RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1168127 - IPA install failing with pki-core build - 10.1.2-6.el7
Summary: IPA install failing with pki-core build - 10.1.2-6.el7
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core
Version: 7.1
Hardware: Unspecified
OS: Unspecified
urgent
high
Target Milestone: rc
: ---
Assignee: Matthew Harmsen
QA Contact: Asha Akkiangady
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-26 08:33 UTC by Kaleem
Modified: 2015-03-26 11:53 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-03-26 11:53:37 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
snippets from log files (10.12 KB, text/plain)
2014-11-26 08:33 UTC, Kaleem 		no flags Details
View All

Description Kaleem 2014-11-26 08:33:18 UTC 
Created attachment 961536 [details]
snippets from log files

Description of problem:
IPA Server install failing with latest pki-core build, 10.1.2-6.el7.

Following seen in pki service status.

Nov 26 13:53:58 dhcp207-1.testrelm.test pkidaemon[21572]: WARNING:  Attempting to change symbolic link '/var/lib/pki/pki-tomcat/common/lib/jss4.jar' to point to target '/jss4.jar' INSTEAD of current target '/usr/lib/java/jss4.jar'!
Nov 26 13:53:58 dhcp207-1.testrelm.test pkidaemon[21572]: INFO:  Removed '/var/lib/pki/pki-tomcat/common/lib/jss4.jar' -> '/usr/lib/java/jss4.jar'!
Nov 26 13:53:58 dhcp207-1.testrelm.test pkidaemon[21572]: INFO:  Attempting to create '/var/lib/pki/pki-tomcat/common/lib/jss4.jar' -> '/jss4.jar' . . .
Nov 26 13:53:58 dhcp207-1.testrelm.test pkidaemon[21572]: ERROR:  Failed making '/var/lib/pki/pki-tomcat/common/lib/jss4.jar' -> '/jss4.jar' since target '/jss4.jar' does NOT exist!

Version-Release number of selected component (if applicable):
pki-core-10.1.2-6.el7

How reproducible:
Always

Steps to Reproduce:
1.Install IPA server with pki-core build 10.1.2-6.el7

Actual results:
IPA install fails while configuring CA instance

Expected results:
IPA install should be successful.

Additional info:
Please find the attached file for snippets from log files.
Comment 3 Matthew Harmsen 2014-11-26 20:32:25 UTC 

*** This bug has been marked as a duplicate of bug 1165351 ***
Comment 4 Jenny Severance 2014-12-01 15:27:15 UTC 
IPA server install is now successful with build pki-ca-10.1.2-7.el7.noarch

[root@dhcp207-1 ~]# rpm -q ipa-server pki-ca
ipa-server-4.1.0-10.el7.x86_64
pki-ca-10.1.2-7.el7.noarch
[root@dhcp207-1 ~]#

[root@dhcp207-1 ~]# ipa-server-install --setup-dns --forwarder=10.65.201.89 --hostname=`hostname` -r TESTRELM.TEST -n testrelm.test -p xxxxxxxx -P xxxxxxxx -a xxxxxxxx -U

...
Configuring NTP daemon (ntpd)
  [1/4]: stopping ntpd
..
  [4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv): Estimated time 1 minute
  [1/38]: creating directory server user
...
....
  [38/38]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds
  [1/27]: creating certificate server user
..
  [27/27]: Configure HTTP to proxy connections
Done configuring certificate server (pki-tomcatd).
Configuring directory server (dirsrv): Estimated time 10 seconds
  [1/3]: configuring ssl for ds instance
..
  [3/3]: adding CA certificate entry
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds
  [1/10]: adding sasl mappings to the directory
...
  [10/10]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin 
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
  [1/2]: starting ipa_memcached 
  [2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring ipa-otpd
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Configuring the web interface (httpd): Estimated time 1 minute
  [1/15]: setting mod_nss port to 443
...
  [15/15]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Applying LDAP updates
Restarting Directory server to apply updates
  [1/2]: stopping directory server
  [2/2]: starting directory server
Done.
Restarting the directory server
Restarting the KDC
Restarting the certificate server
Configuring DNS (named)
  [1/12]: generating rndc key file
...
  [12/12]: changing resolv.conf to point to ourselves
Done configuring DNS (named).
Restarting named

Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files

Restarting the web server
==============================================================================
Setup complete

Next steps:
	1. You must make sure these network ports are open:
		TCP Ports:
		  * 80, 443: HTTP/HTTPS
		  * 389, 636: LDAP/LDAPS
		  * 88, 464: kerberos
		  * 53: bind
		UDP Ports:
		  * 88, 464: kerberos
		  * 53: bind
		  * 123: ntp

	2. You can now obtain a kerberos ticket using the command: 'kinit admin'
	   This ticket will allow you to use the IPA tools (e.g., ipa user-add)
	   and the web user interface.

Be sure to back up the CA certificate stored in /root/cacert.p12
This file is required to create replicas. The password for this
file is the Directory Manager password
Note You need to log in before you can comment on or make changes to this bug.