VIO LDAP configuration fails with the error: Task execution failed
search cancel

VIO LDAP configuration fails with the error: Task execution failed

book

Article ID: 340373

calendar_today

Updated On:

Products

VMware VMware Integrated OpenStack

Issue/Introduction

Symptoms:
  • Configuring LDAP authentication in the VMware Integrated OpenStack Plugin UI fails with the error:

    Task execution failed: Task failed on the following nodes: ['<Controller-VM-IP>', '<Controller-VM-IP>']. Refer logs for more details.
     
  • In the /var/log/jarvis/ansible.log file on the OpenStack Management Server (OMS), you see entries similar to:

    2017-07-03 20:39:56,554 p=8210 u=jarvis | TASK: [keystone | copy the LDAP certificates to keystone and ca-certificates] ***
    2017-07-03 20:39:57,043 p=8210 u=jarvis | failed: [192.168.110.157] => (item=/etc/keystone/ssl/certs) => {"changed": true, "cmd": "cp /tmp/certs/* \"/etc/keystone/ssl/certs\"", "delta": "0:00:00.172060", "end": "2017-07-03 20:37:31.732914", "item": "/etc/keystone/ssl/certs", "rc": 1, "start": "2017-07-03 20:37:31.560854", "warnings": []}
    2017-07-03 20:39:57,044 p=8210 u=jarvis | stderr: cp: cannot stat <E2><80><98>/tmp/certs/*<E2><80><99>: No such file or directory
    2017-07-03 20:39:57,047 p=8210 u=jarvis | failed: [192.168.110.158] => (item=/etc/keystone/ssl/certs) => {"changed": true, "cmd": "cp /tmp/certs/* \"/etc/keystone/ssl/certs\"", "delta": "0:00:00.237841", "end": "2017-07-03 20:39:57.027701", "item": "/etc/keystone/ssl/certs", "rc": 1, "start": "2017-07-03 20:39:56.789860", "warnings": []}
    2017-07-03 20:39:57,048 p=8210 u=jarvis | stderr: cp: cannot stat <E2><80><98>/tmp/certs/*<E2><80><99>: No such file or directory
    2017-07-03 20:39:57,248 p=8210 u=jarvis | failed: [192.168.110.158] => (item=/usr/local/share/ca-certificates) => {"changed": true, "cmd": "cp /tmp/certs/* \"/usr/local/share/ca-certificates\"", "delta": "0:00:00.017487", "end": "2017-07-03 20:39:57.232547", "item": "/usr/local/share/ca-certificates", "rc": 1, "start": "2017-07-03 20:39:57.215060", "warnings": []}
    2017-07-03 20:39:57,248 p=8210 u=jarvis | stderr: cp: cannot stat <E2><80><98>/tmp/certs/*<E2><80><99>: No such file or directory
    2017-07-03 20:39:57,306 p=8210 u=jarvis | failed: [192.168.110.157] => (item=/usr/local/share/ca-certificates) => {"changed": true, "cmd": "cp /tmp/certs/* \"/usr/local/share/ca-certificates\"", "delta": "0:00:00.029702", "end": "2017-07-03 20:37:31.990016", "item": "/usr/local/share/ca-certificates", "rc": 1, "start": "2017-07-03 20:37:31.960314", "warnings": []}
    2017-07-03 20:39:57,306 p=8210 u=jarvis | stderr: cp: cannot stat <E2><80><98>/tmp/certs/*<E2><80><99>: No such file or directory
    2017-07-03 20:39:57,330 p=8210 u=jarvis | FATAL: all hosts have already failed -- aborting


Environment

VMware Integrated OpenStack 3.1.x
VMware Integrated OpenStack 3.0.x

Cause

This issue occurs because the CA certificate from the LDAP configuration does not have the subject name which causes the validation and copy to fail.

Resolution

To resolve this issue:
  1. Log in to the OMS through SSH as viouser.
  2. Validate that the LDAP certificate does not have a subject by running this command:

    sudo viocli show -i | grep "ldap_certificate" | awk -F ' ' '{print $3}' | base64 -d | openssl x509 -noout -subject

    For example:
    • If LDAP certificate does not have a subject, you output similar to:

      viouser@oms:~$ sudo viocli show -i | grep "ldap_certificate" | awk -F ' ' '{print $3}' | base64 -d | openssl x509 -noout -subject
      [sudo] password for viouser:
      subject=

       
    • If LDAP certificate has a subject, you output similar to:

      viouser@oms:~$ sudo viocli show -i | grep "ldap_certificate" | awk -F ' ' '{print $3}' | base64 -d | openssl x509 -noout -subject
      [sudo] password for viouser:
      subject= /DC=local/DC=corp/CN=CONTROLCENTER-CA

       
  3. If CA does not have a subject name, you must add a new certificate with subject name and use this CA.