freeipa

#9220 IPA client Install fails get_ca_certs_from_ldap() error: 'Name' object has no attribute 'rdns'
Closed: fixed by rcritten. Opened by boredape.

Closed: fixed
Reopen Issue

Request for assistance.

I have exhausted all my avenues and would like some assistance to troubleshoot the ipa-client install.

Issue

Ipa client install fails with.

trying to retrieve CA cert via LDAP from e1-ipaserver01.idm.eu.example.com
retrieving schema for SchemaCache url=ldap://e1-ipaserver01.idm.eu.example.com:389 conn=
get_ca_certs_from_ldap() error: 'Name' object has no attribute 'rdns'

Version and distribution

Client
  • ipa-client-4.6.8-5.el7.centos.11.x86_64
  • CentOS Linux release 7.5.1804 (Core)
Server
  • ipa-server-4.9.6-10.module+el8.5.0+13587+92118e57.x86_64
  • Red Hat Enterprise Linux release 8.5 (Ootpa)

What have I tried.

  • Tested with Netcat the following ports from the client to the server.
    TCP: 80, 88, 389, 464 and UDP 464
  • Tested with DIG and can retrieve DNS records PTR and TXT records e.t.c as required.
  • Added hostnames to /etc/hosts as well.
  • Tried downloading the cert with http. It can download the CA Certificate but still fails to install.
  • Copied the cert to /etc/ipa/ca.crt and specified --ca-cert-file.

all combinations seem to refer back to 'Name' object has no attribute 'rdns'

Additional info:

I have around twenty hosts that exhibit this behaviour, which I suspect were built from the same template.
Any help to troubleshoot would be greatly appreciated.

