{"action":"created","issue":{"url":"https://api.github.com/repos/freeipa/ansible-freeipa/issues/72","repository_url":"https://api.github.com/repos/freeipa/ansible-freeipa","labels_url":"https://api.github.com/repos/freeipa/ansible-freeipa/issues/72/labels{/name}","comments_url":"https://api.github.com/repos/freeipa/ansible-freeipa/issues/72/comments","events_url":"https://api.github.com/repos/freeipa/ansible-freeipa/issues/72/events","html_url":"https://github.com/freeipa/ansible-freeipa/issues/72","id":433817597,"node_id":"MDU6SXNzdWU0MzM4MTc1OTc=","number":72,"title":"Error installing freeipa server - cannot connect to https://xxx.yy:8443/ca/rest/account/login","user":{"login":"LucaPrete","id":2330576,"node_id":"MDQ6VXNlcjIzMzA1NzY=","avatar_url":"https://avatars3.githubusercontent.com/u/2330576?v=4","gravatar_id":"","url":"https://api.github.com/users/LucaPrete","html_url":"https://github.com/LucaPrete","followers_url":"https://api.github.com/users/LucaPrete/followers","following_url":"https://api.github.com/users/LucaPrete/following{/other_user}","gists_url":"https://api.github.com/users/LucaPrete/gists{/gist_id}","starred_url":"https://api.github.com/users/LucaPrete/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LucaPrete/subscriptions","organizations_url":"https://api.github.com/users/LucaPrete/orgs","repos_url":"https://api.github.com/users/LucaPrete/repos","events_url":"https://api.github.com/users/LucaPrete/events{/privacy}","received_events_url":"https://api.github.com/users/LucaPrete/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2019-04-16T14:38:23Z","updated_at":"2019-04-17T06:07:55Z","closed_at":null,"author_association":"NONE","body":"Hello everyone,\r\n\r\nWe're using this playbook to install a FreeIPA server (master) on an Ubuntu 18.04LTS.\r\nEverything goes well until I hit the task `TASK [ipaserver : Install - Setup CA]`.\r\n\r\nThis is the output:\r\n\r\n```\r\nTASK [ipaserver : Install - Setup CA] ********************************************************************************************************************************************************************************************************\r\nfatal: [10.0.254.201]: FAILED! => {\"changed\": false, \"module_stderr\": \"Shared connection to 10.0.254.201 closed.\\r\\n\", \"module_stdout\": \"Traceback (most recent call last):\\r\\n  File \\\"/home/XXX/.ansible/tmp/ansible-tmp-1555423433.79043-184703110138725/AnsiballZ_ipaserver_setup_ca.py\\\", line 113, in <module>\\r\\n    _ansiballz_main()\\r\\n  File \\\"/home/XXX/.ansible/tmp/ansible-tmp-1555423433.79043-184703110138725/AnsiballZ_ipaserver_setup_ca.py\\\", line 105, in _ansiballz_main\\r\\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\\r\\n  File \\\"/home/XXX/.ansible/tmp/ansible-tmp-1555423433.79043-184703110138725/AnsiballZ_ipaserver_setup_ca.py\\\", line 48, in invoke_module\\r\\n    imp.load_module('__main__', mod, module, MOD_DESC)\\r\\n  File \\\"/tmp/ansible_ipaserver_setup_ca_payload_fJcQp3/__main__.py\\\", line 239, in <module>\\r\\n  File \\\"/tmp/ansible_ipaserver_setup_ca_payload_fJcQp3/__main__.py\\\", line 209, in main\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipaserver/install/ca.py\\\", line 326, in install_step_0\\r\\n    use_ldaps=standalone)\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipaserver/install/cainstance.py\\\", line 473, in configure_instance\\r\\n    self.start_creation(runtime=runtime)\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipaserver/install/service.py\\\", line 555, in start_creation\\r\\n    run_step(full_msg, method)\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipaserver/install/service.py\\\", line 541, in run_step\\r\\n    method()\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipaserver/install/cainstance.py\\\", line 1791, in migrate_profiles_to_ldap\\r\\n    _create_dogtag_profile(profile_id, profile_data, overwrite=False)\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipaserver/install/cainstance.py\\\", line 1797, in _create_dogtag_profile\\r\\n    with api.Backend.ra_certprofile as profile_api:\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipaserver/plugins/dogtag.py\\\", line 1296, in __enter__\\r\\n    method='GET'\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipapython/dogtag.py\\\", line 167, in https_request\\r\\n    method=method, headers=headers)\\r\\n  File \\\"/usr/lib/python2.7/dist-packages/ipapython/dogtag.py\\\", line 229, in _httplib_request\\r\\n    raise NetworkError(uri=uri, error=str(e))\\r\\nipalib.errors.NetworkError: cannot connect to 'https://freeipa-master-01.XXX.YY:8443/ca/rest/account/login': [Errno 111] Connection refused\\r\\n\", \"msg\": \"MODULE FAILURE\\nSee stdout/stderr for the exact error\", \"rc\": 1}\r\n\tto retry, use: --limit @/Users/XXX/ansible-freeipa/install-server.retry\r\n```\r\n\r\nBasically, the error is:\r\n\r\n```\r\n...