Bug 2214933

Created attachment 1970814 [details]
uninstall log

Description of problem:
Uninstalling of the IPA server is encountering a failure during the unconfiguration of the CA (Unconfiguring CA)

Version-Release number of selected component (if applicable):
# rpm -qa ipa-server*
ipa-server-common-4.10.2-1.el9.noarch
ipa-server-4.10.2-1.el9.x86_64
ipa-server-dns-4.10.2-1.el9.noarch

# rpm -qa idm-pki-*
idm-pki-base-11.4.2-1.el9.noarch
idm-pki-java-11.4.2-1.el9.noarch
idm-pki-tools-11.4.2-1.el9.x86_64
idm-pki-server-11.4.2-1.el9.noarch
idm-pki-acme-11.4.2-1.el9.noarch
idm-pki-ca-11.4.2-1.el9.noarch
idm-pki-kra-11.4.2-1.el9.noarch

How reproducible:
100%

Steps to Reproduce:
1. install ipa server 
#ipa-server-install --setup-dns --forwarder=10.11.5.19 --hostname=master.ipadomain.test -r IPADOMAIN.TEST -n ipadomain.test --ip-address=<ipaddress> -p <xxxpasswordxxxx> -a <xxxpasswordxxxx> -U

2. uninstall ipa server 
#ipa server-install --uninstall -U


Console output:
#ipa-server-install --setup-dns --forwarder=10.11.5.19 --hostname=master.ipadomain.test -r IPADOMAIN.TEST -n ipadomain.test --ip-address=<ipaddress> -p <xxxpasswordxxxx> -a <xxxpasswordxxxx> -U

This step may take considerable amount of time, please wait..
Done.
Configuring client side components
This program will set up IPA client.
Version 4.10.2

Using existing certificate '/etc/ipa/ca.crt'.
Client hostname: master.ipadomain.test
Realm: IPADOMAIN.TEST
DNS Domain: ipadomain.test
IPA Server: master.ipadomain.test
BaseDN: dc=ipadomain,dc=test

Configured /etc/sssd/sssd.conf
Systemwide CA database updated.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config.d/04-ipa.conf
Configuring ipadomain.test as NIS domain.
Client configuration complete.
The ipa-client-install command was successful

==============================================================================
Setup complete

Next steps:
	1. You must make sure these network ports are open:
		TCP Ports:
		  * 80, 443: HTTP/HTTPS
		  * 389, 636: LDAP/LDAPS
		  * 88, 464: kerberos
		  * 53: bind
		UDP Ports:
		  * 88, 464: kerberos
		  * 53: bind
		  * 123: ntp

	2. You can now obtain a kerberos ticket using the command: 'kinit admin'
	   This ticket will allow you to use the IPA tools (e.g., ipa user-add)
	   and the web user interface.

Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
The ipa-server-install command was successful




# ipa-server-install --uninstall -U
Updating DNS system records
Invalid IP address fe80::f816:3eff:fe21:ea4d for master.ipadomain.test.: cannot use link-local IP address fe80::f816:3eff:fe21:ea4d
Forcing removal of master.ipadomain.test
------------------------------------------
Deleted IPA server "master.ipadomain.test"
------------------------------------------
Shutting down all IPA services
Unconfiguring CA
failed to uninstall CA instance CalledProcessError(Command ['/usr/sbin/pkidestroy', '-i', 'pki-tomcat', '-s', 'CA', '--log-file', '/var/log/pki/pki-ca-destroy.20230614020451.log'] returned non-zero exit status 1: 'SSLSocketException: Unable to connect: (-5961) TCP connection reset by peer.\nERROR: Unable to remove CA from security domain\nERROR: To remove manually:\nERROR: $ pki -U https://master.ipadomain.test:8443 -n <admin> securitydomain-host-del "CA master.ipadomain.test 443"\nERROR: Command \'[\'pki\', \'-d\', \'/etc/pki/pki-tomcat/alias\', \'-f\', \'/etc/pki/pki-tomcat/password.conf\', \'-n\', \'subsystemCert cert-pki-ca\', \'-U\', \'https://master.ipadomain.test:8443\', \'--ignore-banner\', \'securitydomain-leave\', \'--type\', \'CA\', \'--hostname\', \'master.ipadomain.test\', \'--secure-port\', \'443\', \'CA master.ipadomain.test 443\']\' returned non-zero exit status 255.\nERROR: CalledProcessError: Command \'[\'pki\', \'-d\', \'/etc/pki/pki-tomcat/alias\', \'-f\', \'/etc/pki/pki-tomcat/password.conf\', \'-n\', \'subsystemCert cert-pki-ca\', \'-U\', \'https://master.ipadomain.test:8443\', \'--ignore-banner\', \'securitydomain-leave\', \'--type\', \'CA\', \'--hostname\', \'master.ipadomain.test\', \'--secure-port\', \'443\', \'CA master.ipadomain.test 443\']\' returned non-zero exit status 255.\n  File "/usr/lib/python3.9/site-packages/pki/server/pkidestroy.py", line 255, in main\n    scriptlet.destroy(deployer)\n  File "/usr/lib/python3.9/site-packages/pki/server/deployment/scriptlets/initialization.py", line 220, in destroy\n    deployer.leave_security_domain(instance, subsystem)\n  File "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line 1448, in leave_security_domain\n    subsystem.leave_security_domain(\n  File "/usr/lib/python3.9/site-packages/pki/server/subsystem.py", line 1591, in leave_security_domain\n    subprocess.check_call(cmd)\n  File "/usr/lib64/python3.9/subprocess.py", line 373, in check_call\n    raise CalledProcessError(retcode, cmd)\n\n')
Unconfiguring named
Unconfiguring ipa-dnskeysyncd
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring ipa-custodia
Unconfiguring ipa-otpd
Removing IPA client configuration
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Systemwide CA database updated.
Client uninstall complete.
The ipa-client-install command was successful
The ipa-server-install command was successful