etc/pki/tls/after_reinstall_3rd.key'
    certificate: type=FILE,location='/etc/pki/tls/after_reinstall_3rd.crt'
    CA: IPA
    issuer: 
    subject: 
    expires: unknown
    pre-save command: 
    post-save command: 
    track: yes
    auto-renew: yes
Request ID '20151214163421':
    status: MONITORING
    stuck: no
    key pair storage: type=FILE,location='/etc/pki/tls/after_ipa_delete_host_4th.key'
    certificate: type=FILE,location='/etc/pki/tls/after_ipa_delete_host_4th.crt'
    CA: IPA
    issuer: CN=Certificate Authority,O=LOCAL
    subject: CN=client,O=LOCAL
    expires: 2015-12-16 10:53:55 UTC
    dns: client
    principal name: host/client@LOCAL
    key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
    eku: id-kp-serverAuth,id-kp-clientAuth
    pre-save command: 
    post-save command: 
    track: yes
    auto-renew: yes

The first certificate request worked perfectly - as expected.

The second request was for an identical cert (bar the location on disk) - and failed.

The third request was after a 'ipa-client-install --uninstall' - and then reinstall. It too failed.

The fourth request was done after uninstall->ipa host-del->reinstall - it succeeds.

This proves that there is something in the IPA state that is not being cleared on uninstall or force join, that stops it from getting certificates.

This seems to be solved in IPA 4.2

Metadata Update from @maartens:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.4 Backlog
Metadata
None
None
None
Normal
defect
IPA
0
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.