Bug 1416454 - replication race condition prevents IPA to install
Summary: replication race condition prevents IPA to install
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.3
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Ganna Kaihorodova
URL:
Whiteboard:
Depends On:
Blocks: 1416488
TreeView+ depends on / blocked
 
Reported: 2017-01-25 14:41 UTC by Petr Vobornik
Modified: 2017-08-01 09:44 UTC (History)
9 users (show)

Fixed In Version: ipa-4.4.0-14.el7.6
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1416488 (view as bug list)
Environment:
Last Closed: 2017-08-01 09:44:33 UTC
Target Upstream Version:


Attachments (Terms of Use)
Verification "Replication race condition prevents IPA to install" (16.93 KB, text/plain)
2017-05-19 14:43 UTC, Ganna Kaihorodova
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2304 normal SHIPPED_LIVE ipa bug fix and enhancement update 2017-08-01 12:41:35 UTC

Description Petr Vobornik 2017-01-25 14:41:25 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/6588

From issue reported here:
https://www.redhat.com/archives/freeipa-users/2016-December/msg00395.html

{{{
Configuring the web interface (httpd). Estimated time: 1 minute
  [1/19]: setting mod_nss port to 443
  [2/19]: setting mod_nss cipher suite
  [3/19]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2
  [4/19]: setting mod_nss password file
  [5/19]: enabling mod_nss renegotiate
  [6/19]: adding URL rewriting rules
  [7/19]: configuring httpd
  [8/19]: setting up httpd keytab
  [9/19]: setting up ssl
  [error] NotFound: no such entry
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

ipa.ipapython.install.cli.install_tool(Replica): ERROR    no such entry
ipa.ipapython.install.cli.install_tool(Replica): ERROR    The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

}}}

During installation replica cannot find HTTP service and installer fails.
This is not 100% reproducible, but is is caused by replication when http entry is not replicated on time from master server.

Steps are following (IPA 4.4):
1. install DS on replica
1. create the http service entry on master for replica (using remote_api; install_http_certs(config, fstore, remote_api))
1. install other services, including http
1. http service fails to install in case that ldap entry from is not replicated yet to replica from master

This is reproducible mainly with ca-less install because in that case replication has less time to replicate entries from master.

Proposed fix: wait after install_http_certs until http service entry is replicated

Comment 2 Petr Vobornik 2017-01-25 14:50:04 UTC
fixed upstream ipa-4-4:
    3d0a0728766aed7245427b9eaf210e31fd40e440 wait_for_entry: use only DN as parameter
    5bddcdb47b40baeae7379e00e8d87297ed3f1cd4 Wait until HTTPS principal entry is replicated to replica
    74020d07dbf14202f696a0c8521829abc735d4c7 Use proper logging for error messages

Comment 9 Ganna Kaihorodova 2017-05-19 14:43:12 UTC
Created attachment 1280436 [details]
Verification "Replication race condition prevents IPA to install"

Comment 10 errata-xmlrpc 2017-08-01 09:44:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2304


Note You need to log in before you can comment on or make changes to this bug.