Bug 1852714
| Summary: | Get One-Time Password for client enrollment fails | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Thomas Woerner <twoerner> |
| Component: | ansible-freeipa | Assignee: | Thomas Woerner <twoerner> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.3 | CC: | mvarun, pcech |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 02:46:57 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Thomas Woerner
2020-07-01 06:43:56 UTC
Here is the upstream PR: https://github.com/freeipa/ansible-freeipa/pull/312 Verified:
ansible-freeipa-0.1.12-4.el8.noarch
ansible_freeipa_tests/test_idm_deploy_client.py::TestClientTC07::test_specified_server_otp
-------------------------------- live log call ---------------------------------
[pytest_multihost.host.Host.master.ParamikoTransport] INFO RUN ['ipactl', 'status']
[pytest_multihost.host.Host.ansible.ParamikoTransport] INFO WRITE inventory/clients.hosts
[pytest_multihost.host.Host.ansible.ParamikoTransport] INFO PUT install-clients.yaml
[pytest_multihost.host.Host.ansible.ParamikoTransport] INFO RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/clients.hosts', 'install-clients.yaml']
PASSED
Complete log
==============
----------------------------- Captured log call -------------------------------
channel.py 1212 DEBUG [chan 5] Max packet in: 32768 bytes
channel.py 1212 DEBUG [chan 5] Max packet out: 32768 bytes
transport.py 1819 DEBUG Secsh channel 5 opened.
transport.py 318 INFO RUN ['ipactl', 'status']
transport.py 519 DEBUG RUN ['ipactl', 'status']
channel.py 1212 DEBUG [chan 5] Sesch channel 5 request ok
transport.py 563 DEBUG -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py 563 DEBUG -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py 563 DEBUG Directory Service: RUNNING
transport.py 563 DEBUG krb5kdc Service: RUNNING
transport.py 563 DEBUG kadmin Service: RUNNING
transport.py 563 DEBUG named Service: RUNNING
transport.py 563 DEBUG httpd Service: RUNNING
transport.py 563 DEBUG ipa-custodia Service: RUNNING
transport.py 563 DEBUG pki-tomcatd Service: RUNNING
transport.py 563 DEBUG ipa-otpd Service: RUNNING
transport.py 563 DEBUG ipa-dnskeysyncd Service: RUNNING
transport.py 563 DEBUG ipa: INFO: The ipactl command was successful
channel.py 1212 DEBUG [chan 5] EOF received (5)
channel.py 1212 DEBUG [chan 5] EOF sent (5)
transport.py 217 DEBUG Exit code: 0
transport.py 293 INFO WRITE inventory/clients.hosts
sftp.py 158 DEBUG [chan 0] open(b'inventory/clients.hosts', 'wb')
sftp.py 158 DEBUG [chan 0] open(b'inventory/clients.hosts', 'wb') -> 00000000
sftp.py 158 DEBUG [chan 0] close(00000000)
transport.py 329 INFO PUT install-clients.yaml
sftp.py 158 DEBUG [chan 0] open(b'install-clients.yaml', 'wb')
sftp.py 158 DEBUG [chan 0] open(b'install-clients.yaml', 'wb') -> 00000000
sftp.py 158 DEBUG [chan 0] close(00000000)
sftp.py 158 DEBUG [chan 0] stat(b'install-clients.yaml')
channel.py 1212 DEBUG [chan 12] Max packet in: 32768 bytes
channel.py 1212 DEBUG [chan 12] Max packet out: 32768 bytes
transport.py 1819 DEBUG Secsh channel 12 opened.
transport.py 318 INFO RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/clients.hosts', 'install-clients.yaml']
transport.py 519 DEBUG RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/clients.hosts', 'install-clients.yaml']
channel.py 1212 DEBUG [chan 12] Sesch channel 12 request ok
transport.py 563 DEBUG -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py 563 DEBUG -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py 563 DEBUG ansible-playbook 2.9.10
transport.py 563 DEBUG config file = /root/ansible.cfg
transport.py 563 DEBUG configured module search path = ['/root/ansible-freeipa/plugins/modules', '/usr/share/ansible/plugins/modules']
transport.py 563 DEBUG ansible python module location = /usr/lib/python3.6/site-packages/ansible
transport.py 563 DEBUG executable location = /usr/bin/ansible-playbook
transport.py 563 DEBUG python version = 3.6.8 (default, Jun 26 2020, 12:10:09) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]
transport.py 563 DEBUG Using /root/ansible.cfg as config file
transport.py 563 DEBUG
transport.py 563 DEBUG PLAYBOOK: install-clients.yaml *************************************************
transport.py 563 DEBUG 1 plays in install-clients.yaml
transport.py 563 DEBUG
transport.py 563 DEBUG PLAY [Playbook to configure IPA clients] ***************************************
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [Gathering Facts] *********************************************************
transport.py 563 DEBUG task path: /root/install-clients.yaml:2
transport.py 563 DEBUG ok: [client1.ipadomain.test]
transport.py 563 DEBUG META: ran handlers
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Import variables specific to distribution] *******************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/main.yml:4
transport.py 563 DEBUG ok: [client1.ipadomain.test] => (item=/usr/share/ansible/roles/ipaclient/vars/RedHat-8.yml) => {"ansible_facts": {"ipaclient_packages": ["@idm:DL1/client"]}, "ansible_included_var_files": ["/usr/share/ansible/roles/ipaclient/vars/RedHat-8.yml"], "ansible_loop_var": "item", "changed": false, "item": "/usr/share/ansible/roles/ipaclient/vars/RedHat-8.yml"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install IPA client] ******************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/main.yml:12
transport.py 563 DEBUG included: /usr/share/ansible/roles/ipaclient/tasks/install.yml for client1.ipadomain.test
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Ensure that IPA client packages are installed] *****
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:4
transport.py 563 DEBUG ok: [client1.ipadomain.test] => {"changed": false, "msg": "Nothing to do", "rc": 0, "results": []}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [Install - Set ipaclient_servers] *****************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:13
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [Install - Set ipaclient_servers from cluster inventory] ******************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:18
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Check that either principal or keytab is set] ******
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:24
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Set default principal if no keytab is given] *******
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:28
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - IPA client test] ***********************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:33
transport.py 563 DEBUG ok: [client1.ipadomain.test] => {"basedn": "dc=ipadomain,dc=test", "changed": false, "client_already_configured": false, "client_domain": "ipadomain.test", "dnsok": true, "domain": "ipadomain.test", "hostname": "client1.ipadomain.test", "ipa_python_version": 40807, "kdc": "master.ipadomain.test", "ntp_pool": null, "ntp_servers": null, "realm": "IPADOMAIN.TEST", "servers": ["master.ipadomain.test"], "sssd": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Cleanup leftover ccache] ***************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:59
transport.py 563 DEBUG ok: [client1.ipadomain.test] => {"changed": false, "path": "/etc/ipa/.dns_ccache", "state": "absent"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Configure NTP] *************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:64
