freeipa

#7799 ipa-ca-install on replica server: ERROR: Remote master check failed
Closed: insufficientinfo by rcritten. Opened by cmonty.

Closed: insufficientinfo
Reopen Issue

Request for enhancement

I was advised to install CA instance on replica server.

Issue

The command ipa-ca-install fails with this error:

[root@ipa-replica ~]# ipa-ca-install
Directory Manager (existing master) password:
Run connection check to master
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
Connection check failed!
See /var/log/ipareplica-conncheck.log for more information.
If the check results are not valid it can be skipped with --skip-conncheck parameter.

Steps to Reproduce

On replica server run
1. ipa-client-install --mkhomedir
2. ipa-replica-install
3. ipa-ca-install

Additional log information

[root@ipa-replica ~]# tail /var/log/ipareplica-conncheck.log
2018-12-07T17:39:53Z DEBUG storing cookie 'ipa_session=MagBearerToken=yQ8JRgM3X47wjZ8GMTO1MIjTlPqygCFkUdsDxhDXNvHclH2f%2frZ6WeXRmpEc%2fIeeymzW6lerXXQV7aK3vQEhSM%2fCdofjzczbNCpWzW8k5M5e00uKr%2b54c7IjMSEOH5qRKtk4D%2f%2bJDxLm8wwx5gnrizJB3nCAJwaemJpQCC59nliXnbmVH6zBbDp3vuHS2AzNpcrk36VOwu0NhjOGSmHjS0rWriB2QEyXj3iP3iy%2feYSko8IaeHUKhpd6fh6%2fxov0eu92nCENIK2kc5g8slrfG8e%2fVIC8sOZ2%2fJc83kiFLWe29U7UczNXNKH2Qt5igQZxbHFrw%2b9dfVs3l%2fKrja66Lw%3d%3d;' for principal host/ipa-replica.biszumbitterenen.de@BISZUMBITTERENEN.DE
2018-12-07T17:39:53Z INFO Execute check on remote master
2018-12-07T17:39:53Z DEBUG [try 1]: Forwarding 'server_conncheck' to json server 'https://ipa-master.biszumbitterenen.de/ipa/session/json'
2018-12-07T17:39:53Z DEBUG HTTP connection keep-alive (ipa-master.biszumbitterenen.de)
2018-12-07T17:40:18Z DEBUG received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=yQ8JRgM3X47wjZ8GMTO1MIjTlPqygCFkUdsDxhDXNvHclH2f%2frZ6WeXRmpEc%2fIeeymzW6lerXXQV7aK3vQEhSM%2fCdofjzczbNCpWzW8k5M5e00uKr%2b54c7IjMSEOH5qRKtk4D%2f%2bJDxLm8wwx5gnrizJB3nCAJwaemJpQCC59nliXnbmVH6zBbDp3vuHS2AzNpcrk36VOwu0NhjOGSmHjS0rWriB2QEyXj3iP3iy%2feYSko8IaeHUKhpd6fh6%2fxov0eu92nCENIK2kc5g8slrfG8e%2fVIC8sOZ2%2fJc83kiFLWe29U7UczNXNKH2Qt5igQZxbHFrw%2b9dfVs3l%2fKrja66Lw%3d%3d;path=/ipa;httponly;secure;']'
2018-12-07T17:40:18Z DEBUG storing cookie 'ipa_session=MagBearerToken=yQ8JRgM3X47wjZ8GMTO1MIjTlPqygCFkUdsDxhDXNvHclH2f%2frZ6WeXRmpEc%2fIeeymzW6lerXXQV7aK3vQEhSM%2fCdofjzczbNCpWzW8k5M5e00uKr%2b54c7IjMSEOH5qRKtk4D%2f%2bJDxLm8wwx5gnrizJB3nCAJwaemJpQCC59nliXnbmVH6zBbDp3vuHS2AzNpcrk36VOwu0NhjOGSmHjS0rWriB2QEyXj3iP3iy%2feYSko8IaeHUKhpd6fh6%2fxov0eu92nCENIK2kc5g8slrfG8e%2fVIC8sOZ2%2fJc83kiFLWe29U7UczNXNKH2Qt5igQZxbHFrw%2b9dfVs3l%2fKrja66Lw%3d%3d;' for principal host/ipa-replica.biszumbitterenen.de@BISZUMBITTERENEN.DE
2018-12-07T17:40:18Z DEBUG Destroyed connection context.rpcclient_139931195343760
2018-12-07T17:40:18Z ERROR ERROR: Remote master check failed with following error message(s):
an internal error has occurred
2018-12-07T17:40:18Z DEBUG Stopping listening thread.

Version/Release/Distribution

[root@ipa-replica ~]# rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.7.0-3.fc29.x86_64
freeipa-client-4.7.0-3.fc29.x86_64
Das Paket ipa-server ist nicht installiert
Das Paket ipa-client ist nicht installiert
389-ds-base-1.4.0.16-1.fc29.x86_64
pki-ca-10.6.6-2.fc29.noarch
krb5-server-1.16.1-21.fc29.x86_64

Hi,
can you check the content of /var/log/httpd/error_log in the master, especially a line with server_conncheck with a timestamp corresponding to the date you ran ipa-ca-install?
A frequent cause for server_conncheck failing is when oddjobd is stopped on the master. In this case the master will log a message similar to dbus.exceptions.DBusException: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freeipa.server was not provided by any .service files just above the server_conncheck error. If it is your case, you can restart and enable oddjobd on the master with

# systemctl start oddjobd
# systemctl enable oddjobd

and re-launch ipa-ca-install on the replica.

Metadata Update from @rcritten:
- Issue close_status updated to: insufficientinfo
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.