Bug 924004
| Summary: | ipa-client-install cannot obtain CA certificate | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Dmitri Pal <dpal> |
| Component: | ipa | Assignee: | Rob Crittenden <rcritten> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.4 | CC: | ksiddiqu, lnovich, mkosek, pasteur |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-3.0.0-31.el6 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: When Identity Management client installer was downloading a CA certificate from Identity Management Server via LDAP protocol, it did not fallback to HTTP protocol in some cases.
Consequence: Identity Management client installation failed due to inability to download CA certificate via LDAP even though the certificate was accessible via HTTP protocol.
Fix: Improve Identity Management client CA retrieval fallback mechanism.
Result: Identity Management client installation can properly fallback between different protocols when downloading CA certificate and thus is able to complete the installation even when the download via one protocol fails.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-11-21 20:52:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Dmitri Pal
2013-03-20 22:15:42 UTC
Fixed upstream: master: 1336b399065ff47477029ba487f1d392f1ce6ac8 Improve client install LDAP cert retrieval fallback 6540eff4687bbc400e285a68936d8edf1895168e Use temporary CCACHE in ipa-client-install ipa-3-1: fdfcd2cf2456fce303553d88cbf53067c975d2f3 Improve client install LDAP cert retrieval fallback 07755e815e09ef722fc1fdb6715fd538aa2d08d4 Use temporary CCACHE in ipa-client-install Reproduction: I was pondering how to recreate the GSSAPI failure given we already fixed the root cause, but I did not find an easy way. Therefore, I would propose to verify this bug as Sanity Only, with checking that the fallback from LDAP to HTTP functionality stays intact. For example with this scenario: SERVER: Rename CAcert on server: dn: cn=CAcert,cn=ipa,cn=etc,dc=example,dc=com changetype: moddn newrdn: cn=CAcert-renamed deleteoldrdn: 1 newsuperior: cn=ipa,cn=etc,dc=example,dc=com CLIENT: # rm -f /etc/ipa/ca.crt # ipa-client-install -p admin -w Secret123 Discovery was successful! Hostname: vm-086.example.com Realm: EXAMPLE.COM DNS Domain: example.com IPA Server: vm-119.example.com BaseDN: dc=example,dc=com Continue to configure the system with these values? [no]: y Synchronizing time with KDC... Unable to download CA cert from LDAP. Do you want to download the CA cert from http://vm-119.example.com/ipa/config/ca.crt? (this is INSECURE) [no]: y Downloading the CA certificate via HTTP, this is INSECURE Successfully retrieved CA cert Subject: CN=Certificate Authority,O=EXAMPLE.COM Issuer: CN=Certificate Authority,O=EXAMPLE.COM Valid From: Fri Oct 11 07:28:43 2013 UTC Valid Until: Tue Oct 11 07:28:43 2033 UTC Enrolled in IPA realm EXAMPLE.COM ... Client configuration complete. Verified. We tried CA retrieval fallback from ldap to http only as suggested. ipa version: ============ [root@rhel65-client ~]# rpm -q ipa-client ipa-client-3.0.0-37.el6.x86_64 [root@rhel65-client ~]# Verification steps: (1)Rename CA ldap entry on Master [root@rhel65-client ~]# cat rename-ca.ldif dn: cn=CAcert,cn=ipa,cn=etc,dc=testrelm,dc=com changetype: moddn newrdn: cn=CAcert-foo deleteoldrdn: 1 newsuperior: cn=ipa,cn=etc,dc=testrelm,dc=com [root@rhel65-client ~]# [root@rhel65-client ~]# ldapadd -h rhel65-master.testrelm.com -p 389 -D "cn=Directory Manager" -w Secret123 -f /root/rename-ca.ldif modifying rdn of entry "cn=CAcert,cn=ipa,cn=etc,dc=testrelm,dc=com" [root@rhel65-client ~]# (2)Install ipa client [root@rhel65-client ~]# ipa-client-install --domain=testrelm.com --realm=TESTRELM.COM -p admin -w xxxxxxxx --server=rhel65-master.testrelm.comAutodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: yes Hostname: rhel65-client.testrelm.com Realm: TESTRELM.COM DNS Domain: testrelm.com IPA Server: rhel65-master.testrelm.com BaseDN: dc=testrelm,dc=com Continue to configure the system with these values? [no]: yes Synchronizing time with KDC... Unable to download CA cert from LDAP. Do you want to download the CA cert from http://rhel65-master.testrelm.com/ipa/config/ca.crt? (this is INSECURE) [no]: yes Downloading the CA certificate via HTTP, this is INSECURE Successfully retrieved CA cert Subject: CN=Certificate Authority,O=TESTRELM.COM Issuer: CN=Certificate Authority,O=TESTRELM.COM Valid From: Tue Oct 15 05:26:16 2013 UTC Valid Until: Sat Oct 15 05:26:16 2033 UTC Enrolled in IPA realm TESTRELM.COM Created /etc/ipa/default.conf New SSSD config will be created Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm TESTRELM.COM trying https://rhel65-master.testrelm.com/ipa/xml Forwarding 'env' to server u'https://rhel65-master.testrelm.com/ipa/xml' Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub Forwarding 'host_mod' to server u'https://rhel65-master.testrelm.com/ipa/xml' SSSD enabled Configured /etc/openldap/ldap.conf NTP enabled Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Client configuration complete. [root@rhel65-client ~]# Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1651.html |