Bug 1782658
| Summary: | add "systemctl restart sssd" to warning message when adding trust agents to replicas | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | François Cami <fcami> |
| Component: | ipa | Assignee: | François Cami <fcami> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.1 | CC: | frenaud, ipa-qe, ksiddiqu, nsoman, pasik, rcritten, sorlov, tscherf, twoerner |
| Target Milestone: | rc | Keywords: | TestCaseProvided |
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1782587 | Environment: | |
| Last Closed: | 2020-04-28 15:44:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1782587 | ||
| Bug Blocks: | |||
|
Description
François Cami
2019-12-12 03:43:13 UTC
Fixed upstream master: https://pagure.io/freeipa/c/d5dad53e70857b47ab89c8ba78b0d8fe7d8fae0b Fixed upstream ipa-4-8: https://pagure.io/freeipa/c/62f0bd0bb8194b0998fca0e582725a6f63bc9154 Fixed upstream ipa-4-7: https://pagure.io/freeipa/c/14de3644ea1e8ce3954b1da6a0e99f6e27d4db03 Fixed upstream ipa-4-6: https://pagure.io/freeipa/c/5bc4218bf8716d28339a3f30d1be8471d04cb4b4 Fix verified for version: # cat /etc/redhat-release Red Hat Enterprise Linux release 8.2 Beta (Ootpa) # rpm -q ipa-server-trust-ad ipa-server-trust-ad-4.8.4-4.module+el8.2.0+5591+1f878b19.x86_64 Verified with two scenarios: 1) setup trust controller, then setup agents 2) setup trust controller and agents in one run 1. Two stages setup: # ipa server-find --all --------------------- 2 IPA servers matched --------------------- dn: cn=master1.testrelm.test,cn=masters,cn=ipa,cn=etc,dc=testrelm,dc=test Server name: master1.testrelm.test Managed suffixes: domain, ca Min domain level: 1 Max domain level: 1 Enabled server roles: CA server, DNS server, IPA master objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig dn: cn=replica1.testrelm.test,cn=masters,cn=ipa,cn=etc,dc=testrelm,dc=test Server name: replica1.testrelm.test Managed suffixes: domain, ca Min domain level: 1 Max domain level: 1 Enabled server roles: CA server, IPA master objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig ---------------------------- Number of entries returned 2 ---------------------------- # ipa-adtrust-install -U ... # ipa-adtrust-install --add-agents ... admin password: IPA generated smb.conf detected. Overwrite smb.conf? [no]: yes Do you want to enable support for trusted domains in Schema Compatibility plugin? This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users. Enable trusted domains support in slapi-nis? [no]: ... WARNING: 1 IPA masters are not yet able to serve information about users from trusted forests. Installer can add them to the list of IPA masters allowed to access information about trusts. If you choose to do so, you also need to restart LDAP service on those masters. Refer to ipa-adtrust-install(1) man page for details. IPA master [replica1.testrelm.test]? [no]: yes WARNING: you MUST restart (both "ipactl restart" and "systemctl restart sssd") the following IPA masters in order to activate them to serve information about users from trusted forests: replica1.testrelm.test ============================================================================= Setup complete You must make sure these network ports are open: TCP Ports: * 135: epmap * 138: netbios-dgm * 139: netbios-ssn * 445: microsoft-ds * 1024..1300: epmap listener range * 3268: msft-gc UDP Ports: * 138: netbios-dgm * 139: netbios-ssn * 389: (C)LDAP * 445: microsoft-ds See the ipa-adtrust-install(1) man page for more details ============================================================================= 2. One stage setup # ipa server-find --all --------------------- 2 IPA servers matched --------------------- dn: cn=master1.testrelm.test,cn=masters,cn=ipa,cn=etc,dc=testrelm,dc=test Server name: master1.testrelm.test Managed suffixes: domain, ca Min domain level: 1 Max domain level: 1 Enabled server roles: CA server, DNS server, IPA master objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig dn: cn=replica1.testrelm.test,cn=masters,cn=ipa,cn=etc,dc=testrelm,dc=test Server name: replica1.testrelm.test Managed suffixes: domain, ca Min domain level: 1 Max domain level: 1 Enabled server roles: CA server, IPA master objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig ---------------------------- Number of entries returned 2 ---------------------------- # ipa-adtrust-install --add-agents ... admin password: WARNING: The smb.conf already exists. Running ipa-adtrust-install will break your existing samba configuration. Do you wish to continue? [no]: yes Do you want to enable support for trusted domains in Schema Compatibility plugin? This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users. Enable trusted domains support in slapi-nis? [no]: Trust is configured but no NetBIOS domain name found, setting it now. Enter the NetBIOS name for the IPA domain. Only up to 15 uppercase ASCII letters, digits and dashes are allowed. Example: EXAMPLE. NetBIOS domain name [TESTRELM]: WARNING: 3 existing users or groups do not have a SID identifier assigned. Installer can run a task to have ipa-sidgen Directory Server plugin generate the SID identifier for all these users. Please note, in case of a high number of users and groups, the operation might lead to high replication traffic and performance degradation. Refer to ipa-adtrust-install(1) man page for details. Do you want to run the ipa-sidgen task? [no]: ... WARNING: 1 IPA masters are not yet able to serve information about users from trusted forests. Installer can add them to the list of IPA masters allowed to access information about trusts. If you choose to do so, you also need to restart LDAP service on those masters. Refer to ipa-adtrust-install(1) man page for details. IPA master [replica1.testrelm.test]? [no]: yes WARNING: you MUST restart (both "ipactl restart" and "systemctl restart sssd") the following IPA masters in order to activate them to serve information about users from trusted forests: replica1.testrelm.test ============================================================================= Setup complete You must make sure these network ports are open: TCP Ports: * 135: epmap * 138: netbios-dgm * 139: netbios-ssn * 445: microsoft-ds * 1024..1300: epmap listener range * 3268: msft-gc UDP Ports: * 138: netbios-dgm * 139: netbios-ssn * 389: (C)LDAP * 445: microsoft-ds See the ipa-adtrust-install(1) man page for more details ============================================================================= Test case upstream master: https://pagure.io/freeipa/c/fc4c3ac795e3af48fcfd8dd51085f5ff98047f1e The commit adds a test in ipatests/test_integration/test_adtrust_install.py::TestIpaAdTrustInstall Test upstream: ipa-4-8: https://pagure.io/freeipa/c/4afd6e5e07061dde6e30b5352668bdf23cd6dedd ipa-4-7: https://pagure.io/freeipa/c/59b09f154b9d85d937da64d6fe271d09c5b61bc1 ipa-4-6: https://pagure.io/freeipa/c/796c86ac701d23d1dd281d0d5c5331b9a66c2888 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2020:1640 |