RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1243771 - realm fails to join domain names with underscore in name
Summary: realm fails to join domain names with underscore in name
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: realmd
Version: 7.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Stef Walter
QA Contact: Kaushik Banerjee
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-07-16 09:32 UTC by Kaushik Banerjee
Modified: 2015-11-19 03:44 UTC (History)
7 users (show)

Fixed In Version: realmd-0.16.1-3.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-19 03:44:10 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2184 0 normal SHIPPED_LIVE Moderate: realmd security, bug fix, and enhancement update 2015-11-19 07:51:28 UTC

Description Kaushik Banerjee 2015-07-16 09:32:49 UTC 
Description of problem:
realm fails to connect to non-root ad domains

Version-Release number of selected component (if applicable):
realmd-0.16.0-1.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. realm join fails to join/discover non-root domains.
    # realm discover -v sssdad_tree.com
    * Resolving: _ldap._tcp.sssdad_tree.com
    * Performing LDAP DSE lookup on: 10.65.206.94
    ! Received invalid or unsupported Netlogon data from server sssdad_tree.com
     type: kerberos
     realm-name: SSSDAD_TREE.COM
     domain-name: sssdad_tree.com
     configured: no

2. I verified that ldapsearch from the same client is able to query netlogon data:
# ldapsearch -LLL -h 10.65.206.94 -x -b '' -s base
"(&(NtVer=\06\00\00\00)(AAC=\00\00\00\00))" NetLogon
dn:
netlogon::
FwAAAP1xAACJRakZcUWGTpPs9+FhGVnUBnNzc2RhZANjb20AC3Nzc2RhZF90cmVlwB8
 FZWFnbGXAJAtTU1NEQURfVFJFRQAFRUFHTEUAABdEZWZhdWx0LUZpcnN0LVNpdGUtTmFtZQDATwUA
 AAD/////


Actual results:
realm fails to join

Expected results:
realm join should work

Additional info:
Comment 7 Stef Walter 2015-07-31 10:57:12 UTC 
The issue here is the underscore which is erroneously flaged as a bad character.
Comment 8 Stef Walter 2015-07-31 11:06:33 UTC 
Fixed upstream:

commit e368c5a42656a687e6b726978752eb4abf6503d0
Author: Stef Walter <stefw>
Date:   Fri Jul 31 12:53:04 2015 +0200

    Be more liberal on what we accept as a domain name
    
    Make the checks on what we accept as a domain name more liberal
    for values coming in from the network.
    
    DNS Domain names are pretty liberal (internet domain names
    are more restrictive) See RFC 2181 section 11
    
    http://www.ietf.org/rfc/rfc2181.txt
    
    However we cannot consume names with whitespace and problematic
    punctuation, due to the various programs that parse the
    configuration files we set up.
Comment 10 Kaushik Banerjee 2015-08-04 11:04:06 UTC 
Verified with realmd-0.16.1-3.el7.x86_64

# realm discover -v sssdad_tree.com
 * Resolving: _ldap._tcp.sssdad_tree.com
 * Performing LDAP DSE lookup on: X.X.X.X
 * Successfully discovered: sssdad_tree.com
sssdad_tree.com
  type: kerberos
  realm-name: SSSDAD_TREE.COM
  domain-name: sssdad_tree.com
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
Comment 11 errata-xmlrpc 2015-11-19 03:44:10 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2184.html
Note You need to log in before you can comment on or make changes to this bug.