Hide Forgot
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/3923 AD implicitly assumes that the DNS domain name and the realm of a trusted domain are the same. This means that a trust will never work if IPA is configured with different realm and domain name. This Bug plans to amend the situation in following way: - ipa-server-install will WARN user if realm and domain differs that AD Trusts will not be possible - Fail in ipa-adtrust-install if realm and domain is different - Fail in trust-add if realm and domain is different
Upstream ticket: https://fedorahosted.org/freeipa/ticket/3924
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/8ebb76177dbe675b281a4c06fabd4d27b2dffd7c https://fedorahosted.org/freeipa/changeset/bae291def780c81144c8f4d71ced5007e1ee3867 ipa-3-3: https://fedorahosted.org/freeipa/changeset/8dec70f0906cd3a61fa1067593b594c600d2f263 https://fedorahosted.org/freeipa/changeset/7e453d4601d67029bb43bdcf84538cba16b62074
* Warning while ipa-server-install is run with realm name different from domain name [root@tyan-gt24-01 ~]# /usr/sbin/ipa-server-install --setup-dns --forwarder=10.16.36.29 --hostname=tyan-gt24-01.testrelm.com -r TEST.IPA -n testrelm.com -p Secret123 -P Secret123 -a Secret123 -U The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will set up the IPA Server. This includes: * Configure a stand-alone CA (dogtag) for certificate management * Configure the Network Time Daemon (ntpd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) * Configure DNS (bind) WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd Warning: skipping DNS resolution of host tyan-gt24-01.testrelm.com Using reverse zone 65.16.10.in-addr.arpa. The IPA Master Server will be configured with: Hostname: tyan-gt24-01.testrelm.com IP address: 10.16.65.177 Domain name: testrelm.com Realm name: TEST.IPA BIND DNS server will be configured to serve IPA domain with: Forwarders: 10.16.36.29 Reverse zone: 65.16.10.in-addr.arpa. WARNING: Realm name does not match the domain name. You will not be able to estabilish trusts with Active Directory unless ythe realm name of the IPA server matches its domain name. ....<Truncated>............ * Warning displayed when ipa-adtrust-install is run on a IPA server having different realm and domain name. [root@tyan-gt24-01 ~]# ipa-adtrust-install -a Secret123 -U The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will setup components needed to establish trust to AD domains for the IPA Server. This includes: * Configure Samba * Add trust related objects to IPA LDAP server To accept the default shown in brackets, press the Enter key. WARNING: Realm name does not match the domain name. You will not be able to estabilish trusts with Active Directory unless the realm name of the IPA server matches its domain name. ....<Truncated>....... * Trust add fails with error caused due to mismatch of realm and domain name [root@tyan-gt24-01 ~]# ipa trust-add adom.qe --type ad --admin administrator --password Active directory domain administrator's password: ipa: ERROR: invalid 'Realm-domain mismatch': To establish trust with Active Directory, the domain name and the realm name of the IPA server must match * Verified in version [root@tyan-gt24-01 ~]# rpm -q ipa-server ipa-server-3.3.3-6.el7.x86_64
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.