Bug 433483

Summary: Check FQDNs in ipa-addservice
Product: [Retired] freeIPA Reporter: Simo Sorce <ssorce>
Component: ipa-admintoolsAssignee: Rob Crittenden <rcritten>
Status: CLOSED ERRATA QA Contact: Chandrasekar Kannan <ckannan>
Severity: medium Docs Contact:
Priority: medium    
Version: 1.0CC: benl
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: freeipa-2.0.0-1.fc15 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-27 07:12:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 429034    
Attachments:
Description Flags
Require DNS A record for service principals none

Description Simo Sorce 2008-02-19 16:15:36 UTC 
Currently ipa-addservice will just happily create a service without checking
that the FQDN is a valid A name in DNS.
A host FQDN should always be an A name as kerberos libraries will resolve any
CNAME into an A name before asking a ticket from the KDC.

ipa-addservice should at least warn if it can't find an A name corresponding to
the FQDN part of the service principal we are about to create.
Comment 1 Rob Crittenden 2008-02-26 18:54:14 UTC 
Created attachment 295981 [details]
Require DNS A record for service principals

David, I've added a new option to ipa-addservice: --force

This will force a principal to created that is not an A record.
Comment 2 Rob Crittenden 2008-02-26 21:01:42 UTC 
pushed in changeset 690
Comment 3 David O'Brien 2008-03-06 13:39:32 UTC 
Updated doc at
http://www.freeipa.com/page/ServerAdministration#Creating_and_Using_Service_Principals
Comment 4 Yi Zhang 2008-05-22 18:16:43 UTC 
QA Verified on May 22, 2008 (Yi)

Build used: May 22, 2008 (x64)

tests have been done:

server64[05/22/24 10:41] ipa-addservice host/ipaclient.example.com
The requested hostname is not a DNS A record. This is required by Kerberos.
server64[05/22/24 10:45] ipa-addservice host/ipaclient.ipaqa.com
server64[05/22/24 10:49] ipa-addservice host/ipa.ipaqa.com
The requested hostname is not a DNS A record. This is required by Kerberos.