Description of problem:
ipa-client-install needs user's interaction and join to IPA domain from authconfig-gtk fails.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
2.choose 'IPAv2' as User Account Databse
3.fill IPA realm,domain and server fields
4. click to join Domain, pass user and password
Join fails (timeout). In cmdline I see following output:
[/usr/sbin/ipa-client-install --noac --domain=IPA --server=sec-ipa1.ipa.baseos.qe --realm=IPA.BASEOS.QE --principal=admin -W]
Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]:
ipa-client-install requests only password and authconfig join pass.
We should allow passing the password by filename, then authconfig-gtk can run with --unattended
That would require changing authconfig as well.
What about using the --noac option as equivalent of --unattended with the modification that password would be still queried.
With my upstream hat on, I don't see why --noac ("do not modify the nsswitch.conf and PAM configuration") should mean "don't prompt the user". We already have an option for that.
With current IPA you can use the --unattended option, and provide the password on stdin. Could authconfig use that?
Yes, we just need to change authconfig to pass the --unattended option along with --noac.
Is the 'Password:' prompt still outputted by ipa_client_install in the --unattended case? Authconfig uses that prompt to detect whether it should send the password to the stdin of ipa_client_install.
Not in ipa-client-3.0.0-42.el6.x86_64:
# echo Secret123 | ipa-client-install -p admin --unattended
Discovery was successful!
DNS Domain: idm.lab.bos.redhat.com
IPA Server: vm-086.idm.lab.bos.redhat.com
Synchronizing time with KDC...
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=IDM.LAB.BOS.REDHAT.COM
Issuer: CN=Certificate Authority,O=IDM.LAB.BOS.REDHAT.COM
Valid From: Fri Jul 18 20:58:36 2014 UTC
Valid Until: Tue Jul 18 20:58:36 2034 UTC
Enrolled in IPA realm IDM.LAB.BOS.REDHAT.COM
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/krb5.conf for IPA realm IDM.LAB.BOS.REDHAT.COM
Forwarding 'env' to server u'https://vm-086.idm.lab.bos.redhat.com/ipa/xml'
Hostname (vm-089.idm.lab.bos.redhat.com) not found in DNS
DNS server record set to: vm-089.idm.lab.bos.redhat.com -> 10.16.78.89
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub
Forwarding 'host_mod' to server u'https://vm-086.idm.lab.bos.redhat.com/ipa/xml'
Configuring idm.lab.bos.redhat.com as NIS domain
Client configuration complete.
OK, that means the changes will have to be more substantial than just passing the --unattended option.
The prompt is not there, but with --unattended the password is the only thing expected on stdin, so it can be sent unconditionally.
This problem was fixed on authconfig side, it can pass the password via stdin as demonstrated in Comment 10.
Upstream already plans to provide more options to reading password (https://fedorahosted.org/freeipa/ticket/4040), we should file a bug to authconfig when this is ready.
For now, closing this Bugzilla as issue was resolved.