freeipa

#9537 FreeIPA in docker CA is not installed yet.
Closed: invalid by rcritten. Opened by antonpatsev.

Closed: invalid
Reopen Issue

Issue

CA is not installed yet

Steps to Reproduce

write docker-compose.yaml 

version: "3.8"
services:
  freeipa:
    image: freeipa/freeipa-server:fedora-39-4.11.1
    container_name: freeipa
    restart: unless-stopped
    hostname: 10.129.0.27.my.local-ip.co
    ports:
      - 123:123/udp
      - 389:389
      - 443:443
      - 464:464
      - 464:464/udp
      - 636:636
      - 80:80
      - 88:88
      - 88:88/udp
    tty: true
    stdin_open: true
    environment:
      IPA_SERVER_HOSTNAME: 10.129.0.27.my.local-ip.co
      TZ: "Europe/Moscow"
    command:
      - --no-ntp
      - --no-host-dns
      - --admin-password=xxxxxxxxx
      - --dirsrv-pin=xxxxxxxx
      - --ds-password=xxxxxxxxx
      - --external-ca
      - --external_ca_file=/ca/ca.crt
      - --external_cert_file=/freeipa-certificate/freeipa.crt
      - --http-pin=xxxxxxxxx
      - --realm=my.local-ip.co
      - --unattended
      - -v
    cap_add:
      - SYS_TIME
      - NET_ADMIN
    volumes:
      - /etc/docker-compose/ca:/ca
      - /etc/docker-compose/freeipa-certificate:/freeipa-certificate
      - /etc/docker-compose/freeipa-data:/data
      - /etc/localtime:/etc/localtime:ro
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.lo.disable_ipv6=0
    security_opt:
      - "seccomp:unconfined"
    tmpfs:
    - /run
    - /tmp

Actual behavior

2024-02-17T06:46:30Z DEBUG The ipa-server-install command failed, exception: ScriptError: CA is not installed yet. To install with an external CA is a two-stage process.
First run the installer with --external-ca.
2024-02-17T06:46:30Z ERROR CA is not installed yet. To install with an external CA is a two-stage process.
First run the installer with --external-ca.

Expected behavior

FreeIPA run in docker with external CA

Version/Release/Distribution

reeipa/freeipa-server:fedora-39-4.11.1

Additional info:

cat freeipa-data/var/log/ipaserver-install.log 
2024-02-17T06:46:29Z DEBUG Logging to /var/log/ipaserver-install.log
2024-02-17T06:46:29Z DEBUG ipa-server-install was invoked with arguments [] and options: {'unattended': True, 'ip_addresses': None, 'domain_name': None, 'realm_name': 'my.local-ip.co', 'host_name': None, 'ca_cert_files': None, 'domain_level': None, 'setup_adtrust': False, 'setup_kra': False, 'setup_dns': False, 'idstart': None, 'idmax': None, 'no_hbac_allow': False, 'no_pkinit': False, 'no_ui_redirect': False, 'dirsrv_config_file': None, 'skip_mem_check': False, 'dirsrv_cert_files': None, 'http_cert_files': None, 'pkinit_cert_files': None, 'dirsrv_cert_name': None, 'http_cert_name': None, 'pkinit_cert_name': None, 'mkhomedir': False, 'ntp_servers': None, 'ntp_pool': None, 'no_ntp': True, 'force_ntpd': False, 'ssh_trust_dns': False, 'no_ssh': False, 'no_sshd': False, 'subid': False, 'no_dns_sshfp': False, 'external_ca': True, 'external_ca_type': None, 'external_ca_profile': None, 'external_cert_files': ['/ca/ca.crt', '/freeipa-certificate/freeipa.crt'], 'subject_base': None, 'ca_subject': None, 'ca_signing_algorithm': None, 'random_serial_numbers': False, 'pki_config_override': None, 'allow_zone_overlap': False, 'reverse_zones': None, 'no_reverse': False, 'auto_reverse': False, 'zonemgr': None, 'forwarders': None, 'no_forwarders': False, 'auto_forwarders': False, 'forward_policy': None, 'no_dnssec_validation': False, 'no_host_dns': True, 'enable_compat': False, 'no_msdcs': False, 'netbios_name': None, 'rid_base': None, 'secondary_rid_base': None, 'ignore_topology_disconnect': False, 'ignore_last_of_role': False, 'verbose': True, 'quiet': False, 'log_file': None, 'uninstall': False}
2024-02-17T06:46:29Z DEBUG IPA version 4.11.1-1.fc39
2024-02-17T06:46:29Z DEBUG IPA platform fedora_container
2024-02-17T06:46:29Z DEBUG IPA os-release Fedora Linux 39 (Container Image)
2024-02-17T06:46:29Z DEBUG container detected
2024-02-17T06:46:29Z DEBUG cgroup v1
2024-02-17T06:46:29Z DEBUG Max RAM 9223372036854771712, used RAM 2416066560
2024-02-17T06:46:29Z DEBUG Available memory is 9223372034438705152B
2024-02-17T06:46:29Z DEBUG Searching for an interface of IP address: ::1
2024-02-17T06:46:29Z DEBUG Testing local IP address: ::1/128 (interface: lo)
2024-02-17T06:46:29Z DEBUG Starting external process
2024-02-17T06:46:29Z DEBUG args=['/usr/sbin/selinuxenabled']
2024-02-17T06:46:29Z DEBUG Process finished, return code=1
2024-02-17T06:46:29Z DEBUG stdout=
2024-02-17T06:46:29Z DEBUG stderr=
2024-02-17T06:46:29Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2024-02-17T06:46:29Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2024-02-17T06:46:29Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2024-02-17T06:46:29Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2024-02-17T06:46:29Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2024-02-17T06:46:29Z DEBUG Check if 10.129.0.27.my.local-ip.co is a primary hostname for localhost
2024-02-17T06:46:29Z DEBUG Primary hostname for localhost: 10.129.0.27.my.local-ip.co
2024-02-17T06:46:29Z DEBUG will use host_name: 10.129.0.27.my.local-ip.co
2024-02-17T06:46:29Z DEBUG read domain_name: 129.0.27.my.local-ip.co
2024-02-17T06:46:29Z DEBUG Writing configuration file /etc/ipa/default.conf
2024-02-17T06:46:29Z DEBUG [global]
host = 10.129.0.27.my.local-ip.co
basedn = dc=my,dc=local-ip,dc=co
realm = MY.LOCAL-IP.CO
domain = 129.0.27.my.local-ip.co
xmlrpc_uri = https://10.129.0.27.my.local-ip.co/ipa/xml
ldap_uri = ldapi://%2Frun%2Fslapd-MY-LOCAL-IP-CO.socket
mode = production
enable_ra = True
ra_plugin = dogtag
dogtag_version = 10

Troubleshooting guide https://www.freeipa.org/page/Troubleshooting dont contain info docker image

certificate:

ca.crt from http://local-ip.co/

openssl x509 -noout -text -in ca/ca.crt 

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:37:6c:13:ff:b8:f8:e3:00:b0:4d:05:7c:f3:e8:1f:dd:79
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Let's Encrypt, CN = R3
        Validity
            Not Before: Jan  8 06:35:42 2024 GMT
            Not After : Apr  7 06:35:41 2024 GMT
        Subject: CN = *.my.local-ip.co
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    xxxx
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                78:45:02:49:31:F4:24:75:78:00:D5:4C:35:B9:F1:CE:7F:04:EC:32
            X509v3 Authority Key Identifier: 
                keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
            Authority Information Access: 
                OCSP - URI:http://r3.o.lencr.org
                CA Issuers - URI:http://r3.i.lencr.org/
            X509v3 Subject Alternative Name: 
                DNS:*.my.local-ip.co
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : xxxxxxxxx
                    Timestamp : Jan  8 07:35:43.109 2024 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                xxxxxxx
                                F5:DC:5A:FE:9C:67:4E
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : xxxxx
                    Timestamp : Jan  8 07:35:43.257 2024 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                xxxxx
    Signature Algorithm: sha256WithRSAEncryption
         xxxxx

openssl x509 -noout -text -in freeipa-certificate/freeipa.crt:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:00:6b:b7:27:92:42:14:0b:4a:27:5d:7c:50:7a:56:af:6e:df:06
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = *.my.local-ip.co
        Validity
            Not Before: Feb 17 06:43:22 2024 GMT
            Not After : Feb 14 06:43:22 2034 GMT
        Subject: C = RU, ST = Moscow, L = Moscow, O = APATSEV, CN = my.local-ip.co, emailAddress = admin@apatsev.org.ru
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:b3:63:a7:df:0f:db:18:c1:72:f6:1e:03:ff:cf:
                    xxxxx
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:my.local-ip.co
            X509v3 Subject Key Identifier: 
                75:C9:DF:7B:80:44:05:8C:A3:2C:45:2D:A6:3E:7F:1A:2B:76:32:47
            X509v3 Authority Key Identifier: 
                keyid:78:45:02:49:31:F4:24:75:78:00:D5:4C:35:B9:F1:CE:7F:04:EC:32
    Signature Algorithm: sha256WithRSAEncryption
         xxxx

openssl req -text -noout -verify -in freeipa-certificate/freeipa.csr

verify OK
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C = RU, ST = Moscow, L = Moscow, O = APATSEV, CN = my.local-ip.co, emailAddress = admin@apatsev.org.ru
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                Exponent: 65537 (0x10001)
        Attributes:
        Requested Extensions:
            X509v3 Subject Alternative Name: 
                DNS:my.local-ip.co
    Signature Algorithm: sha256WithRSAEncryption

The container has its own project. Please open an issue there. https://github.com/freeipa/freeipa-container/issues

Metadata Update from @rcritten:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.