freeipa

#9622 ipa-server-install fails during configuring certificate server instance step when token is specified.
Closed: invalid by abbra. Opened by sumenon.

Closed: invalid
Reopen Issue

Issue

ipa-server-install fails during configuring certificate server instance step when token is specified.

Steps to Reproduce

  1. Create token as pkiuser
    root@server:~# runuser -u ods -- /usr/bin/softhsm2-util --init-token --free --pin 123456 --so-pin 050617 --label ipa_token
    Slot 1 has a free/uninitialized token.
    The token has been initialized and is reassigned to slot 192596205

  2. Install ipa-server with the token_name.
    root@server:~# ipa-server-install -a $ADMIN_PASSWORD -p $DM_PASSWORD -r FEDORA41.TEST -n fedora41.test -U --random-serial-numbers --token-name=ipa_token --token-library-path=/usr/lib64/pkcs11/libsofthsm2.so --token-password=$TOKEN_PASSWORD --setup-dns --forwarder=

Actual behavior

Although the token is attached to the slot the install fails with error in the log ' No such token: ipa_token'
ipa-server-install fails during configuring certificate server instance step.

FINE: TomcatJSS: logging into tokens
org.mozilla.jss.NoSuchTokenException: No such token: ipa_token
at org.mozilla.jss.CryptoManager.getTokenByName(CryptoManager.java:198)
at org.dogtagpki.jss.tomcat.TomcatJSS.getToken(TomcatJSS.java:545)
at org.dogtagpki.jss.tomcat.TomcatJSS.login(TomcatJSS.java:502)
at org.dogtagpki.jss.tomcat.TomcatJSS.login(TomcatJSS.java:496)
at org.dogtagpki.jss.tomcat.TomcatJSS.init(TomcatJSS.java:449)
at org.dogtagpki.server.cli.SubsystemCLI.initializeTomcatJSS(SubsystemCLI.java:41)
at org.dogtagpki.server.cli.SubsystemDBRemoveCLI.execute(SubsystemDBRemoveCLI.java:61)
at org.dogtagpki.cli.CommandCLI.execute(CommandCLI.java:58)
at org.dogtagpki.cli.CLI.execute(CLI.java:353)
at org.dogtagpki.cli.CLI.execute(CLI.java:353)
at org.dogtagpki.cli.CLI.execute(CLI.java:353)
at org.dogtagpki.server.cli.PKIServerCLI.execute(PKIServerCLI.java:93)
at org.dogtagpki.server.cli.PKIServerCLI.main(PKIServerCLI.java:123)
ERROR: CalledProcessError: Command '['/usr/sbin/runuser', '-u', 'pkiuser', '--', '/usr/lib/jvm/jre-21-openjdk/bin/java', '-classpath', '/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/:/var/lib/pki/pki-tomcat/common/lib/:/usr/share/pki/lib/*', '-Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory', '-Dcatalina.base=/var/lib/pki/pki-tomcat', '-Dcatalina.home=/usr/share/tomcat', '-Djava.endorsed.dirs=', '-Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp', '-Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties', '-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager', '-Dcom.redhat.fips=false', 'org.dogtagpki.server.cli.PKIServerCLI', 'ca-db-remove', '--force', '--debug']' returned non-zero exit status 255.
File "/usr/lib/python3.13/site-packages/pki/server/pkispawn.py", line 568, in main

Expected behavior

ipa-server-install should pass

Version/Release/Distribution

root@server:~# cat /etc/redhat-release
Fedora release 41 (Rawhide)

freeipa-server-4.12.1-1.fc41.x86_64
softhsm-2.6.1-9.fc40.x86_64
389-ds-base-3.1.0-10.fc41.x86_64
dogtag-pki-ca-11.5.0-3.fc41.1.noarch
krb5-server-1.21.2-5.fc40.x86_64

Additional info:

Attaching the install log.

root@server:~# softhsm2-util --show-slots
Available slots:
Slot 192596205
Slot info:
Description: SoftHSM slot ID 0xb7ac8ed
Manufacturer ID: SoftHSM project
Hardware version: 2.6
Firmware version: 2.6
Token present: yes
Token info:
Manufacturer ID: SoftHSM project
Model: SoftHSM v2
Hardware version: 2.6
Firmware version: 2.6
Serial number: f33544750b7ac8ed
Initialized: yes
User PIN init.: yes
Label: ipa_token

root@server:/var/lib/softhsm/tokens# cd 4cd9fcec-6d9d-cab0-f335-44750b7ac8ed/
root@server:/var/lib/softhsm/tokens/4cd9fcec-6d9d-cab0-f335-44750b7ac8ed# ls -l
total 8
-rw-------. 1 ods ods 8 Jul 9 15:02 generation
-rw-------. 1 ods ods 0 Jul 9 14:47 token.lock
-rw-------. 1 ods ods 320 Jul 9 14:47 token.object

You created this token as ods user, not pkiuser, thus the problem.

My bad, i had added the pkiuser to the ods group, but ran the command as ods user instead of pkiuser.

root@server:~# cat /etc/group | grep pkiuser
ods:x:986:pkiuser

runuser -u pkiuser -- /usr/bin/softhsm2-util --init-token --free --pin 123456 --so-pin 056789 --label ipa_token

root@server:~# softhsm2-util --show-slots
Token info:
Manufacturer ID: SoftHSM project
Model: SoftHSM v2
Hardware version: 2.6
Firmware version: 2.6
Serial number: 3590e49ab657eb1f
Initialized: yes
User PIN init.: yes
Label: ipa_token

drwx------. 2 pkiuser pkiuser 4096 Jul 9 15:23 c2a8346b-43c3-0e84-3590-e49ab657eb1f

The install works fine and we can close this ticket.
2024-07-09T09:52:00Z DEBUG Contents of pkispawn configuration file (/tmp/tmpmsy33_rj):
pki_admin_cert_request_type = pkcs10
pki_audit_signing_token = ipa_token
pki_token_name = ipa_token
pki_token_password = XXXXXXXX
pki_user = pkiuser
pki_ocsp_signing_token = ipa_token
pki_hsm_modulename = libsofthsm2
The ipa-server-install command was successful
Edited by sumenon

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.