freeipa

#7722 freeipa client install failure on CentOS7.4
Closed: invalid Opened by akadoya.

Closed: invalid
Reopen Issue

Issue

ipa-client-install fails on CentOS7.4 environment and no details could be found in the logs(/var/log/ipaclient-install.log).
What is the cause of this error and how I can correct it?

The ipa-client-install command failed, exception: ScriptError:
when installing ipa-client CentOS7.4 env. ( I have sssd installed, and hosts I have used to be joined to Active directory's domain.)

Steps to Reproduce

  1. yum install ipa-client
  2. ipa-client-install --server --domain= // I don't have dns enabled on the server side.
  3. installation stops with error

Actual behavior

2018-10-03T20:30:19Z DEBUG Using servers from command line, disabling DNS discovery
2018-10-03T20:30:19Z DEBUG will use provided server:
2018-10-03T20:30:19Z INFO Autodiscovery of servers for failover cannot work with this configuration.
2018-10-03T20:30:19Z INFO If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
2018-10-03T20:30:21Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 366, in run
self.validate()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 375, in validate
for _nothing in self._validator():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 636, in _configure
next(validator)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
for _nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3637, in main
install_check(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2263, in install_check
raise ScriptError(rval=CLIENT_INSTALL_ERROR)

2018-10-03T20:30:21Z DEBUG The ipa-client-install command failed, exception: ScriptError:
2018-10-03T20:30:21Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

Expected behavior

Installation complete

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

package freeipa-server is not installed
package freeipa-client is not installed
package ipa-server is not installed
ipa-client-4.5.4-10.el7.centos.4.4.x86_64
package 389-ds-base is not installed
package pki-ca is not installed
package krb5-server is not installed
sssd-1.16.0-19.el7_5.8.x86_64

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

Hi,
unless the -U option is provided to ipa-client-install, the installer should prompt you with:
Proceed with fixed values and no DNS discovery?.
Did you see this prompt and answer yes?

Hi,

Yes I saw the prompt and answered No.
because client server's FQDN is using AD.DOMAIN.COM which is already
managed in AD and FreeIPA domain is IDM.DOMAIN.COM.
I just want freeipa as Authentication server for unix system and keep DNS functionality
in Active Directory.

Thanks,
Aoi

On Wed, Oct 3, 2018 at 11:35 PM Florence Blanc-Renaud pagure@pagure.io
wrote:

frenaud added a new comment to an issue you are following:
Hi, unless the -U option is provided to ipa-client-install, the installer should prompt you with: `Proceed with fixed values and no DNS discovery?`. Did you see this prompt and answer yes?

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/7722
Edited by akadoya

When the prompt Proceed with fixed values and no DNS discovery? is answered with 'no', the installer exits. It is not a bug, this behavior is by design.
Now if the intent is to use DNS discovery, ipa-client-install can be called with --domain IPA_ domain and without --server. In this case, the installer will look for a IPA server in the configured DNS. This requires that the AD DNS contains SRV records for IPA, please have a look at Installing a Server Without Integrated DNS as it explains which DNS records need to be added.
The chapter Updating DNS Records systematically when using external DNS also explains how to avoid manual DNS updates when there is a change in IPA topology (addition or removal of a replica).

Closing this issue as it is not a bug.

Metadata Update from @frenaud:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

If it=E2=80=99s not a bug, why the script throws error?
How come I cannot install client without using dns discovery? Any other way
to install without dns discovery?

Thanks,
Aoi

On Mon, Oct 8, 2018 at 1:39 AM Florence Blanc-Renaud pagure@pagure.io
wrote:

frenaud added a new comment to an issue you are following:
Closing this issue as it is not a bug.

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/7722

The script throws an error because they installation wasn't successful because the user said "no, do not install." This traceback is not visible to the user, only in the log. It might be possible to suppress I suppose but it hasn't shown to be an issue in general.

When you use --server and --domain you are disabling autodiscovery.

I see. I am aware of that I=E2=80=99m disabling the auto discovery here but=
what I
don=E2=80=99t get is, how I should be installing the client?
Considering what I got here so far, Client cannot be installed by the
script in case of no auto discovery?

On Mon, Oct 8, 2018 at 8:14 AM Rob Crittenden pagure@pagure.io wrote:

rcritten added a new comment to an issue you are following:
``
The script throws an error because they installation wasn't successful
because the user said "no, do not install." This traceback is not visible
to the user, only in the log. It might be possible to suppress I suppose
but it hasn't shown to be an issue in general.

When you use --server and --domain you are disabling autodiscovery.
``

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/7722

If you don't want autodiscovery then use the --server and --domain options. It explicitly says in the log output that discovery is disabled and you will be using a fixed set of IPA servers.

Ahh sorry now that I understood that I was misreading the question and
answering NO to proceed.

Thanks for your time!!
I=E2=80=99ll give it a try again.

Aoi

On Mon, Oct 8, 2018 at 8:19 AM Rob Crittenden pagure@pagure.io wrote:

rcritten added a new comment to an issue you are following:
If you don't want autodiscovery then use the --server and --domain options. It explicitly says in the log output that discovery is disabled and you will be using a fixed set of IPA servers.

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/7722
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.