freeipa

#8127 DNS-less deployment may fail server role retrieval in ipa-adtrust-install
Opened by abbra. Modified

Open
Close Issue

When FreeIPA is deployed without integrated DNS server, running ipa-adtrust-install may fail in retrieval of server roles.

This looks similar to the following setup:

# ipa-adtrust-install 
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the FreeIPA Server.
This includes:
  * Configure Samba
  * Add trust related objects to FreeIPA LDAP server
To accept the default shown in brackets, press the Enter key.
Configuring cross-realm trusts for IPA server requires password for user 'admin'.
This user is a regular system account used for IPA server administration.
admin password: 
IPA generated smb.conf detected.
Overwrite smb.conf? [no]: yes
Do you want to enable support for trusted domains in Schema Compatibility plugin?
This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.
Enable trusted domains support in slapi-nis? [no]: yes
The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring CIFS
  [1/25]: validate server hostname
  [2/25]: stopping smbd
  [3/25]: creating samba domain object
Samba domain object already exists
  [4/25]: retrieve local idmap range
  [5/25]: creating samba config registry
  [6/25]: writing samba config file
  [7/25]: adding cifs Kerberos principal
  [8/25]: adding cifs and host Kerberos principals to the adtrust agents group
  [9/25]: check for cifs services defined on other replicas
  [10/25]: adding cifs principal to S4U2Proxy targets
cifs principal already targeted, nothing to do.
  [11/25]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
  [12/25]: adding RID bases
RID bases already set, nothing to do
  [13/25]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
  [14/25]: activating CLDAP plugin
CLDAP plugin already configured, nothing to do
  [15/25]: activating sidgen task
Sidgen task plugin already configured, nothing to do
  [16/25]: map BUILTIN\Guests to nobody group
  [17/25]: configuring smbd to start on boot
  [18/25]: adding special DNS service records
DNS management was not enabled at install time.
Add the following service records to your DNS server for DNS zone some.zone: 
  [error] KeyError: ''
Unexpected error - see /var/log/ipaserver-install.log for details:
KeyError: ''

In the logs I can see the following traceback:

