#7077 ipa host-add with --certificate fails (internal error has occurred)
Closed: wontfix 5 years ago by rcritten. Opened 6 years ago by mreznik.

In caless test suite we are getting fails with command:

# ipa host-add testhost.dom-058-089.ipa.test --force --certificate 'BASE64'

which returns: ipa: ERROR: an internal error has occurred.

After enabling debug wee see the following trace in httpd_errors:

[Mon Jul 31 08:25:59.165265 2017] [wsgi:error] [pid 26149] Traceback (most recent call last):
[Mon Jul 31 08:25:59.165292 2017] [wsgi:error] [pid 26149]   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 370, in wsgi_execute
[Mon Jul 31 08:25:59.165296 2017] [wsgi:error] [pid 26149]     result = command(*args, **options)
[Mon Jul 31 08:25:59.165299 2017] [wsgi:error] [pid 26149]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__
[Mon Jul 31 08:25:59.165302 2017] [wsgi:error] [pid 26149]     return self.__do_call(*args, **options)
[Mon Jul 31 08:25:59.165305 2017] [wsgi:error] [pid 26149]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 478, in __do_call
[Mon Jul 31 08:25:59.165307 2017] [wsgi:error] [pid 26149]     ret = self.run(*args, **options)
[Mon Jul 31 08:25:59.165310 2017] [wsgi:error] [pid 26149]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 800, in run
[Mon Jul 31 08:25:59.165313 2017] [wsgi:error] [pid 26149]     return self.execute(*args, **options)
[Mon Jul 31 08:25:59.165316 2017] [wsgi:error] [pid 26149]   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/baseldap.py", line 1188, in execute
[Mon Jul 31 08:25:59.165319 2017] [wsgi:error] [pid 26149]     self._exc_wrapper(keys, options, ldap.add_entry)(entry_attrs)
[Mon Jul 31 08:25:59.165322 2017] [wsgi:error] [pid 26149]   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/baseldap.py", line 1098, in wrapped
[Mon Jul 31 08:25:59.165325 2017] [wsgi:error] [pid 26149]     return func(*call_args, **call_kwargs)
[Mon Jul 31 08:25:59.165328 2017] [wsgi:error] [pid 26149]   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1512, in add_entry
[Mon Jul 31 08:25:59.165330 2017] [wsgi:error] [pid 26149]     self.conn.add_s(str(entry.dn), list(attrs.items()))
[Mon Jul 31 08:25:59.165333 2017] [wsgi:error] [pid 26149]   File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 209, in add_s
[Mon Jul 31 08:25:59.165336 2017] [wsgi:error] [pid 26149]     msgid = self.add(dn,modlist)
[Mon Jul 31 08:25:59.165339 2017] [wsgi:error] [pid 26149]   File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 206, in add
[Mon Jul 31 08:25:59.165341 2017] [wsgi:error] [pid 26149]     return self.add_ext(dn,modlist,None,None)
[Mon Jul 31 08:25:59.165344 2017] [wsgi:error] [pid 26149]   File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 191, in add_ext
[Mon Jul 31 08:25:59.165347 2017] [wsgi:error] [pid 26149]     return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
