search

AAROC / DevOps

DevOps code to deploy eScience services
http://www.africa-grid.org/DevOps
Other
19 stars 40 forks source link

SE-AMPR | msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist #246

Closed qasims closed 9 years ago

qasims commented 9 years ago

How to create this idp-metadata.xml file? I saw file is not on the destination. Please below TASK: [shibboleth-idp | Org stanza]

root@ssaidp:/home/qasim# ansible-playbook -k /etc/ansible/idp-ldap.yml --ask-vault-pass
SSH password:
SUDO password[defaults to SSH password]:
Vault password:

PLAY [Configure the LDAP machine] *********************************************

GATHERING FACTS ***************************************************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Retrieve iptables rules] ***************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Count iptables rules] ******************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Apply rules for the local network] *****************
skipping: [idp.se.ampr.org] => (item=389)
skipping: [idp.se.ampr.org] => (item=636)

TASK: [fmarco76.firewall | Apply rules for the defined network] ***************
skipping: [idp.se.ampr.org] => (item=389)
skipping: [idp.se.ampr.org] => (item=636)

TASK: [fmarco76.firewall | Apply nat rules] ***********************************
skipping: [idp.se.ampr.org] => (item=389)
skipping: [idp.se.ampr.org] => (item=636)

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [ldap | what are we installing?] ****************************************
ok: [idp.se.ampr.org] => {
    "msg": "['slapd', 'ldap-utils'] will be installed in /etc/ldap"
}

TASK: [ldap | Install the openldap and required Packages for RedHat] **********
skipping: [idp.se.ampr.org]

TASK: [ldap | Install the openldap and required Packages for Debian] **********
ok: [idp.se.ampr.org] => (item=slapd,ldap-utils)

TASK: [ldap | Start ldap server] **********************************************
ok: [idp.se.ampr.org]

TASK: [ldap | Retrieve ldap server configuration] *****************************
ok: [idp.se.ampr.org]

TASK: [ldap | Copy modules file LDIF] *****************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Add modules (Debian)] *******************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Add modules (RedHat)] *******************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Restart ldap server] ********************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Create db LDIF] *************************************************
ok: [idp.se.ampr.org]

TASK: [ldap | Customise DB] ***************************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Copy Password Policy Schema ldap server (Debian)] ***************
skipping: [idp.se.ampr.org]

TASK: [ldap | Apply ppolicy schema] *******************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Copy Overlay LDIF] **********************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Apply overlays] *************************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Enable Secure Communications with the LDAP server (RedHat)] *****
skipping: [idp.se.ampr.org] => (item=SLAPD_LDAPI)
skipping: [idp.se.ampr.org] => (item=SLAPD_LDAPS)

TASK: [ldap | Enable protocols in sysconfig startup script (RedHat)] **********
skipping: [idp.se.ampr.org] => (item=SLAPD_LDAPI)
skipping: [idp.se.ampr.org] => (item=SLAPD_LDAPS)

TASK: [ldap | Enable Secure Communications with the LDAP server] **************
ok: [idp.se.ampr.org] => (item=SLAPD_SERVICES)

TASK: [ldap | Create the directory for ldap certificates] *********************
ok: [idp.se.ampr.org]

TASK: [ldap | Generate the private key for certificate request] ***************
ok: [idp.se.ampr.org]

TASK: [ldap | Strip the passphrase from the key] ******************************
ok: [idp.se.ampr.org]

TASK: [ldap | Create and sign the the new certificate] ************************
ok: [idp.se.ampr.org]

TASK: [ldap | Copy secure config (RedHat)] ************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Copy secure config (Debian)] ************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Config certificates] ********************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Restart ldap server] ********************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Retrieve ldap root dn] ******************************************
ok: [idp.se.ampr.org]

TASK: [ldap | Create the root node] *******************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Add the root node] **********************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Retrieve ldap orgs] *********************************************
ok: [idp.se.ampr.org]

TASK: [ldap | Create Organisations LDIF] **************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Add Organisations to the server] ********************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Retrieve ldap default policy] ***********************************
ok: [idp.se.ampr.org]

TASK: [ldap | Copy Default policies] ******************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Apply overlays] *************************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Retrieve ldap user] *********************************************
ok: [idp.se.ampr.org]

TASK: [ldap | Create the first user ldif] *************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Add first user to ou=People] ************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Retrieve ldap useradmin] ****************************************
ok: [idp.se.ampr.org]

TASK: [ldap | Create the useradmin ldif] **************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Add first user to ou=People] ************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Retrieve ldap services] *****************************************
ok: [idp.se.ampr.org]

