search

ubccr / mokey

FreeIPA self-service account management portal
BSD 3-Clause "New" or "Revised" License
189 stars 45 forks source link

Error Contacting FreeIPA #53

Closed kiranshila closed 4 years ago

kiranshila commented 4 years ago

Opening a new issue for this:

I can create users, and I see them get populated in FreeIPA, but when I try to login - the site pauses for a bit and displays Error contacting FreeIPA.

I spent about a day yesterday trying to get it to work after struggling trying to get PWM to work, but failing on getting the LDAP schemas to register.

Things I have tried

I have run this on both the same IPA server and an IPA client. While running on the ipa server, I could not access the panel remotely, a la #44 .

On the client, I could bring up the panel and things seemed to work at first, but I couldn't register users. I had a problem with the encryption key and saw your comments in some other issues on how to generate them.

Updating the encryption keys, I got to the place where I am now, where I just get the cryptic message at the top and zero logs, even in debug mode.

The IP is bound to 0.0.0.0 as it is just running on a ubuntu client vm on my network.

I have tried the latest rpm release as well as building from source. By the way, it doesn't seem to compile with go v1.14.

aebruno commented 4 years ago

What freeipa version are you running? What distro is the freeipa server running on?

kiranshila commented 4 years ago

FreeIPA 4.8.6 on Fedora 31

aebruno commented 4 years ago

FreeIPA 4.8.6 on Fedora 31

Great, thanks. We do most all of our testing/development on FreeIPA versions shipped with RHEL/CentOS which is currently FreeIPA version 4.6.6. If it's possible, I suggest using this version with mokey as it will be much better supported.

I'll try testing mokey out on a fedora vm running 4.8.6 and see if I can reproduce your issue.

kiranshila commented 4 years ago

Thank you for testing! I'm just running a little intranet for my business of less than 10 people, not a big corporate environment or anything, so I have just been updating when it when a new version comes out.

aebruno commented 4 years ago

By the way, it doesn't seem to compile with go v1.14.

This is building fine for me with go 1.14.4:

$ go version
go version go1.14.4 linux/amd64

What errors are you seeing?

kiranshila commented 4 years ago

Oh weird, I can try to run it again, but rolling back to 1.13 worked for me. I can chock that one up to user configuration error on my part and take your word for it that it does in fact work on 1.14

kiranshila commented 4 years ago

@aebruno Any success on the fedora vm?

aebruno commented 4 years ago

@kiranshila Are you running mokey on the same host as your freeipa server?

kiranshila commented 4 years ago

No I was not, I could not get the page to load when accessed from an external machine. I made a new VM ipa client just to run it.

aebruno commented 4 years ago

I ran some quick tests on CentOS 8 running freeipa version 4.8.4 and all works fine for me. I was able to create users and login. So we may have to do some more digging. Can you verify this file exists /etc/ipa/default.conf and contains the following lines:

server = freepia-test.test.yourdomain.com
realm = TEST.YOUR.DOMAIN.COM

Also, just to confirm:

  1. You can get to mokey (i.e. the home page logs with a the login form)

  2. You can successfully sign up a new user?

  3. After that you can't login? The page just hangs?

kiranshila commented 4 years ago

Yep, contents look good for the ipa conf

#File modified by ipa-client-install

[global]
basedn = dc=lab,dc=gondor,dc=dev
realm = LAB.GONDOR.DEV
domain = lab.gondor.dev
server = ipa.lab.gondor.dev
host = mokey.lab.gondor.dev
xmlrpc_uri = https://ipa.lab.gondor.dev/ipa/xml
enable_ra = True

I register a new user, and it works fine - I check in the freeIPA panel and I can see the added user I then go to login with the same user and password and get this

image
kiranshila commented 4 years ago

And there are no logs, even with --debug upon login failure

kiranshila commented 4 years ago

When I type in the wrong password, it gives an invalid password error and logs it appropriately, so it is validating the password

aebruno commented 4 years ago

Great, thanks for the additional info.

kiranshila commented 4 years ago

Thanks for helping! I feel like we're close to figuring this out. Please let me know if you want me to test anything.

aebruno commented 4 years ago

I can reproduce this on fedora 31 freeipa version 4.8.6. Give me a few days to sort out a fix and best way to support the newer versions of freeipa while maintaining compatibility with rhel/centos.

kiranshila commented 4 years ago

Ooh interesting, implying it might be a Fedora issue?

aebruno commented 4 years ago

Just released v0.5.4. Can you test this out and see if it fixes your issue? This version works well for me on fedora 31 with freeipa v4.8.6.

Thanks again for your help debugging this.

kiranshila commented 4 years ago

Fixed! Incredible work, thank you so much!

tim-skillcafe commented 3 years ago

For info: have tested 0.5.6-1.el7.x86_64 on a Fedora 34 VM (school lab) and in a F34 Docker container (home lab). Works nicely.