[Freeipa-users] Problem in CLI after upgrade to 4.1.0

2015-07-16 Thread Nicola Canepa

I upgraded from freeipa 4.0 to ipa-4.1.0
Users continue to be authenticated, and web GUI works, but from command 
line for every ipa command (after autheiticating with kinit), I get:

[root@ldap-01 ~]# ipa config-show
ipa: ERROR: cannot connect to 'https://ldap-01.mmfg.it/ipa/json': 
(SEC_ERROR_LEGACY_DATABASE) The certificate/key database is in an old, 
unsupported format.


Nicola

--

Nicola Canepa
Tel: +39-0522-399-3474
canep...@mmfg.it
---
Il contenuto della presente comunicazione è riservato e destinato 
esclusivamente ai destinatari indicati. Nel caso in cui sia ricevuto da persona 
diversa dal destinatario sono proibite la diffusione, la distribuzione e la 
copia. Nel caso riceveste la presente per errore, Vi preghiamo di informarci e 
di distruggerlo e/o cancellarlo dal Vostro computer, senza utilizzare i dati 
contenuti. La presente comunicazione (comprensiva dei documenti allegati) non 
avrà valore di proposta contrattuale e/o accettazione di proposte provenienti 
dal destinatario, nè rinuncia o riconoscimento di diritti, debiti e/o crediti, 
nè sarà impegnativa, qualora non sia sottoscritto successivo accordo da chi può 
validamente obbligarci. Non deriverà alcuna responsabilità precontrattuale a 
ns. carico, se la presente non sia seguita da contratto sottoscritto dalle 
parti.

The content of the above communication is strictly confidential and reserved 
solely for the referred addressees. In the event of receipt by persons 
different from the addressee, copying, alteration and distribution are 
forbidden. If received by mistake we ask you to inform us and to destroy and/or 
delete from your computer without using the data herein contained. The present 
message (eventual annexes inclusive) shall not be considered a contractual 
proposal and/or acceptance of offer from the addressee, nor waiver recognizance 
of rights, debts  and/or credits, nor shall it be binding when not executed as 
a subsequent agreement by persons who could lawfully represent us. No 
pre-contractual liability shall apply to us when the present communication is 
not followed by any binding agreement between the parties.

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project


Re: [Freeipa-users] Problem in CLI after upgrade to 4.1.0

2015-07-16 Thread Nicola Canepa
I think the problem is the upgrade from freeipa-* to ipa-*, which does not run 
the scripts cortectly.
Previously I had to run:

/usr/sbin/ipa-ldap-updater --upgrade --quiet /dev/null || 
:/usr/sbin/ipa-upgradeconfig --quiet /dev/null || :

/bin/systemctl enable ipa.service 


Noe I also needed:

python2 -c 'from ipapython.certdb import create_ipa_nssdb; create_ipa_nssdb()'
tempfile=$(mktemp)
if certutil -L -d /etc/pki/nssdb -n 'IPA CA' -a $tempfile 
2/var/log/ipaupgrade.log; then
certutil -A -d /etc/ipa/nssdb -n 'IPA CA' -t CT,C,C -a -i $tempfile 
/var/log/ipaupgrade.log 21
elif certutil -L -d /etc/pki/nssdb -n 'External CA cert' -a $tempfile 
2/var/log/ipaupgrade.log; then
certutil -A -d /etc/ipa/nssdb -n 'External CA cert' -t C,, -a -i 
$tempfile /var/log/ipaupgrade.log 21
fi
rm -f $tempfile

And also the ipa commands work correctly.

Nicola

Il 16 Luglio 2015 14:01:47 CEST, Nicola Canepa canep...@mmfg.it ha scritto:
I upgraded from freeipa 4.0 to ipa-4.1.0
Users continue to be authenticated, and web GUI works, but from command

line for every ipa command (after autheiticating with kinit), I get:
 [root@ldap-01 ~]# ipa config-show
 ipa: ERROR: cannot connect to 'https://ldap-01.mmfg.it/ipa/json': 
 (SEC_ERROR_LEGACY_DATABASE) The certificate/key database is in an
old, 
 unsupported format.

Nicola

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project