Red Hat Bugzilla – Bug 1271618
net ads keytab add fails on system joined to AD with RHEL 7.2 realm join
Last modified: 2018-06-01 06:35:08 EDT
Description of problem: When RHEL system is joined to AD using realm join on RHEL 7.1 (realmd-0.14.6-6.el7, samba-common-4.1.12-21.el7_1), running net ads keytab add HTTP passes, with RHEL 7.1 code or with RHEL 7.2 code. When however the system is joined to AD using realm join on RHEL 7.1 (realmd-0.16.1-3.el7, with or without samba-common-tools-4.2.3-7.el7 installed (to get /usr/bin/net)), that same net ads keytab add command fails. Version-Release number of selected component (if applicable): adcli-0.7.5-4.el7.x86_64 realmd-0.16.1-3.el7.x86_64 samba-common-tools-4.2.3-7.el7.x86_64 How reproducible: Deterministic. Steps to Reproduce: 1. yum install -y sssd adcli realmd /usr/bin/net 2. If your RHEL machine by default does not have DNS pointed to the Active Directory server, do something like cp /etc/resolv.conf /etc/resolv.conf.backup echo nameserver 11.12.13.14 > /etc/resolv.conf 3. In the commands below, we assume the AD realm is ADDOMAIN.TEST and the workgroup is ADDOMAIN: cat > /etc/net-keytab.conf <<EOF [global] workgroup = ADDOMAIN realm = ADDOMAIN.TEST kerberos method = system keytab security = ads EOF 4. realm join -v addomain.test 5. KRB5_KTNAME=FILE:/etc/gssproxy/http.keytab net ads keytab add HTTP -U administrator -d3 -s /etc/net-keytab.conf Actual results: Successfully contacted LDAP server 10.11.12.13 Connected to LDAP server SERVER.ADDOMAIN.TEST ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.30 ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2 ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2 ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2.3 ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10 ads_sasl_spnego_bind: got server principal name = not_defined_in_RFC4178@please_ignore ../source3/libads/kerberos_keytab.c:312: failed to fetch machine password return code = -1 Expected results: Successfully contacted LDAP server 10.12.13.14 Connected to LDAP server SERVER.ADDOMAIN.TEST ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.30 ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2 ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2 ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2.3 ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10 ads_sasl_spnego_bind: got server principal name = not_defined_in_RFC4178@please_ignore ../source3/libads/kerberos_keytab.c:389: Attempting to add/update 'HTTP/client.example.com@ADDOMAIN.TEST' ads_add_service_principal_name: Host account for CLIENT found ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com@ADDOMAIN.TEST) with encryption type (1) and version (2) ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com@ADDOMAIN.TEST) with encryption type (3) and version (2) ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com@ADDOMAIN.TEST) with encryption type (17) and version (2) ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com@ADDOMAIN.TEST) with encryption type (18) and version (2) ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client.example.com@ADDOMAIN.TEST) with encryption type (23) and version (2) ../source3/libads/kerberos_keytab.c:65: Will try to delete old keytab entries ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client@ADDOMAIN.TEST) with encryption type (1) and version (2) ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client@ADDOMAIN.TEST) with encryption type (3) and version (2) ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client@ADDOMAIN.TEST) with encryption type (17) and version (2) ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client@ADDOMAIN.TEST) with encryption type (18) and version (2) ../source3/libads/kerberos_keytab.c:237: adding keytab entry for (HTTP/client@ADDOMAIN.TEST) with encryption type (23) and version (2) return code = 0 Additional info:
On RHEL 7.1, realm join -v calls /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.SZG75X -U Administrator ads join ADDOMAIN.TEST On RHEL 7.2, invocation of /usr/bin/net is not shown. Perhaps the machine is now joined differently which leaves it in state in which the service keytab cannot be retrieved.
The scenario above is documented for Satellite 6 at https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.1/html/User_Guide/sect-Red_Hat_Satellite-User_Guide-Configuring_External_Authentication-Using_Active_Directory_Directly.html so this bugzilla is a blocker for the layered product.
In realmd 0.16.x adcli became the default membership software for performing AD joins. This change is 70878dec6e23226ab25f731654ab53cc0e7b11c3 upstream. So we have two choices: * Revert the upstream patch for RHEL 7.2 * Tell people to use --membership-software=samba if they want to use samba commands on the joined system. Please let me know which is preferred.
I will let Jan to chime in here, but IMO, forcing people to suddenly start using extra option to make realmd working would not be a great experience (as proven by this bug). So reverting the patch (or changing the defaults to match 7.1 behavior) seems as a better choice here.
(In reply to Martin Kosek from comment #4) > I will let Jan to chime in here, but IMO, forcing people to suddenly start > using extra option to make realmd working would not be a great experience > (as proven by this bug). So reverting the patch (or changing the defaults to > match 7.1 behavior) seems as a better choice here. Yes, I think so too.
(In reply to Stef Walter from comment #3) > In realmd 0.16.x adcli became the default membership software for performing > AD joins. This change is 70878dec6e23226ab25f731654ab53cc0e7b11c3 upstream. > > So we have two choices: > > * Revert the upstream patch for RHEL 7.2 > * Tell people to use --membership-software=samba if they want to use samba > commands on the joined system. I confirm that using realm join --membership-software=samba -v addomain.test makes subsequent net ads keytab add HTTP call pass. It should be fairly easy to amend the Satellite documentation. If the user already has the Satellite machine joined to AD with adcli for whatever reason, is there a way to retain that and add necessary Samba setup for net ads keytab to work? Is there a way to retrieve the keytab for the HTTP/ service with adcli stack?
Thanks Libor. The resulting build is here: https://brewweb.devel.redhat.com/taskinfo?taskID=9970259
After discussion we decided to implement both: * Revert the upstream patch for RHEL 7.2 * Tell people to use --membership-software=samba if they want to use samba commands on the joined system.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-2184.html
I'm seeing this issue again with realmd 0.16.1.9 , check some logs on https://gist.github.com/2952399a62a233dc9a0edd711ed0486a
(In reply to Daniel Lobato Garcia from comment #30) > I'm seeing this issue again with realmd 0.16.1.9 , check some logs on > https://gist.github.com/2952399a62a233dc9a0edd711ed0486a I suggest you open new bugzilla as there likely won't be any reopening under this one.