freeipa

#8582 Nightly test failure in test_replica_promotion.py::TestHiddenReplicaPromotion::test_ipahealthcheck_hidden_replica - ClonesConnectivyAndDataCheck
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The nightly test test_replica_promotion.py::TestHiddenReplicaPromotion::test_ipahealthcheck_hidden_replica failed in PR 533 on the master branch with updates-testing enabled.

Logs and report:

self = <ipatests.test_integration.test_replica_promotion.TestHiddenReplicaPromotion object at 0x7f6629a54790>
    def test_ipahealthcheck_hidden_replica(self):
        """Ensure that ipa-healthcheck runs successfully on all members
        of an IPA cluster that includes a hidden replica.
        """
        # verify state
        self._check_config([self.master], [self.replicas[0]])
        # A DNA range is needed on the replica for ipa-healthcheck to work.
        # Create a user so that the replica gets a range.
        tasks.user_add(self.replicas[0], 'testuser')
        tasks.user_del(self.replicas[0], 'testuser')
        for srv in (self.master, self.replicas[0]):
            returncode, _unused = run_healthcheck(
                srv,
                failures_only=True
            )
>           assert returncode == 0
E           assert 1 == 0
E             +1
E             -0
[...]
RUN ['ipa-healthcheck', '--output-type', 'json', '--failures-only']
Internal error testing KRA clone. KRA clone problem detected  Host: replica1.ipa.test Port: 443
[
  {
    "source": "pki.server.healthcheck.clones.connectivity_and_data",
    "check": "ClonesConnectivyAndDataCheck",
    "result": "ERROR",
    "uuid": "abd43647-a4d7-4da0-b970-d23538bbb5dd",
    "when": "20201115044756Z",
    "duration": "5.190928",
    "kw": {
      "status": "ERROR:  pki-tomcat : Internal error testing KRA clone. Host: replica1.ipa.test Port: 443"
    }
  }
]

The check
pki.server.healthcheck.clones.connectivity_and_data failed with ERROR: pki-tomcat : Internal error testing KRA clone. Host: replica1.ipa.test Port: 443

@edewata does this look familiar?

Not sure if it's related, but we recently fixed a cloning issue in PKI due to DS changes on F33:
https://github.com/dogtagpki/pki/issues/3379
Edited by edewata

Ok. We'll leave this open to see if the next nightly tests pass. Thanks for the update.

The issue also happens on [testing_master_latest], i.e. without the updates-testing repo. See PR #552

Another failure: PR636, log

Can you reproduce this outside of IPA? This sounds like an IPA-specific problem: note that it is failing to contact KRA on the IPA port.

The debugger shows that ipa-healthcheck is executing an operation equivalent to 

# /usr/bin/pki -p 443 -h replica.ipa.test -n 'subsystemCert cert-pki-ca' -P https -d /var/lib/pki/pki-tomcat/alias/ -c $PASSWORD kra-key-show 0x01
ForbiddenException: Authorization Error

Corresponding logs on the replica side in /var/log/pki/pki-tomcat/kra/debug.2021-01-28.log

2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: PKIRealm: Authenticating certificate chain:
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: PKIRealm: - CN=CA Subsystem, O=IPA.TEST
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: CertUserDBAuthentication: UID CA-server.ipa.test-443 authenticated.
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: PKIRealm: User ID: CA-server.ipa.test-443
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: UGSubsystem: retrieving user uid=CA-server.ipa.test-443,ou=People,o=kra,o=ipaca
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: PKIRealm: User DN: uid=CA-server.ipa.test-443,ou=people,o=kra,o=ipaca
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: PKIRealm: Roles:
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: PKIRealm: - Trusted Managers
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: AAclAuthz: Granting login permission for certServer.kra.account
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: Creating session 15436FB8B4E5C97F32056824C8018920
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: Principal:
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: - ID: CA-server.ipa.test-443
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: - Full Name: CA-server.ipa.test-443
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: - Email: 
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO: - Roles:
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-5] INFO:   - Trusted Managers
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: UGSubsystem: retrieving user uid=CA-server.ipa.test-443,ou=People,o=kra,o=ipaca
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] SEVERE: checkPermission(): permission denied for the resource certServer.kra.keys on operation execute
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] SEVERE: AAclAuthz: Authorization Failed
certServer.kra.keys does not have permission to execute
    at com.netscape.cms.authorization.AAclAuthz.checkPermission(AAclAuthz.java:529)
    at com.netscape.cms.authorization.AAclAuthz.authorize(AAclAuthz.java:840)
    at com.netscape.cmscore.authorization.AuthzSubsystem.authorize(AuthzSubsystem.java:250)
    at com.netscape.cmscore.authorization.AuthzSubsystem.authorize(AuthzSubsystem.java:255)
    at org.dogtagpki.server.rest.ACLInterceptor.filter(ACLInterceptor.java:261)
    at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:263)
    at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
    at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:236)
    at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:406)
    at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:213)
    at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:228)
    at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
    at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
    at jdk.internal.reflect.GeneratedMethodAccessor46.invoke(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:566)
    at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
    at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:550)
    at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
    at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:225)
    at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47)
    at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149)
    at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:566)
    at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
    at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:550)
    at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
    at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:191)
    at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47)
    at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149)
    at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:667)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:432)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:888)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1597)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Thread.java:834)
2021-01-28 15:02:26 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] SEVERE: AAclAuthz: Authorization failed on resource: certServer.kra.keys, operation: execute

