Bug 1009044
| Summary: | ipa trust-add should not create a trust if IPA realm and domain name differ | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Martin Kosek <mkosek> |
| Component: | ipa | Assignee: | Martin Kosek <mkosek> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | abdullaha, rcritten, sgoveas |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-3.3.2-1.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 12:07:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Martin Kosek
2013-09-17 14:28:51 UTC
Upstream ticket: https://fedorahosted.org/freeipa/ticket/3924 Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/8ebb76177dbe675b281a4c06fabd4d27b2dffd7c https://fedorahosted.org/freeipa/changeset/bae291def780c81144c8f4d71ced5007e1ee3867 ipa-3-3: https://fedorahosted.org/freeipa/changeset/8dec70f0906cd3a61fa1067593b594c600d2f263 https://fedorahosted.org/freeipa/changeset/7e453d4601d67029bb43bdcf84538cba16b62074 * Warning while ipa-server-install is run with realm name different from domain name [root@tyan-gt24-01 ~]# /usr/sbin/ipa-server-install --setup-dns --forwarder=10.16.36.29 --hostname=tyan-gt24-01.testrelm.com -r TEST.IPA -n testrelm.com -p Secret123 -P Secret123 -a Secret123 -U The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will set up the IPA Server. This includes: * Configure a stand-alone CA (dogtag) for certificate management * Configure the Network Time Daemon (ntpd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) * Configure DNS (bind) WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd Warning: skipping DNS resolution of host tyan-gt24-01.testrelm.com Using reverse zone 65.16.10.in-addr.arpa. The IPA Master Server will be configured with: Hostname: tyan-gt24-01.testrelm.com IP address: 10.16.65.177 Domain name: testrelm.com Realm name: TEST.IPA BIND DNS server will be configured to serve IPA domain with: Forwarders: 10.16.36.29 Reverse zone: 65.16.10.in-addr.arpa. WARNING: Realm name does not match the domain name. You will not be able to estabilish trusts with Active Directory unless ythe realm name of the IPA server matches its domain name. ....<Truncated>............ * Warning displayed when ipa-adtrust-install is run on a IPA server having different realm and domain name. [root@tyan-gt24-01 ~]# ipa-adtrust-install -a Secret123 -U The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will setup components needed to establish trust to AD domains for the IPA Server. This includes: * Configure Samba * Add trust related objects to IPA LDAP server To accept the default shown in brackets, press the Enter key. WARNING: Realm name does not match the domain name. You will not be able to estabilish trusts with Active Directory unless the realm name of the IPA server matches its domain name. ....<Truncated>....... * Trust add fails with error caused due to mismatch of realm and domain name [root@tyan-gt24-01 ~]# ipa trust-add adom.qe --type ad --admin administrator --password Active directory domain administrator's password: ipa: ERROR: invalid 'Realm-domain mismatch': To establish trust with Active Directory, the domain name and the realm name of the IPA server must match * Verified in version [root@tyan-gt24-01 ~]# rpm -q ipa-server ipa-server-3.3.3-6.el7.x86_64 This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |