Bug 448339 - ipa-server-install errors during ldapmodify
ipa-server-install errors during ldapmodify
Status: CLOSED ERRATA
Product: freeIPA
Classification: Community
Component: ipa-server (Show other bugs)
1.0
i386 Linux
high Severity high
: ---
: ---
Assigned To: Rob Crittenden
Chandrasekar Kannan
: Reopened
Depends On:
Blocks: 453489
  Show dependency treegraph
 
Reported: 2008-05-25 21:06 EDT by Brian J. Atkisson
Modified: 2015-01-04 18:32 EST (History)
2 users (show)

See Also:
Fixed In Version: freeipa-2.0.0-1.fc15
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-05-27 10:49:27 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
ipaserver-install.log (18.81 KB, application/octet-stream)
2008-05-26 12:06 EDT, Brian J. Atkisson
no flags Details

  None (edit)
Description Brian J. Atkisson 2008-05-25 21:06:15 EDT
Description of problem:
When running the ipa-server-install command, the following errors are encountered:

The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring directory server:
  [1/16]: creating directory server user
  [2/16]: creating directory server instance
  [3/16]: adding default schema
  [4/16]: enabling memberof plugin
  [5/16]: enabling referential integrity plugin
  [6/16]: enabling distributed numeric assignment plugin
  [7/16]: configuring uniqueness plugin
  [8/16]: creating indices
  [9/16]: configuring ssl for ds instance
  [10/16]: configuring certmap.conf
  [11/16]: restarting directory server
  [12/16]: adding default layout
root        : CRITICAL Failed to load bootstrap-template.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w password -f
/tmp/tmpaDK8rc' returned non-zero exit status 32
  [13/16]: configuring Posix uid/gid generation as first master
  [14/16]: adding master entry as first master
root        : CRITICAL Failed to load master-entry.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w password -f
/tmp/tmpXCiv8e' returned non-zero exit status 32
  [15/16]: initializing group membership
  [16/16]: configuring directory to start on boot
done configuring dirsrv.
Configuring Kerberos KDC
  [1/13]: setting KDC account password
  [2/13]: adding sasl mappings to the directory
  [3/13]: adding kerberos entries to the DS
root        : CRITICAL Failed to load kerberos.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w password -f
/tmp/tmpK5JXNi' returned non-zero exit status 32
  [4/13]: adding default ACIs
root        : CRITICAL Failed to load default-aci.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w password -f
/tmp/tmphtq8Mu' returned non-zero exit status 32
  [5/13]: configuring KDC
Failed to populate the realm structure in kerberos Command
'/usr/kerberos/sbin/kdb5_ldap_util -D uid=kdc,cn=sysaccounts,cn=etc,dc=f9test -w
KQVEZWESOEZM create -s -P GQJRJIQOIJOQ -r F9TEST -subtrees dc=f9test -sscope
sub' returned non-zero exit status 1
  [6/13]: adding default keytypes
root        : CRITICAL Failed to load default-keytypes.ldif: Command
'/usr/bin/ldapmodify -h 127.0.0.1 -xv -D cn=Directory Manager -w password -f
/tmp/tmp1hIuoU' returned non-zero exit status 32
  [7/13]: creating a keytab for the directory
Unexpected error - see ipaserver-install.log for details:
 Command '/usr/kerberos/sbin/kadmin.local -q addprinc -randkey
ldap/f9ipa.example.com@F9TEST' returned non-zero exit status 1



Version-Release number of selected component (if applicable):
ipa-server-1.0.0-6

How reproducible:
always

Steps to Reproduce:
1. run ipa-server-install
2.
3.
  
Actual results:
errors

Expected results:
ipa server to cleanly install.

Additional info: I've only tried this in Xen VMs on RHEL5 (both i386 and x86_64)
Comment 1 Rob Crittenden 2008-05-25 23:32:25 EDT
Can you attach /var/log/ipaserver-install.log?
Comment 2 Brian J. Atkisson 2008-05-26 12:06:37 EDT
Created attachment 306687 [details]
ipaserver-install.log
Comment 3 Brian J. Atkisson 2008-05-26 12:10:58 EDT
Note: I see the same error with the Enterprise IPA beta as well.
Comment 4 Rob Crittenden 2008-05-27 09:28:32 EDT
Looks like your domain is 'f9test'. Try f9test.com (.net, .whatever).

