Bug 1318345

Summary:	"ipa" command does not recognize KRB5_CLIENT_KTNAME
Product:	Red Hat Enterprise Linux 7	Reporter:	Matt Smith <mjs>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED WORKSFORME	QA Contact:	Kaleem <ksiddiqu>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	cheimes, mjs, mkosek, pvoborni, rcritten
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-05-11 12:59:35 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Matt Smith 2016-03-16 15:19:47 UTC

Description of problem:
"ipa" command does not recognize KRB5_CLIENT_KTNAME, there for is required to issue a kinit of appropriate keytab before issuing "ipa" in any automated scripting.

Version-Release number of selected component (if applicable):
pa-admintools-4.2.0-15.el7_2.6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. set KRB5_CLIENT_KTNAME
2. run "ipa user-list"
3. fail

Actual results:
Failure if no ccache already exists

Expected results:
ipa should recognize KRB5_CLIENT_KTNAME and initialize ccache appropriately.

Comment 3 Petr Vobornik 2016-03-24 19:31:59 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5766

Comment 5 Petr Vobornik 2017-04-06 16:41:25 UTC

IdM team doesn't have capacity to fix this bug for RHEL 7.4. Moving to next RHEL version. Fixing the bug there will depend on capacity of FreeIPA upstream. Without sufficient  justification there is a chance that it will be moved again later.

Comment 7 Christian Heimes 2018-04-30 09:37:04 UTC

I cannot reproduce the issue any more. Initialization from a keytab with KRB5_CLIENT_KTNAME works fine for me on RHEL 7.5 as well as Fedora with FreeIPA master. Please make sure that the file is readable but the current user. KRB5 doesn't print an error when it doesn't have permission to read the keytab file.

Matt, please check file permissions and try again.

Comment 8 Rob Crittenden 2018-05-11 12:59:35 UTC

I tested this in 7.5 and it works for me as well. Closing.

Comment 9 Matt Smith 2020-02-25 13:53:56 UTC

ACK'ing only to clear needinfo, as I started receiving email alerts.  lgtm.