Log file from IPA Client0

[root@e1-mybadclient ~]# ipa-client-install --domain idm.eu.example.com --debug
Logging to /var/log/ipaclient-install.log
ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': True, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': None, 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': None, 'keytab': None, 'no_ntp': False, 'domain_name': 'idm.eu.example.com', 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': None, 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': False, 'firefox_dir': None, 'unattended': False, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': False, 'log_file': None, 'uninstall': False}
IPA version 4.6.8-5.el7.centos.11
Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
Starting external process
args=/usr/sbin/selinuxenabled
Process finished, return code=1
stdout=
stderr=
Starting external process
args=/bin/systemctl is-enabled chronyd.service
Process finished, return code=1
stdout=disabled
stderr=
Starting external process
args=/bin/systemctl is-active chronyd.service
Process finished, return code=0
stdout=active
stderr=
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd
[IPA Discovery]
Starting IPA discovery with domain=idm.eu.example.com, servers=None, hostname=e1-mybadclient.eu.example.com
Search for LDAP SRV record in idm.eu.example.com
Search DNS for SRV record of _ldap._tcp.idm.eu.example.com
DNS record found: 0 100 389 e1-ipaserver01.idm.eu.example.com.
DNS record found: 0 100 389 e1-ipaserver02.idm.eu.example.com.
[Kerberos realm search]
Search DNS for TXT record of _kerberos.idm.eu.example.com
DNS record found: "IDM.EU.example.COM"
Search DNS for SRV record of _kerberos._udp.idm.eu.example.com
DNS record found: 0 100 88 e1-ipaserver02.idm.eu.example.com.
DNS record found: 0 100 88 e1-ipaserver01.idm.eu.example.com.
[LDAP server check]
Verifying that e1-ipaserver01.idm.eu.example.com (realm IDM.EU.example.COM) is an IPA server
Init LDAP connection to: ldap://e1-ipaserver01.idm.eu.example.com:389
Search LDAP server for IPA base DN
Check if naming context 'dc=idm,dc=eu,dc=example,dc=com' is for IPA
Naming context 'dc=idm,dc=eu,dc=example,dc=com' is a valid IPA context
Search for (objectClass=krbRealmContainer) in dc=idm,dc=eu,dc=example,dc=com (sub)
Found: cn=IDM.EU.example.COM,cn=kerberos,dc=idm,dc=eu,dc=example,dc=com
Discovery result: Success; server=e1-ipaserver01.idm.eu.example.com, domain=idm.eu.example.com, kdc=e1-ipaserver02.idm.eu.example.com,e1-ipaserver01.idm.eu.example.com, basedn=dc=idm,dc=eu,dc=example,dc=com
Validated servers: e1-ipaserver01.idm.eu.example.com
will use discovered domain: idm.eu.example.com
Start searching for LDAP SRV record in "idm.eu.example.com" (Validating DNS Discovery) and its sub-domains
Search DNS for SRV record of _ldap._tcp.idm.eu.example.com
DNS record found: 0 100 389 e1-ipaserver01.idm.eu.example.com.
DNS record found: 0 100 389 e1-ipaserver02.idm.eu.example.com.
DNS validated, enabling discovery
will use discovered server: e1-ipaserver01.idm.eu.example.com
Discovery was successful!
will use discovered realm: IDM.EU.example.COM
will use discovered basedn: dc=idm,dc=eu,dc=example,dc=com
Client hostname: e1-mybadclient.eu.example.com
Hostname source: Machine's FQDN
Realm: IDM.EU.example.COM
Realm source: Discovered from LDAP DNS records in e1-ipaserver01.idm.eu.example.com
DNS Domain: idm.eu.example.com
DNS Domain source: Discovered LDAP SRV records from idm.eu.example.com
IPA Server: e1-ipaserver01.idm.eu.example.com
IPA Server source: Discovered from LDAP DNS records in e1-ipaserver01.idm.eu.example.com
BaseDN: dc=idm,dc=eu,dc=example,dc=com
BaseDN source: From IPA server ldap://e1-ipaserver01.idm.eu.example.com:389
Continue to configure the system with these values? [no]: yes
Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
Starting external process
args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r IDM.EU.example.COM
Process finished, return code=5
stdout=
stderr=realm not found
Skipping synchronizing time with NTP server.
User authorized to enroll computers: enroll
will use principal provided as option: enroll
Starting external process
args=/usr/bin/keyctl get_persistent @s 0
Process finished, return code=0
stdout=766555565
stderr=
Enabling persistent keyring CCACHE
Writing Kerberos configuration to /tmp/tmpeHx6Yl:
#File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
  default_realm = IDM.EU.example.COM
  dns_lookup_realm = false
  dns_lookup_kdc = false
  rdns = false
  dns_canonicalize_hostname = false
  ticket_lifetime = 24h
  forwardable = true
  udp_preference_limit = 0
  default_ccache_name = KEYRING:persistent:%{uid}
[realms]
  IDM.EU.example.COM = {
    kdc = e1-ipaserver01.idm.eu.example.com:88
    master_kdc = e1-ipaserver01.idm.eu.example.com:88
    admin_server = e1-ipaserver01.idm.eu.example.com:749
    kpasswd_server = e1-ipaserver01.idm.eu.example.com:464
    default_domain = idm.eu.example.com
    pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
  }
[domain_realm]
  .idm.eu.example.com = IDM.EU.example.COM
  idm.eu.example.com = IDM.EU.example.COM
  e1-mybadclient.eu.example.com = IDM.EU.example.COM
  .eu.example.com = IDM.EU.example.COM
  eu.example.com = IDM.EU.example.COM
Password for enroll@IDM.EU.example.COM: 
Initializing principal enroll@IDM.EU.example.COM using password
Starting external process
args=/usr/bin/kinit enroll@IDM.EU.example.COM -c /tmp/krbcctIoTrL/ccache
Process finished, return code=0
stdout=Password for enroll@IDM.EU.example.COM: 
stderr=
trying to retrieve CA cert via LDAP from e1-ipaserver01.idm.eu.example.com
retrieving schema for SchemaCache url=ldap://e1-ipaserver01.idm.eu.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f1b0f4b1170>
get_ca_certs_from_ldap() error: 'Name' object has no attribute 'rdns'
'Name' object has no attribute 'rdns'
Unable to download CA cert from LDAP.
Do you want to download the CA cert from http://e1-ipaserver01.idm.eu.example.com/ipa/config/ca.crt?
(this is INSECURE) [no]: yes
Downloading the CA certificate via HTTP, this is INSECURE
trying to retrieve CA cert via HTTP from http://e1-ipaserver01.idm.eu.example.com/ipa/config/ca.crt
Starting external process
args=/usr/bin/curl -o - http://e1-ipaserver01.idm.eu.example.com/ipa/config/ca.crt
Process finished, return code=0
stdout=-----BEGIN CERTIFICATE-----
some interesting characters here.
-----END CERTIFICATE-----
stderr=  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1651  100  1651    0     0   252k      0 --:--:-- --:--:-- --:--:--  268k
Cannot obtain CA certificate
'Name' object has no attribute 'rdns'
Installation failed. Rolling back changes.
Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
Starting external process
args=/usr/sbin/ipa-client-automount --uninstall --debug
Process finished, return code=1
stdout=
stderr=IPA client is not configured on this system
Unconfigured automount client failed: Command '/usr/sbin/ipa-client-automount --uninstall --debug' returned non-zero exit status 1
Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
Starting external process
args=/usr/bin/certutil -d dbm:/etc/ipa/nssdb -L -n Local IPA host -a -f /etc/ipa/nssdb/pwdfile.txt
Process finished, return code=255
stdout=
stderr=certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.
Starting external process
args=/usr/bin/certutil -d sql:/etc/pki/nssdb -L -n IPA Machine Certificate - e1-mybadclient.eu.example.com -a -f /etc/pki/nssdb/pwdfile.txt
Process finished, return code=255
stdout=
stderr=certutil: Could not find cert: IPA Machine Certificate - e1-mybadclient.eu.example.com
: PR_FILE_NOT_FOUND_ERROR: File not found
Starting external process
args=/bin/systemctl start certmonger.service
Process finished, return code=0
stdout=
stderr=
Starting external process
args=/bin/systemctl is-active certmonger.service
Process finished, return code=0
stdout=active
stderr=
Start of certmonger.service complete
Starting external process
args=/bin/systemctl stop certmonger.service
Process finished, return code=0
stdout=
stderr=
Stop of certmonger.service complete
Starting external process
args=/bin/systemctl disable certmonger.service
Process finished, return code=0
stdout=
stderr=
Disabling client Kerberos and LDAP configurations
Starting external process
args=/usr/sbin/authconfig --disablekrb5 --disablesssdauth --disablemkhomedir --update --disableldap
Process finished, return code=0
stdout=
stderr=
Error while moving /etc/sssd/sssd.conf to /etc/sssd/sssd.conf.deleted
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Starting external process
args=/bin/systemctl stop sssd.service
Process finished, return code=0
stdout=
stderr=
Stop of sssd.service complete
Starting external process
args=/bin/systemctl disable sssd.service
Process finished, return code=0
stdout=
stderr=
Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
Starting external process
args=/bin/systemctl disable rhel-domainname.service
Process finished, return code=0
stdout=
stderr=
Starting external process
args=/bin/systemctl list-unit-files --full
Process finished, return code=0
stdout=UNIT FILE                                     STATE   
proc-sys-fs-binfmt_misc.automount             static  
dev-hugepages.mount                           static  
dev-mqueue.mount                              static  
proc-fs-nfsd.mount                            static  
proc-sys-fs-binfmt_misc.mount                 static  
sys-fs-fuse-connections.mount                 static  
sys-kernel-config.mount                       static  
sys-kernel-debug.mount                        static  
tmp.mount                                     disabled
var-lib-nfs-rpc_pipefs.mount                  static  
brandbot.path                                 enabled 
systemd-ask-password-console.path             static  
systemd-ask-password-plymouth.path            static  
systemd-ask-password-wall.path                static  
session-7523.scope                            static  
session-8241.scope                            static  
session-8244.scope                            static  
session-8303.scope                            static  
session-8376.scope                            static  
session-8399.scope                            static  
session-8419.scope                            static  
session-8975.scope                            static  
session-9012.scope                            static  
session-9144.scope                            static  
abrt-ccpp.service                             enabled 
abrt-oops.service                             enabled 
abrt-pstoreoops.service                       disabled
abrt-vmcore.service                           enabled 
abrt-xorg.service                             enabled 
abrtd.service                                 enabled 
arp-ethers.service                            disabled
atd.service                                   disabled
auditd.service                                enabled 
auth-rpcgss-module.service                    static  
autofs.service                                disabled
autovt@.service                               enabled 
blk-availability.service                      disabled
brandbot.service                              static  
certmonger.service                            disabled
chrony-dnssrv@.service                        static  
chrony-wait.service                           disabled
chronyd.service                               disabled
console-getty.service                         disabled
console-shell.service                         disabled
container-getty@.service                      static  
cpupower.service                              disabled
crond.service                                 enabled 
dbus-org.freedesktop.hostname1.service        static  
dbus-org.freedesktop.import1.service          static  
dbus-org.freedesktop.locale1.service          static  
dbus-org.freedesktop.login1.service           static  
dbus-org.freedesktop.machine1.service         static  
dbus-org.freedesktop.timedate1.service        static  
dbus.service                                  static  
debug-shell.service                           disabled
dm-event.service                              static  
dmraid-activation.service                     enabled 
dnsmasq.service                               disabled
dracut-cmdline.service                        static  
dracut-initqueue.service                      static  
dracut-mount.service                          static  
dracut-pre-mount.service                      static  
dracut-pre-pivot.service                      static  
dracut-pre-trigger.service                    static  
dracut-pre-udev.service                       static  
dracut-shutdown.service                       static  
ds_agent.service                              enabled 
ds_nuagent.service                            disabled
ebtables.service                              disabled
emergency.service                             static  
epmd.service                                  disabled
epmd@.service                                 disabled
firewalld.service                             masked  
fprintd.service                               static  
fstrim.service                                static  
getty@.service                                enabled 
gssproxy.service                              disabled
halt-local.service                            static  
initrd-cleanup.service                        static  
initrd-parse-etc.service                      static  
initrd-switch-root.service                    static  
initrd-udevadm-cleanup-db.service             static  
iprdump.service                               disabled
iprinit.service                               disabled
iprupdate.service                             disabled
irqbalance.service                            enabled 
kdump.service                                 enabled 
kmod-static-nodes.service                     static  
kpatch.service                                disabled
libstoragemgmt.service                        enabled 
lvm2-lvmetad.service                          static  
lvm2-lvmpolld.service                         static  
lvm2-monitor.service                          enabled 
lvm2-pvscan@.service                          static  
mdadm-grow-continue@.service                  static  
mdadm-last-resort@.service                    static  
mdmon@.service                                static  
mdmonitor.service                             enabled 
messagebus.service                            static  
microcode.service                             enabled 
munin-node.service                            enabled 
NetworkManager-dispatcher.service             disabled
NetworkManager-wait-online.service            enabled 
NetworkManager.service                        disabled
nfs-blkmap.service                            disabled
nfs-config.service                            static  
nfs-idmap.service                             static  
nfs-idmapd.service                            static  
nfs-lock.service                              static  
nfs-mountd.service                            static  
nfs-rquotad.service                           disabled
nfs-secure.service                            static  
nfs-server.service                            disabled
nfs-utils.service                             static  
nfs.service                                   disabled
nfslock.service                               static  
nrpe.service                                  enabled 
nscd.service                                  enabled 
ntpd.service                                  enabled 
ntpdate.service                               disabled
oddjobd.service                               disabled
plymouth-halt.service                         disabled
plymouth-kexec.service                        disabled
plymouth-poweroff.service                     disabled
plymouth-quit-wait.service                    disabled
plymouth-quit.service                         disabled
plymouth-read-write.service                   disabled
plymouth-reboot.service                       disabled
plymouth-start.service                        disabled
plymouth-switch-root.service                  static  
polkit.service                                static  
postfix.service                               disabled
psacct.service                                disabled
quotaon.service                               static  
rabbitmq-server.service                       enabled 
rc-local.service                              static  
rdisc.service                                 disabled
rdma-load-modules@.service                    static  
rdma-ndd.service                              static  
rdma.service                                  disabled
rescue.service                                static  
rhel-autorelabel-mark.service                 enabled 
rhel-autorelabel.service                      enabled 
rhel-configure.service                        enabled 
rhel-dmesg.service                            enabled 
rhel-domainname.service                       disabled
rhel-import-state.service                     enabled 
rhel-loadmodules.service                      enabled 
rhel-readonly.service                         enabled 
rngd.service                                  enabled 
rpc-gssd.service                              static  
rpc-rquotad.service                           disabled
rpc-statd-notify.service                      static  
rpc-statd.service                             static  
rpcbind.service                               disabled
rpcgssd.service                               static  
rpcidmapd.service                             static  
rsyncd.service                                disabled
rsyncd@.service                               static  
rsyslog.service                               enabled 
saslauthd.service                             disabled
selinux-policy-migrate-local-changes@.service static  
sendmail.service                              enabled 
serial-getty@.service                         disabled
sm-client.service                             enabled 
smartd.service                                disabled
sshd-keygen.service                           static  
sshd.service                                  enabled 
sshd@.service                                 static  
sssd-autofs.service                           indirect
sssd-nss.service                              indirect
sssd-pac.service                              indirect
sssd-pam.service                              indirect
sssd-secrets.service                          indirect
sssd-ssh.service                              indirect
sssd-sudo.service                             indirect
sssd.service                                  disabled
sysstat.service                               enabled 
systemd-ask-password-console.service          static  
systemd-ask-password-plymouth.service         static  
systemd-ask-password-wall.service             static  
systemd-backlight@.service                    static  
systemd-binfmt.service                        static  
systemd-bootchart.service                     disabled
systemd-firstboot.service                     static  
systemd-fsck-root.service                     static  
systemd-fsck@.service                         static  
systemd-halt.service                          static  
systemd-hibernate-resume@.service             static  
systemd-hibernate.service                     static  
systemd-hostnamed.service                     static  
systemd-hwdb-update.service                   static  
systemd-hybrid-sleep.service                  static  
systemd-importd.service                       static  
systemd-initctl.service                       static  
systemd-journal-catalog-update.service        static  
systemd-journal-flush.service                 static  
systemd-journald.service                      static  
systemd-kexec.service                         static  
systemd-localed.service                       static  
systemd-logind.service                        static  
systemd-machine-id-commit.service             static  
systemd-machined.service                      static  
systemd-modules-load.service                  static  
systemd-nspawn@.service                       disabled
systemd-poweroff.service                      static  
systemd-quotacheck.service                    static  
systemd-random-seed.service                   static  
systemd-readahead-collect.service             enabled 
systemd-readahead-done.service                indirect
systemd-readahead-drop.service                enabled 
systemd-readahead-replay.service              enabled 
systemd-reboot.service                        static  
systemd-remount-fs.service                    static  
systemd-rfkill@.service                       static  
systemd-shutdownd.service                     static  
systemd-suspend.service                       static  
systemd-sysctl.service                        static  
systemd-timedated.service                     static  
systemd-tmpfiles-clean.service                static  
systemd-tmpfiles-setup-dev.service            static  
systemd-tmpfiles-setup.service                static  
systemd-udev-settle.service                   static  
systemd-udev-trigger.service                  static  
systemd-udevd.service                         static  
systemd-update-done.service                   static  
systemd-update-utmp-runlevel.service          static  
systemd-update-utmp.service                   static  
systemd-user-sessions.service                 static  
systemd-vconsole-setup.service                static  
tcsd.service                                  disabled
teamd@.service                                static  
tuned.service                                 enabled 
usb_modeswitch@.service                       static  
vgauthd.service                               disabled
vmtoolsd.service                              enabled 
wpa_supplicant.service                        disabled
xinetd.service                                enabled 
-.slice                                       static  
machine.slice                                 static  
system.slice                                  static  
user-0.slice                                  static  
user.slice                                    static  
dbus.socket                                   static  
dm-event.socket                               enabled 
epmd.socket                                   disabled
epmd@.socket                                  disabled
lvm2-lvmetad.socket                           enabled 
lvm2-lvmpolld.socket                          enabled 
nscd.socket                                   enabled 
rpcbind.socket                                enabled 
rsyncd.socket                                 disabled
sshd.socket                                   disabled
sssd-autofs.socket                            disabled
sssd-nss.socket                               disabled
sssd-pac.socket                               disabled
sssd-pam-priv.socket                          disabled
sssd-pam.socket                               disabled
sssd-secrets.socket                           disabled
sssd-ssh.socket                               disabled
sssd-sudo.socket                              disabled
