Red Hat Bugzilla – Bug 1250190
idrange is not added for sub domain
Last modified: 2015-11-19 07:05:03 EST
Description of problem: When trust is added ipa idrange for AD subdomain is not added Version-Release number of selected component (if applicable): [root@vm-idm-014 ~]# rpm -q ipa-server sssd ipa-server-4.2.0-3.el7.x86_64 sssd-1.13.0-11.el7.x86_64 How reproducible: Steps to Reproduce: 1. Add trust from IPA server with root AD having a child domain Actual results: [root@vm-idm-014 ~]# echo Secret123| ipa trust-add adtest.qe --admin Administrator --password -------------------------------------------------- Added Active Directory trust for realm "adtest.qe" -------------------------------------------------- Realm name: adtest.qe Domain NetBIOS name: ADTEST Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879 SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18 SID blacklist outgoing: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18 Trust direction: Trusting forest Trust type: Active Directory domain Trust status: Established and verified (reverse-i-search)`s': echo Secret123| ipa trust-add adtest.qe --admin Administrator --pas^Cord * idrange for pune.adtest.qe is not addded [root@vm-idm-014 ~]# ipa idrange-find ---------------- 2 ranges matched ---------------- Range name: ADTEST.QE_id_range First Posix ID of the range: 1148400000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 0 Domain SID of the trusted domain: S-1-5-21-1910160501-511572375-3625658879 Range type: Active Directory domain range Range name: STVIDRANGE.TEST_id_range First Posix ID of the range: 201000000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range ---------------------------- Number of entries returned 2 ---------------------------- [root@vm-idm-014 ~]# ipa trustdomain-find adtest.qe Domain name: adtest.qe Domain NetBIOS name: ADTEST Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879 Domain enabled: True Domain name: pune.adtest.qe Domain NetBIOS name: PUNE Domain Security Identifier: S-1-5-21-91314187-2404433721-1858927112 Domain enabled: True ---------------------------- Number of entries returned 2 ---------------------------- Expected results: idrange for child domain is added with trust add Additional info:
Alexander, do you know what might be causing this?
Check audit.log for AVCs, if any. With IPA 4.2 we run over D-Bus a request to oddjobd-activated script that discovers the domains and it requires proper configuration of the SELinux policy. Also add debugging to smb.conf.empty when establishing trust, to see communication happening.
Thanks to Tomas, here is the real reason why it wasn't called. Adding the upstream ticket.
Upstream ticket: https://fedorahosted.org/freeipa/ticket/5182
should be fixed in bug 1250192
Not fixed, we found proper fix and reproducer yesterday with Scott. Moving to ASSIGNED.
The issue is in ipa-getkeytab adding key with the same principal and kvno to the TDO keytab instead of overwriting it. As result, /var/lib/sss/keytabs/<trust-forest-root>.keytab contains multiple entries with the same <kvno> <principal> pair and when kinit is performed against the keytab, libkrb5 selects first matching entry, it fails (because it belonged to older trust config which is not valid anymore) and breaks the oddjobd helper.
Patch is sent upstream: https://www.redhat.com/archives/freeipa-devel/2015-August/msg00255.html
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/3692a1c57f5d404a61a01623ef732234ccbbdffd ipa-4-2: https://fedorahosted.org/freeipa/changeset/c30baa9bb9dfa5a5de7685e9203f3eae95dec22a
*** Bug 1250192 has been marked as a duplicate of this bug. ***
I'm still seeing errors here even with two-way=True: :: [ BEGIN ] :: Running 'echo Secret123 | ipa trust-add adtest.qe --admin Administrator --password --two-way=True' -------------------------------------------------- Added Active Directory trust for realm "adtest.qe" -------------------------------------------------- Realm name: adtest.qe Domain NetBIOS name: ADTEST Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879 SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18 SID blacklist outgoing: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18 Trust direction: Two-way trust Trust type: Active Directory domain Trust status: Established and verified :: [ PASS ] :: Command 'echo Secret123 | ipa trust-add adtest.qe --admin Administrator --password --two-way=True' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ipa idrange-show ADTEST.QE_id_range | tee /tmp/tmp.csLTq93zKc/tmpout.idrange_cli_0013.out 2>&1' Range name: ADTEST.QE_id_range First Posix ID of the range: 1148400000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 0 Domain SID of the trusted domain: S-1-5-21-1910160501-511572375-3625658879 Range type: Active Directory domain range :: [ PASS ] :: Command 'ipa idrange-show ADTEST.QE_id_range | tee /tmp/tmp.csLTq93zKc/tmpout.idrange_cli_0013.out 2>&1' (Expected 0, got 0) :: [ PASS ] :: File '/tmp/tmp.csLTq93zKc/tmpout.idrange_cli_0013.out' should contain 'Range type: Active Directory domain range' :: [ BEGIN ] :: Running 'ipa idrange-show PUNE.ADTEST.QE_id_range | tee /tmp/tmp.csLTq93zKc/tmpout.idrange_cli_0013.out 2>&1' ipa: ERROR: PUNE.ADTEST.QE_id_range: range not found :: [ PASS ] :: Command 'ipa idrange-show PUNE.ADTEST.QE_id_range | tee /tmp/tmp.csLTq93zKc/tmpout.idrange_cli_0013.out 2>&1' (Expected 0, got 0)
Created attachment 1064980 [details] samba logs
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/1255dbf2fde068787d711c1fb60946a254d1782c ipa-4-2: https://fedorahosted.org/freeipa/changeset/e13a5ed26e96436d4a7ebb2329f7f9666581008d
Verified. Version :: ipa-server-4.2.0-7.el7.x86_64 Results :: :: [ BEGIN ] :: Running 'echo Secret123 | ipa trust-add adtest.qe --admin Administrator --password --two-way=True' -------------------------------------------------- Added Active Directory trust for realm "adtest.qe" -------------------------------------------------- Realm name: adtest.qe Domain NetBIOS name: ADTEST Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879 SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18 SID blacklist outgoing: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18 Trust direction: Two-way trust Trust type: Active Directory domain Trust status: Established and verified :: [ PASS ] :: Command 'echo Secret123 | ipa trust-add adtest.qe --admin Administrator --password --two-way=True' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ipa idrange-show ADTEST.QE_id_range | tee /tmp/tmp.0syEuYP6oh/tmpout.idrange_cli_0013.out 2>&1' Range name: ADTEST.QE_id_range First Posix ID of the range: 1148400000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 0 Domain SID of the trusted domain: S-1-5-21-1910160501-511572375-3625658879 Range type: Active Directory domain range :: [ PASS ] :: Command 'ipa idrange-show ADTEST.QE_id_range | tee /tmp/tmp.0syEuYP6oh/tmpout.idrange_cli_0013.out 2>&1' (Expected 0, got 0) :: [ PASS ] :: File '/tmp/tmp.0syEuYP6oh/tmpout.idrange_cli_0013.out' should contain 'Range type: Active Directory domain range' :: [ BEGIN ] :: Running 'ipa idrange-show PUNE.ADTEST.QE_id_range | tee /tmp/tmp.0syEuYP6oh/tmpout.idrange_cli_0013.out 2>&1' Range name: PUNE.ADTEST.QE_id_range First Posix ID of the range: 839000000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 0 Domain SID of the trusted domain: S-1-5-21-91314187-2404433721-1858927112 Range type: Active Directory domain range :: [ PASS ] :: Command 'ipa idrange-show PUNE.ADTEST.QE_id_range | tee /tmp/tmp.0syEuYP6oh/tmpout.idrange_cli_0013.out 2>&1' (Expected 0, got 0) :: [ PASS ] :: File '/tmp/tmp.0syEuYP6oh/tmpout.idrange_cli_0013.out' should contain 'Range type: Active Directory domain range' :: [ BEGIN ] :: Running 'systemctl stop sssd; rm -f /var/lib/sss/{db,mc}/*; systemctl start sssd' :: [ PASS ] :: Command 'systemctl stop sssd; rm -f /var/lib/sss/{db,mc}/*; systemctl start sssd' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sleep 5' :: [ PASS ] :: Command 'sleep 5' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sleep 20' :: [ PASS ] :: Command 'sleep 20' (Expected 0, got 0) :: [ BEGIN ] :: Running 'getent passwd aduser07@adtest.qe' aduser07@adtest.qe:*:1148405487:1148405487:ads07 user:/home/adtest.qe/aduser07: :: [ PASS ] :: Command 'getent passwd aduser07@adtest.qe' (Expected 0, got 0) :: [ BEGIN ] :: Running 'getent passwd subuser07@pune.adtest.qe' subuser07@pune.adtest.qe:*:839001111:839001111:subuser07 user:/home/pune.adtest.qe/subuser07: :: [ PASS ] :: Command 'getent passwd subuser07@pune.adtest.qe' (Expected 0, got 0) Previously, the idrange-show and getent commands for PUNE.ADTEST.QE failed due to this bug.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2362.html