freeipa

#7041 [ipa-replica-install] - KDC has no support for encryption type - reoccurence in multireplica scenario
Closed: fixed Opened by mreznik.

Closed: fixed
Reopen Issue

In ticket #6867 we fixed the issue by adding "request_service_keytab" method which implements waiting on entry in LDAP (commit ab71cd5a1693). However this fix works just in case where there is only one master.

In this occurrence we got error in TestLineTopologyWithoutCA testsuite with topology:

master - vm-058-021 (with CA) => replica1 - vm-058-097 (without CA) => replica2 - vm-058-073 (without CA) => replica3 - vm-058-106 (without CA)

running:

IPA server version 4.5.90.dev201706221204+gitb43dab8. API version 2.228

ipa-replica-install failed on third replica:

  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 408, in decorated
    func(installer)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1116, in promote_check
    with rpc_client(remote_api) as client:
  File "/usr/lib64/python2.7/contextlib.py", line 17, in __enter__
    return self.gen.next()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 512, in rpc_client
    client.connect()
  File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect
    conn = self.create_connection(*args, **kw)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1037, in create_connection
    command([], {})
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1249, in _call
    return self.__request(name, args)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1216, in __request
    verbose=self.__verbose >= 3,
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1283, in request
    return self.single_request(host, handler, request_body, verbose)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 677, in single_request
    self.get_auth_info()
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 629, in get_auth_info
    self._handle_exception(e, service=service)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 588, in _handle_exception
    raise errors.KerberosError(message=unicode(e))
2017-06-26T08:06:21Z DEBUG The ipa-replica-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529638926): KDC has no support for encryption type
2017-06-26T08:06:21Z ERROR Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529638926): KDC has no support for encryption type
2017-06-26T08:06:21Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

As in the 2nd replica we already have a replication conflict:

