Description of problem: The change from bug 1211589 / ticket https://fedorahosted.org/freeipa/ticket/4768 introduced new option skip_version_check which is documented in man default.conf(5) as skip_version_check <boolean> Skip client vs. server API version checking. Can lead to errors/strange behavior when newer clients talk to older servers. Use with caution. It works when used with RHEL 7.2 IPA client enrolled against (say) RHEL 7.1 server but does not work against RHEL 6 server. Version-Release number of selected component (if applicable): ipa-admintools-4.2.0-15.el7.x86_64 On server, ipa-server-3.0.0-47.el6.x86_64 is installed. How reproducible: Deterministic. Steps to Reproduce: 1. ipa user-find 2. ipa -e skip_version_check=1 user-find Actual results: # ipa user-find ipa: ERROR: 2.156 client incompatible with 2.49 server at u'https://ipa.example.com/ipa/xml' # ipa -e skip_version_check=1 user-find ipa: ERROR: 2.51 client incompatible with 2.49 server at u'https://ipa.example.com/ipa/xml' Expected results: # ipa user-find ipa: ERROR: 2.156 client incompatible with 2.49 server at u'https://ipa.example.com/ipa/xml' # ipa -e skip_version_check=1 user-find users listed, no error Additional info:
With ipa-server-3.0.0-25.el6.x86_64 from RHEL 6.4 which reports API version 2.46, and when forcing the client version to that value, # ipa user-find still fails with ipa: ERROR: Unknown option: no_members with no incompatibility error. With ipa-server-3.0.0-42.el6.x86_64 and ipa-server-3.0.0-47.el6.x86_64, the incompatibility error happens.
Upstream ticket: https://fedorahosted.org/freeipa/ticket/5601
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/6b2b173a4d6b1cd8789e87d0392dd86c980f858a ipa-4-3: https://fedorahosted.org/freeipa/changeset/51d5150b9b5ffe6ff5f77230a389a9091f28ce48 ipa-4-2: https://fedorahosted.org/freeipa/changeset/7a4a3b099e82fc566d3f353d42009a5f0ef6be18
Blocking integration of other product, setting high sev/prio.
Client incompatible error is not displayed. Verified using RHEL7.3 client and RHEL6.8 Server ipa-server-3.0.0-50.el6.1.x86_64 ipa-client-4.4.0-4.el7.x86_64 [root@client ~]# ipa user-find -------------- 1 user matched -------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 639000000 GID: 639000000 Account disabled: False Password: True Kerberos keys available: True ---------------------------- Number of entries returned 1 ---------------------------- [root@client ~]# ipa -e skip_version_check=1 user-find -------------- 1 user matched -------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 639000000 GID: 639000000 Account disabled: False Password: True Kerberos keys available: True ---------------------------- Number of entries returned 1 ----------------------------
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2404.html