freeipa

#7964 GSSAPI failure causing LWCA key replication failure on f30
Closed: fixed by ftweedal. Opened by ftweedal.

Closed: fixed
Reopen Issue

Issue

LWCA key replication is failing on f30. Dogtag cannot retrieve the keys. In debug log:

2019-05-30 14:53:03 [KeyRetrieverRunner-06e99390-24f8-4632-a26c-a01693fb87fd] FINE: Running ExternalProcessKeyRetriever
2019-05-30 14:53:03 [KeyRetrieverRunner-06e99390-24f8-4632-a26c-a01693fb87fd] FINE: About to execute command: [/usr/libexec/ipa/ipa-pki-retrieve-key, caSigningCert cert-pki-ca 06e99390-24f8-4632-a26c-a01693fb87f
d, f30-0.ipa.local]
2019-05-30 14:53:04 [KeyRetrieverRunner-06e99390-24f8-4632-a26c-a01693fb87fd] SEVERE: Failed to retrieve key from any host.
2019-05-30 14:53:04 [KeyRetrieverRunner-06e99390-24f8-4632-a26c-a01693fb87fd] WARNING: KeyRetriever did not return a result.
2019-05-30 14:53:04 [KeyRetrieverRunner-06e99390-24f8-4632-a26c-a01693fb87fd] FINE: Retrying in 1946 seconds

In journal we see:

GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (No Kerberos credentials available (default cache: KCM:))

In ipa-pki-retrieve-key, credential acquisition (from /etc/pki/pki-tomcat/dogtag.keytab) succeeds but those credentials are not used when binding to LDAP.

Steps to Reproduce

  1. Create server and CA replica on f30.
  2. Create LWCA on one CA server.

Actual behavior

LWCA key replicaion failure on the other CA server, as described above.

Furthermore, the ca-show command fails; NPE due to missing keys:

[f30-1:~/dev/freeipa] [ master● ] ftweedal% ipa ca-show test1
ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500.

Debug log:

2019-05-30 14:56:41 [ajp-nio-127.0.0.1-8009-exec-5] FINE: MessageFormatInterceptor: AuthorityResource.getCert()                                                                                                    
2019-05-30 14:56:41 [ajp-nio-127.0.0.1-8009-exec-5] FINE: MessageFormatInterceptor: content-type: null                                                                                                             
2019-05-30 14:56:41 [ajp-nio-127.0.0.1-8009-exec-5] FINE: MessageFormatInterceptor: accept: [application/pkix-cert]                                                                                                
2019-05-30 14:56:41 [ajp-nio-127.0.0.1-8009-exec-5] FINE: MessageFormatInterceptor: response format: application/pkix-cert                                                                                         
2019-05-30 14:56:41 [ajp-nio-127.0.0.1-8009-exec-5] SEVERE: Servlet.service() for servlet [Resteasy] in context with path [/ca] threw exception                                                                    
org.jboss.resteasy.spi.UnhandledException: java.lang.NullPointerException                            
        at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:77)                                                                                                           
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:220)          ....
Caused by: java.lang.NullPointerException
        at org.dogtagpki.server.ca.rest.AuthorityService.getCert(AuthorityService.java:147)
    ....

Expected behavior

  • no NPE or IPA command failure when executing ca-show and keys are missing.
  • Key replication succeeds.

PR: https://github.com/freeipa/freeipa/pull/3216

master:

  • 854d3053e294e775fac0e4e394ca3b7b71d04c7d Handle missing LWCA certificate or chain
  • c027b9334b8c3fbb1f31674d7b46c9edb5445208 (HEAD) Fix CustodiaClient ccache handling

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-7:

  • 16016e847a817c5a10300bd085678db3449a99a8 Handle missing LWCA certificate or chain
  • 6e57abb239f9e7b91ec4ef93abcf9af12fcb4222 Fix CustodiaClient ccache handling
  • 5f0b0b521b9700612107e7347dfe28ebfbee7133 CustodiaClient: use ldapi when ldap_uri not specified
  • 54a5bbb5a979d1a8f0cb7bff04ebf86cee52eb2b CustodiaClient: fix IPASecStore config on ipa-4-7

ipa-4-6:

  • 82a9fe7e655115befbdde10907a5aa7669c35fde Handle missing LWCA certificate or chain
  • 436214aea7fd5893525292cb03b3c28cdbc249f2 Fix CustodiaClient ccache handling
  • 1f455867f82407c0dfab0b9f123c75ca0d1a0090 CustodiaClient: use ldapi when ldap_uri not specified
  • c9d0ba0c355c433ae883cafa3c1e99fea1a85220 CustodiaClient: fix IPASecStore config on ipa-4-7
  • e686949dcdc46486061d23d5e18f21e2a2038f58 (HEAD) Bump krb5 min version
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.