Bug 773490

Summary:	dns discovery domain needs to be added to sssd.conf
Product:	Red Hat Enterprise Linux 6	Reporter:	Dmitri Pal <dpal>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED ERRATA	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	6.3	CC:	jgalipea, ksiddiqu, mkosek
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-3.0.0-1.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-02-21 09:09:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dmitri Pal 2012-01-11 23:16:36 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2209

Hello,

I've found out that if you have clients outside the server domain and when having conflicting SRV records (AD-records) in the client domain. ipa client enrollment will fail or getting timeouts to IPA services. 

Solution to this is to add dns_discovery_domain to sssd.conf.

ipa-client-install needs to be able to handle this scenario.

Comment 1 Rob Crittenden 2012-03-15 19:19:02 UTC

fixed upstream.

master: 96390ca3e5f9fb89fe930e62dbd267a2de0af1d1

ipa-2-2: 034f6d7d85d6d120f6934f10247c2fe417bd5514

Comment 4 Kaleem 2012-11-27 09:33:27 UTC

Verified.

dns_discovery_domain is added in sssd.conf
dns_discovery_domain = testrelm.com 

ipa-client version:
===================
[root@dhcp201-198 ~]# rpm -q ipa-client
ipa-client-3.0.0-8.el6.i686
[root@dhcp201-198 ~]#

[root@dhcp201-198 ~]# ipa-client-install -p admin -w xxxxxxxx --server=rhel64master.testrelm.com --domain=testrelm.com -U
Hostname: dhcp201-198.englab.pnq.redhat.com
Realm: TESTRELM.COM
DNS Domain: testrelm.com
IPA Server: rhel64master.testrelm.com
BaseDN: dc=testrelm,dc=com
Synchronizing time with KDC...
Enrolled in IPA realm TESTRELM.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm TESTRELM.COM
trying https://rhel64master.testrelm.com/ipa/xml
Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Forwarding 'host_mod' to server u'http://rhel64master.testrelm.com/ipa/xml'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Unable to find 'admin' user with 'getent passwd admin'!
Recognized configuration: SSSD
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.
[root@dhcp201-198 ~]#

[root@dhcp201-198 ~]# cat /etc/sssd/sssd.conf 
[domain/testrelm.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = testrelm.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = dhcp201-198.englab.pnq.redhat.com
chpass_provider = ipa
ipa_server = _srv_, rhel64master.testrelm.com
dns_discovery_domain = testrelm.com
[sssd]
services = nss, pam, ssh
config_file_version = 2
domains = testrelm.com
...
[root@dhcp201-198 ~]#

Comment 6 errata-xmlrpc 2013-02-21 09:09:00 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0528.html