<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> I agree that is weird.<o:p></o:p> Several of the other managed permissions are updated successfully and they are very similar.<o:p></o:p> Yes, I can try to remove the permission manually.<o:p></o:p> Is there any risk in corrupting or breaking the system? This is, I believe, one of three IPA servers in a multi-master replication.<o:p></o:p> And we run our production website (basically our company) off of these servers.<o:p></o:p> Assuming it's safe enough to do, could I delete that permission via the UI or does it need to be directly via LDAP?<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Martin Basti [mailto:mbasti@redhat.com] Sent: Tuesday, October 11, 2016 9:47 AM To: John Popowitch; freeipa-users@redhat.com Subject: Re: [Freeipa-users] FreeIPA v4.2 stopped working, wants me to run ipa-server-upgrade, but has errors<o:p></o:p> </div> </div> <o:p> </o:p> That's weird because the code is checking if a permission exists before it tries to add a new one<o:p></o:p> Can you try to remove 'System: Modify Certificate Profile' manually from LDAP and re-run ipa-server-upgrade?<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div> On 11.10.2016 15:53, John Popowitch wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> 2016-10-10T19:51:38Z DEBUG Updating managed permission: System: Modify Certificate Profile<o:p></o:p> 2016-10-10T19:51:38Z DEBUG Destroyed connection context.ldap2_82077392<o:p></o:p> 2016-10-10T19:51:38Z ERROR Upgrade failed with This entry already exists<o:p></o:p> 2016-10-10T19:51:38Z DEBUG Traceback (most recent call last):<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 306, in __upgrade<o:p></o:p> self.modified = (ld.update(self.files) or self.modified)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 905, in update<o:p></o:p> self._run_updates(all_updates)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 877, in _run_updates<o:p></o:p> self._run_update_plugin(update['plugin'])<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 852, in _run_update_plugin<o:p></o:p> restart_ds, updates = self.api.Updater[plugin_name]()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 1400, in __call__<o:p></o:p> return self.execute(**options)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/plugins/update_managed_permissions.py", line 433, in execute<o:p></o:p> anonymous_read_aci)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/plugins/update_managed_permissions.py", line 529, in update_permission<o:p></o:p> ldap.add_entry(entry)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1428, in add_entry<o:p></o:p> self.conn.add_s(str(entry.dn), attrs.items())<o:p></o:p> File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__<o:p></o:p> self.gen.throw(type, value, traceback)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 938, in error_handler<o:p></o:p> raise errors.DuplicateEntry()<o:p></o:p> DuplicateEntry: This entry already exists<o:p></o:p> <o:p></o:p> 2016-10-10T19:51:38Z DEBUG Traceback (most recent call last):<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 418, in start_creation<o:p></o:p> run_step(full_msg, method)<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 408, in run_step<o:p></o:p> method()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 314, in __upgrade<o:p></o:p> raise RuntimeError(e)<o:p></o:p> RuntimeError: This entry already exists<o:p></o:p> <o:p></o:p> 2016-10-10T19:51:38Z DEBUG [error] RuntimeError: This entry already exists<o:p></o:p> 2016-10-10T19:51:38Z DEBUG [cleanup]: stopping directory server<o:p></o:p> 2016-10-10T19:51:38Z DEBUG Starting external process<o:p></o:p> 2016-10-10T19:51:38Z DEBUG args='/bin/systemctl' 'stop' '<a href="mailto:dirsrv@AWS-CAPPEX-COM.service">dirsrv@AWS-CAPPEX-COM.service</a>'<o:p></o:p> 2016-10-10T19:51:40Z DEBUG Process finished, return code=0<o:p></o:p> 2016-10-10T19:51:40Z DEBUG stdout=<o:p></o:p> 2016-10-10T19:51:40Z DEBUG stderr=<o:p></o:p> 2016-10-10T19:51:40Z DEBUG duration: 1 seconds<o:p></o:p> 2016-10-10T19:51:40Z DEBUG [cleanup]: restoring configuration<o:p></o:p> 2016-10-10T19:51:40Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-10-10T19:51:40Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-10-10T19:51:40Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-10-10T19:51:40Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-10-10T19:51:40Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-10-10T19:51:40Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-10-10T19:51:40Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> 2016-10-10T19:51:40Z DEBUG duration: 0 seconds<o:p></o:p> 2016-10-10T19:51:40Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.<o:p></o:p> 2016-10-10T19:51:40Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute<o:p></o:p> return_value = self.run()<o:p></o:p> File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 50, in run<o:p></o:p> raise admintool.ScriptError(str(e))<o:p></o:p> <o:p></o:p> 2016-10-10T19:51:40Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError: ('IPA upgrade failed.', 1)<o:p></o:p> 2016-10-10T19:51:40Z ERROR ('IPA upgrade failed.', 1)<o:p></o:p> <o:p></o:p> <o:p></o:p> <o:p></o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Martin Basti [<a href="mailto:mbasti@redhat.com">mailto:mbasti@redhat.com</a>] Sent: Tuesday, October 11, 2016 1:53 AM To: John Popowitch; <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] FreeIPA v4.2 stopped working, wants me to run ipa-server-upgrade, but has errors<o:p></o:p> </div> </div> <o:p></o:p> <o:p></o:p> <o:p></o:p> <div> On 10.10.2016 23:30, John Popowitch wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Hello FreeIPA community.<o:p></o:p> I've inherited a group of three FreeIPA v4.2 servers on CentOS 7.2.<o:p></o:p> I had to reboot one of the servers and now IPA won't run saying, "Upgrade required: please run ipa-server-upgrade command."<o:p></o:p> But when I run ipa-server-upgrade I get an error:<o:p></o:p> ipa: ERROR: Upgrade failed with This entry already exists<o:p></o:p> When I run it in debug mode the last action before the error is:<o:p></o:p> ipa.ipaserver.install.plugins.update_managed_permissions.update_managed_permissions: DEBUG: Updating managed permission: System: Modify Certificate Profile<o:p></o:p> It appears that several of the other managed permissions are processed successfully.<o:p></o:p> When I look in the UI on one of the other servers it appears that this permission exists under IPA Server -> Role Based Access Control -> Permissions.<o:p></o:p> I'm not familiar with FreeIPA so any help would be greatly appreciated.<o:p></o:p> Thanks in advance.<o:p></o:p> -John<o:p></o:p> <o:p></o:p> <o:p></o:p> </blockquote> Hello, can you post the related part of ipaupgrade.log here? Martin<o:p></o:p> </blockquote> <o:p> </o:p> </div> </body> </html>