Looks like the certificate used for authenticate is not linked to a user with enough permission.

Metadata Update from @frenaud:
- Issue tagged with: tracker

similar failure observed in:

test_ipahealthcheck_hidden_replica : PR report

Another failure observer in PR689, report

Another failure: PR720, logs

Similar failure observed test_master_previous
Logs

This might be an old issue that somehow resurfaced. There's a possibility that the client cert (i.e. subsystemCert cert-pki-ca) sometimes got mapped incorrectly into uid=CA-server.ipa.test-443 instead of uid=pkidbuser.

The uid=pkidbuser is a member of Data Recovery Manager Agents group which is required by the ACL to access the resource:

resourceACLS: certServer.kra.keys:list,execute:allow (list,execute) group="Data Recovery Manager Agents":Only data recovery manager agents list keys and execute key operations

while the uid=CA-server.ipa.test-443 is a member of Trusted Managers, so it gets an Authorization Error. We need to see how the client cert mapping is configured in IPA.

Could someone provide the LDAP entries for uid=pkidbuser and uid=CA-server.ipa.test-443 and the client cert mapping configuration in IPA? Thanks.

 
# ldapsearch -D cn=directory\ manager -w Secret123 -b o=ipaca "uid=pkidbuser"
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: uid=pkidbuser
# requesting: ALL
#
# pkidbuser, people, ipaca
dn: uid=pkidbuser,ou=people,o=ipaca
seeAlso: CN=CA Subsystem,O=IPA.TEST
userCertificate:: MIID3jCCAkagAwIBAgIBBDANBgkqhkiG9w0BAQsFADAzMREwDwYDVQQKDAhJ
 UEEuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIxMDMwMjE4NDU0MFoXD
 TIzMDIyMDE4NDU0MFowKjERMA8GA1UECgwISVBBLlRFU1QxFTATBgNVBAMMDENBIFN1YnN5c3RlbT
 CCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANEGOxu24rXI8/do0jWl2qLA2wO6JsEHaCT
 MQFauivp5iydFPJmmGFmqfPLTrH5wZFgxZsY8Q5q/ef5+MI6L9SQzgbX0rdItIKc/GA/XFuzcMLSU
 V2NCkngOcXztdmaJNCMDKsvDw0M04kivgmAsVQt4H1qFnK3dGvLklZlaFQ0Qw3CkjkVLoR0h1yohk
 DEWlIl2zDhYOw14N9a8s7CrRjhky7CJm434tVGkXbXZDA0cxbx72CpRTP2wWAsZC6eg/Q4lk7czye
 aPgCVKanBYtYxKam0e7dkweoYpCjvcN2Le3INY0QUItlZGodZiyInX/CULLnB5O6PidnQ42BVwPg8
 CAwEAAaOBhTCBgjAfBgNVHSMEGDAWgBSP8a9w78pyx6PtxZZONOdrqFcFXTA6BggrBgEFBQcBAQQu
 MCwwKgYIKwYBBQUHMAGGHmh0dHA6Ly9pcGEtY2EuaXBhLnRlc3QvY2Evb2NzcDAOBgNVHQ8BAf8EB
 AMCBPAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAKrYdVTTAT0VR9rd+f
 Ptsl4/bROqKc3b3yn6n5x+LE6hpi/B28nQSbXIw/Zn4UCvtW8NnRhOma0ximlLIlMm8pJWi2GtulY
 IxYigKj8eXK3GZkGAQJiGG/cnGFnp2Xih1VxZKdNEZpxSVpYk6ekNtMOjau0RB7ij1ooipk7F14GK
 w3agvtK/Sz8R1SpiEhkthgdTNyg55nnIkuWi0vu/+J0UOVQ5PhQYWBRTStG4sZyKZOgFi6UJWs4Oq
 9lqX4pS5Y+63it68n6JJwOvS6sPTa/UCef0vH2xrtUF2beA4IzCarjDitDrhia10tPMawVafkNoPu
 W/h9prV7yoToPGgi+f+ux5oqS589dYTcJKyVGJFv8ldG4tIneWr9pU7ek5gzB5xVQUfnzdPjJbiBw
 VdyOEKk1yXU98b1rjJjV3n4wBd1TbPtqlq7WgdaDvVPh3hLGlbZKV0KLs907YLRXF8g+BRAQbwksM
 UmgjRdH5f2EhzDQsTEhGazBHtuOY99xAFQ==