syslog.socket                                 static  
systemd-initctl.socket                        static  
systemd-journald.socket                       static  
systemd-shutdownd.socket                      static  
systemd-udevd-control.socket                  static  
systemd-udevd-kernel.socket                   static  
basic.target                                  static  
bluetooth.target                              static  
cryptsetup-pre.target                         static  
cryptsetup.target                             static  
ctrl-alt-del.target                           disabled
default.target                                enabled 
emergency.target                              static  
final.target                                  static  
getty-pre.target                              static  
getty.target                                  static  
graphical.target                              static  
halt.target                                   disabled
hibernate.target                              static  
hybrid-sleep.target                           static  
initrd-fs.target                              static  
initrd-root-fs.target                         static  
initrd-switch-root.target                     static  
initrd.target                                 static  
iprutils.target                               disabled
kexec.target                                  disabled
local-fs-pre.target                           static  
local-fs.target                               static  
machines.target                               disabled
multi-user.target                             enabled 
network-online.target                         static  
network-pre.target                            static  
network.target                                static  
nfs-client.target                             enabled 
nss-lookup.target                             static  
nss-user-lookup.target                        static  
paths.target                                  static  
poweroff.target                               disabled
printer.target                                static  
rdma-hw.target                                static  
reboot.target                                 disabled
remote-cryptsetup.target                      disabled
remote-fs-pre.target                          static  
remote-fs.target                              enabled 
rescue.target                                 disabled
rpc_pipefs.target                             static  
rpcbind.target                                static  
runlevel0.target                              disabled
runlevel1.target                              disabled
runlevel2.target                              enabled 
runlevel3.target                              enabled 
runlevel4.target                              enabled 
runlevel5.target                              static  
runlevel6.target                              disabled
shutdown.target                               static  
sigpwr.target                                 static  
sleep.target                                  static  
slices.target                                 static  
smartcard.target                              static  
sockets.target                                static  
sound.target                                  static  
suspend.target                                static  
swap.target                                   static  
sysinit.target                                static  
system-update.target                          static  
time-sync.target                              static  
timers.target                                 static  
umount.target                                 static  
chrony-dnssrv@.timer                          disabled
fstrim.timer                                  disabled
mdadm-last-resort@.timer                      static  
systemd-readahead-done.timer                  indirect
systemd-tmpfiles-clean.timer                  static  
334 unit files listed.
stderr=
Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
Starting external process
args=/bin/systemctl list-unit-files --full
Process finished, return code=0
stdout=UNIT FILE                                     STATE   
proc-sys-fs-binfmt_misc.automount             static  
dev-hugepages.mount                           static  
dev-mqueue.mount                              static  
proc-fs-nfsd.mount                            static  
proc-sys-fs-binfmt_misc.mount                 static  
sys-fs-fuse-connections.mount                 static  
sys-kernel-config.mount                       static  
sys-kernel-debug.mount                        static  
tmp.mount                                     disabled
var-lib-nfs-rpc_pipefs.mount                  static  
brandbot.path                                 enabled 
systemd-ask-password-console.path             static  
systemd-ask-password-plymouth.path            static  
systemd-ask-password-wall.path                static  
session-7523.scope                            static  
session-8241.scope                            static  
session-8244.scope                            static  
session-8303.scope                            static  
session-8376.scope                            static  
session-8399.scope                            static  
session-8419.scope                            static  
session-8975.scope                            static  
session-9012.scope                            static  
session-9144.scope                            static  
abrt-ccpp.service                             enabled 
abrt-oops.service                             enabled 
abrt-pstoreoops.service                       disabled
abrt-vmcore.service                           enabled 
abrt-xorg.service                             enabled 
abrtd.service                                 enabled 
arp-ethers.service                            disabled
atd.service                                   disabled
auditd.service                                enabled 
auth-rpcgss-module.service                    static  
autofs.service                                disabled
autovt@.service                               enabled 
blk-availability.service                      disabled
brandbot.service                              static  
certmonger.service                            disabled
chrony-dnssrv@.service                        static  
chrony-wait.service                           disabled
chronyd.service                               disabled
console-getty.service                         disabled
console-shell.service                         disabled
container-getty@.service                      static  
cpupower.service                              disabled
crond.service                                 enabled 
dbus-org.freedesktop.hostname1.service        static  
dbus-org.freedesktop.import1.service          static  
dbus-org.freedesktop.locale1.service          static  
dbus-org.freedesktop.login1.service           static  
dbus-org.freedesktop.machine1.service         static  
dbus-org.freedesktop.timedate1.service        static  
dbus.service                                  static  
debug-shell.service                           disabled
dm-event.service                              static  
dmraid-activation.service                     enabled 
dnsmasq.service                               disabled
dracut-cmdline.service                        static  
dracut-initqueue.service                      static  
dracut-mount.service                          static  
dracut-pre-mount.service                      static  
dracut-pre-pivot.service                      static  
dracut-pre-trigger.service                    static  
dracut-pre-udev.service                       static  
dracut-shutdown.service                       static  
ds_agent.service                              enabled 
ds_nuagent.service                            disabled
ebtables.service                              disabled
emergency.service                             static  
epmd.service                                  disabled
epmd@.service                                 disabled
firewalld.service                             masked  
fprintd.service                               static  
fstrim.service                                static  
getty@.service                                enabled 
gssproxy.service                              disabled
halt-local.service                            static  
initrd-cleanup.service                        static  
initrd-parse-etc.service                      static  
initrd-switch-root.service                    static  
initrd-udevadm-cleanup-db.service             static  
iprdump.service                               disabled
iprinit.service                               disabled
iprupdate.service                             disabled
irqbalance.service                            enabled 
kdump.service                                 enabled 
kmod-static-nodes.service                     static  
kpatch.service                                disabled
libstoragemgmt.service                        enabled 
lvm2-lvmetad.service                          static  
lvm2-lvmpolld.service                         static  
lvm2-monitor.service                          enabled 
lvm2-pvscan@.service                          static  
mdadm-grow-continue@.service                  static  
mdadm-last-resort@.service                    static  
mdmon@.service                                static  
mdmonitor.service                             enabled 
messagebus.service                            static  
microcode.service                             enabled 
munin-node.service                            enabled 
NetworkManager-dispatcher.service             disabled
NetworkManager-wait-online.service            enabled 
NetworkManager.service                        disabled
nfs-blkmap.service                            disabled
nfs-config.service                            static  
nfs-idmap.service                             static  
nfs-idmapd.service                            static  
nfs-lock.service                              static  
nfs-mountd.service                            static  
nfs-rquotad.service                           disabled
nfs-secure.service                            static  
nfs-server.service                            disabled
nfs-utils.service                             static  
nfs.service                                   disabled
nfslock.service                               static  
nrpe.service                                  enabled 
nscd.service                                  enabled 
ntpd.service                                  enabled 
ntpdate.service                               disabled
oddjobd.service                               disabled
plymouth-halt.service                         disabled
plymouth-kexec.service                        disabled
plymouth-poweroff.service                     disabled
plymouth-quit-wait.service                    disabled
plymouth-quit.service                         disabled
plymouth-read-write.service                   disabled
plymouth-reboot.service                       disabled
plymouth-start.service                        disabled
plymouth-switch-root.service                  static  
polkit.service                                static  
postfix.service                               disabled
psacct.service                                disabled
quotaon.service                               static  
rabbitmq-server.service                       enabled 
rc-local.service                              static  
rdisc.service                                 disabled
rdma-load-modules@.service                    static  
rdma-ndd.service                              static  
rdma.service                                  disabled
rescue.service                                static  
rhel-autorelabel-mark.service                 enabled 
rhel-autorelabel.service                      enabled 
rhel-configure.service                        enabled 
rhel-dmesg.service                            enabled 
rhel-domainname.service                       disabled
rhel-import-state.service                     enabled 
rhel-loadmodules.service                      enabled 
rhel-readonly.service                         enabled 
rngd.service                                  enabled 
rpc-gssd.service                              static  
rpc-rquotad.service                           disabled
rpc-statd-notify.service                      static  
rpc-statd.service                             static  
rpcbind.service                               disabled
rpcgssd.service                               static  
rpcidmapd.service                             static  
rsyncd.service                                disabled
rsyncd@.service                               static  
rsyslog.service                               enabled 
saslauthd.service                             disabled
selinux-policy-migrate-local-changes@.service static  
sendmail.service                              enabled 
serial-getty@.service                         disabled
sm-client.service                             enabled 
smartd.service                                disabled
sshd-keygen.service                           static  
sshd.service                                  enabled 
sshd@.service                                 static  
sssd-autofs.service                           indirect
sssd-nss.service                              indirect
sssd-pac.service                              indirect
sssd-pam.service                              indirect
sssd-secrets.service                          indirect
sssd-ssh.service                              indirect
sssd-sudo.service                             indirect
sssd.service                                  disabled
sysstat.service                               enabled 
systemd-ask-password-console.service          static  
systemd-ask-password-plymouth.service         static  
systemd-ask-password-wall.service             static  
systemd-backlight@.service                    static  
systemd-binfmt.service                        static  
systemd-bootchart.service                     disabled
systemd-firstboot.service                     static  
systemd-fsck-root.service                     static  
systemd-fsck@.service                         static  
systemd-halt.service                          static  
systemd-hibernate-resume@.service             static  
systemd-hibernate.service                     static  
systemd-hostnamed.service                     static  
systemd-hwdb-update.service                   static  
systemd-hybrid-sleep.service                  static  
systemd-importd.service                       static  
systemd-initctl.service                       static  
systemd-journal-catalog-update.service        static  
systemd-journal-flush.service                 static  
systemd-journald.service                      static  
systemd-kexec.service                         static  
systemd-localed.service                       static  
systemd-logind.service                        static  
systemd-machine-id-commit.service             static  
systemd-machined.service                      static  
systemd-modules-load.service                  static  
systemd-nspawn@.service                       disabled
systemd-poweroff.service                      static  
systemd-quotacheck.service                    static  
systemd-random-seed.service                   static  
systemd-readahead-collect.service             enabled 
systemd-readahead-done.service                indirect
systemd-readahead-drop.service                enabled 
systemd-readahead-replay.service              enabled 
systemd-reboot.service                        static  
systemd-remount-fs.service                    static  
systemd-rfkill@.service                       static  
systemd-shutdownd.service                     static  
systemd-suspend.service                       static  
systemd-sysctl.service                        static  
systemd-timedated.service                     static  
systemd-tmpfiles-clean.service                static  
systemd-tmpfiles-setup-dev.service            static  
systemd-tmpfiles-setup.service                static  
systemd-udev-settle.service                   static  
systemd-udev-trigger.service                  static  
systemd-udevd.service                         static  
systemd-update-done.service                   static  
systemd-update-utmp-runlevel.service          static  
systemd-update-utmp.service                   static  
systemd-user-sessions.service                 static  
systemd-vconsole-setup.service                static  
tcsd.service                                  disabled
teamd@.service                                static  
tuned.service                                 enabled 
usb_modeswitch@.service                       static  
vgauthd.service                               disabled
vmtoolsd.service                              enabled 
wpa_supplicant.service                        disabled
xinetd.service                                enabled 
-.slice                                       static  
machine.slice                                 static  
system.slice                                  static  
user-0.slice                                  static  
user.slice                                    static  
dbus.socket                                   static  
dm-event.socket                               enabled 
epmd.socket                                   disabled
epmd@.socket                                  disabled
lvm2-lvmetad.socket                           enabled 
lvm2-lvmpolld.socket                          enabled 
nscd.socket                                   enabled 
rpcbind.socket                                enabled 
rsyncd.socket                                 disabled
sshd.socket                                   disabled
sssd-autofs.socket                            disabled
sssd-nss.socket                               disabled
sssd-pac.socket                               disabled
sssd-pam-priv.socket                          disabled
sssd-pam.socket                               disabled
sssd-secrets.socket                           disabled
sssd-ssh.socket                               disabled
sssd-sudo.socket                              disabled
syslog.socket                                 static  
systemd-initctl.socket                        static  
systemd-journald.socket                       static  
systemd-shutdownd.socket                      static  
systemd-udevd-control.socket                  static  
systemd-udevd-kernel.socket                   static  
basic.target                                  static  
bluetooth.target                              static  
cryptsetup-pre.target                         static  
cryptsetup.target                             static  
ctrl-alt-del.target                           disabled
default.target                                enabled 
emergency.target                              static  
final.target                                  static  
getty-pre.target                              static  
getty.target                                  static  
graphical.target                              static  
halt.target                                   disabled
hibernate.target                              static  
hybrid-sleep.target                           static  
initrd-fs.target                              static  
initrd-root-fs.target                         static  
initrd-switch-root.target                     static  
initrd.target                                 static  
iprutils.target                               disabled
kexec.target                                  disabled
local-fs-pre.target                           static  
local-fs.target                               static  
machines.target                               disabled
multi-user.target                             enabled 
network-online.target                         static  
network-pre.target                            static  
network.target                                static  
nfs-client.target                             enabled 
nss-lookup.target                             static  
nss-user-lookup.target                        static  
paths.target                                  static  
poweroff.target                               disabled
printer.target                                static  
rdma-hw.target                                static  
reboot.target                                 disabled
remote-cryptsetup.target                      disabled
remote-fs-pre.target                          static  
remote-fs.target                              enabled 
rescue.target                                 disabled
rpc_pipefs.target                             static  
rpcbind.target                                static  
runlevel0.target                              disabled
runlevel1.target                              disabled
runlevel2.target                              enabled 
runlevel3.target                              enabled 
runlevel4.target                              enabled 
runlevel5.target                              static  
runlevel6.target                              disabled
shutdown.target                               static  
sigpwr.target                                 static  
sleep.target                                  static  
slices.target                                 static  
smartcard.target                              static  
sockets.target                                static  
sound.target                                  static  
suspend.target                                static  
swap.target                                   static  
sysinit.target                                static  
system-update.target                          static  
time-sync.target                              static  
timers.target                                 static  
umount.target                                 static  
chrony-dnssrv@.timer                          disabled
fstrim.timer                                  disabled
mdadm-last-resort@.timer                      static  
systemd-readahead-done.timer                  indirect
systemd-tmpfiles-clean.timer                  static  
334 unit files listed.
stderr=
nslcd daemon is not installed, skip configuration
Client uninstall complete.
  File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
    return cfgr.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run
    return self.execute()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute
    for rval in self._executor():
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure
    next(executor)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
    for unused in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3670, in main
    install(self)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2391, in install
    _install(options)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2598, in _install
    raise ScriptError(rval=CLIENT_INSTALL_ERROR)
The ipa-client-install command failed, exception: ScriptError: 
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

