<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi,</div><div class=""><br class=""></div><div class="">I’m wondering if anyone might be able to help me figure out why my KRA is failing after a fairly recent installation. It's throwing exceptions about LDAP authentication that look like the following (note, I’ve truncated some of the stacks for brevity:</div><div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: Could not connect to LDAP server host <a href="http://ipa-1.mydomain.com" class="">ipa-1.mydomain.com</a> port 636 Error netscape.ldap.LDAPException: error result (49)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:205)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.getConn(LdapBoundConnFactory.java:332)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.getConn(LdapBoundConnFactory.java:295)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.dbs.DBSubsystem.hasRangeConflict(DBSubsystem.java:475)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.dbs.Repository.checkRanges(Repository.java:500)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.dbs.KeyRepository.updateKeyStatus(KeyRepository.java:189)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.dbs.KeyStatusUpdateTask.run(KeyRepository.java:604)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)</font></div><div class=""><font size="1" class="">...</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: Could not connect to LDAP server host <a href="http://ipa-1.mydomain.com" class="">ipa-1.mydomain.com</a> port 636 Error netscape.ldap.LDAPException: error result (49)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:205)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.getConn(LdapBoundConnFactory.java:332)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.getConn(LdapBoundConnFactory.java:295)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.dbs.DBSubsystem.hasRangeConflict(DBSubsystem.java:475)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.dbs.Repository.checkRanges(Repository.java:500)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.dbs.KeyRepository.updateKeyStatus(KeyRepository.java:193)</font></div><div class=""><font size="1" class="">Apr 12 21:14:22 server[7515]: at com.netscape.cmscore.dbs.KeyStatusUpdateTask.run(KeyRepository.java:604)</font></div><div class=""><font size="1" class="">...</font></div><div class=""><font size="1" class=""><br class=""></font></div></blockquote>When I restart IPA, I get the following:<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><font size="1" class=""><br class=""></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:34 server[32159]: CA is started.</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:34 server[32159]: SSLAuthenticatorWithFallback: Creating SSL authenticator with fallback</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:34 server[32159]: SSLAuthenticatorWithFallback: Setting container</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:35 server[32159]: SSLAuthenticatorWithFallback: Initializing authenticators</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:35 server[32159]: SSLAuthenticatorWithFallback: Starting authenticators</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:35 server[32159]: CMSEngine.initializePasswordStore() begins</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:35 server[32159]: CMSEngine.initializePasswordStore(): tag=internaldb</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:35 server[32159]: testLDAPConnection connecting to <a href="http://ipa-1.mydomain.com:636" class="">ipa-1.mydomain.com:636</a></div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:35 server[32159]: testLDAPConnection: Invalid Password</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: testLDAPConnection connecting to <a href="http://ipa-1.mydomain.com:636" class="">ipa-1.mydomain.com:636</a></div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: testLDAPConnection: Invalid Password</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: testLDAPConnection connecting to <a href="http://ipa-1.mydomain.com:636" class="">ipa-1.mydomain.com:636</a></div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: testLDAPConnection: Invalid Password</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: CMSEngine: init(): password test execution failed: 2</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: Password test execution failed. Is the database up?</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: Password test execution failed. Is the database up?</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: at com.netscape.cmscore.apps.CMSEngine.initializePasswordStore(CMSEngine.java:469)</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:537)</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: at com.netscape.certsrv.apps.CMS.init(CMS.java:188)</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114)</div></font></div><div class=""><font size="1" class=""><div class="">Apr 12 21:18:36 server[32159]: at javax.servlet.GenericServlet.init(GenericServlet.java:158)</div></font></div><div class=""><font size="1" class="">...</font></div></blockquote><div class=""><div style="font-size: x-small;" class=""><br class=""></div><div class="">If I then try to add or delete a vault, I get the following:</div><div style="font-size: x-small;" class=""><br class=""></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: SSLAuthenticatorWithFallback: Authenticate with client certificate authentication</div></div></font></div><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: java.lang.NullPointerException</div></div></font></div><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:114)</div></div></font></div><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:86)</div></div></font></div><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: at org.apache.catalina.authenticator.SSLAuthenticator.authenticate(SSLAuthenticator.java:81)</div></div></font></div><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:37)</div></div></font></div><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:86)</div></div></font></div><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.authenticate(SSLAuthenticatorWithFallback.java:47)</div></div></font></div><div class=""><font size="1" class="">...</font></div><div class=""><font size="1" class=""><div class=""><div class="">Apr 12 22:19:08 server[32159]: SSLAuthenticatorWithFallback: Result: false</div></div></font></div></blockquote><div class=""><div style="font-size: x-small;" class=""><br class=""></div><div class="">I’ve got the following in /var/log/pki/pki-tomcat/kra/debug:</div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><font size="1" class=""><br class=""></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: Starting request checkRanges</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: Serial numbers left in range: 10000</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: Last Serial Number: 9990000</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: Serial Numbers in next range: 10000000</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: Serial Numbers available: 10010000</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: Checking for a range conflict</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: In LdapBoundConnFactory::getConn()</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: masterConn is null.</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: makeConnection: errorIfDown true</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: TCP Keep-Alive: true</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: SSL handshake happened</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: Can't create master connection in LdapBoundConnFactory::getConn! Could not connect to LDAP server host <a href="http://ipa-1.mydomain.com" class="">ipa-1.mydomain.com</a> port 636 Error netscape.ldap.LDAPException: error result (49)</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: DBSubsystem: hasRangeConflict. Error while checking next range.Could not connect to LDAP server host <a href="http://ipa-1.mydomain.com" class="">ipa-1.mydomain.com</a> port 636 Error netscape.ldap.LDAPException: error result (49)</div></font></div><div class=""><font size="1" class=""><div class="">[12/Apr/2017:21:14:22][KeyStatusUpdateTask]: request checkRanges done</div><div class=""><br class=""></div></font></div></blockquote>This is IPA 4.4.4-1.fc25, installed fairly recently. I’m not sure if this is relevant, but this was installed as a new master on new infrastructure based on an old Fedora 23, IPA 4.3 master that never had a KRA. I initially replicated to a new Fedora 23 host and upgraded that host to Fedora 25 (it may have still been connected to the 4.3 master during and after the upgrade). ipa-kra-install was then run on that Fedora 25 host which was again replicated to what is now presenting this problem. I believe the KRA started up fine at that point but I didn’t thoroughly test it. I then disconnected the old Fedora 25 host and shut down the old infrastructure. I’m now running on a single master IPA node with this broken KRA problem.<div class=""><br class=""></div><div class="">Note that everything else about this installation seems to work. I wouldn’t have even really noticed if not for trying to replicate again and failing due to KRA issues.</div><div class=""><br class=""></div><div class="">Thanks!</div><div class="">— Ilya Kogan<br class=""><div class=""><div class=""><br class=""></div></div></div></body></html>