<div dir="ltr">Ok after some more digging :<div><br></div><div>I found some warnings (see below)<br></div><div><br></div><div>Is any of these the cause for the error ?</div><div><br></div><div>Rob</div><div><br></div><div><snip><br><div><div>2014-10-27T13:56:13Z INFO Updating existing entry: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config</div></div><div><snip></div><div><div>2014-10-27T13:56:13Z WARNING remove: 'sudoRunAsGroup=%deref("ipaSudoRunAs","cn")' not in schema-compat-entry-attribute</div></div><div><snip></div><div>2014-10-27T13:56:13Z WARNING remove: '(targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || ipaUniqueId || memberOf || serverHostName || enrolledBy || ipaNTHash")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=XXXXX,dc=XXXXX";)' not in aci<br></div><div><snip></div></div><div>2014-10-27T13:56:13Z WARNING remove: '(targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=XXXXX,dc=XXXXX";)' not in aci<br></div><div><snip></div><div><br></div><div><snip></div><div>2014-10-27T13:56:13Z INFO Updating existing entry: cn=ipa-winsync,cn=plugins,cn=config<br></div><div><snip></div><div>2014-10-27T13:56:13Z WARNING remove: 'uidNumber 999' not in ipaWinSyncUserAttr<br></div><div><snip></div><div>2014-10-27T13:56:13Z WARNING remove: 'gidNumber 999' not in ipaWinSyncUserAttr<br></div><div><snip></div><div><br></div><div><snip></div><div>2014-10-27T13:56:14Z INFO Updating existing entry: cn=referential integrity postoperation,cn=plugins,cn=config<br></div><div><snip></div><div>2014-10-27T13:56:14Z WARNING remove: 'ipatokenradiusconfiglink' not in nsslapd-pluginArg18<br></div><div><snip></div><div><br></div><div><snip></div><div>2014-10-27T13:56:27Z INFO Updating existing entry: dc=XXXXX,dc=XXXXX<br></div><div><snip></div><div>2014-10-27T13:56:27Z WARNING remove: '(target = "ldap:///idnsname=*,cn=dns,dc=XXXXX,dc=XXXXX")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,dc=XXXXX,dc=XXXXX";)' not in aci<br></div><div><snip></div><div><br></div><div><br></div><div><snip></div><div><div>014-10-27T13:56:13Z INFO Updating existing entry: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config</div></div><div><snip></div><div><div>2014-10-27T13:56:13Z DEBUG remove: '60' from nsslapd-pluginPrecedence, current value []</div><div>2014-10-27T13:56:13Z WARNING remove: '60' not in nsslapd-pluginPrecedence</div></div><div><snip></div><div><br></div><div><snip></div><div><div>2014-10-27T13:56:13Z INFO Updating existing entry: dc=XXXXX,dc=XXXXX</div></div><div><snip></div><div>2014-10-27T13:56:27Z WARNING remove: '(target = "ldap:///idnsname=*,cn=dns,dc=XXXXX,dc=XXXXX")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,dc=XXXXX,dc=XXXXX";)' not in aci<br></div><div><snip></div><div>2014-10-27T13:56:27Z WARNING remove: '(target = "ldap:///idnsname=*,cn=dns,dc=XXXXX,dc=XXXXX")(version 3.0;acl "Remove DNS entries";allow (delete) groupdn = "ldap:///cn=remove dns entries,cn=permissions,cn=pbac,dc=XXXXX,dc=XXXXX";)' not in aci<br></div><div><snip></div><div>2014-10-27T13:56:27Z WARNING remove: '(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy")(target = "ldap:///idnsname=*,cn=dns,dc=XXXXX,dc=XXXXX")(version 3.0;acl "Update DNS entries";allow (write) groupdn = "ldap:///cn=update dns entries,cn=permissions,cn=pbac,dc=XXXXX,dc=XXXXX";)' not in ac<br></div><div><snip></div><div>2014-10-27T13:56:27Z WARNING remove: '(target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=XXXXX,dc=XXXXX")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create and delete tokens"; allow (add, delete) userattr = "ipatokenOwner#SELFDN";)' not in aci<br></div><div><snip></div><div>2014-10-27T13:56:27Z WARNING remove: '(targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPkey || ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenHOTPcounter")(version 3.0; acl "Users can add HOTP token secrets"; allow (write, search) userattr = "ipatokenOwner#USERDN";)' not in aci<br></div><div><snip></div><div><br></div><div><snip></div><div>2014-10-27T13:56:28Z INFO Updating