Foreman upgrade works but fresh install doesn't

Doug_Forster · September 30, 2016, 9:38pm

Everyone,

I need a little help I have two instances of foreman that I have installed.
I am planning on upgrading an instance that is behind a F5 so I have done
the following on the system that worked.

Installed current version on a fresh rhel 7 host.
Cloned the production database to a new mysql server for testing.
upgraded from 1.10 to 1.11.
upgraded to 1.12.

Everything seemed to work fine.

Added a new host and pointed it at the same database and installed foreman
1.12. I cannot auth via LDAP on the new host.

This is the error:
LdapFluff::Generic::UnauthenticatedException
Could not bind to ActiveDirectory user !LDAPForeman
/opt/theforeman/tfm/root/usr/share/gems/gems/ldap_fluff-0.4.3/lib/ldap_fluff/generic.rb:59:in
service_bind' /opt/theforeman/tfm/root/usr/share/gems/gems/ldap_fluff-0.4.3/lib/ldap_fluff/generic.rb:20:inuser_exists?'
/opt/theforeman/tfm/root/usr/share/gems/gems/ldap_fluff-0.4.3/lib/ldap_fluff/ldap_fluff.rb:63:in
block in valid_user?' /opt/theforeman/tfm/root/usr/share/gems/gems/ldap_fluff-0.4.3/lib/ldap_fluff/ldap_fluff.rb:94:inblock in instrument'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/notifications.rb:164:in
block in instrument' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/notifications/instrumenter.rb:20:ininstrument'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/notifications.rb:164:in
instrument' /opt/theforeman/tfm/root/usr/share/gems/gems/ldap_fluff-0.4.3/lib/ldap_fluff/ldap_fluff.rb:93:ininstrument'
/opt/theforeman/tfm/root/usr/share/gems/gems/ldap_fluff-0.4.3/lib/ldap_fluff/ldap_fluff.rb:62:in
valid_user?' /usr/share/foreman/app/models/auth_sources/auth_source_ldap.rb:56:inauthenticate'
/usr/share/foreman/app/models/user.rb:197:in try_to_login' /usr/share/foreman/app/controllers/users_controller.rb:71:inlogin'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal/implicit_render.rb:4:in
send_action' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/abstract_controller/base.rb:198:inprocess_action'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal/rendering.rb:10:in
process_action' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/abstract_controller/callbacks.rb:20:inblock in process_action'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:117:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:117:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:555:in
block (2 levels) in compile' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:498:inblock (2 levels) in around'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:313:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:313:inblock (2 levels) in halting'
/opt/theforeman/tfm/root/usr/share/gems/gems/rails-observers-0.1.2/lib/rails/observers/action_controller/caching/sweeping.rb:73:in
around' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:455:inpublic_send'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:455:in
block in make_lambda' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:312:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:312:in
block in halting' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:497:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:497:in
block in around' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:498:inblock (2 levels) in around'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:313:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:313:inblock (2 levels) in halting'
/usr/share/foreman/app/controllers/concerns/application_shared.rb:13:in
set_timezone' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:432:inblock in make_lambda'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:312:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:312:inblock in halting'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:497:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:497:inblock in around'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:498:in
block (2 levels) in around' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:313:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:313:in
block (2 levels) in halting' /usr/share/foreman/app/models/concerns/foreman/thread_session.rb:32:inclear_thread'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:432:in
block in make_lambda' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:312:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:312:in
block in halting' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:497:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:497:in
block in around' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:498:inblock (2 levels) in around'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:313:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:313:inblock (2 levels) in halting'
/opt/theforeman/tfm/root/usr/share/gems/gems/rails-observers-0.1.2/lib/rails/observers/action_controller/caching/sweeping.rb:73:in
around' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:455:inpublic_send'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:455:in
block in make_lambda' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:312:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:312:in
block in halting' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:497:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:497:in
block in around' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:505:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:92:inrun_callbacks'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:778:in
_run_process_action_callbacks' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:81:inrun_callbacks'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/abstract_controller/callbacks.rb:19:in
process_action' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal/rescue.rb:29:inprocess_action'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal/instrumentation.rb:32:in
block in process_action' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/notifications.rb:164:inblock in instrument'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/notifications/instrumenter.rb:20:in
instrument' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/notifications.rb:164:ininstrument'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal/instrumentation.rb:30:in
process_action' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal/params_wrapper.rb:250:inprocess_action'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activerecord-4.2.5.1/lib/active_record/railties/controller_runtime.rb:18:in
process_action' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/abstract_controller/base.rb:137:inprocess'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionview-4.2.5.1/lib/action_view/rendering.rb:30:in
process' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal.rb:196:indispatch'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal/rack_delegation.rb:13:in
dispatch' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_controller/metal.rb:237:inblock in action'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/routing/route_set.rb:74:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/routing/route_set.rb:74:indispatch'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/routing/route_set.rb:43:in
serve' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/journey/router.rb:43:inblock in serve'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/journey/router.rb:30:in
each' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/journey/router.rb:30:inserve'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/routing/route_set.rb:815:in
call' /opt/theforeman/tfm/root/usr/share/gems/gems/apipie-rails-0.3.6/lib/apipie/static_dispatcher.rb:65:incall'
/opt/theforeman/tfm/root/usr/share/gems/gems/apipie-rails-0.3.6/lib/apipie/extractor/recorder.rb:132:in
call' /opt/theforeman/tfm/root/usr/share/gems/gems/apipie-rails-0.3.6/lib/apipie/middleware/checksum_in_headers.rb:27:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/etag.rb:24:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/conditionalget.rb:38:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/head.rb:13:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/params_parser.rb:27:incall'
/usr/share/foreman/lib/middleware/catch_json_parse_errors.rb:9:in call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/flash.rb:260:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/session/abstract/id.rb:225:in
context' /opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/session/abstract/id.rb:220:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/cookies.rb:560:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activerecord-4.2.5.1/lib/active_record/query_cache.rb:36:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activerecord-4.2.5.1/lib/active_record/connection_adapters/abstract/connection_pool.rb:653:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/callbacks.rb:29:inblock in call'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:88:in
__run_callbacks__' /opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:778:in_run_call_callbacks'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/callbacks.rb:81:in
run_callbacks' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/callbacks.rb:27:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/remote_ip.rb:78:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/debug_exceptions.rb:17:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/show_exceptions.rb:30:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/railties-4.2.5.1/lib/rails/rack/logger.rb:38:incall_app'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/railties-4.2.5.1/lib/rails/rack/logger.rb:22:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/request_id.rb:21:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/methodoverride.rb:22:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/runtime.rb:18:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/activesupport-4.2.5.1/lib/active_support/cache/strategy/local_cache_middleware.rb:28:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/actionpack-4.2.5.1/lib/action_dispatch/middleware/static.rb:116:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/sendfile.rb:113:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/railties-4.2.5.1/lib/rails/engine.rb:518:incall'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/railties-4.2.5.1/lib/rails/application.rb:165:in
call' /opt/rh/sclo-ror42/root/usr/share/gems/gems/railties-4.2.5.1/lib/rails/railtie.rb:194:inpublic_send'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/railties-4.2.5.1/lib/rails/railtie.rb:194:in
method_missing' /opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/urlmap.rb:66:inblock in call'
/opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/urlmap.rb:50:in
each' /opt/rh/sclo-ror42/root/usr/share/gems/gems/rack-1.6.2/lib/rack/urlmap.rb:50:incall'
/usr/share/passenger/phusion_passenger/rack/thread_handler_extension.rb:74:in
process_request' /usr/share/passenger/phusion_passenger/request_handler/thread_handler.rb:141:inaccept_and_process_next_request'
/usr/share/passenger/phusion_passenger/request_handler/thread_handler.rb:109:in
main_loop' /usr/share/passenger/phusion_passenger/request_handler.rb:455:inblock (3
levels) in start_threads'
/opt/theforeman/tfm/root/usr/share/gems/gems/logging-1.8.2/lib/logging/diagnostic_context.rb:323:in
call' /opt/theforeman/tfm/root/usr/share/gems/gems/logging-1.8.2/lib/logging/diagnostic_context.rb:323:inblock in create_with_logging_context'

