From ipaupgrade.log, the CA isn't coming up?
2018-06-06T01:05:40Z DEBUG wait_for_open_ports: localhost [8080, 8443] timeout 300 2018-06-06T01:05:40Z DEBUG waiting for port: 8080 2018-06-06T01:05:40Z DEBUG Failed to connect to port 8080 tcp on ::1 2018-06-06T01:05:40Z DEBUG Failed to connect to port 8080 tcp on 127.0.0.1 2018-06-06T01:05:41Z DEBUG SUCCESS: port: 8080 2018-06-06T01:05:41Z DEBUG waiting for port: 8443 2018-06-06T01:05:41Z DEBUG Failed to connect to port 8443 tcp on ::1 2018-06-06T01:05:41Z DEBUG Failed to connect to port 8443 tcp on 127.0.0.1 2018-06-06T01:05:42Z DEBUG SUCCESS: port: 8443 2018-06-06T01:05:42Z DEBUG Waiting until the CA is running 2018-06-06T01:05:42Z DEBUG request POST http://vmpr-linuxidm.unix.company.com:8080/ca/admin/ca/getStatus 2018-06-06T01:05:42Z DEBUG request body '' 2018-06-06T01:05:46Z DEBUG response status 500 2018-06-06T01:05:46Z DEBUG response headers Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 2208 Date: Wed, 06 Jun 2018 01:05:46 GMT Connection: close
2018-06-06T01:05:46Z DEBUG response body '<html><head><title>Apache Tomcat/7.0.76 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - Subsystem unavailable</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>Subsystem unavailable</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.ws.rs.ServiceUnavailableException: Subsystem unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:500)\n\torg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)\n\torg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087)\n\torg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.java:748)\n</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/7.0.76 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.76</h3></body></html>' 2018-06-06T01:05:46Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500 2018-06-06T01:05:46Z DEBUG Waiting for CA to start... 2018-06-06T01:05:47Z DEBUG request POST http://vmpr-linuxidm.unix.company.com:8080/ca/admin/ca/getStatus 2018-06-06T01:05:47Z DEBUG request body '' 2018-06-06T01:05:47Z DEBUG response status 500 2018-06-06T01:05:47Z DEBUG response headers Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 2208 Date: Wed, 06 Jun 2018 01:05:47 GMT Connection: close
I found some old bugs that don't seem to apply, like this one
https://bugzilla.redhat.com/show_bug.cgi?id=1318616
and some that do https://pagure.io/freeipa/issue/6766
Doesn't actually fix the problem that my users can't login :/
Gah, I thought this had been fixed - it was in my upgrade of the dev server
L.
------ "The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. "
*Greg Bloom* @greggish https://twitter.com/greggish/status/873177525903609857
On 6 June 2018 at 11:24, Lachlan Musicman datakid@gmail.com wrote:
From ipaupgrade.log, the CA isn't coming up?
Digging, I found this
Internal Database Error encountered: Could not connect to LDAP server host vmpr-linuxidm.unix.company.com port 636 Error netscape.ldap.LDAPException: Unable to create socket: java.net.ConnectException: Connection refused (Connection refused) (-1)
I think it was in the pki logs?
So tomcat wont start (according to ipactl, it's started according to sysctl), same for pki-tomcat and dirsrv.
I've had to revert to last night's backup as this is required infrastructure. My updates of the other servers I use as dev worked fine in centos 7.4 -> 7.5 eventually. I can't recall but I think it was just a reboot and ipa-server-upgrade and it was fine.
hmmm L.
freeipa-users@lists.fedorahosted.org
-
Lachlan Musicman