TASK: [ldap | Create the services group] **************************************
skipping: [idp.se.ampr.org]

TASK: [ldap | Configure the services group] ***********************************
skipping: [idp.se.ampr.org]

PLAY [Prepare the identity machine common environment] ************************

GATHERING FACTS ***************************************************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Retrieve iptables rules] ***************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Count iptables rules] ******************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Apply rules for the local network] *****************
skipping: [idp.se.ampr.org] => (item={'dport': 8080, 'port': 80})

TASK: [fmarco76.firewall | Apply rules for the defined network] ***************
skipping: [idp.se.ampr.org] => (item={'dport': 8080, 'port': 80})

TASK: [fmarco76.firewall | Apply nat rules] ***********************************
skipping: [idp.se.ampr.org] => (item={'dport': 8080, 'port': 80})

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Retrieve iptables rules] ***************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Count iptables rules] ******************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Apply rules for the local network] *****************
skipping: [idp.se.ampr.org] => (item=80)
skipping: [idp.se.ampr.org] => (item=8080)

TASK: [fmarco76.firewall | Apply rules for the defined network] ***************
skipping: [idp.se.ampr.org] => (item=80)
skipping: [idp.se.ampr.org] => (item=8080)

TASK: [fmarco76.firewall | Apply nat rules] ***********************************
skipping: [idp.se.ampr.org] => (item=80)
skipping: [idp.se.ampr.org] => (item=8080)

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [fmarco76.tomcat | Install Java platform and server on the machine (Debian)] ***
ok: [idp.se.ampr.org] => (item=default-jdk,tomcat6,ant,expect)

TASK: [fmarco76.tomcat | Install Java platform and server on the machine (RedHat)] ***
skipping: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Retrieve iptables rules] ***************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Count iptables rules] ******************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Apply rules for the local network] *****************
skipping: [idp.se.ampr.org] => (item={'dport': 8443, 'port': 443})

TASK: [fmarco76.firewall | Apply rules for the defined network] ***************
skipping: [idp.se.ampr.org] => (item={'dport': 8443, 'port': 443})

TASK: [fmarco76.firewall | Apply nat rules] ***********************************
skipping: [idp.se.ampr.org] => (item={'dport': 8443, 'port': 443})

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Retrieve iptables rules] ***************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Count iptables rules] ******************************
ok: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Apply rules for the local network] *****************
skipping: [idp.se.ampr.org] => (item=443)
skipping: [idp.se.ampr.org] => (item=8443)

TASK: [fmarco76.firewall | Apply rules for the defined network] ***************
skipping: [idp.se.ampr.org] => (item=443)
skipping: [idp.se.ampr.org] => (item=8443)

TASK: [fmarco76.firewall | Apply nat rules] ***********************************
skipping: [idp.se.ampr.org] => (item=443)
skipping: [idp.se.ampr.org] => (item=8443)

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [fmarco76.firewall | Save iptable rules] ********************************
skipping: [idp.se.ampr.org]

TASK: [shibboleth-idp | Download the shibboleth package] **********************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Create the installation directory] ********************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Unpack the tarball] ***********************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Copy the installer] ***********************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Install the package] **********************************
changed: [idp.se.ampr.org]

TASK: [shibboleth-idp | Associate the correct owner] **************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Copy JKS generator script] ****************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Create JKS for tomcat] ********************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Create endorsed directory] ****************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Copy endorsed libraries] ******************************
ok: [idp.se.ampr.org] => (item=serializer-2.10.0.jar)
ok: [idp.se.ampr.org] => (item=xalan-2.7.1.jar)
ok: [idp.se.ampr.org] => (item=xercesImpl-2.10.0.jar)
ok: [idp.se.ampr.org] => (item=xml-apis-2.10.0.jar)
ok: [idp.se.ampr.org] => (item=xml-resolver-1.2.jar)

TASK: [shibboleth-idp | Set endorsed path] ************************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Remove Custom java memory size] ***********************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | UnSet current java memory size] ***********************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | UnSet java perm gen memory size] **********************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Add java memory size] *********************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Add jar for SSL Implementation supporting SOAP] *******
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Enable the ssl] ***************************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Enble the shibboleth idp application] *****************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Create Attribute Filters] *****************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Create Attribute Resolver] ****************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Create Logger] ****************************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Create Handler] ***************************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Create Relying Parties] *******************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Configure the Login module] ***************************
ok: [idp.se.ampr.org]

