Bug 867442

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/3193

Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/4c4418fb9e9c2cf4fff8dec59b6d8fcdb05ea706
ipa-3-1: https://fedorahosted.org/freeipa/changeset/8bbc4c5ff4b5a3c9bb99241a213bb52deb418212

ipa trust-add command now detects this situation and reports a better worded error.

Verified in freeipa-server-3.1.3-1.fc18.x86_64


[root@f18 acceptance]# ipa-adtrust-install --netbios-name=ADLAB
...
...
...
Setup complete


[root@f18 acceptance]# ipa trust-add --type=ad adlab.qe --admin Administrator --password
Active directory domain administrator's password: 
ipa: ERROR:invalid u'AD Trust Setup': the IPA server and the remote domain cannot share the same NetBIOS name: ADLAB


[root@f18 acceptance]# ipa trust-find
----------------
0 trusts matched
----------------
----------------------------
Number of entries returned 0
----------------------------

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: trust_cli_bz867442: Adtrust install with AD netbios name bz867442
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Creating expect script (Expected 0, got 0)
spawn /usr/sbin/ipa-adtrust-install --netbios-name=ADTEST

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the IPA Server.

This includes:
  * Configure Samba
  * Add trust related objects to IPA LDAP server

To accept the default shown in brackets, press the Enter key.

IPA generated smb.conf detected.
Overwrite smb.conf? [no]: y
Do you want to enable support for trusted domains in Schema Compatibility plugin?
This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.

Enable trusted domains support in slapi-nis? [no]: 

Configuring cross-realm trusts for IPA server requires password for user 'admin'.
This user is a regular system account used for IPA server administration.

admin password: 

Current NetBIOS domain name is TESTRELM, new name is ADTEST.

Please note that changing the NetBIOS name might break existing trust relationships.
Say 'yes' if the NetBIOS shall be changed and 'no' if the old one shall be kept.
Do you want to reset the NetBIOS domain name? [no]: y

WARNING: 1 existing users or groups do not have a SID identifier assigned.
Installer can run a task to have ipa-sidgen Directory Server plugin generate
the SID identifier for all these users. Please note, the in case of a high
number of users and groups, the operation might lead to high replication
traffic and performance degradation. Refer to ipa-adtrust-install(1) man page
for details.

Do you want to run the ipa-sidgen task? [no]: 

The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring CIFS
  [1/19]: stopping smbd
  [2/19]: creating samba domain object
Reset NetBIOS domain name
  [3/19]: creating samba config registry
  [4/19]: writing samba config file
  [5/19]: adding cifs Kerberos principal
  [6/19]: check for cifs services defined on other replicas
  [7/19]: adding cifs principal to S4U2Proxy targets
cifs principal already targeted, nothing to do.
  [8/19]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
  [9/19]: adding RID bases
RID bases already set, nothing to do
  [10/19]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
  [11/19]: activating CLDAP plugin
CLDAP plugin already configured, nothing to do
  [12/19]: activating sidgen plugin and task
Sidgen plugin already configured, nothing to do
Sidgen task plugin already configured, nothing to do
  [13/19]: activating extdom plugin
Extdom plugin already configured, nothing to do
  [14/19]: configuring smbd to start on boot
  [15/19]: adding special DNS service records
  [16/19]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
  [17/19]: adding fallback group
Fallback group already set, nothing to do
  [18/19]: setting SELinux booleans
  [19/19]: starting CIFS services
Done configuring CIFS.

=============================================================================
Setup complete

You must make sure these network ports are open:
	TCP Ports:
	  * 138: netbios-dgm
	  * 139: netbios-ssn
	  * 445: microsoft-ds
	UDP Ports:
	  * 138: netbios-dgm
	  * 139: netbios-ssn

-------ADtrust installed-------

spawn /usr/bin/ipa trust-add --type=ad adtest.qe --admin Administrator --password
Active directory domain administrator's password: 
ipa: ERROR: invalid 'AD Trust Setup': the IPA server and the remote domain cannot share the same NetBIOS name: ADTEST

Trust add failed as expected
:: [   PASS   ] :: Trust-add fails when IPA NetBIOS and AD NetBIOS are same (Expected 2, got 2)

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.