Bug 1376226
| Summary: | IPA replica-prepare failed with error "Profile caIPAserviceCert Not Found" | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Matthew Harmsen <mharmsen> | ||||
| Component: | pki-core | Assignee: | Fraser Tweedale <ftweedal> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Abhijeet Kasurde <akasurde> | ||||
| Severity: | unspecified | Docs Contact: | Marc Muehlfeld <mmuehlfe> | ||||
| Priority: | medium | ||||||
| Version: | 7.3 | CC: | ftweedal, gkapoor, ksiddiqu, nkinder | ||||
| Target Milestone: | rc | ||||||
| Target Release: | 7.4 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | pki-core-10.4.0-1.el7 | Doc Type: | Bug Fix | ||||
| Doc Text: |
PKI Server no longer fails to re-initialize the `LDAPProfileSubsystem` profile
Due to a race condition during re-initializing the `LDAPProfileSubsystem` profile, PKI Server previously could incorrectly reported that the requested profile does not exist. Consequently, requests to use the profile could fail. The problem has been fixed, and requests to use the profile no longer fail.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2017-08-01 22:46:01 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Matthew Harmsen
2016-09-14 23:33:20 UTC
Consider this for a RHEL 7.3-Z stream patch. Pushed to master (ced5cb71c1963d5234c2360d1f2ac11d4a452d9d) Hello Fraser, How to test this scenario? In 7.4 , i don't think we need to do replica-prepare. I think issue is reported during replica-prepare as mentioned in https://pagure.io/freeipa/issue/6274 Thanks Geetika Geetika, this will be difficult to test. It was a race condition that could occur during profile reload e.g. after LDAP disconnection. The reason for this particular symtom (ipa-replica-prepare failure) was that the LDAP server gets restarted as a final step of server installation, and the CI system ran ipa-replica-prepare immediately afterwards. The certificate issuance that occurs as part of ipa-replica-prepare failed because the caIPAserviceCert was temporarily unavailable while the profile subsystem refreshed its view of the profile in LDAP (due to server disconnect). So, how to test: 1. install a pre-RHEL7.3 master (domain level 0) 2. install a RHEL7.4 replica (which will also be domain level 0) 3. on the replica, *immediately* after installation (i.e. it should be scripted), run ipa-replica-prepare for some third host. It should succeed. Because it is a race condition you should do this a few times to be truly satisfied that the issue has been resolved. Hope that helps! Verified using PKI version :: pki-server-10.4.1-8.el7.noarch Marking BZ as verified. As comment #7, tried on ipa-replica-prepare with several RHEL 7.4 servers. Each time ipa-replica-prepare was successful. See attachment for console.log. Created attachment 1287042 [details]
verification_console.log
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2110 |