Bug 1311470
| Summary: | ipa trust-add succeded but after that ipa trust-find returns "0 trusts matched" | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jan Kurik <jkurik> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 7.2 | CC: | abokovoy, ekeck, ipa-maint, jcholast, ksiddiqu, mbasti, mkosek, mvarun, pvoborni, rcritten, sbose, Silvio.Wanka |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.2.0-15.el7_2.11 | Doc Type: | Bug Fix |
| Doc Text: |
When upgrading an IdM server to version 4.2 or installing the 4.2 version, AD trusts created on the server did not work, even though the server reported the trust status as established and verified. This update fixes the configuration of the sidgen and extdom plug-ins, thus eliminating the problem. If you experienced this problem, recreate all trusts using the ipa trust-add utility.
|
Story Points: | --- |
| Clone Of: | 1305533 | Environment: | |
| Last Closed: | 2016-05-12 09:58:38 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1305533 | ||
| Bug Blocks: | |||
|
Description
Jan Kurik
2016-02-24 10:25:23 UTC
Patch related to this bz was incorrectly backported and causes install issue. upstream fix:
master:
fcc540bbdc5daa24990940124ec3bd439b05257d Fix connections to DS during installation
ipa-4-3:
c14fb0b9e0f4cb977e897645126ef7d1bbf9aa9e Fix connections to DS during installation
ipa-4-2:
e2ef561375c63a375710254f159f75d7318c514d Insure the admin_conn is disconnected on stop
0af81913258b2f4c9841c5baddda146667282b2c Fix connections to DS during installation
Verified
Version
ipa-server-4.2.0-15.el7_2.10.x86_64
# ipa trust-add pne.qe --range-type='ipa-ad-trust' --two-way=true
Active Directory domain administrator: Administrator
Active Directory domain administrator's password:
-----------------------------------------------
Added Active Directory trust for realm "pne.qe"
-----------------------------------------------
Realm name: pne.qe
Domain NetBIOS name: PNE
Domain Security Identifier: S-1-5-21-2828791737-1866347024-3967946728
SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19,
S-1-5-18
SID blacklist outgoing: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19,
S-1-5-18
Trust direction: Two-way trust
Trust type: Active Directory domain
Trust status: Established and verified
[root@apollo ~]# ipa trust-find
----------------
3 trusts matched
----------------
Realm name: chd.pne.qe
Domain NetBIOS name: CHD
Domain Security Identifier: S-1-5-21-2165991969-2769796915-1516482243
Realm name: pne.qe
Domain NetBIOS name: PNE
Domain Security Identifier: S-1-5-21-2828791737-1866347024-3967946728
Trust type: Active Directory domain
Realm name: test.qa
Domain NetBIOS name: TEST101
Domain Security Identifier: S-1-5-21-3329144650-2588454953-1484820794
----------------------------
Number of entries returned 3
----------------------------
There is a regression, see bug 1317635 for details but fix it here. Upstream ticket: https://fedorahosted.org/freeipa/ticket/5737 Fixed upstream master: https://fedorahosted.org/freeipa/changeset/de8c6d81fd5d0f759ac0201e2c517bcb8b43d960 ipa-4-3: https://fedorahosted.org/freeipa/changeset/1e0208612087e80f673e7ec1f8e050b57b5f1fb7 ipa-4-2: https://fedorahosted.org/freeipa/changeset/fb11384e65d74b6a027bf8cfe9f93e003bba5236 It should be POST, my bad Verified using ipa-server-4.2.0-15.el7_2.11.x86_64 [root@apollo yum.repos.d]# ipa trust-find ---------------- 3 trusts matched ---------------- Realm name: ipa.in Domain NetBIOS name: IPA Domain Security Identifier: S-1-5-21-4079490025-2129455549-2000505884 Trust type: Active Directory domain Realm name: ipaad2008r2.test Domain NetBIOS name: IPAAD2008R2 Domain Security Identifier: S-1-5-21-1765444267-4284514389-3232425237 Trust type: Active Directory domain Realm name: ipasub2008r2-1.ipaad2008r2.test Domain NetBIOS name: IPASUB2008R2-1 Domain Security Identifier: S-1-5-21-469193889-4273894478-2486872656 ---------------------------- Number of entries returned 3 ---------------------------- Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-1036.html |