Bug 924009

Summary:	Allow client to re-enroll without first unenrolling
Product:	Red Hat Enterprise Linux 6	Reporter:	Dmitri Pal <dpal>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED ERRATA	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	6.4	CC:	ksiddiqu, lnovich, mkosek, tlavigne
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-3.0.0-36.el6	Doc Type:	Bug Fix
Doc Text:	Cause: Identity Management client installer did not allow re-enrolling an already enrolled client. Consequence: When a machine or a VM with a configured Identity Management client is removed or decommissioned without unenrolling the client first, all succeeding client enrollments will fail until the client entry is removed from Identity Management sever. Fix: --force-join option was added to the IdM client installer. Result: Privileged administrator may re-enroll an Identity Management client.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-11-21 20:52:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dmitri Pal 2013-03-20 22:25:50 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3482

The use case is a client as a VM.

Kickstart process creates VM and enrolls client.

client dies

Kickstart process deletes VM and enrolls client.

Fail, already enrolled.

There is no entity in the middle that can run host-delete or host-disable.

The desire is to either add a new flag (e.g. --autoclean), or extend the meaning of --force, to have the client detect that it is already enrolled, call host-disable, then enroll.

It is expected to only work when doing a delegated enrollment. OTP will not work.

Comment 1 Martin Kosek 2013-03-25 09:55:01 UTC

Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/a7ccc198a731d0e48319a73bcb2dd98c34de262a

To reenroll the client, a new option of ipa-client-install can be used:

    --force-join        Force client enrollment even if already enrolled

Comment 7 Martin Kosek 2013-09-17 08:43:57 UTC

I just found out, that the backported patch for this feature was incomplete as it misses some required changes in ipa-join. This leads to ipa-client-install --force-join returning an error.

Comment 9 Martin Kosek 2013-09-17 14:01:23 UTC

Fixed in ipa-3.0.0-36.el6.

Comment 10 Martin Kosek 2013-09-25 11:17:59 UTC

Reproduction scenario:
1. Install IPA server
2. Install IPA client
3. Shutdown IPA server so that client will not be correctly unenrolled
4. --uninstall IPA client
5. Start IPA server
6. Try installing IPA client again - it won't be allowed unless --force-join flag is used

Comment 11 Kaleem 2013-10-11 09:33:57 UTC

Verified.

ipa-client version:
===================
[root@rhel65-client ~]# rpm -q ipa-client
ipa-client-3.0.0-37.el6.x86_64
[root@rhel65-client ~]#

Steps of verification:
======================

(1)Un-installing client and IPA server not reachable while un-installing client

[root@rhel65-client ~]# iptables -A INPUT -j REJECT -p all --source 10.65.207.74;ipa-client-install --uninstall -U;iptables -F
Unenrolling client from IPA server
Unenrolling host failed: Error obtaining initial credentials: Cannot contact any KDC for requested realm.

Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
nslcd daemon is not installed, skip configuration
Client uninstall complete.
[root@rhel65-client ~]# 

(2)Re-enrollment client with --force-join 

[root@rhel65-client ~]# ipa-client-install -U --force-join --domain=testrelm.com --realm=TESTRELM.COM -p admin -w xxxxxxxx --server=rhel65-replica.testrelm.com
Hostname: rhel65-client.testrelm.com
Realm: TESTRELM.COM
DNS Domain: testrelm.com
IPA Server: rhel65-replica.testrelm.com
BaseDN: dc=testrelm,dc=com

Synchronizing time with KDC...
Enrolled in IPA realm TESTRELM.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm TESTRELM.COM
trying https://rhel65-replica.testrelm.com/ipa/xml
Forwarding 'env' to server u'https://rhel65-replica.testrelm.com/ipa/xml'
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub
Forwarding 'host_mod' to server u'https://rhel65-replica.testrelm.com/ipa/xml'
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.
[root@rhel65-client ~]#

Comment 13 errata-xmlrpc 2013-11-21 20:52:15 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1651.html