2019-11-26T07:50:48Z DEBUG   [18/25]: adding special DNS service records
2019-11-26T07:50:48Z DEBUG raw: dns_is_enabled(version='2.235')
2019-11-26T07:50:48Z DEBUG dns_is_enabled(version='2.235')
2019-11-26T07:50:48Z DEBUG DNS management was not enabled at install time.
2019-11-26T07:50:48Z DEBUG Add the following service records to your DNS server for DNS zone some.zone: 
2019-11-26T07:50:48Z DEBUG raw: server_find(None, version='2.235', no_members=False)
2019-11-26T07:50:48Z DEBUG server_find(None, all=False, raw=False, version='2.235', no_members=False, pkey_only=False)
2019-11-26T07:50:48Z DEBUG raw: topologysuffix_find(None, all=True, raw=True, version='2.235')
2019-11-26T07:50:48Z DEBUG topologysuffix_find(None, all=True, raw=True, version='2.235', pkey_only=False)
2019-11-26T07:50:48Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line 1076, in error_handler
    yield
  File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line 1576, in find_entries
    raise e
  File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line 1536, in find_entries
    result = self.conn.result3(id, 0)
  File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line 749, in result3
    resp_ctrl_classes=resp_ctrl_classes
  File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line 756, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line 329, in _ldap_call
    reraise(exc_type, exc_value, exc_traceback)
  File "/usr/lib64/python3.7/site-packages/ldap/compat.py", line 44, in reraise
    raise exc_value
  File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line 313, in _ldap_call
    result = func(*args,**kwargs)
ldap.NO_SUCH_OBJECT: {'desc': 'No such object', 'matched': 'cn=ipa,cn=etc,dc=some,dc=zone'}
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 2067, in execute
    size_limit=options.get('sizelimit', None)
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 1112, in wrapped
    return func(*call_args, **call_kwargs)
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 1121, in exc_func
    self, keys, options, e, call_func, *args, **kwargs)
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 2118, in exc_callback
    raise exc
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 1112, in wrapped
    return func(*call_args, **call_kwargs)
  File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line 1583, in find_entries
    break
  File "/usr/lib64/python3.7/contextlib.py", line 130, in __exit__
    self.gen.throw(type, value, traceback)
  File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line 1086, in error_handler
    raise errors.NotFound(reason=arg_desc or 'no such entry')
ipalib.errors.NotFound: no such entry
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 603, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 589, in run_step
    method()
  File "/usr/lib/python3.7/site-packages/ipaserver/install/adtrustinstance.py", line 616, in __add_dns_service_records
    system_records = IPASystemRecords(api, all_servers=True)
  File "/usr/lib/python3.7/site-packages/ipaserver/dns_data_management.py", line 75, in __init__
    self.__init_data(all_servers=all_servers)
  File "/usr/lib/python3.7/site-packages/ipaserver/dns_data_management.py", line 102, in __init_data
    servers = self.api_instance.Command.server_find(**kwargs)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 450, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 478, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 800, in run
    return self.execute(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 2077, in execute
    self, ldap, entries, truncated, *args, **options
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/server.py", line 415, in post_callback
    suffixes = self.obj._get_suffixes()
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/server.py", line 161, in _get_suffixes
    all=True, raw=True,
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 450, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 478, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 800, in run
    return self.execute(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 2072, in execute
    return self.api.Object[self.obj.parent_object].handle_not_found(
  File "/usr/lib/python3.7/site-packages/ipalib/plugable.py", line 334, in __getitem__
    plugin = self.get_plugin(key)
  File "/usr/lib/python3.7/site-packages/ipalib/plugable.py", line 331, in get_plugin
    return self.__plugins_by_key[key]
KeyError: ''
2019-11-26T07:50:48Z DEBUG   [error] KeyError: ''
2019-11-26T07:50:48Z DEBUG   File "/usr/lib/python3.7/site-packages/ipaserver/install/installutils.py", line 746, in run_script
    return_value = main_function()
  File "/usr/sbin/ipa-adtrust-install", line 213, in main
    adtrust.install(True, options, fstore, api)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/adtrust.py", line 420, in install
    smb.create_instance()
  File "/usr/lib/python3.7/site-packages/ipaserver/install/adtrustinstance.py", line 899, in create_instance
    self.start_creation(show_service_name=False)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 603, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 589, in run_step
    method()
  File "/usr/lib/python3.7/site-packages/ipaserver/install/adtrustinstance.py", line 616, in __add_dns_service_records
    system_records = IPASystemRecords(api, all_servers=True)
  File "/usr/lib/python3.7/site-packages/ipaserver/dns_data_management.py", line 75, in __init__
    self.__init_data(all_servers=all_servers)
  File "/usr/lib/python3.7/site-packages/ipaserver/dns_data_management.py", line 102, in __init_data
    servers = self.api_instance.Command.server_find(**kwargs)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 450, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 478, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 800, in run
    return self.execute(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 2077, in execute
    self, ldap, entries, truncated, *args, **options
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/server.py", line 415, in post_callback
    suffixes = self.obj._get_suffixes()
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/server.py", line 161, in _get_suffixes
    all=True, raw=True,
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 450, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 478, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 800, in run
    return self.execute(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipaserver/plugins/baseldap.py", line 2072, in execute
    return self.api.Object[self.obj.parent_object].handle_not_found(
  File "/usr/lib/python3.7/site-packages/ipalib/plugable.py", line 334, in __getitem__
    plugin = self.get_plugin(key)
  File "/usr/lib/python3.7/site-packages/ipalib/plugable.py", line 331, in get_plugin
    return self.__plugins_by_key[key]
2019-11-26T07:50:48Z DEBUG The ipa-adtrust-install command failed, exception: KeyError: ''

This is Fedora 31, FreeIPA 4.8.2.

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.