Re: [Freeipa-users] FreeIPA-Samba4 integration?

2010-08-12 Thread Endi Sukma Dewata
Hi Attila, Attila Bogár wrote: I would like to deploy an integrated Samba4 / FreeIPA environment. I would like to enquire, what's the current status of FreeIPA 1.9.0.pre4 and Samba4 integration. The integration plan that I was involved with was between IPA v3 and Samba 4. But this plan has

Re: [Freeipa-users] PKI-CA fails to start (broken config after update?)

2014-09-24 Thread Endi Sukma Dewata
On 9/23/2014 6:35 PM, swartz wrote: On 9/22/2014 7:59 PM, Ade Lee wrote: If you scroll to the end of the CS.cfg, does it look like it has been truncated? I'd have to say no. It doesn't look truncated to me. At least there are no obvious signs. But then again I don't know everything that is

Re: [Freeipa-users] Problems and questions installing Identity Manager on RHEL V7

2014-10-03 Thread Endi Sukma Dewata
On 10/3/2014 2:30 AM, Alexander Bokovoy wrote: This issue is known -- when CA install fails, we rollback but since CA isn't installed, we miss rolling it back. There is a ticket for eventually fixing this issue. Which ticket is this? The rollback was actually disabled to allow troubleshooting

Re: [Freeipa-users] bug in pki during install of CA replica and workaround/solution

2015-02-06 Thread Endi Sukma Dewata
On 2/6/2015 8:39 AM, Martin Kosek wrote: Reinstalling the pki-selinux rpm (found references in some other forum posts) via yum reinstall pki-selinux is not enough to help. The solution is as follows: yum downgrade pki-selinux pki-ca pki-common pki-setup pki-silent pki-java-tools pki-symkey

Re: [Freeipa-users] Redhat/Centos iDM 3.0 to 3.1 upgrade fail

2015-01-14 Thread Endi Sukma Dewata
Hi, I need some information from you. Which versions of the PKI packages that you are using on the CentOS 6.6 and 7.0 machines? Could you email me the PKI CA debug logs (/var/log/pki-ca/debug or /var/log/pki/pki-tomcat/ca/debug) from both machines? There's a possibility it may be related to

Re: [Freeipa-users] Trouble installing F21 4.1.2 replica from F20 3.3.5 master

2015-01-05 Thread Endi Sukma Dewata
On 1/5/2015 8:53 PM, Martin Kosek wrote: On 01/05/2015 02:05 PM, Anthony Messina wrote: I was hoping to migrate from F20 to F21 using: http://www.freeipa.org/page/Howto/Migration http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master The migration procedure is only needed if

Re: [Freeipa-users] Trouble installing F21 4.1.2 replica from F20 3.3.5 master

2015-01-06 Thread Endi Sukma Dewata
On 1/6/2015 4:55 AM, Anthony Messina wrote: I'm discussing this with Ade (CC'd). Based on the stack trace it looks like the replica thinks the master returns an incomplete information about the security domain, probably due to the different Dogtag versions used in master and replica. We need

Re: [Freeipa-users] ipa-server setup with external CA fails

2015-03-11 Thread Endi Sukma Dewata
On 3/11/2015 10:13 PM, Gould, Joshua wrote: The selftests.log contradicts itself and I¹m not really sure where to look next. Any ideas? There's an existing ticket about the confusing selftest messages: https://fedorahosted.org/pki/ticket/1249 Could you post the full CA debug log (i.e.

Re: [Freeipa-users] Having Issues with Dogtag After Updating IPA and Rebooting

2015-03-25 Thread Endi Sukma Dewata
http://www.colovore.com On Mon, Mar 23, 2015 at 1:36 PM, Endi Sukma Dewata edew...@redhat.com mailto:edew...@redhat.com wrote: Thanks for the info. The transaction log doesn't indicate the cause of the problem either. I might need to provide a custom build

Re: [Freeipa-users] Unable to Install IPA

2015-03-03 Thread Endi Sukma Dewata
On 2/28/2015 1:01 PM, Hadoop Solutions wrote: Hi Rob, please find the attached log of /var/log/ipaserver-install.log kindly let me know the solution for this.. Thanks, Shaik Hi, I see this near the bottom of the ipaserver-install.log. #

Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED

2015-02-25 Thread Endi Sukma Dewata
On 2/25/2015 6:35 PM, Martin Kosek wrote: yum -y remove pki-selinux pki-ca pki-common pki-setup pki-silent pki-java-tools pki-symkey pki-util pki-native-tools ipa-server-selinux ipa-server ipa-client ipa-admintools ipa-python ipa-pki-ca-theme ipa-pki-common-theme 389-ds-base 389-ds-base-libs

Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED

2015-02-25 Thread Endi Sukma Dewata
On 2/26/2015 8:02 AM, Les Stott wrote: rm -rf /etc/pki-ca /var/lib/pki-ca /var/log/pki-ca /etc/certmonger /etc/sysconfig/pki-ca /etc/sysconfig/pki /var/run/pki-ca.pid /usr/share/pki /etc/ipa /var/log/ipa* reboot Now you have a clean slate. Do you know which step of the steps above actually

Re: [Freeipa-users] Having Issues with Dogtag After Updating IPA and Rebooting

2015-03-23 Thread Endi Sukma Dewata
On 3/23/2015 12:10 PM, Michael Pawlak wrote: Rob, Thanks. Any additional eyes would be greatly apprecated. *Michael Pawlak* Web Systems Administrator | Colovore LLC E: m...@colovore.com mailto:m...@colovore.com C: 408.316.2154 http://www.colovore.com On Mon, Mar 23, 2015 at 6:24 AM, Rob

Re: [Freeipa-users] Unable to Install IPA

2015-03-23 Thread Endi Sukma Dewata
On 3/3/2015 8:19 AM, Endi Sukma Dewata wrote: On 2/28/2015 1:01 PM, Hadoop Solutions wrote: Hi Rob, please find the attached log of /var/log/ipaserver-install.log kindly let me know the solution for this.. Thanks, Shaik Hi, I see this near the bottom of the ipaserver-install.log

Re: [Freeipa-users] Having Issues with Dogtag After Updating IPA and Rebooting

2015-03-23 Thread Endi Sukma Dewata
: 408.316.2154 http://www.colovore.com On Mon, Mar 23, 2015 at 12:14 PM, Endi Sukma Dewata edew...@redhat.com wrote: Hi, Unfortunately the code doesn't log the exact cause of the problem. I need some additional info: 1. Which platform are you using? 2. What are the versions

Re: [Freeipa-users] Certificate renewal issues for dogtag GUI (9443/9444/9445 ports)

2015-05-12 Thread Endi Sukma Dewata
On 5/12/2015 1:11 PM, Nalin Dahyabhai wrote: On Tue, May 12, 2015 at 06:39:13PM +0200, Thibaut Pouzet wrote: There is no more this weird friendlyName :unable to print attribute thing, but the NoSuchTokenException is still in the debug log of pki-ca Thank you for you answer though,

Re: [Freeipa-users] Certificate renewal issues for dogtag GUI (9443/9444/9445 ports)

2015-05-12 Thread Endi Sukma Dewata
On 5/12/2015 11:39 AM, Thibaut Pouzet wrote: There is no more this weird friendlyName :unable to print attribute thing, but the NoSuchTokenException is still in the debug log of pki-ca Hi, Could you post or email me the CS.cfg and the log files of the CA? Thanks. -- Endi S.

Re: [Freeipa-users] ipa-server setup with external CA fails

2015-04-06 Thread Endi Sukma Dewata
On 3/11/2015 8:55 PM, Endi Sukma Dewata wrote: On 3/11/2015 10:13 PM, Gould, Joshua wrote: The selftests.log contradicts itself and I¹m not really sure where to look next. Any ideas? There's an existing ticket about the confusing selftest messages: https://fedorahosted.org/pki/ticket/1249

Re: [Freeipa-users] Setup of freeipa 4.1.3 failed

2015-04-01 Thread Endi Sukma Dewata
On 4/1/2015 2:29 AM, Martin Kosek wrote: On 03/31/2015 07:58 PM, Dmitri Pal wrote: On 03/31/2015 01:54 PM, Markus Roth wrote: Hi all, I want setup freeipa 4.1.3 on a fresh installed fedora 21. The ipa-server-install shows the following output: ... Done configuring directory server

