freeipa

#6757 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit helper when installing replica
Closed: fixed Opened by mbabinsk.

Closed: fixed
Reopen Issue

When installing replica from a current master branch, the following series of tracebacks can be seen in certmonger journal output:

Mar 13 16:11:45 replica1.ipa.test systemd[1]: Started Certificate monitoring and PKI enrollment.
Mar 13 16:12:03 replica1.ipa.test dogtag-ipa-ca-renew-agent-submit[7890]: Traceback (most recent call last):
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 550, in <module>
                                                                              sys.exit(main())
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 520, in main
                                                                              api.Backend.ldap2.connect()
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect
                                                                              conn = self.create_connection(*args, **kw)
                                                                            File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 205, in create_connection
                                                                              principal = krb_utils.get_principal(ccache_name=ccache)
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/krb_utils.py", line 171, in get_principal
                                                                              raise errors.CCacheError(message=unicode(e))
                                                                          CCacheError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639053): No Kerberos credentials available (default cach
Mar 13 16:12:03 replica1.ipa.test dogtag-ipa-ca-renew-agent-submit[7887]: Traceback (most recent call last):
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 550, in <module>
                                                                              sys.exit(main())
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 520, in main
                                                                              api.Backend.ldap2.connect()
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect
                                                                              conn = self.create_connection(*args, **kw)
                                                                            File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 205, in create_connection
                                                                              principal = krb_utils.get_principal(ccache_name=ccache)
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/krb_utils.py", line 171, in get_principal
                                                                              raise errors.CCacheError(message=unicode(e))
                                                                          CCacheError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639053): No Kerberos credentials available (default cach
Mar 13 16:12:03 replica1.ipa.test dogtag-ipa-ca-renew-agent-submit[7889]: Traceback (most recent call last):
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 550, in <module>
                                                                              sys.exit(main())
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 520, in main
                                                                              api.Backend.ldap2.connect()
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect
                                                                              conn = self.create_connection(*args, **kw)
                                                                            File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 205, in create_connection
                                                                              principal = krb_utils.get_principal(ccache_name=ccache)
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/krb_utils.py", line 171, in get_principal
                                                                              raise errors.CCacheError(message=unicode(e))
                                                                          CCacheError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639053): No Kerberos credentials available (default cach
Mar 13 16:12:03 replica1.ipa.test dogtag-ipa-ca-renew-agent-submit[7888]: Traceback (most recent call last):
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 550, in <module>
                                                                              sys.exit(main())
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 520, in main
                                                                              api.Backend.ldap2.connect()
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect
                                                                              conn = self.create_connection(*args, **kw)
                                                                            File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 205, in create_connection
                                                                              principal = krb_utils.get_principal(ccache_name=ccache)
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/krb_utils.py", line 171, in get_principal
                                                                              raise errors.CCacheError(message=unicode(e))
                                                                          CCacheError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639053): No Kerberos credentials available (default cach
Mar 13 16:12:03 replica1.ipa.test dogtag-ipa-ca-renew-agent-submit[7894]: Traceback (most recent call last):
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 550, in <module>
                                                                              sys.exit(main())
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 520, in main
                                                                              api.Backend.ldap2.connect()
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect
                                                                              conn = self.create_connection(*args, **kw)
                                                                            File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 205, in create_connection
                                                                              principal = krb_utils.get_principal(ccache_name=ccache)
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/krb_utils.py", line 171, in get_principal
                                                                              raise errors.CCacheError(message=unicode(e))
                                                                          CCacheError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639053): No Kerberos credentials available (default cach
Mar 13 16:12:03 replica1.ipa.test dogtag-ipa-ca-renew-agent-submit[7893]: Traceback (most recent call last):
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 550, in <module>
                                                                              sys.exit(main())
                                                                            File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 520, in main
                                                                              api.Backend.ldap2.connect()
                                                                            File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect
                                                                              conn = self.create_connection(*args, **kw)
                                                                            File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 205, in create_connection
                                                                              principal = krb_utils.get_principal(ccache_name=ccache)

It may be that these messages are actually harmless since in the end the certificate requests are succesfully resolved, but it may be more helpful to catch these exceptions and log them as soft errors.

Relevant software versions.

[root@replica1 ~]# rpm -q freeipa-server gssproxy
freeipa-server-4.4.90.dev201703131430+git5758f8a-0.fc25.x86_64
gssproxy-0.7.0-1.fc25.x86_64

Metadata Update from @jcholast:
- Issue assigned to jcholast

Metadata Update from @pvoborni:
- Issue priority set to: 1
- Issue set to the milestone: FreeIPA 4.5.1
- Issue tagged with: regression

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1435611

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1435611

Issue linked to bug 1435611

master:

  • b189be12ecd1ba9efa35daf41e7e04a9362c6a5e dsinstance: reconnect ldap2 after DS is restarted by certmonger
  • 8a8558637946d7dac1d85642baaf9ba7c1be98f8 httpinstance: avoid httpd restart during certificate request
  • ec52332229672f35af8db5aaf1ed2827a8dd5467 dsinstance, httpinstance: consolidate certificate request code
  • 181cb94e744c380a823b94d0d5ca088ab3dcca1c install: request service certs after host keytab is set up
  • 3884a671cb59c360fae67884755fa5779053107a renew agent: revert to host keytab authentication

  • a6a89e24147d8542fd09cf64e04982599b79e3cc renew agent, restart scripts: connect to LDAP after kinit
    ipa-4-5:

  • 3a3cd01161b618dd6836fda7df935dd39adc117b dsinstance: reconnect ldap2 after DS is restarted by certmonger

  • 029da956be22c9e05a53c7c30e3afcb2c851ad86 httpinstance: avoid httpd restart during certificate request
  • 3317e172227fd72ad9049f7893d3018043201b3c dsinstance, httpinstance: consolidate certificate request code
  • cb141b0eb3950bcae1950e6190ba3573f348b1f2 install: request service certs after host keytab is set up
  • 1a7db624857c46a2c1c091ed4b8d7902a4486596 renew agent: revert to host keytab authentication
  • e9168e80ddb6066114f9438fa6a7a11b0eaa02cf renew agent, restart scripts: connect to LDAP after kinit

Metadata Update from @mbabinsk:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @stlaz:
- Issue status updated to: Open (was: Closed)

https://pagure.io/freeipa/c/181cb94e744c380a823b94d0d5ca088ab3dcca1c breaks server installation with external CA, fix is in https://github.com/freeipa/freeipa/pull/719

Metadata Update from @stlaz:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/719

master:

  • 25a33ce8b1c77b0d957772143affd7085757bccb server-install: No double Kerberos install

ipa-4-5:

  • 2144eaf25ef1148c9353dfb2680f8811fd8c21aa server-install: No double Kerberos install

Metadata Update from @jcholast:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

regression

None
None
Lowest
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.