Log snippet from IPA server during enrolment phase.

[09/Aug/2022:09:17:33.021877936 +0000] conn=194350 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI
[09/Aug/2022:09:17:33.026505173 +0000] conn=194350 op=0 RESULT err=14 tag=97 nentries=0 wtime=0.000378586 optime=0.004638474 etime=0.005015295, SASL bind in progress
[09/Aug/2022:09:17:33.026930535 +0000] conn=194350 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI
[09/Aug/2022:09:17:33.027804092 +0000] conn=194350 op=1 RESULT err=14 tag=97 nentries=0 wtime=0.000032968 optime=0.000876631 etime=0.000908711, SASL bind in progress
[09/Aug/2022:09:17:33.028196333 +0000] conn=194350 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI
[09/Aug/2022:09:17:33.029789053 +0000] conn=194350 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000096291 optime=0.001598291 etime=0.001692348 dn="uid=enroll,cn=users,cn=accounts,dc=idm,dc=eu,dc=example,dc=com"
[09/Aug/2022:09:17:33.030472239 +0000] conn=194350 op=3 SRCH base="cn=certificates,cn=ipa,cn=etc,dc=idm,dc=eu,dc=example,dc=com" scope=2 filter="(&(objectClass=ipaCertificate)(objectClass=pkiCA))" attrs="ipaKeyExtUsage cn ipaCertSubject ipaPublicKey cacertificate;binary ipaKeyTrust ipaCertIssuerSerial"
[09/Aug/2022:09:17:33.031341146 +0000] conn=194350 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000188137 optime=0.000871061 etime=0.001056244
[09/Aug/2022:09:17:33.032111490 +0000] conn=194350 op=4 SRCH base="cn=schema" scope=0 filter="(objectClass=*)" attrs="attributeTypes objectClasses"
[09/Aug/2022:09:17:33.105504564 +0000] conn=194350 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000131565 optime=0.073396519 etime=0.073525774
[09/Aug/2022:09:17:33.251370185 +0000] conn=194350 op=5 UNBIND
[09/Aug/2022:09:17:33.251397191 +0000] conn=194350 op=5 fd=233 closed error - U1

Can you provide the client install log file /var/log/ipaclient-install.log? There is more info than in the debug output.
What is the content of /etc/openldap/ldap.conf before the client install is launched?