[root@vm-058-073 ~]# ldapsearch -Y GSSAPI -b dc=dom-058-021,dc=ipa,dc=test 'krbprincipalname=HTTP/vm-058-073.ipa.test@*'
SASL/GSSAPI authentication started
SASL username: admin@DOM-058-021.ipa.test
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=dom-058-021,dc=ipa,dc=test> with scope subtree
# filter: krbprincipalname=HTTP/vm-058-073.ipa.test@*
# requesting: ALL
#
# HTTP/vm-058-073.ipa.test@DOM-058-021.IPA.TEST, services, accounts, dom-058-021.ipa.test
dn: krbprincipalname=HTTP/vm-058-073.ipa.test@DOM-058-02
 1.ipa.test,cn=services,cn=accounts,dc=dom-058-021,dc=ipa,dc=test
userCertificate:: MIIFyDCCBLCgAwIBAgIBDzANBgkqhkiG9w0BAQsFADBVMTMwMQYDVQQKDCpE
 T00tMDU4LTAyMS5BQkMuSURNLkxBQi5FTkcuQlJRLlJFREhBVC5DT00xHjAcBgNVBAMMFUNlcnRpZ
 mljYXRlIEF1dGhvcml0eTAeFw0xNzA2MjYwODAzNTdaFw0xOTA2MjcwODAzNTdaMGkxMzAxBgNVBA
 oMKkRPTS0wNTgtMDIxLkFCQy5JRE0uTEFCLkVORy5CUlEuUkVESEFULkNPTTEyMDAGA1UEAwwpdm0
 tMDU4LTA3My5hYmMuaWRtLmxhYi5lbmcuYnJxLnJlZGhhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUA
 A4IBDwAwggEKAoIBAQDdzFfCvZQAEUOnwfwOodDjKB2uPZcL0Wd5DGxhtHPSQhBbrxv6O/pl1zEy9
 ERSHEa1jrLB9G95L+u73euSlf5hpyB2ISov5drrVz9hbdTC/wVsfaQ7VjAQ2WpTXxxptH9MgiwVOE
 Fygl7w/JaDa6F2Wl30PUb6m0eTePYs6rX0wEXbLJlXnxR7A+9kJX3t5B6r80Y4NJ1qIjV9b2g/ihS
 X+X6+NTi9wlwfh9mWfSKc6pX/V0qkSo7E3D/Sd9em7Q7yWkEfwzp9Q82qKVrh1gE6R5j4KjPrw3+v
 RnF1Y9vU6BcMMuE/oB99+cLpfLUs+f/DeprNWXgiRqvkXjRk/AbBAgMBAAGjggKNMIICiTAfBgNVH
 SMEGDAWgBQ3OtjU+A4YR0DpufgRvwQ9N30d5jBcBggrBgEFBQcBAQRQME4wTAYIKwYBBQUHMAGGQG
 h0dHA6Ly9pcGEtY2EuZG9tLTA1OC0wMjEuYWJjLmlkbS5sYWIuZW5nLmJycS5yZWRoYXQuY29tL2N
 hL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjCBmAYD
 VR0fBIGQMIGNMIGKoFKgUIZOaHR0cDovL2lwYS1jYS5kb20tMDU4LTAyMS5hYmMuaWRtLmxhYi5lb
 mcuYnJxLnJlZGhhdC5jb20vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcG
 FjYTEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSaJGqdIOZEjgdRzvv
 mt7iV6dnWITCCAR0GA1UdEQSCARQwggEQgil2bS0wNTgtMDczLmFiYy5pZG0ubGFiLmVuZy5icnEu
 cmVkaGF0LmNvbaBpBgorBgEEAYI3FAIDoFsMWUhUVFAvdm0tMDU4LTA3My5hYmMuaWRtLmxhYi5lb
 mcuYnJxLnJlZGhhdC5jb21ARE9NLTA1OC0wMjEuQUJDLklETS5MQUIuRU5HLkJSUS5SRURIQVQuQ0
 9NoHgGBisGAQUCAqBuMGygLBsqRE9NLTA1OC0wMjEuQUJDLklETS5MQUIuRU5HLkJSUS5SRURIQVQ
 uQ09NoTwwOqADAgEBoTMwMRsESFRUUBspdm0tMDU4LTA3My5hYmMuaWRtLmxhYi5lbmcuYnJxLnJl
 ZGhhdC5jb20wDQYJKoZIhvcNAQELBQADggEBAEKE9j4SsthSPFpG7A0M+G+jciHu90sFYLbTaEY4U
 LHRhAb0h8Z5qlVX43yJhlhtQmMsKH+PrabU3cz4jHxKkX7PJaDMiSpSZqHdeJjSxdjwJG+98wV6z1
 KPUMIjDfL/yLMOFK2FJ1h7fSyhZOruDoEtIfGtcZnfp7APnlWtqn8/hYtveGI/5GsTMgp2YN4wLo+
 DJH2aqu6BEXeQX2/omQouNoN23Xzldi8mKdCmT+SZMfwRX22uHY+dSrFTF7uymyy2ZXSnta92oH7B
 pXdfdLPlkPmVfCKmA73ymyqnZPE8dSZnxnt2PtVS5Rcj1HL18/C6mnquZ+gelWt4kOpIWM8=
krbExtraData:: AAK+v1BZSFRUUC92bS0wNTgtMDczLmFiYy5pZG0ubGFiLmVuZy5icnEucmVkaGF
 0LmNvbUBET00tMDU4LTAyMS5BQkMuSURNLkxBQi5FTkcuQlJRLlJFREhBVC5DT00A
krbLastPwdChange: 20170626080310Z
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipaservice
objectClass: pkiuser
objectClass: ipakrbprincipal
objectClass: top
ipaKrbPrincipalAlias: HTTP/vm-058-073.ipa.test@DOM-058-0
 21.ipa.test
krbCanonicalName: HTTP/vm-058-073.ipa.test@DOM-058-021.IPA.TEST
managedBy: fqdn=vm-058-073.ipa.test,cn=computers,cn=acco
 unts,dc=dom-058-021,dc=ipa,dc=test
krbPrincipalName: HTTP/vm-058-073.ipa.test@DOM-058-021.IPA.TEST
ipaUniqueID: e4e34f64-5a45-11e7-8ad7-001a4a2316f4
krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou
 nts,dc=dom-058-021,dc=ipa,dc=test
# HTTP/vm-058-073.ipa.test@DOM-058-021.IPA.TEST + f81d4303-5a4511e7-85b8c546-36cd4ec2, services, accounts, dom-05
 8-021.ipa.test
dn: krbprincipalname=HTTP/vm-058-073.ipa.test@DOM-058-02
 1.ipa.test+nsuniqueid=f81d4303-5a4511e7-85b8c546-36cd4e
 c2,cn=services,cn=accounts,dc=dom-058-021,dc=ipa,dc=test
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipaservice
objectClass: pkiuser
objectClass: ipakrbprincipal
objectClass: top
ipaKrbPrincipalAlias: HTTP/vm-058-073.ipa.test@DOM-058-0
 21.ipa.test
krbCanonicalName: HTTP/vm-058-073.ipa.test@DOM-058-021.IPA.TEST
managedBy: fqdn=vm-058-073.ipa.test,cn=computers,cn=acco
 unts,dc=dom-058-021,dc=ipa,dc=test
krbPrincipalName: HTTP/vm-058-073.ipa.test@DOM-058-021.IPA.TEST
ipaUniqueID: 01518fb2-5a46-11e7-aa4f-001a4a2316f2
krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou
 nts,dc=dom-058-021,dc=ipa,dc=test
# search result
search: 4
result: 0 Success
# numResponses: 3
# numEntries: 2

Metadata Update from @pvoborni:
- Issue priority set to: critical
- Issue set to the milestone: FreeIPA 4.5.3

See https://pagure.io/freeipa/issue/7013 for a possible reproducer. It seems running TestInstallWithCA1 test suite with vagrant fails quite regularly.

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.4 (was: FreeIPA 4.5.3)

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1470916

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1470916

Issue linked to bug 1470916

Metadata Update from @pvoborni:
- Issue priority set to: blocker (was: critical)

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.5 (was: FreeIPA 4.5.4)

Metadata Update from @pvoborni:
- Issue tagged with: bug

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1689

master:

  • 0f31564b35aac250456233f98730811560eda664 ipa-replica-install: make sure that certmonger picks the right master

ipa-4-6:

  • 75d8ba8e4c9dbdec6b2a0de2a58b763e31198f04 ipa-replica-install: make sure that certmonger picks the right master

ipa-4-5:

  • 490ebcea522ef12920d81dc9405c8a62ae5dcb6e ipa-replica-install: make sure that certmonger picks the right master

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

bug

None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.