freeipa

#9246 Nightly test failure in test_user_permissions.TestInstallClientNoAdmin
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

The nightly test test_user_permissions.TestInstallClientNoAdmin is failing in F36.

The test is failing when trying to request a certificate during ipa-client-install

2022-09-27T01:28:29Z DEBUG Start of certmonger.service complete
2022-09-27T01:28:30Z DEBUG certmonger request is in state 'NEWLY_ADDED_READING_KEYINFO'
2022-09-27T01:28:30Z DEBUG certmonger request is in state 'GENERATING_KEY_PAIR'
2022-09-27T01:28:31Z DEBUG certmonger request is in state 'GENERATING_CSR'
2022-09-27T01:28:32Z DEBUG certmonger request is in state 'CA_UNREACHABLE'
2022-09-27T01:28:32Z DEBUG Cert request 20220927012829 failed: CA_UNREACHABLE (Error setting up ccache for "host" service on client using default keytab: Cannot resolve network address for KDC in requested realm.)
2022-09-27T01:28:32Z DEBUG Giving up on cert request 20220927012829
2022-09-27T01:28:32Z ERROR certmonger request failed
Traceback (most recent call last):
  File "/usr/lib/python3.10/site-packages/ipaclient/install/client.py", line 853, in configure_certmonger
    certmonger.request_and_wait_for_cert(
  File "/usr/lib/python3.10/site-packages/ipalib/install/certmonger.py", line 414, in request_and_wait_for_cert
    raise RuntimeError(
RuntimeError: Certificate issuance failed (CA_UNREACHABLE: Error setting up ccache for "host" service on client using default keytab: Cannot resolve network address for KDC in requested realm.)
2022-09-27T01:28:32Z ERROR Installation failed. Rolling back changes.

This is almost certainly because we haven't created the krb5.conf yet.

I can move the creation back to where it was so that certmonger will have a configuration to work with but it will still be in a race with replication for the client host to appear on all IPA servers.

I can look to move the certificate request later to give it a higher probability of success.

Related to https://pagure.io/freeipa/issue/9228

Metadata Update from @frenaud:
- Issue tagged with: test-failure

master:

  • dbec885cb0923de9a396fe8b30f1c54f5d31498e Move client certificate request after krb5.conf is created
Edited by amore

ipa-4-10:

  • f3c861b9fcbf7815161b46e5eab582813c1021dc Move client certificate request after krb5.conf is created

ipa-4-9:

  • 762d786bf7a3043fd56877949f02bccd077e2711 Move client certificate request after krb5.conf is created

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-6:

  • d79cf3a8c99d13b91051728477cabecdc5948c36 Move client certificate request after krb5.conf is created
Metadata

test-failure

None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.