ipaclient-install.log

[root@e1-mybadclient02 ~]# cat /var/log/ipaclient-install.log 
2022-08-09T09:43:06Z DEBUG Logging to /var/log/ipaclient-install.log
2022-08-09T09:43:06Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': True, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': None, 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': None, 'keytab': None, 'no_ntp': False, 'domain_name': 'idm.eu.example.com', 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': None, 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': False, 'firefox_dir': None, 'unattended': False, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': False, 'log_file': None, 'uninstall': False}
2022-08-09T09:43:06Z DEBUG IPA version 4.6.8-5.el7.centos.11
2022-08-09T09:43:06Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2022-08-09T09:43:06Z DEBUG Starting external process
2022-08-09T09:43:06Z DEBUG args=/usr/sbin/selinuxenabled
2022-08-09T09:43:06Z DEBUG Process finished, return code=1
2022-08-09T09:43:06Z DEBUG stdout=
2022-08-09T09:43:06Z DEBUG stderr=
2022-08-09T09:43:06Z DEBUG Starting external process
2022-08-09T09:43:06Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2022-08-09T09:43:06Z DEBUG Process finished, return code=1
2022-08-09T09:43:06Z DEBUG stdout=disabled
2022-08-09T09:43:06Z DEBUG stderr=
2022-08-09T09:43:06Z DEBUG Starting external process
2022-08-09T09:43:06Z DEBUG args=/bin/systemctl is-active chronyd.service
2022-08-09T09:43:06Z DEBUG Process finished, return code=0
2022-08-09T09:43:06Z DEBUG stdout=active
2022-08-09T09:43:06Z DEBUG stderr=
2022-08-09T09:43:06Z DEBUG [IPA Discovery]
2022-08-09T09:43:06Z DEBUG Starting IPA discovery with domain=idm.eu.example.com, servers=None, hostname=e1-mybadclient02.eu.example.com
2022-08-09T09:43:06Z DEBUG Search for LDAP SRV record in idm.eu.example.com
2022-08-09T09:43:06Z DEBUG Search DNS for SRV record of _ldap._tcp.idm.eu.example.com
2022-08-09T09:43:06Z DEBUG DNS record found: 0 100 389 e1-ipaserver01.idm.eu.example.com.
2022-08-09T09:43:06Z DEBUG DNS record found: 0 100 389 e1-ipaserver02.idm.eu.example.com.
2022-08-09T09:43:06Z DEBUG [Kerberos realm search]
2022-08-09T09:43:06Z DEBUG Search DNS for TXT record of _kerberos.idm.eu.example.com
2022-08-09T09:43:06Z DEBUG DNS record found: "IDM.EU.example.COM"
2022-08-09T09:43:06Z DEBUG Search DNS for SRV record of _kerberos._udp.idm.eu.example.com
2022-08-09T09:43:06Z DEBUG DNS record found: 0 100 88 e1-ipaserver02.idm.eu.example.com.
2022-08-09T09:43:06Z DEBUG DNS record found: 0 100 88 e1-ipaserver01.idm.eu.example.com.
2022-08-09T09:43:06Z DEBUG [LDAP server check]
2022-08-09T09:43:06Z DEBUG Verifying that e1-ipaserver01.idm.eu.example.com (realm IDM.EU.example.COM) is an IPA server
2022-08-09T09:43:06Z DEBUG Init LDAP connection to: ldap://e1-ipaserver01.idm.eu.example.com:389
2022-08-09T09:43:06Z DEBUG Search LDAP server for IPA base DN
2022-08-09T09:43:06Z DEBUG Check if naming context 'dc=idm,dc=eu,dc=example,dc=com' is for IPA
2022-08-09T09:43:06Z DEBUG Naming context 'dc=idm,dc=eu,dc=example,dc=com' is a valid IPA context
2022-08-09T09:43:06Z DEBUG Search for (objectClass=krbRealmContainer) in dc=idm,dc=eu,dc=example,dc=com (sub)
2022-08-09T09:43:06Z DEBUG Found: cn=IDM.EU.example.COM,cn=kerberos,dc=idm,dc=eu,dc=example,dc=com
2022-08-09T09:43:06Z DEBUG Discovery result: Success; server=e1-ipaserver01.idm.eu.example.com, domain=idm.eu.example.com, kdc=e1-ipaserver02.idm.eu.example.com,e1-ipaserver01.idm.eu.example.com, basedn=dc=idm,dc=eu,dc=example,dc=com
2022-08-09T09:43:06Z DEBUG Validated servers: e1-ipaserver01.idm.eu.example.com
2022-08-09T09:43:06Z DEBUG will use discovered domain: idm.eu.example.com
2022-08-09T09:43:06Z DEBUG Start searching for LDAP SRV record in "idm.eu.example.com" (Validating DNS Discovery) and its sub-domains
2022-08-09T09:43:06Z DEBUG Search DNS for SRV record of _ldap._tcp.idm.eu.example.com
2022-08-09T09:43:06Z DEBUG DNS record found: 0 100 389 e1-ipaserver02.idm.eu.example.com.
2022-08-09T09:43:06Z DEBUG DNS record found: 0 100 389 e1-ipaserver01.idm.eu.example.com.
2022-08-09T09:43:06Z DEBUG DNS validated, enabling discovery
2022-08-09T09:43:06Z DEBUG will use discovered server: e1-ipaserver01.idm.eu.example.com
2022-08-09T09:43:06Z INFO Discovery was successful!
2022-08-09T09:43:06Z DEBUG will use discovered realm: IDM.EU.example.COM
2022-08-09T09:43:06Z DEBUG will use discovered basedn: dc=idm,dc=eu,dc=example,dc=com
2022-08-09T09:43:06Z INFO Client hostname: e1-mybadclient02.eu.example.com
2022-08-09T09:43:06Z DEBUG Hostname source: Machine's FQDN
2022-08-09T09:43:06Z INFO Realm: IDM.EU.example.COM
2022-08-09T09:43:06Z DEBUG Realm source: Discovered from LDAP DNS records in e1-ipaserver01.idm.eu.example.com
2022-08-09T09:43:06Z INFO DNS Domain: idm.eu.example.com
2022-08-09T09:43:06Z DEBUG DNS Domain source: Discovered LDAP SRV records from idm.eu.example.com
2022-08-09T09:43:06Z INFO IPA Server: e1-ipaserver01.idm.eu.example.com
2022-08-09T09:43:06Z DEBUG IPA Server source: Discovered from LDAP DNS records in e1-ipaserver01.idm.eu.example.com
2022-08-09T09:43:06Z INFO BaseDN: dc=idm,dc=eu,dc=example,dc=com
2022-08-09T09:43:06Z DEBUG BaseDN source: From IPA server ldap://e1-ipaserver01.idm.eu.example.com:389
2022-08-09T09:43:10Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2022-08-09T09:43:10Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2022-08-09T09:43:10Z DEBUG Starting external process
2022-08-09T09:43:10Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r IDM.EU.example.COM
2022-08-09T09:43:10Z DEBUG Process finished, return code=5
2022-08-09T09:43:10Z DEBUG stdout=
2022-08-09T09:43:10Z DEBUG stderr=realm not found
2022-08-09T09:43:10Z INFO Skipping synchronizing time with NTP server.
2022-08-09T09:43:15Z DEBUG will use principal provided as option: enroll
2022-08-09T09:43:15Z DEBUG Starting external process
2022-08-09T09:43:15Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
2022-08-09T09:43:15Z DEBUG Process finished, return code=0
2022-08-09T09:43:15Z DEBUG stdout=766555565
2022-08-09T09:43:15Z DEBUG stderr=
2022-08-09T09:43:15Z DEBUG Enabling persistent keyring CCACHE
2022-08-09T09:43:15Z DEBUG Writing Kerberos configuration to /tmp/tmpwGIIZr:
2022-08-09T09:43:15Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
  default_realm = IDM.EU.example.COM
  dns_lookup_realm = false
  dns_lookup_kdc = false
  rdns = false
  dns_canonicalize_hostname = false
  ticket_lifetime = 24h
  forwardable = true
  udp_preference_limit = 0
  default_ccache_name = KEYRING:persistent:%{uid}
[realms]
  IDM.EU.example.COM = {
    kdc = e1-ipaserver01.idm.eu.example.com:88
    master_kdc = e1-ipaserver01.idm.eu.example.com:88
    admin_server = e1-ipaserver01.idm.eu.example.com:749
    kpasswd_server = e1-ipaserver01.idm.eu.example.com:464
    default_domain = idm.eu.example.com
    pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
  }
[domain_realm]
  .idm.eu.example.com = IDM.EU.example.COM
  idm.eu.example.com = IDM.EU.example.COM
  e1-mybadclient02.eu.example.com = IDM.EU.example.COM
  .eu.example.com = IDM.EU.example.COM
  eu.example.com = IDM.EU.example.COM
2022-08-09T09:43:22Z DEBUG Initializing principal enroll@IDM.EU.example.COM using password
2022-08-09T09:43:22Z DEBUG Starting external process
2022-08-09T09:43:22Z DEBUG args=/usr/bin/kinit enroll@IDM.EU.example.COM -c /tmp/krbcc5tx4s8/ccache
2022-08-09T09:43:22Z DEBUG Process finished, return code=0
2022-08-09T09:43:22Z DEBUG stdout=Password for enroll@IDM.EU.example.COM: 
2022-08-09T09:43:22Z DEBUG stderr=
2022-08-09T09:43:22Z DEBUG trying to retrieve CA cert via LDAP from e1-ipaserver01.idm.eu.example.com
2022-08-09T09:43:22Z DEBUG retrieving schema for SchemaCache url=ldap://e1-ipaserver01.idm.eu.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f8d495f5170>
2022-08-09T09:43:22Z DEBUG get_ca_certs_from_ldap() error: 'Name' object has no attribute 'rdns'
2022-08-09T09:43:22Z DEBUG 'Name' object has no attribute 'rdns'
2022-08-09T09:43:30Z WARNING Downloading the CA certificate via HTTP, this is INSECURE
2022-08-09T09:43:30Z DEBUG trying to retrieve CA cert via HTTP from http://e1-ipaserver01.idm.eu.example.com/ipa/config/ca.crt
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/usr/bin/curl -o - http://e1-ipaserver01.idm.eu.example.com/ipa/config/ca.crt
2022-08-09T09:43:30Z DEBUG Process finished, return code=0
2022-08-09T09:43:30Z DEBUG stdout=-----BEGIN CERTIFICATE-----
some interesting characters here.
-----END CERTIFICATE-----
2022-08-09T09:43:30Z DEBUG stderr=  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1651  100  1651    0     0   289k      0 --:--:-- --:--:-- --:--:--  322k
2022-08-09T09:43:30Z ERROR Cannot obtain CA certificate
'Name' object has no attribute 'rdns'
2022-08-09T09:43:30Z ERROR Installation failed. Rolling back changes.
2022-08-09T09:43:30Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2022-08-09T09:43:30Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/usr/sbin/ipa-client-automount --uninstall --debug
2022-08-09T09:43:30Z DEBUG Process finished, return code=1
2022-08-09T09:43:30Z DEBUG stdout=
2022-08-09T09:43:30Z DEBUG stderr=IPA client is not configured on this system
2022-08-09T09:43:30Z ERROR Unconfigured automount client failed: Command '/usr/sbin/ipa-client-automount --uninstall --debug' returned non-zero exit status 1
2022-08-09T09:43:30Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2022-08-09T09:43:30Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/usr/bin/certutil -d dbm:/etc/ipa/nssdb -L -n Local IPA host -a -f /etc/ipa/nssdb/pwdfile.txt
2022-08-09T09:43:30Z DEBUG Process finished, return code=255
2022-08-09T09:43:30Z DEBUG stdout=
2022-08-09T09:43:30Z DEBUG stderr=certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/usr/bin/certutil -d sql:/etc/pki/nssdb -L -n IPA Machine Certificate - e1-mybadclient02.eu.example.com -a -f /etc/pki/nssdb/pwdfile.txt
2022-08-09T09:43:30Z DEBUG Process finished, return code=255
2022-08-09T09:43:30Z DEBUG stdout=
2022-08-09T09:43:30Z DEBUG stderr=certutil: Could not find cert: IPA Machine Certificate - e1-mybadclient02.eu.example.com
: PR_FILE_NOT_FOUND_ERROR: File not found
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/bin/systemctl start certmonger.service
2022-08-09T09:43:30Z DEBUG Process finished, return code=0
2022-08-09T09:43:30Z DEBUG stdout=
2022-08-09T09:43:30Z DEBUG stderr=
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/bin/systemctl is-active certmonger.service
2022-08-09T09:43:30Z DEBUG Process finished, return code=0
2022-08-09T09:43:30Z DEBUG stdout=active
2022-08-09T09:43:30Z DEBUG stderr=
2022-08-09T09:43:30Z DEBUG Start of certmonger.service complete
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/bin/systemctl stop certmonger.service
2022-08-09T09:43:30Z DEBUG Process finished, return code=0
2022-08-09T09:43:30Z DEBUG stdout=
2022-08-09T09:43:30Z DEBUG stderr=
2022-08-09T09:43:30Z DEBUG Stop of certmonger.service complete
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/bin/systemctl disable certmonger.service
2022-08-09T09:43:31Z DEBUG Process finished, return code=0
2022-08-09T09:43:31Z DEBUG stdout=
2022-08-09T09:43:31Z DEBUG stderr=
2022-08-09T09:43:31Z INFO Disabling client Kerberos and LDAP configurations
2022-08-09T09:43:31Z DEBUG Starting external process
2022-08-09T09:43:31Z DEBUG args=/usr/sbin/authconfig --disablekrb5 --disablesssdauth --disablemkhomedir --update --disableldap
2022-08-09T09:43:31Z DEBUG Process finished, return code=0
2022-08-09T09:43:31Z DEBUG stdout=
2022-08-09T09:43:31Z DEBUG stderr=
2022-08-09T09:43:31Z DEBUG Error while moving /etc/sssd/sssd.conf to /etc/sssd/sssd.conf.deleted
2022-08-09T09:43:31Z INFO Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
2022-08-09T09:43:31Z DEBUG Starting external process
2022-08-09T09:43:31Z DEBUG args=/bin/systemctl stop sssd.service
2022-08-09T09:43:31Z DEBUG Process finished, return code=0
2022-08-09T09:43:31Z DEBUG stdout=
2022-08-09T09:43:31Z DEBUG stderr=
2022-08-09T09:43:31Z DEBUG Stop of sssd.service complete
2022-08-09T09:43:31Z DEBUG Starting external process
2022-08-09T09:43:31Z DEBUG args=/bin/systemctl disable sssd.service
2022-08-09T09:43:31Z DEBUG Process finished, return code=0
2022-08-09T09:43:31Z DEBUG stdout=
2022-08-09T09:43:31Z DEBUG stderr=
2022-08-09T09:43:31Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2022-08-09T09:43:31Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2022-08-09T09:43:31Z DEBUG Starting external process
2022-08-09T09:43:31Z DEBUG args=/bin/systemctl disable rhel-domainname.service
2022-08-09T09:43:31Z DEBUG Process finished, return code=0
2022-08-09T09:43:31Z DEBUG stdout=
2022-08-09T09:43:31Z DEBUG stderr=
2022-08-09T09:43:31Z DEBUG Starting external process
2022-08-09T09:43:31Z DEBUG args=/bin/systemctl list-unit-files --full
2022-08-09T09:43:31Z DEBUG Process finished, return code=0
2022-08-09T09:43:31Z DEBUG stdout=UNIT FILE                                     STATE   
proc-sys-fs-binfmt_misc.automount             static  
dev-hugepages.mount                           static  
dev-mqueue.mount                              static  
proc-fs-nfsd.mount                            static  
proc-sys-fs-binfmt_misc.mount                 static  
sys-fs-fuse-connections.mount                 static  
sys-kernel-config.mount                       static  
sys-kernel-debug.mount                        static  
tmp.mount                                     disabled
var-lib-nfs-rpc_pipefs.mount                  static  
brandbot.path                                 enabled 
systemd-ask-password-console.path             static  
systemd-ask-password-plymouth.path            static  
systemd-ask-password-wall.path                static  
session-7523.scope                            static  
session-8241.scope                            static  
session-8244.scope                            static  
session-8303.scope                            static  
session-8376.scope                            static  
session-8399.scope                            static  
session-8419.scope                            static  
session-8975.scope                            static  
session-9012.scope                            static  
session-9144.scope                            static  
abrt-ccpp.service                             enabled 
abrt-oops.service                             enabled 
abrt-pstoreoops.service                       disabled
abrt-vmcore.service                           enabled 
abrt-xorg.service                             enabled 
abrtd.service                                 enabled 
arp-ethers.service                            disabled
atd.service                                   disabled
auditd.service                                enabled 
auth-rpcgss-module.service                    static  
autofs.service                                disabled
autovt@.service                               enabled 
blk-availability.service                      disabled
brandbot.service                              static  
certmonger.service                            disabled
chrony-dnssrv@.service                        static  
chrony-wait.service                           disabled
chronyd.service                               disabled
console-getty.service                         disabled
console-shell.service                         disabled
container-getty@.service                      static  
cpupower.service                              disabled
crond.service                                 enabled 
dbus-org.freedesktop.hostname1.service        static  
dbus-org.freedesktop.import1.service          static  
dbus-org.freedesktop.locale1.service          static  
dbus-org.freedesktop.login1.service           static  
dbus-org.freedesktop.machine1.service         static  
dbus-org.freedesktop.timedate1.service        static  
dbus.service                                  static  
debug-shell.service                           disabled
dm-event.service                              static  
dmraid-activation.service                     enabled 
dnsmasq.service                               disabled
dracut-cmdline.service                        static  
dracut-initqueue.service                      static  
dracut-mount.service                          static  
dracut-pre-mount.service                      static  
dracut-pre-pivot.service                      static  
dracut-pre-trigger.service                    static  
dracut-pre-udev.service                       static  
dracut-shutdown.service                       static  
ds_agent.service                              enabled 
ds_nuagent.service                            disabled
ebtables.service                              disabled
emergency.service                             static  
epmd.service                                  disabled
epmd@.service                                 disabled
firewalld.service                             masked  
fprintd.service                               static  
fstrim.service                                static  
getty@.service                                enabled 
gssproxy.service                              disabled
