<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">http error log has nothing. This is with http restart and a failed request for web ui. The request has no error. Is there a different log that I am overlooking that might have more information?<div class=""><br class=""><div class=""><br class=""></div><div class=""><div class="">[Mon May 08 10:46:14.842162 2017] [:warn] [pid 25471] NSSSessionCacheTimeout is deprecated. Ignoring.</div><div class="">[Mon May 08 10:46:15.136803 2017] [auth_digest:notice] [pid 25471] AH01757: generating secret for digest authentication ...</div><div class="">[Mon May 08 10:46:15.137403 2017] [lbmethod_heartbeat:notice] [pid 25471] AH02282: No slotmem from mod_heartmonitor</div><div class="">[Mon May 08 10:46:15.137422 2017] [:warn] [pid 25471] NSSSessionCacheTimeout is deprecated. Ignoring.</div><div class="">[Mon May 08 10:46:15.145343 2017] [mpm_prefork:notice] [pid 25471] AH00163: Apache/2.4.6 (CentOS) mod_auth_gssapi/1.4.0 mod_auth_kerb/5.4 mod_nss/1.0.14 NSS/3.21 Basic ECC mod_wsgi/3.4 Python/2.7.5 configured -- resuming normal operations</div><div class="">[Mon May 08 10:46:15.145378 2017] [core:notice] [pid 25471] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'</div><div class="">[Mon May 08 10:46:18.234880 2017] [:error] [pid 25476] ipa: INFO: *** PROCESS START ***</div><div class="">[Mon May 08 10:46:18.431700 2017] [:error] [pid 25475] ipa: INFO: *** PROCESS START **</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On May 8, 2017, at 1:43 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" class="">rcritten@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Pete Fuller wrote:</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">IPA command line seems to work. Have been able to use ipa user-find<br class="">and ipa cert-find. Can also sudo and kinit from other machines as IPA user.<br class=""><br class="">Another clue here, looks like even when querying with the ipa cli tools,<br class="">I’m getting 400 errors in the access logs. The top one is obviously a<br class="">browser request. The next 4 were following a cli call to ipa user-find.<br class="">That request does respond back with users, so not sure what is failing<br class="">there. The 192.168.0.95 IP is the local ip of the IPA server itself.<span class="Apple-converted-space"> </span><br class=""><br class="">192.168.51.20 - - [08/May/2017:10:31:46 -0700] "GET / HTTP/1.1" 400 347<br class="">"-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0)<br class="">Gecko/20100101 Firefox/53.0"<br class="">192.168.0.95 - - [08/May/2017:10:32:40 -0700] "POST /ipa/json HTTP/1.1"<br class="">400 347<br class="">192.168.0.95 - - [08/May/2017:10:32:43 -0700] "POST /ipa/json HTTP/1.1"<br class="">400 347<br class="">192.168.0.95 - - [08/May/2017:10:33:01 -0700] "POST /ipa/json HTTP/1.1"<br class="">400 347<br class="">192.168.0.95 - - [08/May/2017:10:33:10 -0700] "POST /ipa/json HTTP/1.1"<br class="">400 347<br class=""></blockquote><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Note that client activity (login, sudo, etc) does not go through Apache.</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Only the IPA API does (so web UI and cli).</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Still need to see the error log.</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">rob</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""><br class=""><blockquote type="cite" class="">On May 8, 2017, at 1:20 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" class="">rcritten@redhat.com</a><br class=""><<a href="mailto:rcritten@redhat.com" class="">mailto:rcritten@redhat.com</a>>> wrote:<br class=""><br class="">Pete Fuller wrote:<br class=""><blockquote type="cite" class="">I ran the 4.4 upgrade yesterday on a group of Centos7 servers that are<br class="">IPA replicas for my North American datacenters. All seem to have the<br class="">same issue that I am now unable to connect to the web UI, with the<br class="">following error in the browser…<br class=""><br class=""><br class="">Bad Request<br class=""><br class="">Your browser sent a request that this server could not understand.<br class=""><br class="">Additionally, a 400 Bad Request error was encountered while trying to<br class="">use an ErrorDocument to handle the request.<br class=""><br class=""><br class=""><br class="">The maddening thing is I can’t find any reference in the apache logs to<br class="">what is generating the error and why a direct request to the UI would<br class="">error.<span class="Apple-converted-space"> </span><br class=""><br class="">As far as I can tell IPA is otherwise working. Logins seem to work,<br class="">sudo rules are working, DNS is working. <br class=""><br class="">[root@lb3 httpd]# ipactl status<br class="">Directory Service: RUNNING<br class="">krb5kdc Service: RUNNING<br class="">kadmin Service: RUNNING<br class="">named Service: RUNNING<br class="">ipa_memcached Service: RUNNING<br class="">httpd Service: RUNNING<br class="">ipa-custodia Service: RUNNING<br class="">ntpd Service: RUNNING<br class="">pki-tomcatd Service: RUNNING<br class="">ipa-otpd Service: RUNNING<br class="">ipa-dnskeysyncd Service: RUNNING<br class=""><br class="">I can see one file in the httpd/conf.d directory that was changed -<br class="">nss.conf. I attempted reverting and that did not work.<br class=""><br class="">Has anyone run upon this error? <br class=""></blockquote><br class="">Does the ipa command-line tool work?<br class=""><br class="">What are you seeing in the Apache error log?<br class=""><br class="">rob</blockquote></blockquote></div></blockquote></div><br class=""></div></div></body></html>