Description of problem:

If you have a linux box you can run the ipaclient install script (ipa-client-install) that knows of a ntp server already, the installer will bark that it cannot sync time with the ipa ntp server.

Version-Release number of selected component (if applicable):

freeipa-3.3.4

How reproducible:

According to the freeipa-users, rather easily. That said, I only tested by running ipa-client-install in a centos 6.4 box. I did, however, checked the code in the release 3.3.4 of freeipa and the issue is still there.

Steps to Reproduce:
1. Setup the free ipa server (i.e. the kdc) to do ntp.
2. Configure ntp in the rehat/centos/fedora box that you are trying to create its host principal (using the ipa-client-install). In my case, I set my dhcp server to announce the kdc as the ntp server (option ntp-servers 10.0.0.11;)
3. Run ipa-client-install. It will be successful but will complain about not being able to sync against the ipa ntp server.

Actual results:

[root@centos64 ~]# hostname
centos64
[root@centos64 ~]# ipa-client-install --hostname=`hostname -f`
Discovery was successful!
Hostname: centos64.in.domain.com
Realm: DOMAIN.COM
DNS Domain: domain.com
IPA Server: auth.in.domain.com
BaseDN: dc=domain,dc=com

[so far so good!]

Continue to configure the system with these values? [no]: yes
User authorized to enroll computers: admin
Synchronizing time with KDC...
Unable to sync time with IPA NTP server, assuming the time is in sync.
Please check that 123 UDP port is opened.
Password for admin:

[Note that it will succeed in the setting up, which is not what this bug is all about. Here is what /var/log/ipaclient-install.log shows]

2014-02-08T13:14:31Z DEBUG args=/usr/sbin/ntpdate -U ntp -s -b -v
auth.in.domain.com
2014-02-08T13:14:31Z DEBUG stdout=
2014-02-08T13:14:31Z DEBUG stderr=
2014-02-08T13:14:31Z WARNING Unable to sync time with IPA NTP server,
assuming the time is in sync. Please check that 123 UDP port is
opened.

Expected results:


Additional info:

Suggested solution is to edit ipa-client/ipaclient/ntpconf.py, function 
synconce_ntp(server_fqdn):

replace

        cmd = [ntpdate, "-U", "ntp", "-s", "-b", "-v", server_fqdn]

with

        cmd = [ntpdate, "-U", "ntp", "-s", "-b", "-v", "-u", server_fqdn]

Reasoning:

[root@centos64 ~]# date +%T -s "10:13:13"
10:13:13
[root@centos64 ~]# date
Mon Feb 10 10:13:15 EST 2014
[root@centos64 ~]# /usr/sbin/ntpdate -U ntp -s -b -v -u auth
[root@centos64 ~]# date
Mon Feb 10 16:05:49 EST 2014
[root@centos64 ~]# service ntpd status
ntpd (pid  8870) is running...
[root@centos64 ~]#