RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 924077 - IPA fails to start if Dogtag is too slow
Summary: IPA fails to start if Dogtag is too slow
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-03-21 06:53 UTC by Martin Kosek
Modified: 2014-06-18 00:07 UTC (History)
3 users (show)

Fixed In Version: ipa-3.2.1-1.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 13:30:23 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Martin Kosek 2013-03-21 06:53:54 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3492

The IPA startup script is supposed to keep checking Dogtag's status for 2 minutes until it's up and running (see ipapython/platform/fedora16.py lines 160-166):

{{{
while time.time() < op_timeout
    status = dogtag.ca_status()
    if status == 'running':
        break
      time.sleep(1)
}}}

However, this code also assumes that ca_status() would return immediately and not throw an exception. The problem is the ca_status() uses an HTTP GET operation to check Dogtag's status. Under some circumstances Dogtag may take a long time to respond, so the HTTP GET may time out much earlier than 2 minutes. And since the above code doesn't catch the exception, the whole loop fails immediately, so it doesn't wait for a full 2 minutes as expected.

One possible solution is to catch the exception, either in the above loop or inside ca_status().

Related Dogtag issue:
* https://fedorahosted.org/pki/ticket/524
Comment 1 Namita Soman 2013-03-21 19:23:04 UTC 
Pleae provide steps to reproduce and verify
Comment 2 Martin Kosek 2013-03-22 07:27:44 UTC 
With Fedora 18, reproduction is easy - one just needs to restart ipa services:

# ipactl restart

It waits on pki-ca starting up, but it ends with error before the specified startup timeout (120 seconds by default) passes.

With this fix, ipactl will properly wait for specified startup timeout time or until the pki-ca service is up and running. To increase the timeout, default.conf can be configured:

echo "startup_timeout=200" >> /etc/ipa/default.conf
Comment 3 Martin Kosek 2013-03-22 07:28:00 UTC 
Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/41031fe121d6ec8bc9a6bb48b62068a9af905dc3
ipa-3-1: https://fedorahosted.org/freeipa/changeset/4f8c88988eb14f59df37750d8be31e45d7ebf55c
Comment 6 Xiyang Dong 2014-01-13 18:48:48 UTC 
Verified on ipa-server-3.3.3-6.el7.x86_64 :

:: [ 13:50:06 ] ::  running "echo 'startup_timeout=200' >> /etc/ipa/default.conf"
:: [   PASS   ] :: set specified startup timeout time that ipactl should wait for (Expected 0, got 0)
:: [ 13:50:06 ] ::  running 'ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting ipa_memcached Service
Restarting httpd Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
ipa: INFO: The ipactl command was successful
:: [   PASS   ] :: ipactl will wait for specified startup timeout time or until the pki-tomcatd service is up and running and ends up with no errors (Expected 0, got 0)
Comment 7 Ludek Smid 2014-06-13 13:30:23 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.