Bug 430001

Ticket #53 (new defect)

Opened 3 months ago

Last modified 1 week ago
ipa-client-install query about domain names when DNS is not available to autofill data is insufficiently precise
Reported by: 	Suzanne Hillman <shillman> 	Assigned to: 	simo
Priority: 	major 	Milestone: 	
Component: 	ipa-client 	Version: 	
Keywords: 		Cc: 	
Description ¶

ipa-client-install query about domain names when DNS is not available to autofill data is insufficiently precise, such that is it not possible to tell if the domain name information desired is that of the client or the server (if they are not in the same domain).

eg: "[root@dhcp83-110 ~]# ipa-client-install Failed to determine your DNS domain (DNS misconfigured?) Please provide your domain name (ex: example.com):"
Change History
2008-01-15 11:58:56 changed by rcritten ¶

It is the domain of the master but even more so, it is the domain used when IPA was configured as far as I can tell.

The domain is used to setup LDAP search queries for identifying users, etc. for pam. That goes into /etc/ldap.conf

So for example you could have your IPA server on ipa.corp.example.com but have the realm in IPA as example.com.

If you enter the wrong thing it does seem that there is plenty of warning that the client install tool can't figure out what the heck is going on.
2008-01-15 12:55:31 changed by rcritten ¶

The warnings are pretty harsh and could lead someone to believe their DNS is misconfigured when it isn't.

For example, if discovery doesn't work you'll see:

Failed to determine your DNS domain (DNS misconfigured?) Please provide your domain name (ex: example.com):

This doesn't mean that DNS is misconfigured, just that it lacks the auto-discovery entries.

If you get past that you'll get:

Failed to find the IPA Server (DNS misconfigured?) Please provide your server name (ex: ipa.example.com):

Again, DNS could be perfectly fine.

Is it a safe assumption that if the DNS domain name can't be auto-discovered that the IPA server will fail as well?
2008-01-15 13:18:27 changed by simo ¶

In theory we request admins to correctly set up their DNS to provide the SRV records we need. Not doing so IMO can be marked as a DNS misconfiguration. The Domian name may not be discoverable because our host domain name is not a child of the IPA domain. eg: domain = corp.example.com our name = client1.cli.example.com

If the SRV records are on corp.redhat.com then the domain discovery may fail but once that soved the SRV records for ldap and kerberos should be found. If not, then, it means you have no SRV records at all anywhere.