<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">Le 20 juil. 2015 à 17:58, Petr Vobornik <<a href="mailto:pvoborni@redhat.com" class="">pvoborni@redhat.com</a>> a écrit :</div><br class="Apple-interchange-newline"><div class="">On 07/20/2015 05:17 PM, Alexander Bokovoy wrote:<br class=""><blockquote type="cite" class="">On Mon, 20 Jul 2015, Alexandre Ellert wrote:<br class=""><blockquote type="cite" class=""><br class=""><blockquote type="cite" class="">Can you please show output from<br class="">fgrep -r 'dc' /etc/dirsrv/slapd-INSTANCE/schema<br class=""></blockquote><br class=""># fgrep -r 'dc' /etc/dirsrv/slapd-NUMEEZY-FR/schema<br class=""></blockquote><br class="">This is original 'dc' definition:<br class=""><blockquote type="cite" class="">/etc/dirsrv/slapd-NUMEEZY-FR/schema/00core.ldif:attributeTypes: (<br class="">0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' )<br class=""></blockquote><br class="">This is the offending one:<br class=""><blockquote type="cite" class="">/etc/dirsrv/slapd-NUMEEZY-FR/schema/99user.ldif:attributeTypes: (<br class="">0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) D<br class=""></blockquote><br class=""><blockquote type="cite" class="">In 00core.ldif, I have :<br class="">attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc'<br class="">'domaincomponent' )<br class=""> EQUALITY caseIgnoreIA5Match<br class=""> SUBSTR caseIgnoreIA5SubstringsMatch<br class=""> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26<br class=""> SINGLE-VALUE<br class=""> X-ORIGIN 'RFC 4519'<br class=""> X-DEPRECATED 'domaincomponent' )<br class=""></blockquote>If you look into 99user.ldif, you'll see the wrong definition there.<br class=""><br class="">99user.ldif accumulates definitions coming from replication or updates.<br class="">You can check other IPA masters, do they have 'dc' attribute defined in<br class="">a wrong way?<br class=""><br class=""><blockquote type="cite" class="">As far as I remember, the only modification I made was to disable<br class="">read-only access without authentication. I don’t need any other<br class="">special customization.<br class=""></blockquote>Something brought the wrong definition into your IPA masters.<br class="">May be someone tried to add support for some old application?<br class=""><br class=""></blockquote><br class="">Probably caused by migration from 6.6 to 7.x. See <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1220788" class="">https://bugzilla.redhat.com/show_bug.cgi?id=1220788</a> Usually it doesn't cause any issue but looks scary.<br class=""></div></blockquote><div><br class=""></div><div>I confirm this was a migration from CentOS 6.6 to 7.1. Every thing else worked just fine following the RedHat migration procedure (<a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/migrating-ipa-proc.html" class="">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/migrating-ipa-proc.html</a>)</div><br class=""><blockquote type="cite" class=""><div class=""><br class="">I'd try to isolate entries from DS, CA, maybe also krb5kdc logs around the time the following CA error happened (could be new start).<br class=""><br class="">[30/Jun/2015:10:02:14][localhost-startStop-1]: CMS:Caught EBaseException<br class="">Internal Database Error encountered: Could not connect to LDAP server host <a href="http://ipa.mydomain.org" class="">ipa.mydomain.org</a><br class=""></div></blockquote><div><br class=""></div><div>I restarted IPA :</div><div><br class=""></div><div>/var/log/pki/pki-tomcat/ca/debug :</div>[20/Jul/2015:18:12:17][localhost-startStop-1]: CMS:Caught EBaseException<br class=""><div><br class=""></div><div>/var/log/krb5kdc.log :</div><div>otp: Loaded<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](Error): preauth pkinit failed to initialize: No realms configured correctly for pkinit support<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](info): setting up network...