#9480 KeyError: 'ipacasubjectdn' in certs.is_ipa_issued_cert
Closed: invalid by rcritten. Opened by rcritten.

Issue

Issue seen when running ipa-healthcheck. This is a self-signed CA with a default subject base.

  {
    "source": "ipahealthcheck.ipa.certs",
    "check": "IPACertRevocation",
    "result": "CRITICAL",
    "uuid": "e2b0a302-fba3-4240-888d-e25bc43d9f9f",
    "when": "20231113200248Z",
    "duration": "0.292754",
    "kw": {
      "exception": "'ipacasubjectdn'",
      "traceback": "Traceback (most recent call last):
File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/core/core.py\", line 56, in run_plugin
    for result in plugin.check(): 
  File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/core/plugin.py\", line 18, in wrapper
    for result in f(*args, **kwds):
  File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/ipa/certs.py\", line 1278, in check
    requests = get_expected_requests(self.ca, self.ds, self.serverid,
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/ipa/certs.py\", line 115, in get_expected_requests
    issued = is_ipa_issued_cert(api, cert)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/home/rcrit/redhat/freeipa-healthcheck/src/ipahealthcheck/ipa/certs.py\", line 46, in is_ipa_issued_cert
    return certs.is_ipa_issued_cert(myapi, cert)          
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/usr/lib/python3.11/site-packages/ipaserver/install/certs.py\", line 138, in is_ipa_issued_cert
    cacert_subject = certstore.get_ca_subject(
                     ^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/usr/lib/python3.11/site-packages/ipalib/install/certstore.py\", line 397, in get_ca_subject
    cacert_subject = ldap.get_entry(dn)['ipacasubjectdn'][0]
                     ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File \"/usr/lib/python3.11/site-packages/ipapython/ipaldap.py\", line 510, in __getitem__
    return self._get_nice(name)
           ^^^^^^^^^^^^^^^^^^^^
  File \"/usr/lib/python3.11/site-packages/ipapython/ipaldap.py\", line 477, in _get_nice
    name = self._get_attr_name(name)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/usr/lib/python3.11/site-packages/ipapython/ipaldap.py\", line 473, in _get_attr_name
    name = self._names[name]
           ~~~~~~~~~~~^^^^^^
  File \"/usr/lib/python3.11/site-packages/ipapython/ipautil.py\", line 657, in __getitem__
    return super(CIDict, self).__getitem__(key.lower())
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
KeyError: 'ipacasubjectdn'
"
    }
  }

Bah not a bug in released code. I was using my experimental cache branch in IPA and that is where the issue is seen.

Metadata Update from @rcritten:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

Metadata