transport.py 563 DEBUG ok: [client1.ipadomain.test] => {"changed": false}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Make sure One-Time Password is enabled if it's already defined] ***
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:76
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Disable One-Time Password for on_master] ***********
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:81
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Test if IPA client has working krb5.keytab] ********
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:86
transport.py 563 DEBUG ok: [client1.ipadomain.test] => {"ca_crt_exists": false, "changed": false, "krb5_conf_ok": false, "krb5_keytab_ok": false, "ping_test_ok": false}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Disable One-Time Password for client with working krb5.keytab] ***
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:96
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Keytab or password is required for getting otp] ****
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:112
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Get One-Time Password for client enrollment] *******
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:120
transport.py 563 DEBUG changed: [client1.ipadomain.test -> master.ipadomain.test] => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result", "changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Report error for OTP generation] *******************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:139
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Store the previously obtained OTP] *****************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:145
transport.py 563 DEBUG ok: [client1.ipadomain.test] => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result", "changed": false}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Store predefined OTP in admin_password] **********************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:154
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result", "changed": false}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Check if principal and keytab are set] *************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:170
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Check if one of password or keytabs are set] *******
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:174
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Purge IPADOMAIN.TEST from host keytab] *************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:182
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"changed": true, "cmd": ["/usr/sbin/ipa-rmkeytab", "-k", "/etc/krb5.keytab", "-r", "IPADOMAIN.TEST"], "delta": "0:00:00.004157", "end": "2020-07-10 03:41:53.917190", "failed_when_result": false, "msg": "non-zero return code", "rc": 3, "start": "2020-07-10 03:41:53.913033", "stderr": "Failed to open keytab '/etc/krb5.keytab': No such file or directory", "stderr_lines": ["Failed to open keytab '/etc/krb5.keytab': No such file or directory"], "stdout": "", "stdout_lines": []}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Backup and set hostname] ***************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:195
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Join IPA] ******************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:200
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"already_joined": false, "changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : fail] ********************************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:222
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : fail] ********************************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:227
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : fail] ********************************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:230
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Configure IPA default.conf] ************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:242
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Configure SSSD] ************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:251
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Configure krb5 for IPA realm] **********************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:273
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - IPA API calls for remaining enrollment parts] ******
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:287
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"ca_enabled": true, "changed": true, "subject_base": "O=IPADOMAIN.TEST"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Fix IPA ca] ****************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:295
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Create IPA NSS database] ***************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:305
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"ca_enabled_ra": true, "changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Configure SSH and SSHD] ****************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:336
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Configure automount] *******************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:344
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Configure firefox] *********************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:350
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Configure NIS] *************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:355
transport.py 563 DEBUG changed: [client1.ipadomain.test] => {"changed": true}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Install - Restore original admin password if overwritten by OTP] ***
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:373
transport.py 563 DEBUG ok: [client1.ipadomain.test] => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result", "changed": false}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Cleanup leftover ccache] *************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/install.yml:379
transport.py 563 DEBUG ok: [client1.ipadomain.test] => {"changed": false, "path": "/etc/ipa/.dns_ccache", "state": "absent"}
transport.py 563 DEBUG
transport.py 563 DEBUG TASK [ipaclient : Uninstall IPA client] ****************************************
transport.py 563 DEBUG task path: /usr/share/ansible/roles/ipaclient/tasks/main.yml:16
transport.py 563 DEBUG skipping: [client1.ipadomain.test] => {"changed": false, "skip_reason": "Conditional result was False"}
transport.py 563 DEBUG META: ran handlers
transport.py 563 DEBUG META: ran handlers
transport.py 563 DEBUG
transport.py 563 DEBUG PLAY RECAP *********************************************************************
transport.py 563 DEBUG client1.ipadomain.test : ok=23 changed=12 unreachable=0 failed=0 skipped=18 rescued=0 ignored=0
transport.py 563 DEBUG
channel.py 1212 DEBUG [chan 12] EOF received (12)
channel.py 1212 DEBUG [chan 12] EOF sent (12)
transport.py 217 DEBUG Exit code: 0
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (ansible-freeipa bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2020:4663 |