description: 2;4;CN=Certificate Authority,O=IPA.TEST;CN=CA Subsystem,O=IPA.TES
 T
userstate: 1
usertype: agentType
cn: pkidbuser
sn: pkidbuser
uid: pkidbuser
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: cmsuser
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
# ldapsearch -D cn=directory\ manager -w Secret123 -b o=ipaca "uid=CA-server*"
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: uid=CA-server*
# requesting: ALL
#
# CA-server.ipa.test-443, people, kra, ipaca
dn: uid=CA-server.ipa.test-443,ou=people,o=kra,o=ipaca
userCertificate:: MIID3jCCAkagAwIBAgIBBDANBgkqhkiG9w0BAQsFADAzMREwDwYDVQQKDAhJ
 UEEuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIxMDMwMjE4NDU0MFoXD
 TIzMDIyMDE4NDU0MFowKjERMA8GA1UECgwISVBBLlRFU1QxFTATBgNVBAMMDENBIFN1YnN5c3RlbT
 CCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANEGOxu24rXI8/do0jWl2qLA2wO6JsEHaCT
 MQFauivp5iydFPJmmGFmqfPLTrH5wZFgxZsY8Q5q/ef5+MI6L9SQzgbX0rdItIKc/GA/XFuzcMLSU
 V2NCkngOcXztdmaJNCMDKsvDw0M04kivgmAsVQt4H1qFnK3dGvLklZlaFQ0Qw3CkjkVLoR0h1yohk
 DEWlIl2zDhYOw14N9a8s7CrRjhky7CJm434tVGkXbXZDA0cxbx72CpRTP2wWAsZC6eg/Q4lk7czye
 aPgCVKanBYtYxKam0e7dkweoYpCjvcN2Le3INY0QUItlZGodZiyInX/CULLnB5O6PidnQ42BVwPg8
 CAwEAAaOBhTCBgjAfBgNVHSMEGDAWgBSP8a9w78pyx6PtxZZONOdrqFcFXTA6BggrBgEFBQcBAQQu
 MCwwKgYIKwYBBQUHMAGGHmh0dHA6Ly9pcGEtY2EuaXBhLnRlc3QvY2Evb2NzcDAOBgNVHQ8BAf8EB
 AMCBPAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAKrYdVTTAT0VR9rd+f
 Ptsl4/bROqKc3b3yn6n5x+LE6hpi/B28nQSbXIw/Zn4UCvtW8NnRhOma0ximlLIlMm8pJWi2GtulY
 IxYigKj8eXK3GZkGAQJiGG/cnGFnp2Xih1VxZKdNEZpxSVpYk6ekNtMOjau0RB7ij1ooipk7F14GK
 w3agvtK/Sz8R1SpiEhkthgdTNyg55nnIkuWi0vu/+J0UOVQ5PhQYWBRTStG4sZyKZOgFi6UJWs4Oq
 9lqX4pS5Y+63it68n6JJwOvS6sPTa/UCef0vH2xrtUF2beA4IzCarjDitDrhia10tPMawVafkNoPu
 W/h9prV7yoToPGgi+f+ux5oqS589dYTcJKyVGJFv8ldG4tIneWr9pU7ek5gzB5xVQUfnzdPjJbiBw
 VdyOEKk1yXU98b1rjJjV3n4wBd1TbPtqlq7WgdaDvVPh3hLGlbZKV0KLs907YLRXF8g+BRAQbwksM
 UmgjRdH5f2EhzDQsTEhGazBHtuOY99xAFQ==
description: 2;4;CN=Certificate Authority,O=IPA.TEST;CN=CA Subsystem,O=IPA.TES
 T
userstate: 1
usertype: agentType
cn: CA-server.ipa.test-443
sn: CA-server.ipa.test-443
uid: CA-server.ipa.test-443
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: cmsuser
# CA-server.ipa.test-8443, people, ipaca
dn: uid=CA-server.ipa.test-8443,ou=people,o=ipaca
userCertificate:: MIID3jCCAkagAwIBAgIBBDANBgkqhkiG9w0BAQsFADAzMREwDwYDVQQKDAhJ
 UEEuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIxMDMwMjE4NDU0MFoXD
 TIzMDIyMDE4NDU0MFowKjERMA8GA1UECgwISVBBLlRFU1QxFTATBgNVBAMMDENBIFN1YnN5c3RlbT
 CCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANEGOxu24rXI8/do0jWl2qLA2wO6JsEHaCT
 MQFauivp5iydFPJmmGFmqfPLTrH5wZFgxZsY8Q5q/ef5+MI6L9SQzgbX0rdItIKc/GA/XFuzcMLSU
 V2NCkngOcXztdmaJNCMDKsvDw0M04kivgmAsVQt4H1qFnK3dGvLklZlaFQ0Qw3CkjkVLoR0h1yohk
 DEWlIl2zDhYOw14N9a8s7CrRjhky7CJm434tVGkXbXZDA0cxbx72CpRTP2wWAsZC6eg/Q4lk7czye
 aPgCVKanBYtYxKam0e7dkweoYpCjvcN2Le3INY0QUItlZGodZiyInX/CULLnB5O6PidnQ42BVwPg8
 CAwEAAaOBhTCBgjAfBgNVHSMEGDAWgBSP8a9w78pyx6PtxZZONOdrqFcFXTA6BggrBgEFBQcBAQQu
 MCwwKgYIKwYBBQUHMAGGHmh0dHA6Ly9pcGEtY2EuaXBhLnRlc3QvY2Evb2NzcDAOBgNVHQ8BAf8EB
 AMCBPAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBAKrYdVTTAT0VR9rd+f
 Ptsl4/bROqKc3b3yn6n5x+LE6hpi/B28nQSbXIw/Zn4UCvtW8NnRhOma0ximlLIlMm8pJWi2GtulY
 IxYigKj8eXK3GZkGAQJiGG/cnGFnp2Xih1VxZKdNEZpxSVpYk6ekNtMOjau0RB7ij1ooipk7F14GK
 w3agvtK/Sz8R1SpiEhkthgdTNyg55nnIkuWi0vu/+J0UOVQ5PhQYWBRTStG4sZyKZOgFi6UJWs4Oq
 9lqX4pS5Y+63it68n6JJwOvS6sPTa/UCef0vH2xrtUF2beA4IzCarjDitDrhia10tPMawVafkNoPu
 W/h9prV7yoToPGgi+f+ux5oqS589dYTcJKyVGJFv8ldG4tIneWr9pU7ek5gzB5xVQUfnzdPjJbiBw
 VdyOEKk1yXU98b1rjJjV3n4wBd1TbPtqlq7WgdaDvVPh3hLGlbZKV0KLs907YLRXF8g+BRAQbwksM
 UmgjRdH5f2EhzDQsTEhGazBHtuOY99xAFQ==
description: 2;4;CN=Certificate Authority,O=IPA.TEST;CN=CA Subsystem,O=IPA.TES
 T
userstate: 1
usertype: agentType
cn: CA-server.ipa.test-8443
sn: CA-server.ipa.test-8443
uid: CA-server.ipa.test-8443
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: cmsuser
# search result
search: 2
result: 0 Success
# numResponses: 3
# numEntries: 2
# cat /etc/dirsrv/slapd-IPA-TEST/certmap.conf 
# VERSION 3 - DO NOT REMOVE THIS LINE
#
# This file is managed by IPA and will be overwritten on upgrades.
#
#
# This file configures how a certificate is mapped to an LDAP entry.  See the
# documentation for more information on this file.
#
# The format of this file is as follows:
#   certmap <name> <issuerDN>
#   <name>:<prop1> [<val1>]
#   <name>:<prop2> [<val2>]
#
# Notes:
#
# 1.  Mapping can be defined per issuer of a certificate.  If mapping doesn't
#     exists for a particular 'issuerDN' then the server uses the default
#     mapping. 
#
# 2.  There must be an entry for <name>=default and issuerDN "default".
#     This mapping is the default mapping.
#
# 3.  '#' can be used to comment out a line.
#
# 4.  DNComps & FilterComps are used to form the base DN and filter resp. for 
#     performing an LDAP search while mapping the cert to a user entry.
#
# 5.  DNComps can be one of the following:
#   commented out - take the user's DN from the cert as is
#   empty         - search the entire LDAP tree (DN == suffix)
#   attr names    - a comma separated list of attributes to form DN
#
# 6.  FilterComps can be one of the following:
#   commented out - set the filter to "objectclass=*"
#   empty         - set the filter to "objectclass=*"
#   attr names    - a comma separated list of attributes to form the filter
#
certmap default         default
#default:DNComps
#default:FilterComps    e, uid
#default:verifycert     on
#default:CmapLdapAttr   certSubjectDN
#default:library        <path_to_shared_lib_or_dll>
#default:InitFn         <Init function's name>
default:DNComps
default:FilterComps     uid
certmap ipaca           CN=Certificate Authority,O=IPA.TEST
ipaca:CmapLdapAttr      seeAlso
ipaca:verifycert        on

