<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } </style></head><body style=" font-family:'Monospace'; font-size:10pt; font-weight:400; font-style:normal;"> On Monday 08 of July 2013 16:58:18 Ana Krivokapic wrote: > On 06/25/2013 05:28 PM, Ana Krivokapic wrote: > > On 06/24/2013 02:27 PM, Tomas Babej wrote: > >> On 06/11/2013 04:42 PM, Ade Lee wrote: > >> [snip] > >>> Just FYI, we plan to do a new release of pki-core today (pki-core-10.0.3-2) > >>> to address this issue. > >>>> -- > >>>> Regards, > >>>> > >>>> Ana Krivokapic > >>>> Associate Software Engineer > >>>> FreeIPA team > >>>> Red Hat Inc. > >> Ok, so I tested the patch, since pki-core has the PkiExport command fixed now. > >> > >> I'm getting a little bit further now. > >> > >> [tbabej@vm-127 ~]$ sudo ipa-replica-prepare --ip-address 10.34.47.129 > >> vm-129.idm.lab.eng.brq.redhat.com > >> Directory Manager (existing master) password: > >> > >> Preparing replica for vm-129.idm.lab.eng.brq.redhat.com from > >> vm-127.idm.lab.eng.brq.redhat.com > >> Constraint violation: Failed to update password > >> > >> With debug output, I get (snipped out irrelevant parts): > >> > >> Directory Manager (existing master) password: > >> > >> ipa.ipaserver.plugins.ldap2.ldap2: DEBUG: Created connection > >> context.ldap2_57668944 > >> ipa.ipapython.ipaldap.SchemaCache: DEBUG: retrieving schema for SchemaCache > >> url=ldapi://%2fvar%2frun%2fslapd-IDM-LAB-ENG-BRQ-REDHAT-COM.socket > >> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x3700ab8> > >> ipa.ipaserver.plugins.ldap2.ldap2: DEBUG: Destroyed connection > >> context.ldap2_57668944 > >> ipa: DEBUG: Search DNS for vm-129.idm.lab.eng.brq.redhat.com > >> ipa: DEBUG: Search failed: [Errno -2] Name or service not known > >> ipa.ipapython.ipaldap.SchemaCache: DEBUG: flushing > >> ldapi://%2fvar%2frun%2fslapd-IDM-LAB-ENG-BRQ-REDHAT-COM.socket from SchemaCache > >> ipa.ipapython.ipaldap.SchemaCache: DEBUG: retrieving schema for SchemaCache > >> url=ldapi://%2fvar%2frun%2fslapd-IDM-LAB-ENG-BRQ-REDHAT-COM.socket > >> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x4c704d0> > >> ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: DEBUG: Not logging > >> to a file > >> ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: DEBUG: > >> ipa-replica-prepare was invoked with arguments > >> ['vm-129.idm.lab.eng.brq.redhat.com'] and options: {'log_file': None, > >> 'verbose': True, 'reverse_zone': None, 'setup_pkinit': True, 'http_pin': None, > >> 'quiet': False, 'http_pkcs12': None, 'pkinit_pkcs12': None, 'ca_file': > >> '/root/cacert.p12', 'no_reverse': False, 'dirsrv_pkcs12': None, 'password': > >> None, 'ip_address': CheckedIPAddress('10.34.47.129'), 'dirsrv_pin': None, > >> 'pkinit_pin': None} > >> ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: INFO: Preparing > >> replica for vm-129.idm.lab.eng.brq.redhat.com from > >> vm-127.idm.lab.eng.brq.redhat.com > >> ipa.ipapython.ipaldap.SchemaCache: DEBUG: flushing > >> ldapi://%2fvar%2frun%2fslapd-IDM-LAB-ENG-BRQ-REDHAT-COM.socket from SchemaCache > >> ipa.ipapython.ipaldap.SchemaCache: DEBUG: retrieving schema for SchemaCache > >> url=ldapi://%2fvar%2frun%2fslapd-IDM-LAB-ENG-BRQ-REDHAT-COM.socket > >> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x3700710> > >> ipa: DEBUG: Starting external process > >> ipa: DEBUG: args=/usr/bin/PKCS12Export -d /etc/pki/pki-tomcat/alias/ -p > >> /tmp/tmprgUrso -w /tmp/tmp6SBBXF -o /root/cacert.p12 > >> ipa: DEBUG: Process finished, return code=0 > >> ipa: DEBUG: stdout= > >> ipa: DEBUG: stderr= > >> ipa.ipaserver.plugins.ldap2.ldap2: DEBUG: Created connection > >> context.ldap2_139884970376144 > >> ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: DEBUG: File > >> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute > >> return_value = self.run() > >> File > >> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_replica_prepare.py", > >> line 245, in run > >> self.copy_ds_certificate() > >> File > >> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_replica_prepare.py", > >> line 281, in copy_ds_certificate > >> self.update_pki_admin_password() > >> File > >> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_replica_prepare.py", > >> line 520, in update_pki_admin_password > >> ldap.modify_password(dn, self.dirman_password) > >> File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line > >> 332, in modify_password > >> self.conn.passwd_s(dn, old_pass, new_pass) > >> File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__ > >> self.gen.throw(type, value, traceback) > >> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 919, in > >> error_handler > >> raise errors.DatabaseError(desc=desc, info=info) > >> > >> ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: DEBUG: The > >> ipa-replica-prepare command failed, exception: DatabaseError: Constraint > >> violation: Failed to update password > >> ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: ERROR: Constraint > >> violation: Failed to update password > >> > >> Tomas > > It seems that this time the culprit is 389-ds-base packages. The password change > > is rejected when using the latest version of 389-ds-base > > (389-ds-base-1.3.1.2-1.fc19.x86_64). I tried testing it with a previous version > > (389-ds-base-1.3.0.5-1.fc19.x86_64) and it works. > > > > I open an upstream ticket for the 389 DS project: > > https://fedorahosted.org/389/ticket/47406. > > > > The password change rejection problem has been fixed in the new version of > 389-ds-base: 389-ds-base-1.3.1.3-1.fc19. > > -- > Regards, > > Ana Krivokapic > Associate Software Engineer > FreeIPA team > Red Hat Inc. > The patch now fixes the issue. However, we need to bump the dependency in the specfile since now we require version 1.3.1.1. Tomas</body></html>