[Mon Jul 31 08:25:59.165364 2017] [wsgi:error] [pid 26149]   File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 106, in _ldap_call
[Mon Jul 31 08:25:59.165369 2017] [wsgi:error] [pid 26149]     result = func(*args,**kwargs)
[Mon Jul 31 08:25:59.165375 2017] [wsgi:error] [pid 26149] TypeError: ('expected a string in the list', ('0\\x82\\x03\\x1a0\\x82\\x02\\x02\\xa0\\x03\\x02\\x01\\x02\\x02\\x01\\x0f0\\r\\x06\\t*\\x86H\\x86\\xf7\\r\\x01\\x01\\x0b\\x05\\x000,1\\x1d0\\x1b\\x06\\x03U\\x04\\n\\x0c\\x14Example Organization1\\x0b0\\t\\x06\\x03U\\x04\\x03\\x0c\\x02CA0\\x1e\\x17\\r170731061003Z\\x17\\r180731061003Z0<1\\x1d0\\x1b\\x06\\x03U\\x04\\n\\x0c\\x14Example Organization1\\x1b0\\x19\\x06\\x03U\\x04\\x03\\x0c\\x12unused-client.test0\\x82\\x01"0\\r\\x06\\t*\\x86H\\x86\\xf7\\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\\n\\x02\\x82\\x01\\x01\\x00\\xd1YNZ\\x81T\\x8b\\xcd\\xb0\\xc6\\xca\\xab\\xb1\\xafh\\x13\\xd2$\\xa2\\x00\\x95\\xc4W\\x00\\xcb\\xb5\\xb4\\xf6\\xb54\\xfbadl\\x84\\xce\\xb4\\x05\\x19[q\\x07\\xcd\\x93`\\xcc\\xc0\\xa5\\xa2\\xc5\\xb0P\\xc3pP\\x01TxZa\\xedh\\xee@\\xe1\\xf5\\xabE1<ck\\x13f\\x9fd\\x17m\\x82\\x1as\\xb4\\x95\\xad\\x95\\xc4\\x82J\\xb54\\x15\\xc3\\x9a:\\x82ZA\\xa9\\xc5\\x7f\\xb1\\x8a\\x8f6"\\x92\\xe6s\\xd4d\\xc9\\xe9\\xf1\\tx:AZw\\x98?\\x02$\\x9c\\x1b\\xf6H\\xd2b\\x8d\\x10\\\\\\x96\\xcd\\xf3\\xf8.PpW\\xee\\xb3e\\xa0\\x92w\\xd8\\xae\\x13\\xe3A\\x10\\xe6;$"\\x99\\xad\\x95\\x98E\\xa3\\xa48\\xe6\\xaf\\xb8\\xe9\\x81$\\x7fN\\x8f\\x7fV4\\x1d?\\xdc1\\xdfE\\x00l&\\xa1\\xc8\\xc0Oew\\xcb\\xe0^&1\\xe2\\x1e;\\xfcn\\x16\\xe9\\xd0\\x8cbJ7+\\x7f\\xcd\\xe1\\x7f\\x85\\x93\\xf1\\xca\\xfd\\xd2\\xa2\\x00\\xfce\\xab\\x05\\xaa\\xc1\\xa5\\xc0!\\xb4\\xfb9\\x8c\\xf1\\x98\\x8eZ\\x7fW\\xee\\x9e\\x04\\xf9O\\xb1\\x97\\xac\\xde\\x8dB?p\\xb7\\xb1\\x85\\x02\\x03\\x01\\x00\\x01\\xa370503\\x06\\x03U\\x1d\\x1f\\x04,0*0(\\xa0&\\xa0$\\x86"file:///tmp/ipatest-2Qaf7U/ca1.crl0\\r\\x06\\t*\\x86H\\x86\\xf7\\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00%$\\xe4)\\x14\\xaa\\xee\\xed\\xc59\\xaf\\x89\\x1f\\xe2W\\x8e\\x0c,\\xb1\\xda\\xf1Z\\x127\\x82*fM%\\xdb~\\xae\\x9fR\\xd8\\x19&\\xd8\\t\\x04\\xf4+\\xbf\\xdf5k\\x85\\xfan\\xc3\\x8a\\xdf\\xc8\\xfcI\\x90y\\xaf\\x0c\\x85\\x0c\\xe8D\\xec)]~\\x8e\\xb8`\\xbd\\xf0\\x15\\x19\\x86`\\xed\\x9f\\xb4r\\xba\\xa9\\\\<ZAf\\x0bZ\\x86\\x04\\x80\\x0e&C\\xc5\\xaf\\xa33ljd\\x00\\xe9\\x9caA\\xf8\\x8b\\xbf{w\\x15Z\\x18\\xbcRY\\x9a\\x8d\\xda\\x81\\xdaX\\xda!\\x08OI\\xe7\\xee[\\xb8\\x01L\\x8f\\x93Y\\xb4k\\x90\\x03\\x8c\\x99"\\xd4\\xb9\\x92\\x95OF\\xbf\\x04b^nG0\\xf21\\xf7\\x13\\x80\\xe21O\\x98\\xb7E\\xbd\\xa1\\xfdu]h\\x15\\xaa\\xe0i\\xbbnLC\\xec?J$\\x87\\x1d.^=^\\xb5\\xec\\xb7\\x93Zh4V\\xbap.\\x98<\\x02\\xb7\\xf9\\xecjl\\xf7C\\xa4\\n9\\xd5,Hxmp\\xc0\\xe1\\xdc\\x00\\x18>\\xaa\\x87\\x08\\x9cZ5\\'\\xa8$2\\x1f\\xee\\xc7\\xb0\\x00\\xca\\xf4\\x16\\xa0\\xba{\\x15\\xb3\\xbe\\x0eD\\xf8',))
