Bug 736684
Summary: | ipa-client-install should sync time before kinit | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 6 | Reporter: | Marko Myllynen <myllynen> |
Component: | ipa | Assignee: | Alexander Bokovoy <abokovoy> |
Status: | CLOSED ERRATA | QA Contact: | Chandrasekar Kannan <ckannan> |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | 6.1 | CC: | benl, dpal, jgalipea, mkosek, nsoman, rcritten |
Target Milestone: | rc | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | ipa-2.1.2-1.el6 | Doc Type: | Bug Fix |
Doc Text: |
Cause: If IPA client is installed and there is a too big time difference between the client and an IPA server, KDC running on the IPA server machine may refuse any Kerberos authentication request from the client.
Consequence: Installation may fail as it cannot get a valid Kerberos ticket during the process
Fix: Always try to synchronize the time with the NTP servers configured for the client domain or the IPA server itself
Result: If the time synchronization succeeds, the time on the client machine is fixed and Kerberos authentication and the installation itself should successfully continue
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2011-12-06 18:30:57 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Marko Myllynen
2011-09-08 12:24:51 UTC
Upstream ticket: https://fedorahosted.org/freeipa/ticket/1773 fixed upstream master: acb2c3106ad763a07eca6e0f6f6737c04f967bfe ipa-2-1: 60bacc23a0989c7f9c060d8c209ba4396546ec89 Started with time on master at 13:45, and on client at 15:45 Ran ipa-client-install debug logs indicate: Synchronizing time with KDC... root : DEBUG args=/usr/sbin/ntpdate -U ntp -s -b rhel62-server1.testrelm .....where rhel62-server1.testrelm is the master IPA server. after install, time on client matches master and is at 13:50 verified using ipa-client-2.1.2-2.el6.x86_64 Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: If IPA client is installed and there is a too big time difference between the client and an IPA server, KDC running on the IPA server machine may refuse any Kerberos authentication request from the client. Consequence: Installation may fail as it cannot get a valid Kerberos ticket during the process Fix: Always try to synchronize the time with the NTP servers configured for the client domain or the IPA server itself Result: If the time synchronization succeeds, the time on the client machine is fixed and Kerberos authentication and the installation itself should successfully continue Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html |