Bug 2546573
| Summary: | Cannot delete hosts on F45 freeipa due to certificate deletion error | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Martin Jackson <mhjacks> |
| Component: | freeipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 45 | CC: | abokovoy, dhanina, ftrivino, ipa-maint, mhjacks, rcritten, rhbz, ssorce, twoerner |
| Target Milestone: | --- | Keywords: | Regression, Reopened |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| URL: | https://codeberg.org/freeipa/freeipa/issues/10083 | ||
| Whiteboard: | AcceptedFreezeException | ||
| Fixed In Version: | freeipa-4.13.4-3.2.fc46 freeipa-4.13.4-3.2.fc45 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-10-23 04:38:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2406955 | ||
|
Description
Martin Jackson
2026-10-06 12:06:58 UTC
Proposed as a Freeze Exception for 45-final by Fedora user mhjacks using the blocker tracking app because: The issue prevents deletion of hosts by default on a FreeIPA server running under Fedora 45. A fix has been proposed and tested, and it is small, targeted, and straightforward to verify. FEDORA-2026-7f4dc45e0f (freeipa-4.13.4-3.2.fc46) has been submitted as an update to Fedora 46. https://bodhi.fedoraproject.org/updates/FEDORA-2026-7f4dc45e0f FEDORA-2026-7f4dc45e0f (freeipa-4.13.4-3.2.fc46) has been pushed to the Fedora 46 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2026-59d195ce8e (freeipa-4.13.4-3.2.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-59d195ce8e FEDORA-2026-59d195ce8e has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-59d195ce8e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-59d195ce8e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. After running this upgrade, the top of my ipa-pki-proxy.conf file has: ``` # VERSION 17 - DO NOT REMOVE THIS LINE ProxyRequests Off # matches for ee port <LocationMatch "^/ca/ee/ca/checkRequest|^/ca/ee/ca/getCertChain|^/ca/ee/ca/getTokenInfo|^/ca/ee/ca/tokenAuthenticate|^/ca/ocsp|^/ca/ee/ca/updateNumberRange|^/ca/ee/ca/getCRL|^/ca/ee/ca/profileSubmit"> ``` While the template in /usr has: ``` # VERSION 18 - DO NOT REMOVE THIS LINE # Do not customise this file; it gets rewritten on every upgrade ProxyRequests Off $DOGTAG_AJP_PACKET_SIZE ``` I have not tried with a new install but I suspect it would work. For now, I have a separate, manually injected file in my apache config which contains: ``` # cat ipa-pki-ajp-buffer.conf # Dogtag AJP connectors use packetSize=65536. Apache default # 8192-byte AJP packet limit turns cert_find into HTTP 500 # (AH01081: incoming message is too big). ProxyIOBufferSize 65536 ``` This seems to be an effective workaround for the moment - but I think the key question is what it will take to get the version 18 file to render on RPM upgrades. +3 in https://forge.fedoraproject.org/quality/blocker-review/issues/2202 , marking accepted FE (it's a weak approval, though. Please be really careful not to break anything worse) Looking further into my systems, I do not have ipaupgrade.log entries matching the timeframe of the package install. I did run ipa-server-upgrade "manually" on both of them, which generated the logs and did successfully install the new version 18 of the ipa-pki-proxy.conf file. I do not understand why the %posttrans code seems not to have run. I don't have any further logging around the transaction beyond the dnf5 history info for the transaction ID's. They were both command-line dnf5 invocations so I didn't get the details that would come from, say, dnf5-automatic. I do have some potentially unusual elements in my dnf config. My hope is that I've hit a corner case on this and this won't be a problem for most users. Happy to share more if it would be helpful. FEDORA-2026-59d195ce8e (freeipa-4.13.4-3.2.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report. |