[Mon Jul 31 08:25:59.165692 2017] [wsgi:error] [pid 26149] ipa: INFO: [jsonserver_session] admin@DOM-058-089.IPA.TEST: host_add/1(u'testhost.dom-058-089.IPA.TEST', usercertificate=('0\\x82\\x03\\x1a0\\x82\\x02\\x02\\xa0\\x03\\x02\\x01\\x02\\x02\\x01\\x0f0\\r\\x06\\t*\\x86H\\x86\\xf7\\r\\x01\\x01\\x0b\\x05\\x000,1\\x1d0\\x1b\\x06\\x03U\\x04\\n\\x0c\\x14Example Organization1\\x0b0\\t\\x06\\x03U\\x04\\x03\\x0c\\x02CA0\\x1e\\x17\\r170731061003Z\\x17\\r180731061003Z0<1\\x1d0\\x1b\\x06\\x03U\\x04\\n\\x0c\\x14Example Organization1\\x1b0\\x19\\x06\\x03U\\x04\\x03\\x0c\\x12unused-client.test0\\x82\\x01"0\\r\\x06\\t*\\x86H\\x86\\xf7\\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\\n\\x02\\x82\\x01\\x01\\x00\\xd1YNZ\\x81T\\x8b\\xcd\\xb0\\xc6\\xca\\xab\\xb1\\xafh\\x13\\xd2$\\xa2\\x00\\x95\\xc4W\\x00\\xcb\\xb5\\xb4\\xf6\\xb54\\xfbadl\\x84\\xce\\xb4\\x05\\x19[q\\x07\\xcd\\x93`\\xcc\\xc0\\xa5\\xa2\\xc5\\xb0P\\xc3pP\\x01TxZa\\xedh\\xee@\\xe1\\xf5\\xabE1<ck\\x13f\\x9fd\\x17m\\x82\\x1as\\xb4\\x95\\xad\\x95\\xc4\\x82J\\xb54\\x15\\xc3\\x9a:\\x82ZA\\xa9\\xc5\\x7f\\xb1\\x8a\\x8f6"\\x92\\xe6s\\xd4d\\xc9\\xe9\\xf1\\tx:AZw\\x98?\\x02$\\x9c\\x1b\\xf6H\\xd2b\\x8d\\x10\\\\\\x96\\xcd\\xf3\\xf8.PpW\\xee\\xb3e\\xa0\\x92w\\xd8\\xae\\x13\\xe3A\\x10\\xe6;$"\\x99\\xad\\x95\\x98E\\xa3\\xa48\\xe6\\xaf\\xb8\\xe9\\x81$\\x7fN\\x8f\\x7fV4\\x1d?\\xdc1\\xdfE\\x00l&\\xa1\\xc8\\xc0Oew\\xcb\\xe0^&1\\xe2\\x1e;\\xfcn\\x16\\xe9\\xd0\\x8cbJ7+\\x7f\\xcd\\xe1\\x7f\\x85\\x93\\xf1\\xca\\xfd\\xd2\\xa2\\x00\\xfce\\xab\\x05\\xaa\\xc1\\xa5\\xc0!\\xb4\\xfb9\\x8c\\xf1\\x98\\x8eZ\\x7fW\\xee\\x9e\\x04\\xf9O\\xb1\\x97\\xac\\xde\\x8dB?p\\xb7\\xb1\\x85\\x02\\x03\\x01\\x00\\x01\\xa370503\\x06\\x03U\\x1d\\x1f\\x04,0*0(\\xa0&\\xa0$\\x86"file:///tmp/ipatest-2Qaf7U/ca1.crl0\\r\\x06\\t*\\x86H\\x86\\xf7\\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00%$\\xe4)\\x14\\xaa\\xee\\xed\\xc59\\xaf\\x89\\x1f\\xe2W\\x8e\\x0c,\\xb1\\xda\\xf1Z\\x127\\x82*fM%\\xdb~\\xae\\x9fR\\xd8\\x19&\\xd8\\t\\x04\\xf4+\\xbf\\xdf5k\\x85\\xfan\\xc3\\x8a\\xdf\\xc8\\xfcI\\x90y\\xaf\\x0c\\x85\\x0c\\xe8D\\xec)]~\\x8e\\xb8`\\xbd\\xf0\\x15\\x19\\x86`\\xed\\x9f\\xb4r\\xba\\xa9\\\\<ZAf\\x0bZ\\x86\\x04\\x80\\x0e&C\\xc5\\xaf\\xa33ljd\\x00\\xe9\\x9caA\\xf8\\x8b\\xbf{w\\x15Z\\x18\\xbcRY\\x9a\\x8d\\xda\\x81\\xdaX\\xda!\\x08OI\\xe7\\xee[\\xb8\\x01L\\x8f\\x93Y\\xb4k\\x90\\x03\\x8c\\x99"\\xd4\\xb9\\x92\\x95OF\\xbf\\x04b^nG0\\xf21\\xf7\\x13\\x80\\xe21O\\x98\\xb7E\\xbd\\xa1\\xfdu]h\\x15\\xaa\\xe0i\\xbbnLC\\xec?J$\\x87\\x1d.^=^\\xb5\\xec\\xb7\\x93Zh4V\\xbap.\\x98<\\x02\\xb7\\xf9\\xecjl\\xf7C\\xa4\\n9\\xd5,Hxmp\\xc0\\xe1\\xdc\\x00\\x18>\\xaa\\x87\\x08\\x9cZ5\\'\\xa8$2\\x1f\\xee\\xc7\\xb0\\x00\\xca\\xf4\\x16\\xa0\\xba{\\x15\\xb3\\xbe\\x0eD\\xf8',), force=True, version=u'2.229'): InternalError
[Mon Jul 31 08:25:59.166378 2017] [wsgi:error] [pid 26149] ipa: DEBUG: Destroyed connection context.ldap2_140486344717264