\r\ncannot connect to 'https://freeipa-master-01.XXX.YY:8443/ca/rest/account/login\r\n...\r\n```\r\n\r\nAFAIK, there's a known issue on Ubuntu. For example, you can look for 8443 here `https://themeanti.me/technology/2018/02/21/installing-freeipa.html`.\r\nIt says to modify `/usr/lib/python2.7/dist-packages/ipaserver/install/cainstance.py` adding a timeout in two methods:\r\n\r\n```\r\nfrom __future__ import print_function\r\n...\r\nimport time\r\n...\r\n \r\n...\r\ndef __import_ca_chain(self):\r\n    time.sleep(10)\r\n...\r\n \r\n...\r\ndef migrate_profiles_to_ldap():\r\n   time.sleep(10)\r\n...\r\n```\r\n\r\nUnfortunately, I can't find any `__import_ca_chain(self):` method. I've tried to add the timeout in the latter, but the error keeps showing up.\r\n\r\nAny idea how can I fix the issue and move forward?\r\n\r\nThanks,\r\n\r\n-Luca"},"comment":{"url":"https://api.github.com/repos/freeipa/ansible-freeipa/issues/comments/483950027","html_url":"https://github.com/freeipa/ansible-freeipa/issues/72#issuecomment-483950027","issue_url":"https://api.github.com/repos/freeipa/ansible-freeipa/issues/72","id":483950027,"node_id":"MDEyOklzc3VlQ29tbWVudDQ4Mzk1MDAyNw==","user":{"login":"abbra","id":2066,"node_id":"MDQ6VXNlcjIwNjY=","avatar_url":"https://avatars1.githubusercontent.com/u/2066?v=4","gravatar_id":"","url":"https://api.github.com/users/abbra","html_url":"https://github.com/abbra","followers_url":"https://api.github.com/users/abbra/followers","following_url":"https://api.github.com/users/abbra/following{/other_user}","gists_url":"https://api.github.com/users/abbra/gists{/gist_id}","starred_url":"https://api.github.com/users/abbra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abbra/subscriptions","organizations_url":"https://api.github.com/users/abbra/orgs","repos_url":"https://api.github.com/users/abbra/repos","events_url":"https://api.github.com/users/abbra/events{/privacy}","received_events_url":"https://api.github.com/users/abbra/received_events","type":"User","site_admin":false},"created_at":"2019-04-17T06:07:55Z","updated_at":"2019-04-17T06:07:55Z","author_association":"NONE","body":"The reference to a logout endpoint is OK. The code runs under a context where it automatically logins into the REST API on enter to the context and logs out on exit. The exit happens because an attempt to enable profile fails internally in dogtag and we get exception from that:\r\n\r\n```\r\n2019-04-16T21:09:25Z DEBUG response body '{\"Attributes\":{\"Attribute\":[]},\"ClassName\":\"com.netscape.certsrv.base.ConflictingOperationException\",\"Code\":409,\"Message\":\"Profile already exists\"}'\r\n2019-04-16T21:09:25Z DEBUG Error migrating 'caCMCserverCert': Request failed with status 409: Non-2xx response from CA REST API: 409. Profile already exists\r\n2019-04-16T21:09:25Z DEBUG request POST https://freeipa-master-01.mgmt.dev.xxx.yyy.internal:8443/ca/rest/profiles/caCMCserverCert?action=enable\r\n2019-04-16T21:09:25Z DEBUG request body ''\r\n2019-04-16T21:09:26Z DEBUG httplib request failed:\r\nTraceback (most recent call last):\r\n  File \"/usr/lib/python2.7/dist-packages/ipapython/dogtag.py\", line 220, in _httplib_request\r\n    conn.request(method, uri, body=request_body, headers=headers)\r\n  File \"/usr/lib/python2.7/httplib.py\", line 1042, in request\r\n    self._send_request(method, url, body, headers)\r\n  File \"/usr/lib/python2.7/httplib.py\", line 1082, in _send_request\r\n    self.endheaders(body)\r\n  File \"/usr/lib/python2.7/httplib.py\", line 1038, in endheaders\r\n    self._send_output(message_body)\r\n  File \"/usr/lib/python2.7/httplib.py\", line 882, in _send_output\r\n    self.send(msg)\r\n  File \"/usr/lib/python2.7/httplib.py\", line 844, in send\r\n    self.connect()\r\n  File \"/usr/lib/python2.7/httplib.py\", line 1263, in connect\r\n    server_hostname=server_hostname)\r\n  File \"/usr/lib/python2.7/ssl.py\", line 369, in wrap_socket\r\n    _context=self)\r\n  File \"/usr/lib/python2.7/ssl.py\", line 617, in __init__\r\n    self.do_handshake()\r\n  File \"/usr/lib/python2.7/ssl.py\", line 846, in do_handshake\r\n    self._sslobj.do_handshake()\r\nerror: [Errno 104] Connection reset by peer\r\n```\r\nThe part about 'profile already exists' is normal, so the next step is to enable already existing profile what fails with this 'Connection reset by peer'. E.g. the issue is something in dogtag.\r\n\r\nCould you please share `/var/log/pki/pki-tomcat/` folder? There would be files like `localhost.<date>.log` which could have errors around the time the processing happened. Also there would be `localhost_access_log.<date>.txt` that would have bunch of operations on `/ca/rest/profiles/` recorded."}}
{"actor":{"display_login":"abbra"}}