TASK: [shibboleth-idp | Org stanza] *******************************************
failed: [idp.se.ampr.org] => (item=</ContactPerson>) => {"failed": true, "item": "</ContactPerson>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=<EmailAddress>mailto:bbecker@csir.co.za</EmailAddress>) => {"failed": true, "item": "<EmailAddress>mailto:bbecker@csir.co.za</EmailAddress>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=<SurName>Support</SurName>) => {"failed": true, "item": "<SurName>Support</SurName>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=<GivenName>System</GivenName>) => {"failed": true, "item": "<GivenName>System</GivenName>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=<ContactPerson contactType="technical">) => {"failed": true, "item": "<ContactPerson contactType=\"technical\">", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=</Organization>) => {"failed": true, "item": "</Organization>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=<OrganizationURL xml:lang="en">http://aaroc.github.io</OrganizationURL>) => {"failed": true, "item": "<OrganizationURL xml:lang=\"en\">http://aaroc.github.io</OrganizationURL>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=<OrganizationDisplayName xml:lang="en">Catch-All Identity Provider</OrganizationDisplayName>) => {"failed": true, "item": "<OrganizationDisplayName xml:lang=\"en\">Catch-All Identity Provider</OrganizationDisplayName>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=<OrganizationName xml:lang="en">Africa-Arabia Regional Operations Centre</OrganizationName>) => {"failed": true, "item": "<OrganizationName xml:lang=\"en\">Africa-Arabia Regional Operations Centre</OrganizationName>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !
failed: [idp.se.ampr.org] => (item=<Organization>) => {"failed": true, "item": "<Organization>", "rc": 257}
msg: Destination /opt/shibboleth-idp/metadata/idp-metadata.xml does not exist !

FATAL: all hosts have already failed -- aborting

PLAY RECAP ********************************************************************
           to retry, use: --limit @/root/idp-ldap.retry

idp.se.ampr.org            : ok=70   changed=1    unreachable=0    failed=1
brucellino commented 9 years ago

Hi @qasims sorry we seem to have missed this one. The error is due to a missing path, of course, but I need to check why that path is not created.

Also, it seems that the variables for your site are using the default ones. Can you remind me of your group_vars ?

qasims commented 9 years ago

@brucellino

Here are files Debian-servers.yml, identty-ll.yml, password-ssa.yml which are same as in your repo. Here is my changes in

identity-ssa-dip.yml

---
# institute metadata
site_name: SSA
host_institute:
  name: SSA
  url: http://www.ssa.se

# LDAP variables
server_country: SE
server_state:
server_location: Stockholm
server_organization: TTA
server_organization_unit: SSA
ldap_server: ldap.se.ampr.org
root_password_clear: ******
sgw_admin: qasim.sarfraz@gmail.com  

# institute metadata
host_institute:
  name: SSA
  url: http://www.ssa.se

organisation:
  name: SSA
  logo: dit.jpg

mail_contact: qasim.sarfraz@gmail.com
# IDP variables. these are specifically related to the IdPOpen Web front end.
idp:
  name: SSA IdP
  admin_user: qasim
  admin_email: qasim.sarfraz@gmail.com
  metadata_url: https://{{ hostvars[groups['shibboleth-idps'][0]]['ansible_fqdn']}}/idp/shibboleth
  mail_server: 
  header_logo: Logo.jpg
fmarco76 commented 9 years ago

Hi @qasims, is the directory "/opt/shibboleth-idp/" created with an empty metadata folder or it does not exist at all?

qasims commented 9 years ago

Hi @fmarco76 all path as you mentioned above and under that path metadata.yml is created.

Here is the file data

---
# these variables should in included in the role vars
- name: Org stanza
  lineinfile:
    dest: "{{ shibboleth_install_path }}/metadata/idp-metadata.xml"
    line: "{{ item }}"
    insertafter: "</AttributeAuthorityDescriptor>"
    state: present
  with_items: metadata_lines
  tags: metadata
qasims commented 9 years ago

@brucellino @fmarco76 Guys any idea? I am behind in my IdP project.

brucellino commented 9 years ago

I've just taken a look at this; it seems that the xml file is not created. I fact, most of the files necessary are not installed - /opt/shibboleth-idp is there, but the directories are empty.

The reason is that the install script actually dies...

BUILD FAILED
/home/bruce/idp/shibboleth-identityprovider-2.4.1/src/installer/resources/build.xml:70: java.lang.IllegalStateException: No match found

The line is 

                <regexSplit input="${idp.hostname}" regex="^.*\.(.*\..*$)" addproperty="idp.scope"/>

so, the hostname is not set probably.

brucellino commented 9 years ago

ok, this was due to the fact that the hostname of the machine was not set to the name in the inventory. Setting the hostname results in fixing the problem. I'm going to add this to a pre-task in the role.