freeipa

#7102 kdcproxy startup fails with backtrace if LDAP server not available
Closed: invalid Opened by rcritten.

Closed: invalid
Reopen Issue

The kdcproxy fails to start with an LDAP connection error if 389-ds is up which causes Apache startup to fail.

Now maybe it's ok to not start but a traceback isn't so nice.

To reproduce:

# ipactl stop
# service httpd start

It fails with:

   Unknown error while retrieving setting from ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket: [Errno 111] Connection refused
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]: Traceback (most recent call last):
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:   File "/usr/libexec/ipa/ipa-httpd-kdcproxy", line 84, in _ldap_con
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:     self.con.do_bind(timeout=self.time_limit)
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1681, in do_bind
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:     self.do_external_bind(pw_name, timeout=timeout)
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1671, in do_external_bind
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:     self.__bind_with_wait(self.external_bind, timeout, user_name)
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1660, in __bind_with_wait
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:     self.__wait_for_connection(timeout)
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1643, in __wait_for_connection
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:     wait_for_open_socket(lurl.hostport, timeout)
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:   File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 1307, in wait_for_open_socket
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]:     raise e
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]: error: [Errno 111] Connection refused
Aug 14 15:39:06 lego.example.com ipa-httpd-kdcproxy[10913]: ipa         : ERROR    Unknown error while retrieving setting from ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket: [Errno 111] Connection refused
Aug 14 15:39:06 lego.example.com systemd[1]: httpd.service: Control process exited, code=exited status=1

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.7
- Issue tagged with: easyfix

This was fixed by commit a68c95d11612108375877ff45bdb53ce6fc8fbe4 for ticket https://fedorahosted.org/freeipa/ticket/6461

Errors are routed via ipapython/ipaldap.py::error_handler so the right exception is raised and caught gracefully.

Metadata Update from @rcritten:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None

easyfix

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.