halt-local.service                            static  
initrd-cleanup.service                        static  
initrd-parse-etc.service                      static  
initrd-switch-root.service                    static  
initrd-udevadm-cleanup-db.service             static  
iprdump.service                               disabled
iprinit.service                               disabled
iprupdate.service                             disabled
irqbalance.service                            enabled 
kdump.service                                 enabled 
kmod-static-nodes.service                     static  
kpatch.service                                disabled
libstoragemgmt.service                        enabled 
lvm2-lvmetad.service                          static  
lvm2-lvmpolld.service                         static  
lvm2-monitor.service                          enabled 
lvm2-pvscan@.service                          static  
mdadm-grow-continue@.service                  static  
mdadm-last-resort@.service                    static  
mdmon@.service                                static  
mdmonitor.service                             enabled 
messagebus.service                            static  
microcode.service                             enabled 
munin-node.service                            enabled 
NetworkManager-dispatcher.service             disabled
NetworkManager-wait-online.service            enabled 
NetworkManager.service                        disabled
nfs-blkmap.service                            disabled
nfs-config.service                            static  
nfs-idmap.service                             static  
nfs-idmapd.service                            static  
nfs-lock.service                              static  
nfs-mountd.service                            static  
nfs-rquotad.service                           disabled
nfs-secure.service                            static  
nfs-server.service                            disabled
nfs-utils.service                             static  
nfs.service                                   disabled
nfslock.service                               static  
nrpe.service                                  enabled 
nscd.service                                  enabled 
ntpd.service                                  enabled 
ntpdate.service                               disabled
oddjobd.service                               disabled
plymouth-halt.service                         disabled
plymouth-kexec.service                        disabled
plymouth-poweroff.service                     disabled
plymouth-quit-wait.service                    disabled
plymouth-quit.service                         disabled
plymouth-read-write.service                   disabled
plymouth-reboot.service                       disabled
plymouth-start.service                        disabled
plymouth-switch-root.service                  static  
polkit.service                                static  
postfix.service                               disabled
psacct.service                                disabled
quotaon.service                               static  
rabbitmq-server.service                       enabled 
rc-local.service                              static  
rdisc.service                                 disabled
rdma-load-modules@.service                    static  
rdma-ndd.service                              static  
rdma.service                                  disabled
rescue.service                                static  
rhel-autorelabel-mark.service                 enabled 
rhel-autorelabel.service                      enabled 
rhel-configure.service                        enabled 
rhel-dmesg.service                            enabled 
rhel-domainname.service                       disabled
rhel-import-state.service                     enabled 
rhel-loadmodules.service                      enabled 
rhel-readonly.service                         enabled 
rngd.service                                  enabled 
rpc-gssd.service                              static  
rpc-rquotad.service                           disabled
rpc-statd-notify.service                      static  
rpc-statd.service                             static  
rpcbind.service                               disabled
rpcgssd.service                               static  
rpcidmapd.service                             static  
rsyncd.service                                disabled
rsyncd@.service                               static  
rsyslog.service                               enabled 
saslauthd.service                             disabled
selinux-policy-migrate-local-changes@.service static  
sendmail.service                              enabled 
serial-getty@.service                         disabled
sm-client.service                             enabled 
smartd.service                                disabled
sshd-keygen.service                           static  
sshd.service                                  enabled 
sshd@.service                                 static  
sssd-autofs.service                           indirect
sssd-nss.service                              indirect
sssd-pac.service                              indirect
sssd-pam.service                              indirect
sssd-secrets.service                          indirect
sssd-ssh.service                              indirect
sssd-sudo.service                             indirect
sssd.service                                  disabled
sysstat.service                               enabled 
systemd-ask-password-console.service          static  
systemd-ask-password-plymouth.service         static  
systemd-ask-password-wall.service             static  
systemd-backlight@.service                    static  
systemd-binfmt.service                        static  
systemd-bootchart.service                     disabled
systemd-firstboot.service                     static  
systemd-fsck-root.service                     static  
systemd-fsck@.service                         static  
systemd-halt.service                          static  
systemd-hibernate-resume@.service             static  
systemd-hibernate.service                     static  
systemd-hostnamed.service                     static  
systemd-hwdb-update.service                   static  
systemd-hybrid-sleep.service                  static  
systemd-importd.service                       static  
systemd-initctl.service                       static  
systemd-journal-catalog-update.service        static  
systemd-journal-flush.service                 static  
systemd-journald.service                      static  
systemd-kexec.service                         static  
systemd-localed.service                       static  
systemd-logind.service                        static  
systemd-machine-id-commit.service             static  
systemd-machined.service                      static  
systemd-modules-load.service                  static  
systemd-nspawn@.service                       disabled
systemd-poweroff.service                      static  
systemd-quotacheck.service                    static  
systemd-random-seed.service                   static  
systemd-readahead-collect.service             enabled 
systemd-readahead-done.service                indirect
systemd-readahead-drop.service                enabled 
systemd-readahead-replay.service              enabled 
systemd-reboot.service                        static  
systemd-remount-fs.service                    static  
systemd-rfkill@.service                       static  
systemd-shutdownd.service                     static  
systemd-suspend.service                       static  
systemd-sysctl.service                        static  
systemd-timedated.service                     static  
systemd-tmpfiles-clean.service                static  
systemd-tmpfiles-setup-dev.service            static  
systemd-tmpfiles-setup.service                static  
systemd-udev-settle.service                   static  
systemd-udev-trigger.service                  static  
systemd-udevd.service                         static  
systemd-update-done.service                   static  
systemd-update-utmp-runlevel.service          static  
systemd-update-utmp.service                   static  
systemd-user-sessions.service                 static  
systemd-vconsole-setup.service                static  
tcsd.service                                  disabled
teamd@.service                                static  
tuned.service                                 enabled 
usb_modeswitch@.service                       static  
vgauthd.service                               disabled
vmtoolsd.service                              enabled 
wpa_supplicant.service                        disabled
xinetd.service                                enabled 
-.slice                                       static  
machine.slice                                 static  
system.slice                                  static  
user-0.slice                                  static  
user.slice                                    static  
dbus.socket                                   static  
dm-event.socket                               enabled 
epmd.socket                                   disabled
epmd@.socket                                  disabled
lvm2-lvmetad.socket                           enabled 
lvm2-lvmpolld.socket                          enabled 
nscd.socket                                   enabled 
rpcbind.socket                                enabled 
rsyncd.socket                                 disabled
sshd.socket                                   disabled
sssd-autofs.socket                            disabled
sssd-nss.socket                               disabled
sssd-pac.socket                               disabled
sssd-pam-priv.socket                          disabled
sssd-pam.socket                               disabled
sssd-secrets.socket                           disabled
sssd-ssh.socket                               disabled
sssd-sudo.socket                              disabled
syslog.socket                                 static  
systemd-initctl.socket                        static  
systemd-journald.socket                       static  
systemd-shutdownd.socket                      static  
systemd-udevd-control.socket                  static  
systemd-udevd-kernel.socket                   static  
basic.target                                  static  
bluetooth.target                              static  
cryptsetup-pre.target                         static  
cryptsetup.target                             static  
ctrl-alt-del.target                           disabled
default.target                                enabled 
emergency.target                              static  
final.target                                  static  
getty-pre.target                              static  
getty.target                                  static  
graphical.target                              static  
halt.target                                   disabled
hibernate.target                              static  
hybrid-sleep.target                           static  
initrd-fs.target                              static  
initrd-root-fs.target                         static  
initrd-switch-root.target                     static  
initrd.target                                 static  
iprutils.target                               disabled
kexec.target                                  disabled
local-fs-pre.target                           static  
local-fs.target                               static  
machines.target                               disabled
multi-user.target                             enabled 
network-online.target                         static  
network-pre.target                            static  
network.target                                static  
nfs-client.target                             enabled 
nss-lookup.target                             static  
nss-user-lookup.target                        static  
paths.target                                  static  
poweroff.target                               disabled
printer.target                                static  
rdma-hw.target                                static  
reboot.target                                 disabled
remote-cryptsetup.target                      disabled
remote-fs-pre.target                          static  
remote-fs.target                              enabled 
rescue.target                                 disabled
rpc_pipefs.target                             static  
rpcbind.target                                static  
runlevel0.target                              disabled
runlevel1.target                              disabled
runlevel2.target                              enabled 
runlevel3.target                              enabled 
runlevel4.target                              enabled 
runlevel5.target                              static  
runlevel6.target                              disabled
shutdown.target                               static  
sigpwr.target                                 static  
sleep.target                                  static  
slices.target                                 static  
smartcard.target                              static  
sockets.target                                static  
sound.target                                  static  
suspend.target                                static  
swap.target                                   static  
sysinit.target                                static  
system-update.target                          static  
time-sync.target                              static  
timers.target                                 static  
umount.target                                 static  
chrony-dnssrv@.timer                          disabled
fstrim.timer                                  disabled
mdadm-last-resort@.timer                      static  
systemd-readahead-done.timer                  indirect
systemd-tmpfiles-clean.timer                  static  
334 unit files listed.
2022-08-09T09:43:31Z DEBUG stderr=
2022-08-09T09:43:31Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2022-08-09T09:43:31Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2022-08-09T09:43:31Z DEBUG Starting external process
2022-08-09T09:43:31Z DEBUG args=/bin/systemctl list-unit-files --full
2022-08-09T09:43:31Z DEBUG Process finished, return code=0
2022-08-09T09:43:31Z DEBUG stdout=UNIT FILE                                     STATE   
proc-sys-fs-binfmt_misc.automount             static  
dev-hugepages.mount                           static  
dev-mqueue.mount                              static  
proc-fs-nfsd.mount                            static  
proc-sys-fs-binfmt_misc.mount                 static  
sys-fs-fuse-connections.mount                 static  
sys-kernel-config.mount                       static  
sys-kernel-debug.mount                        static  
tmp.mount                                     disabled
var-lib-nfs-rpc_pipefs.mount                  static  
brandbot.path                                 enabled 
systemd-ask-password-console.path             static  
systemd-ask-password-plymouth.path            static  
systemd-ask-password-wall.path                static  
session-7523.scope                            static  
session-8241.scope                            static  
session-8244.scope                            static  
session-8303.scope                            static  
session-8376.scope                            static  
session-8399.scope                            static  
session-8419.scope                            static  
session-8975.scope                            static  
session-9012.scope                            static  
session-9144.scope                            static  
abrt-ccpp.service                             enabled 
abrt-oops.service                             enabled 
abrt-pstoreoops.service                       disabled
abrt-vmcore.service                           enabled 
abrt-xorg.service                             enabled 
abrtd.service                                 enabled 
arp-ethers.service                            disabled
atd.service                                   disabled
auditd.service                                enabled 
auth-rpcgss-module.service                    static  
autofs.service                                disabled
autovt@.service                               enabled 
blk-availability.service                      disabled
brandbot.service                              static  
certmonger.service                            disabled
chrony-dnssrv@.service                        static  
chrony-wait.service                           disabled
chronyd.service                               disabled
console-getty.service                         disabled
console-shell.service                         disabled
container-getty@.service                      static  
cpupower.service                              disabled
crond.service                                 enabled 
dbus-org.freedesktop.hostname1.service        static  