Foreman Debug output from system that worked:
HOSTNAME: working.net
OS: redhat
RELEASE: Red Hat Enterprise Linux Server release 7.2 (Maipo)
FOREMAN: 1.12.3
RUBY: ruby 2.0.0p598 (2014-11-13) [x86_64-linux]
PUPPET: 3.8.6
DENIALS: 0

Foreman debug output from system that didn't work:
HOSTNAME: broken.net
OS: redhat
RELEASE: Red Hat Enterprise Linux Server release 7.2 (Maipo)
FOREMAN: 1.12.3
RUBY: ruby 2.0.0p598 (2014-11-13) [x86_64-linux]
PUPPET: 3.8.6
DENIALS: 0

Each is running under passenger with the tfm-ruby --version
ruby 2.2.2p95 (2015-04-13 revision 50295) [x86_64-linux]

If you need any other info please let me know.

Anurag · October 1, 2016, 5:28pm

> Everyone,
>
> I need a little help I have two instances of foreman that I have
> installed. I am planning on upgrading an instance that is behind a F5 so I
> have done the following on the system that worked.
>
> 1. Installed current version on a fresh rhel 7 host.
> 2. Cloned the production database to a new mysql server for testing.
> 3. upgraded from 1.10 to 1.11.
> 4. upgraded to 1.12.
>
> Everything seemed to work fine.
>
> Added a new host and pointed it at the same database and installed foreman
> 1.12. I cannot auth via LDAP on the new host.
>
> This is the error:
> LdapFluff::Generic::UnauthenticatedException
> Could not bind to ActiveDirectory user !LDAPForeman
>

[snip]

