Bug 1694596
| Summary: | ipa-server-upgrade fails with ConversionError: invalid 'cn': must be Unicode text | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Florence Blanc-Renaud <frenaud> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.7 | CC: | cheimes, ksiddiqu, ndehadra, pvoborni, rcritten, tscherf |
| Target Milestone: | rc | Keywords: | Regression, TestBlocker |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.6.5-3.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:09:37 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Upstream ticket: https://pagure.io/freeipa/issue/7896 Fixed upstream master: https://pagure.io/freeipa/c/d60122f9fba9fd9f74721763c4d5cf9f9f93986c Fixed upstream ipa-4-7: https://pagure.io/freeipa/c/84197a03c764bfd66c91deb42f843662ec02582b Fixed upstream ipa-4-6: https://pagure.io/freeipa/c/4c4d0841161b4cc774f2e4fe69531a7f144b2b2b Tested the bug with following observations: 1. IPA upgrade FAILs when upgraded from following upgrade paths: RHEL 75z > RHEL77 RHEL 73z > RHEL77 RHEL 72z > RHEL77 RHEL 71z > RHEL77 RHEL 70 > RHEL77 2. IPA upgrade is successful with upgrade path: RHEL76z > RHEL77 RHEL74z > RHEL77 Console output: (75z > 77) ------------------------------ Cleanup : libsss_sudo-1.16.0-19.el7_5.8.x86_64 160/162 Cleanup : libipa_hbac-1.16.0-19.el7_5.8.x86_64 161/162 Cleanup : 389-ds-base-libs-1.3.7.5-28.el7_5.x86_64 162/162 Job for ipa.service failed because the control process exited with error code. See "systemctl status ipa.service" and "journalctl -xe" for details. warning: %posttrans(ipa-server-4.6.5-3.el7.x86_64) scriptlet failed, exit status 1 Non-fatal POSTTRANS scriptlet failure in rpm package ipa-server-4.6.5-3.el7.x86_64 Verifying : sssd-dbus-1.16.4-8.el7.x86_64 1/162 Verifying : python-magic-5.11-35.el7.noarch 2/162 Ipa upgrade log snippet: (75z > 77) -------------------------------------- 2019-04-02T09:40:01Z DEBUG Waiting for CA to start... 2019-04-02T09:40:02Z DEBUG request POST http://sparks.nd2aprnor.pnq:8080/ca/admin/ca/getStatus 2019-04-02T09:40:02Z DEBUG request body '' 2019-04-02T09:40:02Z DEBUG response status 500 2019-04-02T09:40:02Z DEBUG response headers Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 2208 Date: Tue, 02 Apr 2019 09:40:02 GMT Connection: close 2019-04-02T09:40:02Z DEBUG response body '<html><head><title>Apache Tomcat/7.0.76 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - Subsystem unavailable</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>Subsystem unavailable</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.ws.rs.ServiceUnavailableException: Subsystem unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:500)\n\torg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)\n\torg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087)\n\torg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.java:748)\n</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/7.0.76 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.76</h3></body></html>' 2019-04-02T09:40:02Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500 2019-04-02T09:40:02Z DEBUG Waiting for CA to start... 2019-04-02T09:40:03Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2019-04-02T09:40:03Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 56, in run raise admintool.ScriptError(str(e)) 2019-04-02T09:40:03Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError: CA did not start in 300.0s 2019-04-02T09:40:03Z ERROR CA did not start in 300.0s 2019-04-02T09:40:03Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information Thus on above observation marking status of bug to "ASSIGNED" The issue described in comment #c8 is different, re-setting this BZ as ON_QA. IPA-Version: ipa-server-4.6.5-3.el7.x86_64
Tested the bug on the basis of following points:
1. Verified that IPA upgrade is successful for IPA server (RHEL 76z > RHEL77)
:: [ 14:33:44 ] :: [ PASS ] :: Command 'yum -y update 'ipa*' sssd 'python*' 'kernel-*' 'selinux-policy*'' (Expected 0, got 0)
:: [ 14:33:44 ] :: [ BEGIN ] :: Running 'tail -1 /var/log/ipaupgrade.log | grep 'The ipa-server-upgrade command was successful''
2019-04-02T09:02:14Z INFO The ipa-server-upgrade command was successful
:: [ 14:33:44 ] :: [ PASS ] :: Command 'tail -1 /var/log/ipaupgrade.log | grep 'The ipa-server-upgrade command was successful'' (Expected 0, got 0)
:: [ 14:34:27 ] :: [ BEGIN ] :: Running 'sleep 60'
:: [ 14:35:27 ] :: [ PASS ] :: Command 'sleep 60' (Expected 0, got 0)
:: [ 14:35:27 ] :: [ BEGIN ] :: Running 'ipactl restart'
MARK-LWD-LOOP -- 2019-04-02 14:36:04 --
ipa: INFO: The ipactl command was successful
Stopping pki-tomcatd Service
Restarting Directory Service
debugging enabled, suppressing output.
