freeipa

Clone
Source Code
GIT

#9289 Configure server affinity during replica installation
Closed: fixed 2 years ago by frenaud. Opened 2 years ago by rcritten.

Closed: fixed
Reopen Issue

Issue

Failures have been seen during non-CA replica installation, frequently when certmonger is trying to retrieve certificates, getting CA_REJECTED:

2022-11-22T14:30:11Z DEBUG Cert request 20221122143010 failed: CA_REJECTED (Server at https://ipa.example.test/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)).)

The working assumption is that there is no affinity during installation so it is a race between the installer and replication.

At least one user in this situation was able to successfully install by doing a client promotion installation with:

  • update /etc/krb5.conf to set dns_lookup_realm = false and add a kdc to the REALM section.
  • update /etc/sssd/sssd.conf to set ipa_server = SERVER_TO_CONNECT_TO (removed srv).
  • update /etc/ipa/default.conf to set references to an IPA server to SERVER_TO_CONNECT_TO

These steps are not always successful but it they may be part of an eventual solution.

I have confirmed that modifying the settings prior to install are overwritten during the installation resulting in a correct configuration.

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2149344
2 years ago

Metadata Update from @rcritten:
- Issue assigned to rcritten
2 years ago

A question is: do we automatically switch to a server that provides the new service (CA or KRA) or fail?

My feeling is that in the promotion case we change the server because otherwise users are going to end up deleting agreements, twiddling with config files, etc.

For a non-promotion replica install (with --server) failing is fine since we prevent a bad setup.

master:

  • 45fa435 Configure affinity during server installation

ipa-4-9:

  • 3af7747 Configure affinity during server installation
  • 0cf6292 Don't assume KRB5CCNAME is in the environment in replica install

master:

  • f248b22 Don't assume KRB5CCNAME is in the environment in replica install

ipa-4-11:

  • 54a251b Configure affinity during server installation
  • 169f9ab Don't assume KRB5CCNAME is in the environment in replica install

ipa-4-10:

  • 08dad8f Configure affinity during server installation
  • 74f6646 Don't assume KRB5CCNAME is in the environment in replica install

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
2 years ago

Metadata Update from @abbra:
- Custom field changelog adjusted to Replica installation process now happens against a chosen server, not only for Kerberos authentication but also for all IPA API and CA requests. This helps to avoid incomplete replicated details when adding a new replica to a complex topology.
a year ago

master:

  • 2a95a05 Server affinity: Retain user-requested remote server

ipa-4-11:

  • d2ffa10 Server affinity: Retain user-requested remote server

ipa-4-10:

  • fdc27b2 Server affinity: Retain user-requested remote server

ipa-4-9:

  • 3add9ba Server affinity: Retain user-requested remote server

Log in to comment on this ticket.

Metadata
None
None
None
important
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
Replica installation process now happens against a chosen server, not only for Kerberos authentication but also for all IPA API and CA requests. This helps to avoid incomplete replicated details when adding a new replica to a complex topology.
None
Powered by Pagure 5.14.1
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.