Bug 1026676 - Attempt to run ipa-client-install fails with /etc/pki/nssdb/libnssckbi.so: cannot open shared object file: No such file or directory (PR_LOAD_LIBRARY_ERROR)
Attempt to run ipa-client-install fails with /etc/pki/nssdb/libnssckbi.so: ca...
Status: CLOSED DUPLICATE of bug 1026677
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Martin Kosek
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-11-05 03:39 EST by Jan Pazdziora
Modified: 2013-11-05 05:11 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-11-05 05:11:55 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Pazdziora 2013-11-05 03:39:59 EST
Description of problem:

Attempting to run ipa-client-install on RHEL 7 (against IdM on RHEL 6).

I get

Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
Cannot connect to the server due to generic error: cannot connect to 'https://ipa.example.com/ipa/xml': /etc/pki/nssdb/libnssckbi.so: cannot open shared object file: No such file or directory (PR_LOAD_LIBRARY_ERROR) Failure to load dynamic library.
Installation failed. Rolling back changes.

Version-Release number of selected component (if applicable):

# rpm -q ipa-client
ipa-client-3.3.3-1.el7.x86_64

How reproducible:

Seen once, suspect deterministic.

Steps to Reproduce:
1. Have an IPA/IdM server configured with domain example.com and realm EXAMPLE.COM.
2. On RHEL 7 machine, run yum install -y ipa-client.
3. On RHEL 7 machine, point the resolv.conf to the IP address of that IPA server: echo nameserver 10.11.12.13 > /etc/resolv.conf
4. Run ipa-client-install --domain example.com

Actual results:

#  ipa-client-install --domain example.com
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd

Discovery was successful!
Hostname: the.real.machine.company.net
Realm: EXAMPLE.COM
DNS Domain: example.com
IPA Server: ipa.example.com
BaseDN: dc=example,dc=com

Continue to configure the system with these values? [no]: yes
User authorized to enroll computers: admin
Synchronizing time with KDC...
Password for admin@EXAMPLE.COM: 
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=EXAMPLE.COM
    Issuer:      CN=Certificate Authority,O=EXAMPLE.COM
    Valid From:  Mon Oct 14 02:14:11 2013 UTC
    Valid Until: Fri Oct 14 02:14:11 2033 UTC

Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
Cannot connect to the server due to generic error: cannot connect to 'https://ipa.example.com/ipa/xml': /etc/pki/nssdb/libnssckbi.so: cannot open shared object file: No such file or directory (PR_LOAD_LIBRARY_ERROR) Failure to load dynamic library.
Installation failed. Rolling back changes.
Unenrolling client from IPA server
Unenrolling host failed: Error getting default Kerberos realm: Configuration file does not specify default realm.

Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Client uninstall complete.

Expected results:

No error, client IPA-enrolled.

Additional info:
Comment 2 Jan Pazdziora 2013-11-05 05:11:55 EST
Not sure why the bug got filed twice, closing this dupe.

*** This bug has been marked as a duplicate of bug 1026677 ***

Note You need to log in before you can comment on or make changes to this bug.