Red Hat Bugzilla – Bug 831313
ipa-replica-install enable GSSAPI for replication list index out of range failure
Last modified: 2013-02-21 04:15:34 EST
Description of problem: ipa-replica-install fails after [7/9]: enable GSSAPI for replication with failure "list index out of range". With some help from Rob: <rcrit> spoore, I think this will get resolved as part of ticket https://fedorahosted.org/freeipa/ticket/2737 <rcrit> at the time we tried to set up replication one of the principals wasn't available yet Version-Release number of selected component (if applicable): ipa-server-2.2.0-16.el6.x86_64 krb5-server-1.9-33.el6.x86_64 389-ds-base-1.2.10.2-17.el6_3.x86_64 How reproducible: Unknown. have seen this a few times now running automated tests. Steps to Reproduce: 1. <Setup RHEL 6.3 IPA Master> 2. ipa-replica-prepare -p <PASSWORD> --ip-address=<host_ip> <hostname.domain> 3. <Setup RHEL 6.3 server and prep to install Replica> 4. <sftp replica package gpg file to /dev/shm on replica> 5. ipa-replica-install -U --setup-dns --forwarder=<Fordwarder_IP> -w <PASSWORD> -p <PASSWORD> /dev/shm/replica-info-<hostname.domain>.gpg Actual results: sometimes (frequency unknown as it is a timing issue) will see this: 2012-06-12T16:05:18Z DEBUG duration: 0 seconds 2012-06-12T16:05:18Z DEBUG [7/9]: enable GSSAPI for replication 2012-06-12T16:05:18Z INFO Setting agreement cn=meToibm-x3655-04.testrelm.com,cn=replica,cn=dc\3Dtestrelm\2Cdc\3Dcom,cn=mapping tree,cn=config schedule to 2358-2359 0 to force synch 2012-06-12T16:05:19Z INFO Deleting schedule 2358-2359 0 from agreement cn=meToibm-x3655-04.testrelm.com,cn=replica,cn=dc\3Dtestrelm\2Cdc\3Dcom,cn=mapping tree,cn=config 2012-06-12T16:05:20Z INFO Replication Update in progress: FALSE: status: 3 Replication error acquiring replica: permission denied: start: 0: end: 0 2012-06-12T16:05:20Z INFO Setting agreement cn=meToipaqa64vma.testrelm.com,cn=replica,cn=dc\3Dtestrelm\2Cdc\3Dcom,cn=mapping tree,cn=config schedule to 2358-2359 0 to force synch 2012-06-12T16:05:21Z INFO Deleting schedule 2358-2359 0 from agreement cn=meToipaqa64vma.testrelm.com,cn=replica,cn=dc\3Dtestrelm\2Cdc\3Dcom,cn=mapping tree,cn=config 2012-06-12T16:05:22Z INFO Replication Update in progress: TRUE: status: 0 Replica acquired successfully: Incremental update started: start: 20120612160521Z: end: 0 2012-06-12T16:05:23Z INFO Replication Update in progress: TRUE: status: 0 Replica acquired successfully: Incremental update started: start: 20120612160521Z: end: 0 2012-06-12T16:05:24Z INFO Replication Update in progress: FALSE: status: 0 Replica acquired successfully: Incremental update succeeded: start: 20120612160521Z: end: 20120612160523Z 2012-06-12T16:05:24Z DEBUG list index out of range File "/usr/sbin/ipa-replica-install", line 496, in <module> main() File "/usr/sbin/ipa-replica-install", line 441, in main krb = install_krb(config, setup_pkinit=options.setup_pkinit) File "/usr/sbin/ipa-replica-install", line 163, in install_krb setup_pkinit, pkcs12_info) File "/usr/lib/python2.6/site-packages/ipaserver/install/krbinstance.py", line 207, in create_replica self.start_creation("Configuring Kerberos KDC", 30) File "/usr/lib/python2.6/site-packages/ipaserver/install/service.py", line 257, in start_creation method() File "/usr/lib/python2.6/site-packages/ipaserver/install/krbinstance.py", line 442, in __convert_to_gssapi_replication r_bindpw=self.dm_password) File "/usr/lib/python2.6/site-packages/ipaserver/install/replication.py", line 833, in convert_to_gssapi_replication self.gssapi_update_agreements(self.conn, r_conn) File "/usr/lib/python2.6/site-packages/ipaserver/install/replication.py", line 557, in gssapi_update_agreements self.setup_krb_princs_as_replica_binddns(a, b) File "/usr/lib/python2.6/site-packages/ipaserver/install/replication.py", line 550, in setup_krb_princs_as_replica_binddns mod = [(ldap.MOD_ADD, "nsds5replicabinddn", a_pn[0].dn)] Expected results: No failure. Additional info: Similar to
Upstream ticket: https://fedorahosted.org/freeipa/ticket/2737
Fixed upstream. master: 6bb462e26a814e683b3ec5b39d2ff9a1db8fa4ec Wait longer and look explicitly for the principals we need to be sure they exist before proceeding with converting the replication agreement.