At least a 2-part domain is required. This is fixed in the IPA tip but hasn't
made its way into Fedora yet.
Comment 5 Brian J. Atkisson 2008-05-27 09:51:14 EDT
Using a three part realm name (BLEH.TEST.REALM) seemed to let the install
proceed.  Thanks.
Comment 6 Rob Crittenden 2008-05-27 10:49:27 EDT
Closing this as fixed UPSTREAM. This will be fixed in the next release of IPA.
Comment 7 Michael Gregg 2008-11-19 19:24:34 EST
Verified against:
1.1.0-2.20081119.el5ipa  

Output from install:

Excluded by options:
  * Configure the Network Time Daemon (ntpd)

To accept the default shown in brackets, press the Enter key.

The domain name has been calculated based on the host name.

The IPA Master Server will be configured with
Hostname:    ipaqa-64vm.dsqa.sjc2.redhat.com
IP address:  10.14.0.135
Domain name: dsqa.sjc2.redhat.com

Configuring directory server:
  [1/17]: creating directory server user
  [2/17]: creating directory server instance
  [3/17]: adding default schema
  [4/17]: enabling memberof plugin
  [5/17]: enabling referential integrity plugin
  [6/17]: enabling distributed numeric assignment plugin
  [7/17]: enabling winsync plugin
  [8/17]: configuring uniqueness plugin
  [9/17]: creating indices
  [10/17]: configuring ssl for ds instance
  [11/17]: configuring certmap.conf
  [12/17]: restarting directory server
  [13/17]: adding default layout
  [14/17]: configuring Posix uid/gid generation as first master
  [15/17]: adding master entry as first master
  [16/17]: initializing group membership
  [17/17]: configuring directory to start on boot
done configuring dirsrv.
Configuring Kerberos KDC
  [1/13]: setting KDC account password
  [2/13]: adding sasl mappings to the directory
  [3/13]: adding kerberos entries to the DS
  [4/13]: adding default ACIs
  [5/13]: configuring KDC
  [6/13]: adding default keytypes
  [7/13]: creating a keytab for the directory
  [8/13]: creating a keytab for the machine
  [9/13]: exporting the kadmin keytab
  [10/13]: adding the password extension to the directory
  [11/13]: adding the kerberos master key to the directory
  [12/13]: starting the KDC
  [13/13]: configuring KDC to start on boot
done configuring krb5kdc.
Configuring ipa_kpasswd
  [1/2]: starting ipa_kpasswd
  [2/2]: configuring ipa_kpasswd to start on boot
done configuring ipa_kpasswd.
Configuring the web interface
  [1/10]: disabling mod_ssl in httpd
  [2/10]: Setting mod_nss port to 443
  [3/10]: Adding URL rewriting rules
  [4/10]: configuring httpd
  [5/10]: creating a keytab for httpd
  [6/10]: Setting up ssl
  [7/10]: Setting up browser autoconfig
  [8/10]: configuring SELinux for httpd
  [9/10]: restarting httpd
  [10/10]: configuring httpd to start on boot
done configuring httpd.
Configuring ipa_webgui
  [1/2]: starting ipa_webgui
  [2/2]: configuring ipa_webgui to start on boot
done configuring ipa_webgui.
Configuring bind:
  [1/5]: Setting up our zone
  [2/5]: Setting up named.conf
  [3/5]: restarting named
  [4/5]: configuring named to start on boot
  [5/5]: Changing resolv.conf to point to ourselves
done configuring named.
Applying LDAP updates
restarting the directory server
restarting the KDC
==============================================================================
Setup complete

Next steps:
        1. You must make sure these network ports are open:
                TCP Ports:
                  * 80, 443: HTTP/HTTPS
                  * 389, 636: LDAP/LDAPS
                  * 88, 464: kerberos
                  * 53: bind
                UDP Ports:
                  * 88, 464: kerberos
                  * 53: bind

        2. You can now obtain a kerberos ticket using the command: 'kinit admin'
           This ticket will allow you to use the IPA tools (e.g., ipa-adduser)
           and the web user interface.
        3. Kerberos requires time synchronization between clients
           and servers for correct operation. You should consider enabling ntpd.

Be sure to back up the CA certificate stored in /etc/dirsrv/slapd-DSQA-SJC2-REDHAT-COM/cacert.p12
The password for this file is in /etc/dirsrv/slapd-DSQA-SJC2-REDHAT-COM/pwdfile.txt
+ ret=0
+ [ 0 -ne 0 ]

Note You need to log in before you can comment on or make changes to this bug.