Hide Forgot
Created attachment 475043 [details] IPA server installation log showing the client side Description of problem: The IPA installer attempts to create an RA user, issue a certificate for it and use it for all subsequent RA operations. The creation of the user is failing, we aren't getting back the expected certificate (hence the b64_cert error). The error apparently being returned by the CA is Authorization Error but as far as I can tell authorization was successful. The request just seems to stop in the CA debug log. Version-Release number of selected component (if applicable): pki-ca-9.0.1-2.svn.1762M.20110121T1347z.fc14.noarch How reproducible: Only one user has reported this, I have been unable to reproduce.
Created attachment 475044 [details] CA debug log
From attachment 475043 [details]: errorReason="Authorization Error"; errorCode="1"; From attachment 475044 [details]: [24/Jan/2011:12:06:09][http-9443-1]: ProfileProcessServlet: Missing nonce [24/Jan/2011:12:06:09][http-9443-1]: ProfileProcessServlet: nonceVerified=false Above log entries are consistent with CS.cfg file containing: ca.enableNonces=true
Suggestion: RA certificate could be obtained in single step by using profile similar to caAgentServerCert instead of using caServerCert profile.
some test details, seem tot work just fine with last builds: Fedora release 14 (Laughlin) Linux ipaserver2.example.com 2.6.35.10-74.fc14.x86_64 #1 SMP Thu Dec 23 16:04:50 UTC 2010 x86_64 x86_64 x86_64 GNU/Linux freeipa-admintools-2.0-0.2011013122git41abde2.fc14.x86_64 freeipa-client-2.0-0.2011013122git41abde2.fc14.x86_64 freeipa-server-selinux-2.0-0.2011013122git41abde2.fc14.x86_64 freeipa-python-2.0-0.2011013122git41abde2.fc14.x86_64 freeipa-server-2.0-0.2011013122git41abde2.fc14.x86_64 pki-ca-9.0.1-2.fc14.noarch osutil-9.0.0-1.fc14.x86_64 dogtag-pki-ca-theme-9.0.0-3.fc14.noarch dogtag-pki-common-theme-9.0.0-3.fc14.noarch jss-4.2.6-12.fc14.x86_64 tomcatjss-2.1.0-1.fc14.noarch ipa-server-install --realm=EXAMPLE.COM --domain=example.com --ds-password=password --master-password=password --admin-password=password --hostname=ipaserver2.example.com --idstart=1000 --setup-dns --forwarder=10.14.7.221 --zonemgr=msauton and got in the CA debug log: /var/log/pki-ca/debug ...snip... [31/Jan/2011:17:21:21][http-9443-1]: CMSServlet:service() uri = /ca/agent/ca/profileProcess ...snip... [31/Jan/2011:17:21:21][http-9443-1]: CMSServlet::service() param name='name' value='CN=RA Subsystem,O=EXAMPLE.COM' [31/Jan/2011:17:21:21][http-9443-1]: CMSServlet: caProfileProcess start to service. [31/Jan/2011:17:21:21][http-9443-1]: IP: 10.14.5.15 [31/Jan/2011:17:21:21][http-9443-1]: AuthMgrName: certUserDBAuthMgr [31/Jan/2011:17:21:21][http-9443-1]: CMSServlet: retrieving SSL certificate [31/Jan/2011:17:21:21][http-9443-1]: CMSServlet: certUID=CN=ipa-ca-agent,O=EXAMPLE.COM [31/Jan/2011:17:21:21][http-9443-1]: CertUserDBAuth: started [31/Jan/2011:17:21:21][http-9443-1]: CertUserDBAuth: Retrieving client certificate [31/Jan/2011:17:21:21][http-9443-1]: CertUserDBAuth: Got client certificate [31/Jan/2011:17:21:21][http-9443-1]: Authentication: client certificate found ...snip... [31/Jan/2011:17:21:21][http-9443-1]: authenticated uid=admin,ou=people,o=ipaca ...snip... [31/Jan/2011:17:21:21][http-9443-1]: evaluated expression: group="Certificate Manager Agents" to be true ...snip... [31/Jan/2011:17:21:21][http-9443-1]: ProfileProcessServlet: start serving [31/Jan/2011:17:21:21][http-9443-1]: ProfileProcessServlet: SubId=profile [31/Jan/2011:17:21:21][http-9443-1]: ProfileProcessServlet: requestId=7 the servlet ProfileProcessServlet went through as expected for this enrollment.
The nonce error is a real head scratcher because we set it to false and then restart the server. This worked for everyone but the one user who reported the problem. He added another restart right before we start fetching the agent cert and it fixed things.
Old and new CA logs provided consistently report that nonces are enabled (see: log entries including "CertificateAuthority init: Nonces enabled."). Nonces are enable in CA by default, which means that absence of the following line "ca.enableNonces=false" in CS.cfg file will result in CA requiring nonces. CS team is unable reproduce this issue. This issue could be avoided by obtaining RA certificate in single step (not 2 steps). Obtaining RA certificate in single step can be achieved by using enrollment authenticated by agent. CA provides sample profile (caAgentServerCert) allowing for such enrollment. Replacing caServerCert with caAgentServerCert profile should be relatively simple since both enrollments use the same parameters.