Red Hat Bugzilla – Bug 1015481
client incompatible error message not shown on RHEL-65 ipa client
Last modified: 2014-10-14 03:32:14 EDT
Description of problem: After successfully installing RHEL-65 ipa client (ipa-client-3.0.0-37) with RHEL-64 IPA server (ipa-server-3.0.0-26.el6_4.4), When i tried to run ipa command on client, following error message shown instead of client incompatible error message " ipa: ERROR: Unknown option: no_members " Version-Release number of selected component (if applicable): ipa-client-3.0.0-37 ipa-server-3.0.0-26.el6_4.4 How reproducible: Always Steps to Reproduce: 1.Install RHEL-65 ipa client (ipa-client-3.0.0-37) with RHEL-64 ipa server (ipa-server-3.0.0-26.el6_4.4). 2.Run following ipa command on client ipa user-show admin Actual results: [root@client65x86 ~]# ipa user-show admin ipa: ERROR: Unknown option: no_members [root@client65x86 ~]# Expected results: # ipa user-show admin ipa: ERROR: 2.49 client incompatible with 2.46 server at u'https://vm-201.idm.lab.eng.brq.redhat.com/ipa/xml'
Upstream ticket: https://fedorahosted.org/freeipa/ticket/3963
FYI, I also see similar when testing RHEL7 clients with RHEL6.5 servers: ipa: ERROR: 2.65 client incompatible with 2.49 server at u'https://nocp9.testrelm.test/ipa/xml'
FYI, Dev has confirmed that RHEL7 client to RHEL6.5 server won't work for "ipa" commands. The design is "forward compatible" not "backward compatible". 6.5 clients to 7 servers should work but, my scenario will not. Regards.
Fixed upstream: ipa-3-0: https://fedorahosted.org/freeipa/changeset/220539a3653b15e4f5679b53cab8e601abaf8990 ipa-3-1: https://fedorahosted.org/freeipa/changeset/98f5abe37461844b42989766caee525c0d8864f8 ipa-3-2: https://fedorahosted.org/freeipa/changeset/b4d2637fc43798669b8ea1bc6fe0f851fd30401a ipa-3-3: https://fedorahosted.org/freeipa/changeset/7486140e00c2f1e119250fb69040864fa902290d
master: https://fedorahosted.org/freeipa/changeset/ba53299b98977308966039fad9518c79296bccbf
I tried on RHEL-6.6 client (build ipa-client-3.0.0-41.el6.x86_64) with RHEL-6.4 IPA server and found that issue is still there. [root@hp-ms-01-c28 ~]# rpm -q ipa-client ipa-client-3.0.0-41.el6.x86_64 [root@hp-ms-01-c28 ~]# ipa user-show admin ipa: ERROR: Unknown option: no_members [root@hp-ms-01-c28 ~]#
Any update on this?
Sorry, Comment 11 slipped between cracks. There was probably a misunderstanding of how the checks works. The check itself is performed *on the server*. This means that only patched servers (RHEL-6.6 and later) will display the better error message. So for example, if we add a new option in RHEL-6.7 and RHEL-6.7 client would use it, RHEL-6.6 server would error out with the new message instead of "Unknown option" error. As this fix is not reproducible right now, can it be only tested with SanityOnly, i.e. that user-show on RHEL-6.6 server works from the same or older IPA client?
Verified SanityOnly. [root@dhcp207-60 ~]# echo xxxxxxx|kinit admin Password for admin@TESTRELM.TEST: [root@dhcp207-60 ~]# ipa user-show admin User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 1572600000 GID: 1572600000 Account disabled: False Password: True Member of groups: admins, trust admins Kerberos keys available: True [root@dhcp207-60 ~]# cat /etc/redhat-release ; rpm -q ipa-client Red Hat Enterprise Linux Server release 6.5 (Santiago) ipa-client-3.0.0-37.el6.x86_64 [root@dhcp207-60 ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1383.html