Bug 1026845

Summary:	Server does not detect different server and IPA domain
Product:	Red Hat Enterprise Linux 7	Reporter:	Dmitri Pal <dpal>
Component:	ipa	Assignee:	Martin Kosek <mkosek>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	7.0	CC:	mkosek, rcritten, spoore
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-3.3.3-3.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 11:36:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dmitri Pal 2013-11-05 14:16:35 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/4012

Server domain is being checked if it is in a main IPA domain. When not, additional realm_domain mapping is added to `/etc/krb5.conf`.

However, given that the domain is checked just with string comparison of the domain, when the server has fqdn like `ipa-idm.example.com` and main domain and realm is `idm.example.com`, the installer does not detect this mismatch, does not configure realm_domain mapping and httpd does not start due to obscure error:

{{{
gss_acquire_cred() failed: Unspecified GSS failure.  Minor code may provide more
information (, ), referer: https://ipa-idm.example.com/ipa/xml
}}}

Comment 1 Namita Soman 2013-11-05 17:45:44 UTC

Please provide steps to verify

Comment 2 Martin Kosek 2013-11-06 09:27:56 UTC

Reproduction scenario:

1) Install IPA so that server FQDN lies in different domain than the main domain (--domain) but shares the same suffix. E.g.:

# hostname ipa-idm.example.com
# ipa-server-install --domain idm.example.com

2) When installation is complete, try kinit and one command:
# kinit admin
# ipa user-show admin

ipa command will fail with the old version as realm-domain mapping is missing in /etc/krb5.conf.

Comment 4 Martin Kosek 2013-11-11 08:28:14 UTC

Patch also pushed upstream:
master: https://fedorahosted.org/freeipa/changeset/b4ee7da8e9d578ce2c053fad7d0f1ace7f0b6e6a
ipa-3-3: https://fedorahosted.org/freeipa/changeset/cce06d3ba2da95abc05aab274df541d93fb24174

Comment 5 Scott Poore 2014-01-29 18:37:47 UTC

Verified.

Version ::

ipa-server-3.3.3-15.el7.x86_64

Test Results ::

[root@rhel7-4 ~]# sed -i "/$(hostname -i)/d" /etc/hosts

[root@rhel7-4 ~]# sed -i "/$(hostname)/d" /etc/hosts

[root@rhel7-4 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

[root@rhel7-4 ~]# echo "$(hostname -i) ipa-idm.example.com" >> /etc/hosts

[root@rhel7-4 ~]# echo ipa-idm.example.com > /etc/hostname

[root@rhel7-4 ~]# hostname ipa-idm.example.com

[root@rhel7-4 ~]# hostname
ipa-idm.example.com

[root@rhel7-4 ~]# ipa-server-install --setup-dns --forwarder=192.168.122.1 -r IDM.EXAMPLE.COM -n idm.example.com -p Secret123 -P Secret123 -a Secret123 -U
...

[root@rhel7-4 ~]# kinit admin
Password for admin.COM: 

[root@rhel7-4 ~]# ipa user-show admin
  User login: admin
  Last name: Administrator
  Home directory: /home/admin
  Login shell: /bin/bash
  UID: 997600000
  GID: 997600000
  Account disabled: False
  Password: True
  Member of groups: admins, trust admins
  Kerberos keys available: True
[root@rhel7-4 ~]# cat /etc/krb5.conf
includedir /var/lib/sss/pubconf/krb5.include.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = IDM.EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = true
 rdns = false
 ticket_lifetime = 24h
 forwardable = yes
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 IDM.EXAMPLE.COM = {
  kdc = ipa-idm.example.com:88
  master_kdc = ipa-idm.example.com:88
  admin_server = ipa-idm.example.com:749
  default_domain = idm.example.com
  pkinit_anchors = FILE:/etc/ipa/ca.crt
}

[domain_realm]
 .idm.example.com = IDM.EXAMPLE.COM
 idm.example.com = IDM.EXAMPLE.COM
 .example.com = IDM.EXAMPLE.COM
 example.com = IDM.EXAMPLE.COM

[dbmodules]
  IDM.EXAMPLE.COM = {
    db_library = ipadb.so
  }

[root@rhel7-4 ~]#

Comment 6 Ludek Smid 2014-06-13 11:36:34 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.