freeipa

#8657 IPA Error 903: InternalError on UI login
Opened by rcritten. Modified

Open
Close Issue

Issue

If an entry (user tested) has an invalid userCertificate value then on UI login they will be presented with a traceback and a IPA Error 903: InternalError

Steps to Reproduce

  1. kinit admin
  2. ipa user-add tuser --password
  3. ldapmodify -Y GSSAPI
    dn: uid=tuser,cn=users,cn=accounts,dc=example,dc=test
    changetype: modify
    add: usercertificate;binary
    usercertificate;binary:< file:///var/lib/ipa/certs/httpd.crt
  4. kinit tuser (reset password)
  5. firefox, hit IPA site

If you log in as a different user then you get a pop-up with the operations error but are able to continue to the UI (I tried admin).

Version/Release/Distribution

User-reported on freeipa-users didn't include version but 4.6 - 4.9 presumably. I reproduced it with git master today.

Additional info:

Runtime error
Web UI got in unrecoverable state during "profile" phase.
Technical details:
whoami.data is undefined
update_logged_in@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:51:558
choose_profile@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:48:3010
register_phases/<@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:5:292
_run_phase/<@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:6:2457
forEach@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:2:23501
_run_phase@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:6:2399
next_phase@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:8:6
_run_phase/<@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:7:151
signalListener@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:4:6613
Deferred/promise.then@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:4:9137
_run_phase@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:7:41
next_phase@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:8:6
_run_phase/<@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:7:151
signalListener@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:4:6613
signalWaiting@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:4:6430
Deferred/this.resolve@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:4:8375
all/</<@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:5:13883
signalListener@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:4:6613
signalWaiting@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:4:6430
Deferred/this.resolve@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:4:8375
register_phases/</<@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:5:153
on_success@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:85:3335
freeipa/rpc/</rpc.concurrent_command/that.on_success_all@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:157:26
freeipa/rpc/</rpc.concurrent_command/that.command_completed@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:156:40
freeipa/rpc/</rpc.concurrent_command/that.success_handler@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:155:598
freeipa/rpc/</rpc.concurrent_command/that.execute/command.on_success</<@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:154:288
freeipa/rpc/</rpc.command/that.register_handlers/<@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:152:245
dispatcher@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:3:22841
dojo/on/</on.emit@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:3:16044
dojo/on/</on.emit@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:3:16982
emit@https://ipa.example.test/ipa/ui/js/dojo/dojo.js?v=41000:3:21147
success_handler@https://ipa.example.test/ipa/ui/js/freeipa/app.js?41000:144:608
c@https://ipa.example.test/ipa/ui/js/libs/jquery.js?v=41000:2:27742
fireWith@https://ipa.example.test/ipa/ui/js/libs/jquery.js?v=41000:2:28487
l@https://ipa.example.test/ipa/ui/js/libs/jquery.js?v=41000:2:78734
o/<@https://ipa.example.test/ipa/ui/js/libs/jquery.js?v=41000:2:81062

Note that it is invalid because the certificate gets doubl base64-encoded the way it is added.
Metadata
None

webui

None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.