Hide Forgot
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/2415 If certutil call fails for some reason, exception is not handled and client installation is not rolled back. Attachments: Client_first_try attachment: ipa-client-install with failing certutil. Certutil failed because mess in filesystem. Client was accidentaly installed on ipa-server. Problem with messed files solved by "ipa-server-install --uninstall". Client_second_try - ipa-client-install fails, probably because duplicated host is in LDAP - result of missing rollback/exception handling in first try Affected version: freeipa-client-2.1.4-4.fc16.x86_64
delete /etc/pki/nssdb directory and then run ipa-client-install to verify this issue
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/71d134dfa03eb86066eeb331815647bdff04aaa8 ipa-2-2: https://fedorahosted.org/freeipa/changeset/cada19d71f832a9ae9109f8de1050a462300e3a3
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: No documentation needed.
Verified. Now, ipa-client installation is rolledback properly when exception raised from certutil call. "Failed to add CA to the default NSS database. Installation failed. Rolling back changes." ipa-client version: =================== [root@ipaclient1 ~]# rpm -q ipa-client ipa-client-2.2.0-11.el6.x86_64 [root@ipaclient1 ~]# Steps used to verify: ==================== (1)Rename /etc/pki/nssdb which will raise exception for certutil call from ipa-client (2)Run ipa-client-install [root@ipaclient1 ~]# ipa-client-install -p admin -w Secret123 -U Discovery was successful! Hostname: ipaclient1.testrelm.com Realm: TESTRELM.COM DNS Domain: testrelm.com IPA Server: ipa63server.testrelm.com BaseDN: dc=testrelm,dc=com Synchronizing time with KDC... Enrolled in IPA realm TESTRELM.COM Created /etc/ipa/default.conf Domain testrelm.com is already configured in existing SSSD config, creating a new one. The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. Configured /etc/sssd/sssd.conf Failed to add CA to the default NSS database. Installation failed. Rolling back changes. [root@ipaclient1 ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0819.html