The issue is reproducible:

  1. Install ipa-server (in this case we have caless but it fails also with ca)
  2. ipa host-add testhost.dom-058-089.ipa.test --force --certificate 'BASE64' (fails also without --force)
# ipa ping
-----------------------------------------------------------------------
IPA server version 4.5.90.dev201707301739+gitc95617e. API version 2.229
-----------------------------------------------------------------------

Consulting the issue with @stlaz as it may be related to the recent work on certificates.

Metadata Update from @stlaz:
- Issue assigned to stlaz

6 years ago

Metadata Update from @tkrizek:
- Issue priority set to: major
- Issue set to the milestone: FreeIPA 4.6

6 years ago

master:

  • 7d217c8 host, service: fix adding host/svc with a cert

Metadata Update from @tkrizek:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

6 years ago

Reopening to backport it to 4.5 - raising prio to make it noticible.

Metadata Update from @pvoborni:
- Issue priority set to: critical (was: major)
- Issue set to the milestone: FreeIPA 4.5.3 (was: FreeIPA 4.6)
- Issue status updated to: Open (was: Closed)

6 years ago

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.5.4 (was: FreeIPA 4.5.3)
- Issue tagged with: backport

6 years ago

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.5.5 (was: FreeIPA 4.5.4)

6 years ago

Closing as wontfix. We are no longer working on the 4.5 branch.

Metadata Update from @rcritten:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)

5 years ago

Login to comment on this ticket.

Metadata
Attachments 2
Attached 6 years ago View Comment
Attached 6 years ago View Comment