Bug 1009044 - ipa trust-add should not create a trust if IPA realm and domain name differ
ipa trust-add should not create a trust if IPA realm and domain name differ
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.0
Unspecified Unspecified
medium Severity unspecified
: rc
: ---
Assigned To: Martin Kosek
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-09-17 10:28 EDT by Martin Kosek
Modified: 2015-09-23 10:36 EDT (History)
3 users (show)

See Also:
Fixed In Version: ipa-3.3.2-1.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-13 08:07:28 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Kosek 2013-09-17 10:28:51 EDT
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3923

AD implicitly assumes that the DNS domain name and the realm of a trusted domain are the same. This means that a trust will never work if IPA is configured with different realm and domain name.

This Bug plans to amend the situation in following way:
- ipa-server-install will WARN user if realm and domain differs that AD Trusts will not be possible
- Fail in ipa-adtrust-install if realm and domain is different
- Fail in trust-add if realm and domain is different
Comment 1 Martin Kosek 2013-09-17 10:36:31 EDT
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/3924
Comment 4 Steeve Goveas 2013-12-19 03:18:05 EST
* Warning while ipa-server-install is run with realm name different from domain name

[root@tyan-gt24-01 ~]# /usr/sbin/ipa-server-install --setup-dns --forwarder=10.16.36.29 --hostname=tyan-gt24-01.testrelm.com -r TEST.IPA -n testrelm.com -p Secret123 -P Secret123 -a Secret123 -U

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.

This includes:
  * Configure a stand-alone CA (dogtag) for certificate management
  * Configure the Network Time Daemon (ntpd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)
  * Configure DNS (bind)

WARNING: conflicting time&date synchronization service 'chronyd' will be disabled
in favor of ntpd

Warning: skipping DNS resolution of host tyan-gt24-01.testrelm.com
Using reverse zone 65.16.10.in-addr.arpa.

The IPA Master Server will be configured with:
Hostname:      tyan-gt24-01.testrelm.com
IP address:    10.16.65.177
Domain name:   testrelm.com
Realm name:    TEST.IPA

BIND DNS server will be configured to serve IPA domain with:
Forwarders:    10.16.36.29
Reverse zone:  65.16.10.in-addr.arpa.

WARNING: Realm name does not match the domain name.
You will not be able to estabilish trusts with Active Directory unless
ythe realm name of the IPA server matches its domain name.
....<Truncated>............

* Warning displayed when ipa-adtrust-install is run on a IPA server having different realm and domain name.

[root@tyan-gt24-01 ~]# ipa-adtrust-install -a Secret123 -U

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the IPA Server.

This includes:
  * Configure Samba
  * Add trust related objects to IPA LDAP server

To accept the default shown in brackets, press the Enter key.

WARNING: Realm name does not match the domain name.
You will not be able to estabilish trusts with Active Directory unless
the realm name of the IPA server matches its domain name.
....<Truncated>.......

* Trust add fails with error caused due to mismatch of realm and domain name

[root@tyan-gt24-01 ~]# ipa trust-add adom.qe --type ad --admin administrator --password
Active directory domain administrator's password: 
ipa: ERROR: invalid 'Realm-domain mismatch': To establish trust with Active Directory, the domain name and the realm name of the IPA server must match

* Verified in version

[root@tyan-gt24-01 ~]# rpm -q ipa-server
ipa-server-3.3.3-6.el7.x86_64
Comment 5 Ludek Smid 2014-06-13 08:07:28 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.