existing entry: cn=ipaConfig,cn=etc,dc=XXXXX,dc=XXXXX<br></div><div><snip></div><div>2014-10-27T13:56:28Z WARNING remove: 'AllowLMhash' not in ipaConfigString<br></div><div><snip></div><div><br></div><div>and then we get to the traceback:</div><div>2014-10-27T13:56:34Z ERROR Upgrade failed with cannot connect to 'ldapi://%2fvar%2frun%2fslapd-XXXXX-XXXXX.socket':<br></div><div><div>2014-10-27T13:56:34Z DEBUG Traceback (most recent call last):</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 152, in __upgrade</div><div> self.modified = (ld.update(self.files, ordered=True) or</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 874, in update</div><div> updates = api.Backend.updateclient.update(POST_UPDATE, self.dm_password, self.ldapi, self.live_run)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/plugins/updateclient.py", line 131, in update</div><div> ld.update_from_dict(updates)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 889, in update_from_dict</div><div> self._run_updates(updates)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 799, in _run_updates</div><div> self._update_record(update)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 661, in _update_record</div><div> e = self._get_entry(new_entry.dn)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 544, in _get_entry</div><div> return self.conn.get_entries(dn, scope, searchfilter, sattrs)</div><div> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1421, in get_entries</div><div> base_dn=base_dn, scope=scope, filter=filter, attrs_list=attrs_list)</div><div> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1527, in find_entries</div><div> break</div><div> File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__</div><div> self.gen.throw(type, value, traceback)</div><div> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1206, in error_handler</div><div> error=info)</div><div>NetworkError: cannot connect to 'ldapi://%2fvar%2frun%2fslapd-XXXXX-XXXXX.socket':</div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2014-10-26 21:38 GMT+01:00 Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">Rob Verduijn wrote:<br>
> hmmmm....<br>
><br>
> after some more digging (monitoring the upgrade more closely.)<br>
> I saw that the upgrade kept waiting for the ca to start, which it did<br>
> not do.<br>
> and after 5 minutes the upgrade gave up with the following errors in the<br>
> ipaupgrade log :<br>
><br>
> at 85% it says :<br>
> 2014-10-26T15:04:35Z DEBUG retrieving schema for SchemaCache<br>
> url=ldapi://%2fvar%2frun%2fslapd-XXXX-XXXX.socket<br>
> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x2b18cb0><br>
> 2014-10-26T15:04:35Z DEBUG Starting external process<br>
> 2014-10-26T15:04:35Z DEBUG args='/usr/bin/certutil' '-d'<br>
> '/etc/httpd/alias' '-L'<br>
> 2014-10-26T15:04:35Z DEBUG Process finished, return code=0<br>
> 2014-10-26T15:04:35Z DEBUG stdout=<br>
> Certificate Nickname Trust<br>
> Attributes<br>
><br>
> SSL,S/MIME,JAR/XPI<br>
><br>
> Signing-Cert u,u,u<br>
> XXXX.XXXX IPA CA CT,C,C<br>
> ipaCert u,u,u<br>
> Server-Cert u,u,u<br>
><br>
> 2014-10-26T15:04:35Z DEBUG stderr=<br>
> 2014-10-26T15:04:35Z DEBUG Starting external process<br>
> 2014-10-26T15:04:35Z DEBUG args='/usr/bin/certutil' '-d'<br>
> '/etc/httpd/alias' '-L' '-n' 'TJAKO.THUIS IPA CA' '-a'<br>
> 2014-10-26T15:04:35Z DEBUG Process finished, return code=0<br>
> 2014-10-26T15:04:35Z DEBUG stdout=-----BEGIN CERTIFICATE-----<br>
> < certificate-removed ><br>
> -----END CERTIFICATE-----<br>
> 2014-10-26T15:04:35Z DEBUG stderr=<br>
> 2014-10-26T15:04:36Z ERROR Upgrade failed with cannot connect to<br>
</div></div>> 'ldapi://%2fvar%2frun%2fslapd-XXXX-XXXX.socket':\<br>
<br>
This has nothing to do with the CA, the LDAP server didn't come up. I'd<br>
start with those logs or look earlier in ipaupgrade.log<br>
<br>
The CA requires 389-ds to be running so if it isn't up, then it will<br>
fail to start too.<br>
<span class="HOEnZb"><font color="#888888"><br>
rob<br>
<br>
</font></span></blockquote></div><br></div>