Bug 798381

Summary:	ipa-client-install failing with "ipaserver.testrelm.com is not an IPA v2 Server."
Product:	Red Hat Enterprise Linux 6	Reporter:	Jenny Severance <jgalipea>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED WORKSFORME	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	unspecified	Docs Contact:
Priority:	urgent
Version:	6.3	CC:	atkac, mkosek, nsoman
Target Milestone:	rc	Keywords:	Regression
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-2.2.0-9.el6	Doc Type:	Bug Fix
Doc Text:	No documentation needed.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-05-09 14:42:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Jenny Severance 2012-02-28 18:50:02 UTC

Description of problem:

With latest builds can not install ipa client


# ipa-client-install --domain=testrelm.com --realm=TESTRELM.COM -p admin -w mysecret -U --server=ipaserver.testrelm.com
ipaserver.testrelm.com is not an IPA v2 Server.

<rcrit> Invalid ACL element: any;
<rcrit> I"m not sure this is an ipa server problem. I'll see if I can find a workaround

<jgalipea> from the client I can ping the outside world ... so ipaserver.testrelm.com is forwarding non-authoritative requests ...

<rcrit> it's not allowing queries I presume
<rcrit> ipa dnszone-mod testrelm.com --delattr idnsallowquery=any; && ipa dnszone-mod testrelm.com --delattr idnsallowtransfer=none;
<rcrit> jgalipea, that is how I got resolution working again, along with a named restart



Version-Release number of selected component (if applicable):
ipa-server-2.2.0-102.20120228T1040zgit449c71c.el6.x86_64
ipa-client-2.2.0-102.20120228T1040zgit449c71c.el6.x86_64

How reproducible:


Steps to Reproduce:
1. 
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 2 Martin Kosek 2012-02-29 08:54:26 UTC

What is the version of bind-dyndb-ldap? It looks like you have the old RHEL build where idnsAllowQuery was still a multivalued LDAP attribute where ACL elements were added separately. The new version have all ACL elements as one attribute value, separated with ";".

Comment 3 Jenny Severance 2012-02-29 12:02:49 UTC

bind-dyndb-ldap.x86_64 0:1.1.0-0.6.a1.20120228T1006z.el6

Comment 4 Martin Kosek 2012-02-29 12:43:34 UTC

Thanks. I see I was right, ACL format is fixed in bind-dyndb-ldap >= 1.1.0-0.8.a2. You would need an updated version of this package.

Comment 6 Rob Crittenden 2012-02-29 14:28:51 UTC

We'll need to reset the Conflicts version number to whatever the build is as well (Conflicts because we don't require bind-dyndb-ldap to be installed but if it is we use this to require a specific version).

Comment 8 Rob Crittenden 2012-04-18 20:30:31 UTC

We have added a Conflicts to require a minimum n-v-r on bind-dyndb-ldap as part of BZ 805814. Is this problem still occurring?

Comment 9 Jenny Severance 2012-04-19 14:44:31 UTC

I have not seen this error in quite sometime.  I suggest we close as works for me and if we come across it again we can re-open.

Comment 12 Martin Kosek 2012-04-19 18:07:27 UTC

(In reply to comment #9)
> I have not seen this error in quite sometime.  I suggest we close as works for
> me and if we come across it again we can re-open.

Yes, this was just an issue of in-compatibility between ipa and bind-dyndb-ldap which should no longer occur because of ipa package requirements. +1 for closing as WORKSFORME.

Comment 14 Martin Kosek 2012-04-24 13:31:50 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No documentation needed.

Comment 15 Namita Soman 2012-05-09 14:42:00 UTC

closing as worksforme