Red Hat Bugzilla – Bug 1026845
Server does not detect different server and IPA domain
Last modified: 2014-06-17 20:12:37 EDT
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/4012 Server domain is being checked if it is in a main IPA domain. When not, additional realm_domain mapping is added to `/etc/krb5.conf`. However, given that the domain is checked just with string comparison of the domain, when the server has fqdn like `ipa-idm.example.com` and main domain and realm is `idm.example.com`, the installer does not detect this mismatch, does not configure realm_domain mapping and httpd does not start due to obscure error: {{{ gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information (, ), referer: https://ipa-idm.example.com/ipa/xml }}}
Please provide steps to verify
Reproduction scenario: 1) Install IPA so that server FQDN lies in different domain than the main domain (--domain) but shares the same suffix. E.g.: # hostname ipa-idm.example.com # ipa-server-install --domain idm.example.com 2) When installation is complete, try kinit and one command: # kinit admin # ipa user-show admin ipa command will fail with the old version as realm-domain mapping is missing in /etc/krb5.conf.
Patch also pushed upstream: master: https://fedorahosted.org/freeipa/changeset/b4ee7da8e9d578ce2c053fad7d0f1ace7f0b6e6a ipa-3-3: https://fedorahosted.org/freeipa/changeset/cce06d3ba2da95abc05aab274df541d93fb24174
Verified. Version :: ipa-server-3.3.3-15.el7.x86_64 Test Results :: [root@rhel7-4 ~]# sed -i "/$(hostname -i)/d" /etc/hosts [root@rhel7-4 ~]# sed -i "/$(hostname)/d" /etc/hosts [root@rhel7-4 ~]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 [root@rhel7-4 ~]# echo "$(hostname -i) ipa-idm.example.com" >> /etc/hosts [root@rhel7-4 ~]# echo ipa-idm.example.com > /etc/hostname [root@rhel7-4 ~]# hostname ipa-idm.example.com [root@rhel7-4 ~]# hostname ipa-idm.example.com [root@rhel7-4 ~]# ipa-server-install --setup-dns --forwarder=192.168.122.1 -r IDM.EXAMPLE.COM -n idm.example.com -p Secret123 -P Secret123 -a Secret123 -U ... [root@rhel7-4 ~]# kinit admin Password for admin@IDM.EXAMPLE.COM: [root@rhel7-4 ~]# ipa user-show admin User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 997600000 GID: 997600000 Account disabled: False Password: True Member of groups: admins, trust admins Kerberos keys available: True [root@rhel7-4 ~]# cat /etc/krb5.conf includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = IDM.EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = yes default_ccache_name = KEYRING:persistent:%{uid} [realms] IDM.EXAMPLE.COM = { kdc = ipa-idm.example.com:88 master_kdc = ipa-idm.example.com:88 admin_server = ipa-idm.example.com:749 default_domain = idm.example.com pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .idm.example.com = IDM.EXAMPLE.COM idm.example.com = IDM.EXAMPLE.COM .example.com = IDM.EXAMPLE.COM example.com = IDM.EXAMPLE.COM [dbmodules] IDM.EXAMPLE.COM = { db_library = ipadb.so } [root@rhel7-4 ~]#
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.