<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](info): listening on fd 8: udp 0.0.0.0.88 (pktinfo)<br class="">krb5kdc: setsockopt(9,IPV6_V6ONLY,1) worked<br class="">krb5kdc: Invalid argument - Cannot request packet info for udp socket address :: port 88<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](info): skipping unrecognized local address family 17<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](info): skipping unrecognized local address family 17<br class="">krb5kdc: setsockopt(9,IPV6_V6ONLY,1) worked<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](info): listening on fd 9: udp fe80::250:56ff:fe93:357e%ens160.88<br class="">krb5kdc: setsockopt(10,IPV6_V6ONLY,1) worked<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](info): listening on fd 11: tcp 0.0.0.0.88<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](info): listening on fd 10: tcp ::.88<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16635](info): set up 4 sockets<br class="">Jul 20 18:11:47 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16636](info): commencing operation<br class="">Jul 20 18:11:48 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16636](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: NEEDED_PREAUTH: <a href="mailto:host/inf-ipa-2.numeezy.fr@NUMEEZY.FR" class="">host/inf-ipa-2.numeezy.fr@NUMEEZY.FR</a> for <a href="mailto:krbtgt/NUMEEZY.FR@NUMEEZY.FR" class="">krbtgt/NUMEEZY.FR@NUMEEZY.FR</a>, Additional pre-authentication required<br class="">Jul 20 18:11:48 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:11:48 <a href="http://inf-ipa-2.numeezy.fr" class="">inf-ipa-2.numeezy.fr</a> krb5kdc[16636](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: ISSUE: authtime 1437408708, etypes {rep=18 tkt=18 ses=18}, <a href="mailto:host/inf-ipa-2.numeezy.fr@NUMEEZY.FR" class="">host/inf-ipa-2.numeezy.fr@NUMEEZY.FR</a> for <a href="mailto:krbtgt/NUMEEZY.FR@NUMEEZY.FR" class="">krbtgt/NUMEEZY.FR@NUMEEZY.FR</a><br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): TGS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: ISSUE: authtime 1437408708, etypes {rep=18 tkt=18 ses=18}, host/inf-ipa-2.numeezy.fr@NUMEEZY.FR for ldap/inf-ipa-2.numeezy.fr@NUMEEZY.FR<br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: NEEDED_PREAUTH: DNS/inf-ipa-2.numeezy.fr@NUMEEZY.FR for krbtgt/NUMEEZY.FR@NUMEEZY.FR, Additional pre-authentication required<br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: ISSUE: authtime 1437408708, etypes {rep=18 tkt=18 ses=18}, DNS/inf-ipa-2.numeezy.fr@NUMEEZY.FR for krbtgt/NUMEEZY.FR@NUMEEZY.FR<br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): TGS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: ISSUE: authtime 1437408708, etypes {rep=18 tkt=18 ses=18}, DNS/inf-ipa-2.numeezy.fr@NUMEEZY.FR for ldap/inf-ipa-2.numeezy.fr@NUMEEZY.FR<br class="">Jul 20 18:11:48 inf-ipa-2.numeezy.fr krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:11:49 inf-ipa-2.numeezy.fr krb5kdc[16636](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: NEEDED_PREAUTH: ldap/inf-ipa-2.numeezy.fr@NUMEEZY.FR for krbtgt/NUMEEZY.FR@NUMEEZY.FR, Additional pre-authentication required<br class="">Jul 20 18:11:49 inf-ipa-2.numeezy.fr krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:11:49 inf-ipa-2.numeezy.fr krb5kdc[16636](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: ISSUE: authtime 1437408709, etypes {rep=18 tkt=18 ses=18}, ldap/inf-ipa-2.numeezy.fr@NUMEEZY.FR for krbtgt/NUMEEZY.FR@NUMEEZY.FR<br class="">Jul 20 18:11:49 inf-ipa-2.numeezy.fr krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:11:49 inf-ipa-2.numeezy.fr krb5kdc[16636](info): TGS_REQ (6 etypes {18 17 16 23 25 26}) 37.59.203.176: ISSUE: authtime 1437408709, etypes {rep=18 tkt=18 ses=18}, ldap/inf-ipa-2.numeezy.fr@NUMEEZY.FR for ldap/inf-ipa.numeezy.fr@NUMEEZY.FR<br class="">Jul 20 18:11:49 inf-ipa-2.numeezy.fr krb5kdc[16636](info): closing down fd 12<br class="">Jul 20 18:13:00 inf-ipa-2.numeezy.fr krb5kdc[16636](info): TGS_REQ (4 etypes {18 17 16 23}) 188.165.154.171: ISSUE: authtime 1437408779, etypes {rep=18 tkt=18 ses=18}, host/mut-web-2.numeezy.fr@NUMEEZY.FR for ldap/inf-ipa.numeezy.fr@NUMEEZY.FR<br class="">Jul 20 18:17:02 inf-ipa-2.numeezy.fr krb5kdc[16636](info): TGS_REQ (4 etypes {18 17 16 23}) 37.59.203.170: ISSUE: authtime 1437409022, etypes {rep=18 tkt=18 ses=18}, host/ded-web-8.numeezy.fr@NUMEEZY.FR for ldap/inf-ipa.numeezy.fr@NUMEEZY.FR<br class="">Jul 20 18:17:05 inf-ipa-2.numeezy.fr krb5kdc[16636](info): preauth (encrypted_timestamp) verify failure: Decrypt integrity check failed<br class="">Jul 20 18:17:05 inf-ipa-2.numeezy.fr krb5kdc[16636](info): AS_REQ (4 etypes {18 17 16 23}) 188.165.154.171: PREAUTH_FAILED: admin@NUMEEZY.FR for krbtgt/NUMEEZY.FR@NUMEEZY.FR, Decrypt integrity check failed</div><div><br class=""></div><div>Thanks for your investigation.</div><div><br class=""></div></div><br class=""></body></html>