Hi All,
As you might be interested, today we re-attempted to create a replica.
Apparently, exactly the same problem was reported to Red Hat Bugzilla ten days
ago: https://bugzilla.redhat.com/show_bug.cgi?id=1432016
Our replica install also fails on the following point:
[...]
Done configuring directory server (dirsrv).
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30
seconds
[1/27]: creating certificate server user
[2/27]: configuring certificate server instance
[3/27]: stopping certificate server instance to update CS.cfg
[4/27]: backing up CS.cfg
[5/27]: disabling nonces
[6/27]: set up CRL publishing
[7/27]: enable PKIX certificate path discovery and validation
[8/27]: starting certificate server instance
< hangs here indefinitely >
At this moment we are thus stuck and waiting for the new package to be released.
Thanks for the pointers!
Bennie
-------- Original Message --------
Subject: Re: [Freeipa-users] FreeIPA update guidance
Local Time: 21 april 2017 5:55 PM
UTC Time: 21 april 2017 15:55
From: b.harr...@protonmail.com
To: Jochen Hein <joc...@jochen.org>
freeipa-users\@redhat.com <freeipa-users@redhat.com>
Hi Jochen,
Thanks for your quick reply! As I just left the office I don't have the log
ATM. The installation however failed after setting up de Tomcat PKI service,
where the ipa-replica-install script was waiting for the service to come up.
While manually trying to reach the service using Curl, I also never got a
response. After running the Tomcat PKI service manually, I got an error stating
that the user "cn=<replica>,cn=config" doesn't exist in the directory. When
manually querying the directory I noticed the same, it did however exist with
an additional CN. I will retry the replication excersise next monday and
hopefully your tip will help me. Then I can also provide the logs. I will keep
you updated!
Thanks,
Bennie
-------- Original Message --------
Subject: Re: [Freeipa-users] FreeIPA update guidance
Local Time: April 21, 2017 5:29 PM
UTC Time: April 21, 2017 3:29 PM
From: joc...@jochen.org
To: B.harries <b.harr...@protonmail.com>
freeipa-users\@redhat.com <freeipa-users@redhat.com>
"B.harries" <b.harr...@protonmail.com> writes:
> Second attempt
> We then tried to install a fresh CentOS server, having FreeIPA version
> 4.4 and attaching it as a second master to our IPA instance. This
> however didn't work out as well,
I did that to move my installation from Fedora to CentOS - it worked
quite well. First adding a replica failed, because python-jwcrypto on
CentOS is quite old. I've installed the package from Fedora
(python-jwcrypto-0.3.2-1.fc23.noarch.rpm) and all went well. After I
decomissioned the Fedora system I've downgraded the package again.
That's what I found:
https://www.redhat.com/archives/freeipa-users/2016-December/msg00024.html
(Re: [Freeipa-users] Add 4.4 replica to 4.3 server fails)
Can you provide logs/messages what didn't work?
Jochen
--
This space is intentionally left blank.
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