Verified. Version :: ipa-server-3.0.0-8.el6.x86_64 Manual Test Results :: [root@rhel6-2 log]# ipa-replica-install -U --setup-dns --forwarder=$DNSFORWARD -w $ADMINPW -p $ADMINPW /dev/shm/replica-info-$SLAVE_S.$DOMAIN.gpg Run connection check to master Check connection from replica to remote master 'rhel6-1.testrelm.com': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos Kpasswd: TCP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK The following list of ports use UDP protocol and would need to be checked manually: Kerberos KDC: UDP (88): SKIPPED Kerberos Kpasswd: UDP (464): SKIPPED Connection from replica to master is OK. Start listening on required ports for remote master check Get credentials to log in to remote master Execute check on remote master Check connection from master to remote replica 'rhel6-2.testrelm.com': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos KDC: UDP (88): OK Kerberos Kpasswd: TCP (464): OK Kerberos Kpasswd: UDP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK Connection from master to replica is OK. Connection check OK Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv): Estimated time 1 minute [1/31]: creating directory server user [2/31]: creating directory server instance [3/31]: adding default schema [4/31]: enabling memberof plugin [5/31]: enabling winsync plugin [6/31]: configuring replication version plugin [7/31]: enabling IPA enrollment plugin [8/31]: enabling ldapi [9/31]: disabling betxn plugins [10/31]: configuring uniqueness plugin [11/31]: configuring uuid plugin [12/31]: configuring modrdn plugin [13/31]: enabling entryUSN plugin [14/31]: configuring lockout plugin [15/31]: creating indices [16/31]: enabling referential integrity plugin [17/31]: configuring ssl for ds instance [18/31]: configuring certmap.conf [19/31]: configure autobind for root [20/31]: configure new location for managed entries [21/31]: restarting directory server [22/31]: setting up initial replication Starting replication, please wait until this has completed. Update in progress Update in progress Update in progress Update in progress Update succeeded [23/31]: adding replication acis [24/31]: setting Auto Member configuration [25/31]: enabling S4U2Proxy delegation [26/31]: initializing group membership [27/31]: adding master entry [28/31]: configuring Posix uid/gid generation [29/31]: enabling compatibility plugin [30/31]: tuning directory server [31/31]: configuring directory to start on boot Done configuring directory server (dirsrv). Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds [1/9]: adding sasl mappings to the directory [2/9]: writing stash file from DS [3/9]: configuring KDC [4/9]: creating a keytab for the directory [5/9]: creating a keytab for the machine [6/9]: adding the password extension to the directory [7/9]: enable GSSAPI for replication [8/9]: starting the KDC [9/9]: configuring KDC to start on boot Done configuring Kerberos KDC (krb5kdc). Configuring kadmin [1/2]: starting kadmin [2/2]: configuring kadmin to start on boot Done configuring kadmin. Configuring ipa_memcached [1/2]: starting ipa_memcached [2/2]: configuring ipa_memcached to start on boot Done configuring ipa_memcached. Configuring the web interface (httpd): Estimated time 1 minute [1/13]: disabling mod_ssl in httpd [2/13]: setting mod_nss port to 443 [3/13]: setting mod_nss password file [4/13]: enabling mod_nss renegotiate [5/13]: adding URL rewriting rules [6/13]: configuring httpd [7/13]: setting up ssl [8/13]: publish CA cert [9/13]: creating a keytab for httpd [10/13]: clean up any existing httpd ccache [11/13]: configuring SELinux for httpd [12/13]: restarting httpd [13/13]: configuring httpd to start on boot Done configuring the web interface (httpd). Applying LDAP updates Restarting the directory server Restarting the KDC Using reverse zone 122.168.192.in-addr.arpa. Configuring DNS (named) [1/8]: adding NS record to the zone [2/8]: setting up reverse zone [3/8]: setting up our own record [4/8]: setting up kerberos principal [5/8]: setting up named.conf [6/8]: restarting named [7/8]: configuring named to start on boot [8/8]: changing resolv.conf to point to ourselves Done configuring DNS (named). Global DNS configuration in LDAP server is empty You can use 'dnsconfig-mod' command to set global DNS options that would override settings in local named.conf files Restarting the web server From /var/log/ipareplica-install.log: 2012-11-26T20:33:09Z DEBUG [7/9]: enable GSSAPI for replication 2012-11-26T20:33:09Z DEBUG flushing ldaps://rhel6-2.testrelm.com:636 from SchemaCache 2012-11-26T20:33:09Z DEBUG retrieving schema for SchemaCache url=ldaps://rhel6-2.testrelm.com:636 conn= <ldap.ldapobject.SimpleLDAPObject instance at 0x4aaffc8> 2012-11-26T20:33:09Z DEBUG flushing ldaps://rhel6-1.testrelm.com:636 from SchemaCache 2012-11-26T20:33:09Z DEBUG retrieving schema for SchemaCache url=ldaps://rhel6-1.testrelm.com:636 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x4ab5998> 2012-11-26T20:33:09Z INFO Setting agreement cn=meTorhel6-1.testrelm.com,cn=replica,cn=dc\=testrelm\,dc\=com,cn=mapping tree,cn=config schedule to 2358-2359 0 to force synch 2012-11-26T20:33:10Z INFO Deleting schedule 2358-2359 0 from agreement cn=meTorhel6-1.testrelm.com,cn=replica,cn=dc\=testrelm\,dc\=com,cn=mapping tree,cn=config 2012-11-26T20:33:11Z INFO Replication Update in progress: FALSE: status: 0 Replica acquired successfully: Incremental update succeeded: start: 0: end: 0 2012-11-26T20:33:11Z INFO Setting agreement cn=meTorhel6-2.testrelm.com,cn=replica,cn=dc\=testrelm\,dc\=com,cn=mapping tree,cn=config schedule to 2358-2359 0 to force synch 2012-11-26T20:33:12Z INFO Deleting schedule 2358-2359 0 from agreement cn=meTorhel6-2.testrelm.com,cn=replica,cn=dc\=testrelm\,dc\=com,cn=mapping tree,cn=config 2012-11-26T20:33:13Z INFO Replication Update in progress: FALSE: status: 0 Replica acquired successfully: Incremental update succeeded: start: 0: end: 0 2012-11-26T20:33:13Z INFO Getting ldap service principals for conversion: (krbprincipalname=ldap/rhel6-2.testrelm.com@TESTRELM.COM) and (krbprincipalname=ldap/rhel6-1.testrelm.com@TESTRELM.COM) 2012-11-26T20:33:13Z DEBUG Found both principals. 2012-11-26T20:33:13Z DEBUG duration: 4 seconds I saw the above results 4 times in a row and have not run into this bug since 3.0.0-1 was released in all of my testing in the last 2+ months.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html