Re: [Freeipa-users] Setup of freeipa 4.1.3 failed

2015-04-01 Thread Endi Sukma Dewata
On 4/1/2015 4:29 PM, Markus Roth wrote: Am Mittwoch, 1. April 2015, 16:04:54 schrieben Sie: On 4/1/2015 11:56 AM, Endi Sukma Dewata wrote: On 03/31/2015 01:54 PM, Markus Roth wrote: Hi all, I want setup freeipa 4.1.3 on a fresh installed fedora 21. The ipa-server-install shows

Re: [Freeipa-users] Setup of freeipa 4.1.3 failed

2015-04-01 Thread Endi Sukma Dewata
On 4/1/2015 11:56 AM, Endi Sukma Dewata wrote: On 03/31/2015 01:54 PM, Markus Roth wrote: Hi all, I want setup freeipa 4.1.3 on a fresh installed fedora 21. The ipa-server-install shows the following output: ... Done configuring directory server (dirsrv). Configuring certificate server

Re: [Freeipa-users] Certificate renewal issues for dogtag GUI (9443/9444/9445 ports)

2015-06-05 Thread Endi Sukma Dewata
On 5/19/2015 3:54 AM, Thibaut Pouzet wrote: Hi, It appeared that the NSS DB had fips enabled due to the troubleshooting of an old problem : # modutil -dbdir /var/lib/pki-ca/alias/ -list Listing of PKCS #11 Modules --- 1. NSS Internal

Re: [Freeipa-users] Upgrading from 3.0.0 CentOS6 to 4.2.3 CentOS7

2016-01-28 Thread Endi Sukma Dewata
Hi, If you're cloning from an IPA running on RHEL/CentOS 6 with CA signed by another CA you are likely hitting this issue: https://bugzilla.redhat.com/show_bug.cgi?id=1291747 The bug has been fixed in this package: pki-ca-9.0.3-45. You'll need to install it on the master, then restart the

Re: [Freeipa-users] Upgrading from 3.0.0 CentOS6 to 4.2.3 CentOS7

2016-02-23 Thread Endi Sukma Dewata
On 1/28/2016 2:45 PM, Endi Sukma Dewata wrote: Hi, If you're cloning from an IPA running on RHEL/CentOS 6 with CA signed by another CA you are likely hitting this issue: https://bugzilla.redhat.com/show_bug.cgi?id=1291747 The bug has been fixed in this package: pki-ca-9.0.3-45. You'll need

Re: [Freeipa-users] Impossible to restart IPA because of the presence of a file called CS.cfg.bak.saved

2016-07-12 Thread Endi Sukma Dewata
On 7/12/2016 12:17 PM, bahan w wrote: Hello everyone. I'm using ipa 3.0.0-47 on a RHEL6.6 OS (multi-masters). Today I tried to restart the IPA service with the commande ### service ipa restart ### And I got the following warning concerning the pkica service : ### Since the file

Re: [Freeipa-users] CA: Cannot add Centos7.2 replica to Centos6.8 ipa server

2016-09-09 Thread Endi Sukma Dewata
On 9/9/2016 8:09 AM, Petr Vobornik wrote: On 09/09/2016 02:33 PM, Giorgos Kafataridis wrote: Yes, I have followed https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/upgrading.html to the letter. The only reason

Re: [Freeipa-users] CA: Cannot add Centos7.2 replica to Centos6.8 ipa server

2016-09-13 Thread Endi Sukma Dewata
On 9/12/2016 9:35 PM, Endi Sukma Dewata wrote: On 9/9/2016 2:46 PM, Georgios Kafataridis wrote: I've tried that but still the same result. [root@ipa-server /]# ldapsearch -D "cn=directory manager" -W -p 389 -h localhost -b "uid=admin,ou=people,o=ipaca" Enter LDAP Passw

Re: [Freeipa-users] CA: Cannot add Centos7.2 replica to Centos6.8 ipa server

2016-09-12 Thread Endi Sukma Dewata
On 9/9/2016 2:46 PM, Georgios Kafataridis wrote: I've tried that but still the same result. [root@ipa-server /]# ldapsearch -D "cn=directory manager" -W -p 389 -h localhost -b "uid=admin,ou=people,o=ipaca" Enter LDAP Password: # extended LDIF # # LDAPv3 # base