Hi List,
I have encountered a strange behavior in Dogtag when working on
https://fedorahosted.org/freeipa/ticket/5570
I have set the deployment config for KRA to use LDAPS for communication
with IPA dirsrv backend during spawn. Everything works perfectly, except
that I see the following timeout during ipa-kra-install on FreeIPA master:
http://fpaste.org/329271/45641447/
However the installation finishes as usual and pki-tomcatd service is
running in the end, albeit showing the following traceback:
http://fpaste.org/329260/56413840/
The KRA subsystem is also recognized by subsystem-find:
http://fpaste.org/329335/20387145/
Our upstream XMLRPC tests excersizing KRA and CA subystem also pass, so
clearly functionality is not affected.
Nevertheless something is preventing Dogtag to start up given our 300 s
timeout (i have tried longer intervals up to 1200 s to no avail). In the
IPA KRA install log, I can see our code polling CA's REST interface
unsuccessfully:
http://fpaste.org/329294/15776145/
After some few additional installation steps when Dogtag instance is
shutdown and started up again, it goes up just fine and REST api reports
ready status.
I would like to know if this is issue on Dogtag side or some
misconfiguration from my side. I have CA and KRA subsystem logs at hand.
If anyone is interested ping me on IRC and I will give them to you. Endi
an Christian (CC'ed) should also have them at hand.
I should also mentioned that I was only able to reproduce this in my
local vagrant/libvirt environment. Also, deploying CA subsystem on
hardened CA-less FreeIPA server using LDAPS works fine without any timeouts.
Thank you for your help.
--
Martin^3 Babinsky