dbus-org.freedesktop.import1.service          static  
dbus-org.freedesktop.locale1.service          static  
dbus-org.freedesktop.login1.service           static  
dbus-org.freedesktop.machine1.service         static  
dbus-org.freedesktop.timedate1.service        static  
dbus.service                                  static  
debug-shell.service                           disabled
dm-event.service                              static  
dmraid-activation.service                     enabled 
dnsmasq.service                               disabled
dracut-cmdline.service                        static  
dracut-initqueue.service                      static  
dracut-mount.service                          static  
dracut-pre-mount.service                      static  
dracut-pre-pivot.service                      static  
dracut-pre-trigger.service                    static  
dracut-pre-udev.service                       static  
dracut-shutdown.service                       static  
ds_agent.service                              enabled 
ds_nuagent.service                            disabled
ebtables.service                              disabled
emergency.service                             static  
epmd.service                                  disabled
epmd@.service                                 disabled
firewalld.service                             masked  
fprintd.service                               static  
fstrim.service                                static  
getty@.service                                enabled 
gssproxy.service                              disabled
halt-local.service                            static  
initrd-cleanup.service                        static  
initrd-parse-etc.service                      static  
initrd-switch-root.service                    static  
initrd-udevadm-cleanup-db.service             static  
iprdump.service                               disabled
iprinit.service                               disabled
iprupdate.service                             disabled
irqbalance.service                            enabled 
kdump.service                                 enabled 
kmod-static-nodes.service                     static  
kpatch.service                                disabled
libstoragemgmt.service                        enabled 
lvm2-lvmetad.service                          static  
lvm2-lvmpolld.service                         static  
lvm2-monitor.service                          enabled 
lvm2-pvscan@.service                          static  
mdadm-grow-continue@.service                  static  
mdadm-last-resort@.service                    static  
mdmon@.service                                static  
mdmonitor.service                             enabled 
messagebus.service                            static  
microcode.service                             enabled 
munin-node.service                            enabled 
NetworkManager-dispatcher.service             disabled
NetworkManager-wait-online.service            enabled 
NetworkManager.service                        disabled
nfs-blkmap.service                            disabled
nfs-config.service                            static  
nfs-idmap.service                             static  
nfs-idmapd.service                            static  
nfs-lock.service                              static  
nfs-mountd.service                            static  
nfs-rquotad.service                           disabled
nfs-secure.service                            static  
nfs-server.service                            disabled
nfs-utils.service                             static  
nfs.service                                   disabled
nfslock.service                               static  
nrpe.service                                  enabled 
nscd.service                                  enabled 
ntpd.service                                  enabled 
ntpdate.service                               disabled
oddjobd.service                               disabled
plymouth-halt.service                         disabled
plymouth-kexec.service                        disabled
plymouth-poweroff.service                     disabled
plymouth-quit-wait.service                    disabled
plymouth-quit.service                         disabled
plymouth-read-write.service                   disabled
plymouth-reboot.service                       disabled
plymouth-start.service                        disabled
plymouth-switch-root.service                  static  
polkit.service                                static  
postfix.service                               disabled
psacct.service                                disabled
quotaon.service                               static  
rabbitmq-server.service                       enabled 
rc-local.service                              static  
rdisc.service                                 disabled
rdma-load-modules@.service                    static  
rdma-ndd.service                              static  
rdma.service                                  disabled
rescue.service                                static  
rhel-autorelabel-mark.service                 enabled 
rhel-autorelabel.service                      enabled 
rhel-configure.service                        enabled 
rhel-dmesg.service                            enabled 
rhel-domainname.service                       disabled
rhel-import-state.service                     enabled 
rhel-loadmodules.service                      enabled 
rhel-readonly.service                         enabled 
rngd.service                                  enabled 
rpc-gssd.service                              static  
rpc-rquotad.service                           disabled
rpc-statd-notify.service                      static  
rpc-statd.service                             static  
rpcbind.service                               disabled
rpcgssd.service                               static  
rpcidmapd.service                             static  
rsyncd.service                                disabled
rsyncd@.service                               static  
rsyslog.service                               enabled 
saslauthd.service                             disabled
selinux-policy-migrate-local-changes@.service static  
sendmail.service                              enabled 
serial-getty@.service                         disabled
sm-client.service                             enabled 
smartd.service                                disabled
sshd-keygen.service                           static  
sshd.service                                  enabled 
sshd@.service                                 static  
sssd-autofs.service                           indirect
sssd-nss.service                              indirect
sssd-pac.service                              indirect
sssd-pam.service                              indirect
sssd-secrets.service                          indirect
sssd-ssh.service                              indirect
sssd-sudo.service                             indirect
sssd.service                                  disabled
sysstat.service                               enabled 
systemd-ask-password-console.service          static  
systemd-ask-password-plymouth.service         static  
systemd-ask-password-wall.service             static  
systemd-backlight@.service                    static  
systemd-binfmt.service                        static  
systemd-bootchart.service                     disabled
systemd-firstboot.service                     static  
systemd-fsck-root.service                     static  
systemd-fsck@.service                         static  
systemd-halt.service                          static  
systemd-hibernate-resume@.service             static  
systemd-hibernate.service                     static  
systemd-hostnamed.service                     static  
systemd-hwdb-update.service                   static  
systemd-hybrid-sleep.service                  static  
systemd-importd.service                       static  
systemd-initctl.service                       static  
systemd-journal-catalog-update.service        static  
systemd-journal-flush.service                 static  
systemd-journald.service                      static  
systemd-kexec.service                         static  
systemd-localed.service                       static  
systemd-logind.service                        static  
systemd-machine-id-commit.service             static  
systemd-machined.service                      static  
systemd-modules-load.service                  static  
systemd-nspawn@.service                       disabled
systemd-poweroff.service                      static  
systemd-quotacheck.service                    static  
systemd-random-seed.service                   static  
systemd-readahead-collect.service             enabled 
systemd-readahead-done.service                indirect
systemd-readahead-drop.service                enabled 
systemd-readahead-replay.service              enabled 
systemd-reboot.service                        static  
systemd-remount-fs.service                    static  
systemd-rfkill@.service                       static  
systemd-shutdownd.service                     static  
systemd-suspend.service                       static  
systemd-sysctl.service                        static  
systemd-timedated.service                     static  
systemd-tmpfiles-clean.service                static  
systemd-tmpfiles-setup-dev.service            static  
systemd-tmpfiles-setup.service                static  
systemd-udev-settle.service                   static  
systemd-udev-trigger.service                  static  
systemd-udevd.service                         static  
systemd-update-done.service                   static  
systemd-update-utmp-runlevel.service          static  
systemd-update-utmp.service                   static  
systemd-user-sessions.service                 static  
systemd-vconsole-setup.service                static  
tcsd.service                                  disabled
teamd@.service                                static  
tuned.service                                 enabled 
usb_modeswitch@.service                       static  
vgauthd.service                               disabled
vmtoolsd.service                              enabled 
wpa_supplicant.service                        disabled
xinetd.service                                enabled 
-.slice                                       static  
machine.slice                                 static  
system.slice                                  static  
user-0.slice                                  static  
user.slice                                    static  
dbus.socket                                   static  
dm-event.socket                               enabled 
epmd.socket                                   disabled
epmd@.socket                                  disabled
lvm2-lvmetad.socket                           enabled 
lvm2-lvmpolld.socket                          enabled 
nscd.socket                                   enabled 
rpcbind.socket                                enabled 
rsyncd.socket                                 disabled
sshd.socket                                   disabled
sssd-autofs.socket                            disabled
sssd-nss.socket                               disabled
sssd-pac.socket                               disabled
sssd-pam-priv.socket                          disabled
sssd-pam.socket                               disabled
sssd-secrets.socket                           disabled
sssd-ssh.socket                               disabled
sssd-sudo.socket                              disabled
syslog.socket                                 static  
systemd-initctl.socket                        static  
systemd-journald.socket                       static  
systemd-shutdownd.socket                      static  
systemd-udevd-control.socket                  static  
systemd-udevd-kernel.socket                   static  
basic.target                                  static  
bluetooth.target                              static  
cryptsetup-pre.target                         static  
cryptsetup.target                             static  
ctrl-alt-del.target                           disabled
default.target                                enabled 
emergency.target                              static  
final.target                                  static  
getty-pre.target                              static  
getty.target                                  static  
graphical.target                              static  
halt.target                                   disabled
hibernate.target                              static  
hybrid-sleep.target                           static  
initrd-fs.target                              static  
initrd-root-fs.target                         static  
initrd-switch-root.target                     static  
initrd.target                                 static  
iprutils.target                               disabled
kexec.target                                  disabled
local-fs-pre.target                           static  
local-fs.target                               static  
machines.target                               disabled
multi-user.target                             enabled 
network-online.target                         static  
network-pre.target                            static  
network.target                                static  
nfs-client.target                             enabled 
nss-lookup.target                             static  
nss-user-lookup.target                        static  
paths.target                                  static  
poweroff.target                               disabled
printer.target                                static  
rdma-hw.target                                static  
reboot.target                                 disabled
remote-cryptsetup.target                      disabled
remote-fs-pre.target                          static  
remote-fs.target                              enabled 
rescue.target                                 disabled
rpc_pipefs.target                             static  
rpcbind.target                                static  
runlevel0.target                              disabled
runlevel1.target                              disabled
runlevel2.target                              enabled 
runlevel3.target                              enabled 
runlevel4.target                              enabled 
runlevel5.target                              static  
runlevel6.target                              disabled
shutdown.target                               static  
sigpwr.target                                 static  
sleep.target                                  static  
slices.target                                 static  
smartcard.target                              static  
sockets.target                                static  
sound.target                                  static  
suspend.target                                static  
swap.target                                   static  
sysinit.target                                static  
system-update.target                          static  
time-sync.target                              static  
timers.target                                 static  
umount.target                                 static  
chrony-dnssrv@.timer                          disabled
fstrim.timer                                  disabled
mdadm-last-resort@.timer                      static  
systemd-readahead-done.timer                  indirect
systemd-tmpfiles-clean.timer                  static  
334 unit files listed.
2022-08-09T09:43:31Z DEBUG stderr=
2022-08-09T09:43:31Z INFO nslcd daemon is not installed, skip configuration
2022-08-09T09:43:31Z INFO Client uninstall complete.
2022-08-09T09:43:31Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
    return cfgr.run()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run
    return self.execute()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute
    for rval in self._executor():
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure
    next(executor)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner
    exc_handler(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
    self._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
    self.__parent._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner
    step()
  File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda>
    step = lambda: next(self.__gen)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
  File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
    for unused in self._installer(self.parent):
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3670, in main
    install(self)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2391, in install
    _install(options)
  File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2598, in _install
    raise ScriptError(rval=CLIENT_INSTALL_ERROR)
2022-08-09T09:43:31Z DEBUG The ipa-client-install command failed, exception: ScriptError: 
2022-08-09T09:43:31Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

