CA and KRA replicas can be installed on a replica at a later point in time. The commands ipa-ca-install and ipa-kra-install asked for the Directory Manager password, but fail to validate that the password is correct. There is no safe way to recover from a bad password other than complete uninstallation of the entire replica.
ipa-ca-install
ipa-kra-install
$ ipa-client-install ... $ kinit admin $ ipa-replica-install ... $ ipa-ca-install $ ipa-ca-install Directory Manager (existing master) password: WrongPassword Run connection check to master Connection check OK Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/25]: creating certificate server db [2/25]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 4 seconds elapsed Update succeeded [3/25]: creating installation admin user [4/25]: configuring certificate server instance ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpNKIUbr' returned non-ze1 ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information: ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. CA configuration failed.
The installers also ask for DM password when the subsystem is already installed:
# ipa-kra-install Directory Manager password: KRA already installed The ipa-kra-install command failed. See /var/log/ipaserver-kra-install.log for more information
Metadata Update from @pvoborni: - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1445390
Issue linked to bug 1445390
Metadata Update from @pvoborni: - Issue priority set to: blocker - Issue set to the milestone: FreeIPA 4.5.1 - Issue tagged with: bug
Metadata Update from @tkrizek: - Issue assigned to tkrizek
Metadata Update from @tkrizek: - Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/757
master:
ipa-4-5:
Metadata Update from @mbasti: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
Log in to comment on this ticket.