Hide Forgot
Description of problem: When an AD (probably IPA too) has more IP addresses (typically IPv6) it seems only the first three are discovered. Is this any reason for this limitation? Version-Release number of selected component (if applicable): realmd-0.14.6-1.el7 How reproducible: always Steps to Reproduce: Block IPv6 traffic: # ip6tables -A INPUT -j REJECT # ip6tables -L Chain INPUT (policy ACCEPT) target prot opt source destination REJECT all anywhere anywhere reject-with icmp6-port-unreachable Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) # # realm -v discover ad.baseos.qe * Resolving: _ldap._tcp.ad.baseos.qe * Performing LDAP DSE lookup on: 2001:db8:ee8c:180:1dfe:a8ea:f0d8:380c * Performing LDAP DSE lookup on: 2620:52:0:2223::1:1 * Performing LDAP DSE lookup on: 2620:52:0:2223:1dfe:a8ea:f0d8:380c ! Discovery timed out after 15 seconds ad.baseos.qe type: kerberos realm-name: AD.BASEOS.QE domain-name: ad.baseos.qe configured: no # host ad.baseos.qe ad.baseos.qe has address 10.34.37.22 ad.baseos.qe has IPv6 address 2001:db8:ee8c:180:1dfe:a8ea:f0d8:380c ad.baseos.qe has IPv6 address 2620:52:0:2223::1:1 # # ip6tables -F # realm -v discover ad.baseos.qe * Resolving: _ldap._tcp.ad.baseos.qe * Performing LDAP DSE lookup on: 2001:db8:ee8c:180:1dfe:a8ea:f0d8:380c * Performing LDAP DSE lookup on: 2620:52:0:2223::1:1 * Performing LDAP DSE lookup on: 2620:52:0:2223:1dfe:a8ea:f0d8:380c ! Can't contact LDAP server * Performing LDAP DSE lookup on: 10.34.37.22 * Successfully discovered: ad.baseos.qe ad.baseos.qe type: kerberos realm-name: AD.BASEOS.QE domain-name: ad.baseos.qe configured: no server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common Then deleted the address "2001:db8:ee8c:180:1dfe:a8ea:f0d8:380c" from DNS of AD: # ip6tables -A INPUT -j REJECT # realm -v discover ad.baseos.qe * Resolving: _ldap._tcp.ad.baseos.qe * Performing LDAP DSE lookup on: 2620:52:0:2223::1:1 * Performing LDAP DSE lookup on: 2620:52:0:2223:1dfe:a8ea:f0d8:380c * Performing LDAP DSE lookup on: 10.34.37.22 * Successfully discovered: ad.baseos.qe ad.baseos.qe type: kerberos realm-name: AD.BASEOS.QE domain-name: ad.baseos.qe configured: no server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common
Discovering and contacting all DC addresses for a large domain is a potentially nearly unbounded operation. We have to stop somewhere, so we chose to contact 3 addresses. Please reopen if this is an actual problem. Do you have a use case this breaks?Otherwise this is NOTABUG.
Well, there isn't a real use case I'm just trying to test a scenario where the IPv6 network is down between the host and server. And wen there are 3 IPv6 addresses realm newer tries IPv4, the only one that actually works. I can fix it by removing one IPv6 address, so not a big deal. I just wanted to see if this is by purpose.
I did some research how exactly it works and it looks like this: realmd tries to connect to remote ldap with the first 3 addresses and where no response is returned withing 15 sec. it quits with no result. If and error (e.g. icmp net unreachable) is returned from one of the addresses the next address from the pool is picked and that is tried and so on. All this within the first 15 seconds. This mechanisms seems to be ok, when errors are returned, but IMHO it could be more robust when no error is returned. For example try more (all) addresses (maybe not at once but e.g. 3 every 1 second) until one is answered. And timeout after 15 secs as it is. But this is really a marginal case, so feel free to close it as not a bug (and definitely we shouldn't bother with it in RHEL-7.0).
Makes sense.
This does not have a solid real world use case. I'm not against someone providing and including a patch for this, but I'm unable to spend time fixing what seems like an extreme edge case.
Development Management has reviewed and declined this request. You may appeal this decision by reopening this request.