> Foreman Debug output from system that worked:
> HOSTNAME: working.net
> OS: redhat
> RELEASE: Red Hat Enterprise Linux Server release 7.2 (Maipo)
> FOREMAN: 1.12.3
> RUBY: ruby 2.0.0p598 (2014-11-13) [x86_64-linux]
> PUPPET: 3.8.6
> DENIALS: 0
>
> Foreman debug output from system that didn't work:
> HOSTNAME: broken.net
> OS: redhat
> RELEASE: Red Hat Enterprise Linux Server release 7.2 (Maipo)
> FOREMAN: 1.12.3
> RUBY: ruby 2.0.0p598 (2014-11-13) [x86_64-linux]
> PUPPET: 3.8.6
> DENIALS: 0
>
> Each is running under passenger with the tfm-ruby --version
> ruby 2.2.2p95 (2015-04-13 revision 50295) [x86_64-linux]
>
> If you need any other info please let me know.
>

Were you able to manually bind on the new host using ldapsearch with same
credentials as foreman? Also, see if passenger is able to make ldap
requests (# getsebool -a | grep passenger_can_connect_ldap)

Anurag

···

On Sat, Oct 1, 2016 at 3:08 AM, Doug Forster wrote:

Dominic_Cleal2 · October 3, 2016, 2:56pm

If you're sharing a database, ensure the encryption token is the same on
both servers or Foreman will not be able to decrypt the contents of
passwords within the database (e.g. the bind password).

See
https://theforeman.org/manuals/1.12/index.html#5.8MultipleForemaninstances
for more details.

···

On 30/09/16 22:38, Doug Forster wrote: > 1. Installed current version on a fresh rhel 7 host. > 2. Cloned the production database to a new mysql server for testing. > 3. upgraded from 1.10 to 1.11. > 4. upgraded to 1.12. > > Everything seemed to work fine. > > Added a new host and pointed it at the same database and installed > foreman 1.12. I cannot auth via LDAP on the new host.

–
Dominic Cleal
dominic@cleal.org

Doug_Forster · October 3, 2016, 2:54pm

SeLinux does not seem to be the problem.

getsebool -a | grep passenger_can_connect_ldap

getsebool: SELinux is disabled

I can bind with ldapsearch on both working and non working nodes.

···

On Saturday, October 1, 2016 at 11:29:24 AM UTC-6, Anurag Patel wrote: > > On Sat, Oct 1, 2016 at 3:08 AM, Doug Forster > wrote: > >> Everyone, >> >> I need a little help I have two instances of foreman that I have >> installed. I am planning on upgrading an instance that is behind a F5 so I >> have done the following on the system that worked. >> >> 1. Installed current version on a fresh rhel 7 host. >> 2. Cloned the production database to a new mysql server for testing. >> 3. upgraded from 1.10 to 1.11. >> 4. upgraded to 1.12. >> >> Everything seemed to work fine. >> >> Added a new host and pointed it at the same database and installed >> foreman 1.12. I cannot auth via LDAP on the new host. >> >> This is the error: >> *LdapFluff::Generic::UnauthenticatedException* >> *Could not bind to ActiveDirectory user !LDAPForeman* >> > > [snip] > > >> Foreman Debug output from system that worked: >> HOSTNAME: working.net >> OS: redhat >> RELEASE: Red Hat Enterprise Linux Server release 7.2 (Maipo) >> FOREMAN: 1.12.3 >> RUBY: ruby 2.0.0p598 (2014-11-13) [x86_64-linux] >> PUPPET: 3.8.6 >> DENIALS: 0 >> >> Foreman debug output from system that didn't work: >> HOSTNAME: broken.net >> OS: redhat >> RELEASE: Red Hat Enterprise Linux Server release 7.2 (Maipo) >> FOREMAN: 1.12.3 >> RUBY: ruby 2.0.0p598 (2014-11-13) [x86_64-linux] >> PUPPET: 3.8.6 >> DENIALS: 0 >> >> Each is running under passenger with the tfm-ruby --version >> ruby 2.2.2p95 (2015-04-13 revision 50295) [x86_64-linux] >> >> If you need any other info please let me know. >> > > Were you able to manually bind on the new host using ldapsearch with same > credentials as foreman? Also, see if passenger is able to make ldap > requests (# getsebool -a | grep passenger_can_connect_ldap) > > Anurag >

Doug_Forster · October 3, 2016, 3:12pm

Thanks that did it.

···

On Monday, October 3, 2016 at 8:56:29 AM UTC-6, Dominic Cleal wrote: > > On 30/09/16 22:38, Doug Forster wrote: > > 1. Installed current version on a fresh rhel 7 host. > > 2. Cloned the production database to a new mysql server for testing. > > 3. upgraded from 1.10 to 1.11. > > 4. upgraded to 1.12. > > > > Everything seemed to work fine. > > > > Added a new host and pointed it at the same database and installed > > foreman 1.12. I cannot auth via LDAP on the new host. > > If you're sharing a database, ensure the encryption token is the same on > both servers or Foreman will not be able to decrypt the contents of > passwords within the database (e.g. the bind password). > > See > https://theforeman.org/manuals/1.12/index.html#5.8MultipleForemaninstances > for more details. > > -- > Dominic Cleal > dom...@cleal.org >