| Summary: | SSSD subdomains provider does not resolve SRV records correctly when DNS name of the server is different from domain/realm name of IPA install in IPA server mode | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Dmitri Pal <dpal> |
| Component: | sssd | Assignee: | Jakub Hrozek <jhrozek> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | agunn, grajaiya, jgalipea, lslebodn, mkosek, nsoman, pbrezina, spoore |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.11.1-1.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 12:21:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Dmitri Pal
2013-09-12 14:37:16 UTC
Patches are on review on the upstream list -> ASSIGNED master: 82d248c7e7d61dba7065a1a744823bc06c1b5b96 sssd-1-11: 419cbf2efe34f4314bb92e506df3efc041cd5600 Temporarily moving bugs to MODIFIED to work around errata tool bug In order to test, configure the dns_discovery_domain parameter on an IPA server. If the IPA server in sssd.conf is set to be autodiscovered (either with explicit _srv_ or by omitting the ipa_server parameter completely), then you should see a warning in both syslog and debug logs. If autodiscovery is not used, you should see a different warning in debug logs (no syslog this time) telling you that the discovery domain is being ignored. Verified.
Version ::
sssd-1.11.2-27.el7.x86_64
Results ::
# test with ipa_server not set
#ipa_server = rhel7-4.example.com
dns_discovery_domain = testrelm.com
[root@rhel7-4 sssd]# service sssd restart
Redirecting to /bin/systemctl restart sssd.service
[root@rhel7-4 sssd]# grep dns_discovery_domain /var/log/messages
Jan 30 10:40:49 rhel7-4 sssd[be[testrelm.com]]: SRV discovery is enabled on the IPA server while using custom dns_discovery_domain. DNS discovery of trusted AD domain will likely fail. It is recommended not to use SRV discovery or the dns_discovery_domain option for the IPA domain while running on the server itself
[root@rhel7-4 sssd]# grep dns_discovery_domain /var/log/sssd/sssd_testrelm.com.log
(Thu Jan 30 10:40:49 2014) [sssd[be[testrelm.com]]] [dp_get_options] (0x0400): Option dns_discovery_domain has value testrelm.com
(Thu Jan 30 10:40:49 2014) [sssd[be[testrelm.com]]] [sssm_ipa_id_init] (0x0020): SRV discovery is enabled on IPA server while using custom dns_discovery_domain. DNS discovery of trusted AD domain will likely fail. It is recommended not to use SRV discovery or the dns_discovery_domain option for the IPA domain while running on the server itself
### Test with ipa_server set to hostname
[root@rhel7-4 sssd]# vi /etc/sssd/sssd.conf
ipa_server = rhel7-4.example.com
dns_discovery_domain = testrelm.com
[root@rhel7-4 sssd]# > /var/log/messages
[root@rhel7-4 sssd]# > /var/log/sssd/sssd_testrelm.com.log
[root@rhel7-4 sssd]# service sssd restart
Redirecting to /bin/systemctl restart sssd.service
[root@rhel7-4 sssd]# grep dns_discovery_domain /var/log/messages
[root@rhel7-4 sssd]# grep dns_discovery_domain /var/log/sssd/sssd_testrelm.com.log
(Thu Jan 30 10:50:38 2014) [sssd[be[testrelm.com]]] [dp_get_options] (0x0400): Option dns_discovery_domain has value testrelm.com
(Thu Jan 30 10:50:38 2014) [sssd[be[testrelm.com]]] [sssm_ipa_id_init] (0x0100): The value of dns_discovery_domain will be ignored in ipa_server_mode
### Testing ipa_server set to test AD
[root@rhel7-4 sssd]# service sssd stop
Redirecting to /bin/systemctl stop sssd.service
[root@rhel7-4 sssd]# vi /etc/sssd/sssd.conf
[root@rhel7-4 sssd]# egrep "ipa_server |dns_discovery_domain " /etc/sssd/sssd.conf
#ipa_server = _srv_
ipa_server = rhel7-4.example.com
dns_discovery_domain = testrelm.com
[root@rhel7-4 sssd]# rm -rf /var/lib/sss/{db,mc}/*
[root@rhel7-4 sssd]# service sssd start
Redirecting to /bin/systemctl start sssd.service
[root@rhel7-4 sssd]# id aduser1.test
uid=551801125(aduser1.test) gid=551801125(aduser1.test) groups=551801125(aduser1.test),551801746(adgroup2.test),551801131(adgroup1.test),551800513(domain users.test)
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |