freeipa

#8723 FreeIPA migration web page blank in 4.9.2-2 and 4.9.2-1; TypeError: IPA.group is undefined, Fedora 33
Closed: duplicate by robbiethek. Opened by robbiethek.

Closed: duplicate
Reopen Issue

The UI for the migration page is just a blank which page. I've tried with different browsers. Initially on 4.9.2-1, I saw this error in the Apache error log: File does not exist: /usr/share/ipa/ui/js/freeipa/menu.js

I upgraded to 4.9.2-2 and I went to the Git page and download all of the JS files and copied them over. Still a blank page.

In Firefox Console I see this: TypeError: IPA.group is undefined. Screenshot attached.

Here is the end of the Tomcat logs:

2021-02-24 14:07:11 [SerialNumberUpdateTask] INFO: SerialNumberUpdateTask: updating serial numbers
2021-02-24 14:07:11 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca, o=ipaca
2021-02-24 14:07:11 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=INVALID)
2021-02-24 14:07:11 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca, o=ipaca
2021-02-24 14:07:11 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=VALID)
2021-02-24 14:07:11 [CertStatusUpdateTask] INFO: DBVirtualList: dn: cn=2,ou=certificateRepository,ou=ca,o=ipaca
2021-02-24 14:07:11 [CertStatusUpdateTask] INFO: DBVirtualList: Searching ou=certificateRepository, ou=ca, o=ipaca
2021-02-24 14:07:11 [CertStatusUpdateTask] INFO: DBVirtualList: filter: (certStatus=REVOKED)

The kernel is 5.8.18-300.fc33.x86_64

rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server1
freeipa-server-4.9.2-2.fc33.x86_64
freeipa-client-4.9.2-2.fc33.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-1.4.4.12-1.fc33.x86_64
pki-ca-10.10.3-3.fc33.noarch
krb5-server-1.18.2-29.fc33.x86_64

In the Apache error log the only logs I see with errors/warnings are:
[Wed Feb 24 13:56:00.417163 2021] [wsgi:error] [pid 3730416:tid 3730772] [remote 150.108.64.139:50578] ipa: DEBUG: WSGI wsgi_dispatch.__call__:
[Wed Feb 24 13:56:00.417348 2021] [wsgi:error] [pid 3730416:tid 3730772] [remote 150.108.64.139:50578] ipa: DEBUG: WSGI jsonserver_i18n_messages.__call__:
[Wed Feb 24 13:56:00.417628 2021] [wsgi:error] [pid 3730416:tid 3730772] [remote 150.108.64.139:50578] ipa: DEBUG: WSGI jsonserver.__call__:
[Wed Feb 24 13:56:00.417750 2021] [wsgi:error] [pid 3730416:tid 3730772] [remote 150.108.64.139:50578] ipa: DEBUG: WSGI WSGIExecutioner.__call__:
[Wed Feb 24 13:56:00.418135 2021] [wsgi:error] [pid 3730416:tid 3730772] [remote 150.108.64.139:50578] ipa: DEBUG: raw: i18n_messages(version='2.240')
[Wed Feb 24 13:56:00.418348 2021] [wsgi:error] [pid 3730416:tid 3730772] [remote 150.108.64.139:50578] ipa: DEBUG: i18n_messages(version='2.240')
[Wed Feb 24 13:56:00.427292 2021] [wsgi:error] [pid 3730416:tid 3730772] [remote 150.108.64.139:50578] ipa: INFO: [jsonserver_i18n_messages] UNKNOWN: i18n_messages(version='2.240'): SUCCESS

and
AH02008: SSL library error 1 in handshake1
SSL Library Error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown (SSL alert number 46)
freeipamigration.PNG

Anything else I can provide?

Edit, from slapd error log:

[24/Feb/2021:12:36:42.690729685 -0500] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES
[24/Feb/2021:12:36:42.736008675 -0500] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[24/Feb/2021:12:36:42.770507037 -0500] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES
[24/Feb/2021:12:36:42.787248561 -0500] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[24/Feb/2021:12:36:42.804139678 -0500] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption.
[24/Feb/2021:12:36:42.825923250 -0500] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES
[24/Feb/2021:12:36:42.846711543 -0500] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[24/Feb/2021:12:36:42.873906713 -0500] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES
[24/Feb/2021:12:36:42.898024902 -0500] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[24/Feb/2021:12:36:42.923262556 -0500] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption.
[24/Feb/2021:12:36:42.988302866 -0500] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup!
[24/Feb/2021:12:36:43.043773891 -0500] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=ourserver,dc=edu does not exist

I think this is a problem with FAS plugin, not with stock FreeIPA.

I think this is a problem with FAS plugin, not with stock FreeIPA.

Where can I find support for that and what else can I provide?

Seems to be related to this issue where the reset password page also breaks.

If you are not using FAS plugin, don't install it.
https://github.com/fedora-infra/freeipa-fas is the place and we already have an issue opened there for the reset password page: https://github.com/fedora-infra/freeipa-fas/issues/131

Uninstalling the plugin worked, the reset password page should also mention the migration page, IMHO.

Metadata Update from @robbiethek:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.