Description of problem: RHEL7 IPA client doesn't work with RHEL6 IDM server Version-Release number of selected component (if applicable): RHEL7 client: ipa-client-3.3.3-5.el7.x86_64 RHEL6 server: ipa-server-3.0.0-37.el6.x86_64 How reproducible: Steps to Reproduce: 1. set up ipa-server on RHEL6 2. set up ipa-client on RHEL7 3. subscribe RHEL7 IDM client to RHEL6 IDM server Actual results: [root@www2 ~]# ipa user-find example ipa: ERROR: 2.65 client incompatible with 2.49 server at u'https://idm1.example.com/ipa/xml' Expected results: [root@www2 etc]# ipa user-find example --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- Additional info: changing API_VERSION=u'2.49' in /usr/lib/python2.7/site-packages/ipapython/version.py fixes/hides the problem.
Hello Jeremy, this is expected behavior. *ipa management tool* only maintains forward compatibility. Other client functionality (read SSSD) is of course backward compatible. You will get identity, authentication, authorization or policy services on your RHEL-7 IPA client connected to RHEL-6 IPA server. As this is a common question, I created a wiki article about it on upstream wiki: http://www.freeipa.org/page/Client#Compatibility
hi martin, that's good information. as i would imagine most noobs to rhel7 will be running the new ipa client on rhel6 servers, do you think it's worth adding a "--dont-protect-me-from-myself" flag to ipa ? if all we want to do is use the tool to verify ipa is configured properly on the client, an "ipa --dont-protect-me-from-myself user-find username" is probably an acceptable query.
"ipa" is really just a management command to objects in FreeIPA. It is not something that regular FreeIPA users need to use or have on their client machines. If you want to check that FreeIPA client services (identity, authentication, authorization or central policies like sudo), it is better to try them directly instead of calling FreeIPA management command: $ id $SOME_IPA_USER $ kinit $SOME_IPA_USER $ klist ... something like that. I think you are more or less looking for a client troubleshooting tool (RFE filed in https://fedorahosted.org/freeipa/ticket/4008).
I would say that this specific issue would be CLOSED WONTFIX. Any objections?
I saw not further update from Jeremy so I assume there are no objections. This is not something that FreeIPA should fix. Closing as WONTFIX.