Re: [389-users] Errors installing PKI Clone / chicken or egg question

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 

Mike Mercier wrote:

Hello,

Note: I have cross posted this because it seems to be related to both
applications.


The steps I have taken:

1. Install fedora 10 on 2 servers (service-1, service-2)
2. run yum update on both systems
3. on service-1 and service-2
  a) yum install fedora-ds
  b) setup replication agreement for
    i) o=NetscapeRoot
    ii) userRoot
Everything at this point seems to be fine.

4. on service-1 yum install pki-ca
  a) run through setup screens
    i) Create new security domain
    ii) Configure this Instance as a New CA Subsystem
    iii) Make this a Self-Signed Root CA within this new PKI hierarchy
    iv) use 'localhost' for internal database
    v) use defaults for rest of screen (exporting pkcs12)
  b) pki-ca looks like it is running fine

5. on service-2 yum install pki-ca
  a) run through setup screens
    i) Join an Existing Security Domain (pointing to service-1:9444)
    ii) type username / password
    iii) chose to clone a system (only one option in drop down for service-1)
    iv) import keys
    v) use 'localhost' for internal database

At this point, the installation seems to hang... (see
/var/log/pki-ca/debug for what it is waiting for)

Should I not be using 'localhost' for the internal database?
I would not, that was likely the first issue you encountered when replication could not be initialized by the Dogtag web configuration wizard. 
An additional question:

When running through the setup for dogtag, you have the option of
using ssl for communication.  What if you want to use your dogtag CA
(which you are setting up) to provide the sign the ldap certificate?
The web configuration wizard creates all the necessary certificates and keys, as well all the replication agreements. Assuming the nsDS5ReplicaHost is not localhost, you may have hit a regression with Bugzilla 454032, with modified status, for RHCS 8.0, which should also be in Dogtag, what exact version are you using? (may want to check if you have this fix) In that case, a possible work around would be to not select SSL in the Dogtag web configuration wizard, and then later configure SSL replication either manually or using the Directory Server console. 

I have the following in my logs:

Service-1:
/var/log/dirsrv/slapd-TEST/errors
[21/May/2009:12:13:30 -0400] slapi_ldap_bind - Error: could not read
bind results for id [cn=Replication Manager
cloneAgreement1-service-2-pki-ca,cn=config] mech [SIMPLE]: error 32
(No such object)
[21/May/2009:12:13:30 -0400] NSMMReplicationPlugin -
agmt="cn=masterAgreement1-service-2-pki-ca" (localhost:389):
Replication bind with SIMPLE auth failed: LDAP error 32 (No such
object) ()
[21/May/2009:12:13:31 -0400] slapi_ldap_bind - Error: could not read
bind results for id [cn=Replication Manager
cloneAgreement1-service-2-pki-ca,cn=config] mech [SIMPLE]: error 32
(No such object)
[21/May/2009:12:13:31 -0400] NSMMReplicationPlugin -
agmt="cn=masterAgreement1-service-2-pki-ca" (localhost:389):
Replication bind with SIMPLE auth failed: LDAP error 32 (No such
object) ()
[21/May/2009:12:13:31 -0400] slapi_ldap_bind - Error: could not read
bind results for id [cn=Replication Manager
cloneAgreement1-service-2-pki-ca,cn=config] mech [SIMPLE]: error 32
(No such object)
[21/May/2009:12:13:35 -0400] slapi_ldap_bind - Error: could not read
bind results for id [cn=Replication Manager
cloneAgreement1-service-2-pki-ca,cn=config] mech [SIMPLE]: error 32
(No such object)
[21/May/2009:12:13:41 -0400] slapi_ldap_bind - Error: could not read
bind results for id [cn=Replication Manager
cloneAgreement1-service-2-pki-ca,cn=config] mech [SIMPLE]: error 32
(No such object)
[21/May/2009:12:13:53 -0400] slapi_ldap_bind - Error: could not read
bind results for id [cn=Replication Manager
cloneAgreement1-service-2-pki-ca,cn=config] mech [SIMPLE]: error 32
(No such object)
[21/May/2009:12:14:17 -0400] slapi_ldap_bind - Error: could not read
bind results for id [cn=Replication Manager
cloneAgreement1-service-2-pki-ca,cn=config] mech [SIMPLE]: error 32
(No such object)

Service-2:
/var/log/dirsrv/slapd-TEST/errors
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: allCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: allExpiredCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: allInvalidCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allInValidCertsNotBefore-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allNonRevokedCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allRevokedCaCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: allRevokedCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allRevokedCertsNotAfter-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allRevokedExpiredCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allRevokedOrRevokedExpiredCaCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allRevokedOrRevokedExpiredCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: allValidCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allValidCertsNotAfter-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
allValidOrRevokedCerts-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: caAll-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: caCanceled-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
caCanceledEnrollment-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
caCanceledRenewal-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
caCanceledRevocation-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: caComplete-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
caCompleteEnrollment-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
caCompleteRenewal-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV:
caCompleteRevocation-pki-caIndex
[21/May/2009:12:13:29 -0400] - pki-ca: Indexing VLV: caEnrollment-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV: caPending-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV:
caPendingEnrollment-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV:
caPendingRenewal-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV:
caPendingRevocation-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV: caRejected-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV:
caRejectedEnrollment-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV:
caRejectedRenewal-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV:
caRejectedRevocation-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV: caRenewal-pki-caIndex
[21/May/2009:12:13:30 -0400] - pki-ca: Indexing VLV: caRevocation-pki-caIndex
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=certificaterepository,ou=ca,dc=pki-ca'; entry
ou=certificaterepository,ou=ca,dc=pki-ca may not be added to the
database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - info: entrydn not indexed on
'ou=ca,ou=requests,dc=pki-ca'; entry ou=ca,ou=requests,dc=pki-ca may
not be added to the database yet.
[21/May/2009:12:13:30 -0400] - pki-ca: Finished indexing.
[21/May/2009:12:13:30 -0400] NSMMReplicationPlugin -
agmt="cn=cloneAgreement1-service-2-pki-ca" (service-1:389): Replica
has a different generation ID than the local data.

/var/log/pki-ca/debug - this is what shows up continuously
[21/May/2009:12:21:02][http-9444-Processor25]: DatabasePanel
comparetAndWaitEntries checking ou=people,dc=pki-ca
[21/May/2009:12:21:02][http-9444-Processor25]: DatabasePanel
comparetAndWaitEntries ou=people,dc=pki-ca not found, let's wait!

Thanks,
Mike

--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users



--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users
[Index of Archives]     [Fedora Directory Users]     [Fedora Directory Devel]     [Fedora Announce]     [Fedora Legacy Announce]     [Kernel]     [Fedora Legacy]     [Share Photos]     [Fedora Desktop]     [PAM]     [Red Hat Watch]     [Red Hat Development]     [Big List of Linux Books]     [Gimp]     [Yosemite News]

  Powered by Linux