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting ntpd Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
:: [ 14:37:45 ] :: [ PASS ] :: Command 'ipactl restart' (Expected 0, got 0)
:: [ 14:37:45 ] :: [ BEGIN ] :: Running 'ipactl status'
ipa: INFO: The ipactl command was successful
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
:: [ 14:37:53 ] :: [ PASS ] :: Command 'ipactl status' (Expected 0, got 0)
:: [ 14:37:53 ] :: [ BEGIN ] :: Running 'service sssd status'
Redirecting to /bin/systemctl status sssd.service
● sssd.service - System Security Services Daemon
Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2019-04-02 14:32:10 IST; 5min ago
Main PID: 25910 (sssd)
CGroup: /system.slice/sssd.service
├─25910 /usr/sbin/sssd -i --logger=files
├─25911 /usr/libexec/sssd/sssd_be --domain ndnor2apr19.test --uid 0 --gid 0 --logger=files
├─25912 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
├─25913 /usr/libexec/sssd/sssd_sudo --uid 0 --gid 0 --logger=files
├─25914 /usr/libexec/sssd/sssd_ifp --uid 0 --gid 0 --logger=files
├─25915 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files
├─25916 /usr/libexec/sssd/sssd_ssh --uid 0 --gid 0 --logger=files
└─25917 /usr/libexec/sssd/sssd_pac --uid 0 --gid 0 --logger=files
Apr 02 14:33:28 vm-idm-001.ndnor2apr19.test sssd[be[ndnor2apr19.test]][25911]: Backend is online
Apr 02 14:33:28 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 2
Apr 02 14:33:28 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 1
Apr 02 14:33:28 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 1
Apr 02 14:33:28 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 1
Apr 02 14:33:28 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 2
Apr 02 14:35:41 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 1
Apr 02 14:35:41 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 1
Apr 02 14:35:41 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 1
Apr 02 14:35:41 vm-idm-001.ndnor2apr19.test sssd_be[25911]: GSSAPI client step 2
:: [ 14:37:53 ] :: [ PASS ] :: Command 'service sssd status' (Expected 0, got 0)
:: [ 14:37:53 ] :: [ BEGIN ] :: Running 'service sssd restart'
Redirecting to /bin/systemctl restart sssd.service
:: [ 14:37:54 ] :: [ PASS ] :: Command 'service sssd restart' (Expected 0, got 0)
:: [ 14:37:54 ] :: [ BEGIN ] :: Running 'rpm -q ipa-server 389-ds-base bind bind-dyndb-ldap pki-ca sssd'
ipa-server-4.6.5-3.el7.x86_64
389-ds-base-1.3.8.4-23.el7_6.x86_64
bind-9.9.4-73.el7_6.x86_64
bind-dyndb-ldap-11.1-4.el7.x86_64
pki-ca-10.5.9-13.el7_6.noarch
sssd-1.16.4-8.el7.x86_64
:: [ 14:37:54 ] :: [ PASS ] :: Command 'rpm -q ipa-server 389-ds-base bind bind-dyndb-ldap pki-ca sssd' (Expected 0, got 0)
2. For the issue mentioned at above comment#8, a separate bug is Filed :
https://bugzilla.redhat.com/show_bug.cgi?id=1695063
Thus , since the original issue mentioned in the bug is resolved and the upgrade is successful marking this bug as 'VERIFIED'.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2241 |
Description of problem: ipa-server-upgrade fails Version-Release number of selected component (if applicable): ipa-server-4.6.5-2.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. ipa-server-install --domain $DOMAIN --realm $REALM --setup-dns --auto-forwarder --auto-reverse -a Secret123 -p Secret123 -U 2. ipa-server-upgrade Actual results: ipa-server-upgrade fails with: [...] [Create systemd-user hbac service and rule] IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: ConversionError: invalid 'cn': must be Unicode text The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information Expected results: ipa-server-upgrade should finish successfully Additional info: Extract of /var/log/ipaupgrade.log: 2019-04-01T08:25:08Z INFO [Create systemd-user hbac service and rule] 2019-04-01T08:25:08Z DEBUG raw: hbacsvc_add('systemd-user', description='pam_systemd and systemd user@.service', version=u'2.230') 2019-04-01T08:25:08Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2019-04-01T08:25:08Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2146, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2033, in upgrade_configuration add_systemd_user_hbac() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1697, in add_systemd_user_hbac description='pam_systemd and systemd user@.service' File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__ return self.__do_call(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 471, in __do_call params = self.convert(**params) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 672, in convert (k, self.params[k].convert(v)) for (k, v) in kw.items() File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 672, in <genexpr> (k, self.params[k].convert(v)) for (k, v) in kw.items() File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 852, in convert return convert(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 1571, in _convert_scalar raise ConversionError(name=self.name, error=ugettext(self.type_error)) 2019-04-01T08:25:08Z DEBUG The ipa-server-upgrade command failed, exception: ConversionError: invalid 'cn': must be Unicode text 2019-04-01T08:25:08Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: ConversionError: invalid 'cn': must be Unicode text 2019-04-01T08:25:08Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information