ERF12-5287 » History » Version 8
Stephen Benjamin, 07/22/2015 01:13 PM
1 | 3 | Stephen Benjamin | h1. ERF12-5287: Unable to create realm entry |
---|---|---|---|
2 | |||
3 | 8 | Stephen Benjamin | Look at /var/log/foreman-proxy/proxy.log and /var/log/foreman/production.log for errors. |
4 | 1 | Stephen Benjamin | |
5 | Possible solutions to this issue: |
||
6 | |||
7 | 6 | Stephen Benjamin | h2. Upgraded IPA 3.x to 4.x |
8 | |||
9 | 7 | Stephen Benjamin | If you upgraded IPA from 3 to 4, the permissions system has changed and the custom permissions foreman needs are not migrated correctly. You can verify this is the problem by looking at /var/log/httpd/*.log for permissions errors. |
10 | 6 | Stephen Benjamin | |
11 | Re-run `foreman-prepare-realm` from a server with the IPA version *4* client tools installed (such as the FreeIPA server itself). |
||
12 | |||
13 | |||
14 | 2 | Stephen Benjamin | h2. Expired Keytab |
15 | |||
16 | Do you see an error like this in /var/log/foreman-proxy/proxy.log? |
||
17 | |||
18 | <pre> |
||
19 | ERROR -- : Failed to initailize credentials cache from keytab: krb5_get_init_creds_keytab: Decrypt integrity check failed |
||
20 | </pre> |
||
21 | |||
22 | 4 | Tommy McNeely | Your Keytab may be expired. The keytab expiration follows your password expiration policies. |
23 | 2 | Stephen Benjamin | |
24 | You can get a new one by: |
||
25 | |||
26 | <pre> |
||
27 | # kinit admin@EXAMPLE.COM (or other suitable IPA admin) |
||
28 | # ipa-getkeytab -s ipa01.example.com -p realm-proxy@EXAMPLE.COM -k /etc/foreman-proxy/freeipa.keytab |
||
29 | 4 | Tommy McNeely | # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab |
30 | 2 | Stephen Benjamin | </pre> |
31 | |||
32 | 1 | Stephen Benjamin | |
33 | h2. Wrong Size Error |
||
34 | |||
35 | Do you see an error like this in /var/log/foreman-proxy/proxy.log? |
||
36 | |||
37 | <pre> |
||
38 | E, [2014-11-03T15:23:02.715791 #21273] ERROR -- : Wrong size. Was 307, should be 191 |
||
39 | </pre> |
||
40 | |||
41 | This is due to a bug in Ruby: |
||
42 | https://bugs.ruby-lang.org/issues/8182 |
||
43 | |||
44 | 5 | Dominic Cleal | This has been fixed in RHEL 7.1 + rebuilds, please run @yum update ruby@. The relevant bugzilla |
45 | 1 | Stephen Benjamin | is: https://bugzilla.redhat.com/show_bug.cgi?id=1071187 |
46 | |||
47 | 5 | Dominic Cleal | On 7.0, you can temporarily work around the problem by commenting these out on lines 505-506 in |
48 | 1 | Stephen Benjamin | /usr/share/ruby/xmlrpc/client.rb: |
49 | |||
50 | <pre> |
||
51 | #elsif expected != "<unknown>" and expected.to_i != data.bytesize and resp["Transfer-Encoding"].nil? |
||
52 | # raise "Wrong size. Was #{data.bytesize}, should be |
||
53 | # #{expected}" |
||
54 | </pre> |