ldap.conf

[root@e1-mybadclient02 ~]#  cat /etc/openldap/ldap.conf 
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never
TLS_CACERTDIR   /etc/openldap/certs
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on

Hi @boredape
from the logs it looks like the cert is properly downloaded but cannot be parsed correctly:

2022-08-09T09:43:22Z DEBUG trying to retrieve CA cert via LDAP from e1-ipaserver01.idm.eu.example.com
2022-08-09T09:43:22Z DEBUG retrieving schema for SchemaCache url=ldap://e1-ipaserver01.idm.eu.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f8d495f5170>
2022-08-09T09:43:22Z DEBUG get_ca_certs_from_ldap() error: 'Name' object has no attribute 'rdns'
2022-08-09T09:43:22Z DEBUG 'Name' object has no attribute 'rdns'
2022-08-09T09:43:30Z WARNING Downloading the CA certificate via HTTP, this is INSECURE
2022-08-09T09:43:30Z DEBUG trying to retrieve CA cert via HTTP from http://e1-ipaserver01.idm.eu.example.com/ipa/config/ca.crt
2022-08-09T09:43:30Z DEBUG Starting external process
2022-08-09T09:43:30Z DEBUG args=/usr/bin/curl -o - http://e1-ipaserver01.idm.eu.example.com/ipa/config/ca.crt
2022-08-09T09:43:30Z DEBUG Process finished, return code=0
2022-08-09T09:43:30Z DEBUG stdout=-----BEGIN CERTIFICATE-----
some interesting characters here.
-----END CERTIFICATE-----
2022-08-09T09:43:30Z DEBUG stderr=  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1651  100  1651    0     0   289k      0 --:--:-- --:--:-- --:--:--  322k
2022-08-09T09:43:30Z ERROR Cannot obtain CA certificate

I would check 2 things:
- was python2-cryptography installed as an rpm or using pip?
- can you share the CA cert? Maybe it contains a field that prevents loading it properly

Or you can try to validate its content using the same python code as the client installer. Put the cert in a /tmp/ca.crt file and run:
python -c 'from ipalib import x509; certs = x509.load_certificate_list_from_file("/tmp/ca.crt");print(certs[0].subject)'

If the command is able to load the cert we need to find other ideas.

Thanks for looking into this issue for me.

The python2-cryptography package was installed as an RPM. Currently using the version below.

[root@e1-mybadclient02 ~]# rpm -qa | grep python2-cryptography
python2-cryptography-1.7.2-2.el7.x86_64

Just for your information, I am using the same cert on 200+ servers without issues, I have run the command as suggested as not so keen on sharing the cert.

[root@e1-mybadclient02 ~]# python -c 'from ipalib import x509; certs = x509.load_certificate_list_from_file("/tmp/ca.crt");print(certs[0].subject)'
<Name([<NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.10, name=organizationName)>, value=u'IDM.EU.example.COM')>, <NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.3, name=commonName)>, value=u'Certificate Authority')>])>

Since it works on 200 other machines it suggests that something is broken on this one. Locally installed pip modules often conflict with the system-wide packages.

Another thing to try is to duplicate where it is failing so you can see the full traceback.

Replace the hostname, basedn and realm with your environment in this script.

from ipapython import ipaldap
from ipalib.install import certstore
ldap_uri = ipaldap.get_ldap_uri(HOSTNAME)
conn = ipaldap.LDAPClient(ldap_uri, sasl_nocanon=True)
conn.gssapi_bind()
certs = certstore.get_ca_certs(conn, BASEDN, REALM, True)

Thanks again. I am sure you are right. I may have a 100 of these all built from the same template in another region, hence the call for help. Thanks for your understanding.

I have run the following as instructed.

>>> from ipapython import ipaldap
>>> from ipalib.install import certstore
>>> ldap_uri = ipaldap.get_ldap_uri('e1-ipaserver01')
>>> conn = ipaldap.LDAPClient(ldap_uri, sasl_nocanon=True)
>>> conn.gssapi_bind()
>>> certs = certstore.get_ca_certs(conn, 'dc=idm,dc=eu,dc=example,dc=com', 'IDM.EU.EXAMPLE.COM', True)

StackTrace below.

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/site-packages/ipalib/install/certstore.py", line 312, in get_ca_certs
    _parse_cert(cert)
  File "/usr/lib/python2.7/site-packages/ipalib/install/certstore.py", line 35, in _parse_cert
    subject = DN(cert.subject)
  File "/usr/lib/python2.7/site-packages/ipapython/dn.py", line 1107, in __init__
    self.rdns = self._rdns_from_sequence(args)
  File "/usr/lib/python2.7/site-packages/ipapython/dn.py", line 1150, in _rdns_from_sequence
    rdn = self._rdns_from_value(item)
  File "/usr/lib/python2.7/site-packages/ipapython/dn.py", line 1136, in _rdns_from_value
    for rdn in value.rdns
AttributeError: 'Name' object has no attribute 'rdns'

Did you selectively update packages? CentOS 7.5 should have ipa-client-4.5.4

It looks like a repo has been added that should not have been.

Good spot and I can confirm that with the ipa-client-4.5.4 client it works. I should have checked that, apologies and the ticket can be closed.

Glad you got it working.

Metadata Update from @rcritten:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)

Metadata Update from @boredape:
- Issue close_status updated to: fixed (was: worksforme)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.