The content of Data Recovery Manager Agents is the following:

# ldapsearch -D cn=directory\ manager -w Secret123 -b o=ipaca "cn=Data Recovery Manager Agents"
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: cn=Data Recovery Manager Agents
# requesting: ALL
#
# Data Recovery Manager Agents, groups, kra, ipaca
dn: cn=Data Recovery Manager Agents,ou=groups,o=kra,o=ipaca
uniqueMember: uid=admin,ou=People,o=kra,o=ipaca
uniqueMember: uid=ipakra,ou=people,o=kra,o=ipaca
cn: Data Recovery Manager Agents
objectClass: top
objectClass: groupOfUniqueNames
description: Agents for Data Recovery Manager
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1

uid=pkidbuser,ou=People,o=ipaca is only a member of cn=Certificate Manager Agents,ou=groups,o=ipaca and cn=Subsystem Group,ou=groups,o=ipaca, while uid=CA-server.ipa.test-8443,ou=People,o=ipaca is a member of cn=Subsystem Group,ou=groups,o=ipaca.

Failure observed in testing_master_previous
PR #753
Logs
Edited by sumedhs

Failure observed in testing_master_previous
PR #784
Logs

Failure observed in testing_master_previous
PR #803
Logs

master:

  • 7eb50d4e6eaee12e9950de611d71f428567798a4 ipatests: mark test_ipahealthcheck_hidden_replica as expected failure
Edited by frenaud

ipa-4-9:

  • 0ffaf29a370d42d62ae4701fe7c1f5f885a7df2c ipatests: mark test_ipahealthcheck_hidden_replica as expected failure

For those of us being hit by this, is there a workaround?

Not that I know of. I believe the pki team is going to re-write the healthcheck and use the IPA credentials instead.

Metadata Update from @frenaud:
- Issue assigned to frenaud

master:

  • f3636c6afa75d9822a2fd1a535415b09f3fe1867 ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus

ipa-4-9:

  • 9bae5492270d8b695999cd82831cbee62b04626b ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus

master:

  • e46dd73a9a34df8879221019b839933ad2a0aaef ipatests: xfail for test_ipahealthcheck_hidden_replica to respect pki version

ipa-4-9:

  • 60739ce483e897cbd85575304dfb7562066189e4 ipatests: xfail for test_ipahealthcheck_hidden_replica to respect pki version

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure tests tracker

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.