Hide Forgot
Please see IPA related ticket: https://fedorahosted.org/freeipa/ticket/6274 It looks for me the same issue as this reported in past: https://fedorahosted.org/pki/ticket/1702 "caIPAServiceCert" is default profile for IPA, should always exists. This is reproducible in our CI test automation, it looks like dogtag is reporting that ready to serve, but when we execute ipa-replica-prepare too early, it fails with error "Profile caIPAserviceCert Not Found". Manually it works when delay between dogtag restart during ipa-server-install and ipa-replica-prepare is longer. PS: we check dogtag status using http polling.
Consider this for a RHEL 7.3-Z stream patch.
Pushed to master (ced5cb71c1963d5234c2360d1f2ac11d4a452d9d)
Hello Fraser, How to test this scenario? In 7.4 , i don't think we need to do replica-prepare. I think issue is reported during replica-prepare as mentioned in https://pagure.io/freeipa/issue/6274 Thanks Geetika
Geetika, this will be difficult to test. It was a race condition that could occur during profile reload e.g. after LDAP disconnection. The reason for this particular symtom (ipa-replica-prepare failure) was that the LDAP server gets restarted as a final step of server installation, and the CI system ran ipa-replica-prepare immediately afterwards. The certificate issuance that occurs as part of ipa-replica-prepare failed because the caIPAserviceCert was temporarily unavailable while the profile subsystem refreshed its view of the profile in LDAP (due to server disconnect). So, how to test: 1. install a pre-RHEL7.3 master (domain level 0) 2. install a RHEL7.4 replica (which will also be domain level 0) 3. on the replica, *immediately* after installation (i.e. it should be scripted), run ipa-replica-prepare for some third host. It should succeed. Because it is a race condition you should do this a few times to be truly satisfied that the issue has been resolved. Hope that helps!
Verified using PKI version :: pki-server-10.4.1-8.el7.noarch Marking BZ as verified. As comment #7, tried on ipa-replica-prepare with several RHEL 7.4 servers. Each time ipa-replica-prepare was successful. See attachment for console.log.
Created attachment 1287042 [details] verification_console.log
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2110