Bug 1365546 - External trust with root domain is transitive
Summary: External trust with root domain is transitive
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Kaleem
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-09 13:58 UTC by Sudhir Menon
Modified: 2016-11-04 06:00 UTC (History)
5 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2016-11-04 06:00:39 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2404 normal SHIPPED_LIVE ipa bug fix and enhancement update 2016-11-03 13:56:18 UTC

Description Sudhir Menon 2016-08-09 13:58:26 UTC
Description of problem: External trust with root domain is transitive


Version-Release number of selected component (if applicable):
Always

How reproducible:


Steps to Reproduce:
1. ipa trust-add --type=ad ad.domain --admin Administrator --password --range-type ipa-ad-trust --external
2. ipa trustdomain-find ad.domain 

Actual results:
trustdomain-find command returns both ad.domain and child.ad.domain 

Expected results:
trustdomain-find command should return only ad.domain, because external trust is non-transitive 

Additional info:

Comment 3 Petr Vobornik 2016-08-09 16:58:36 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6021

Comment 4 Martin Babinsky 2016-08-22 11:39:30 UTC
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/9b3819ea94d3fd8e866d38ccba2051446d057ecd

Comment 7 Sudhir Menon 2016-09-07 04:49:15 UTC
Fix is seen in RHEL7.3 using 
ipa-server-trust-ad-4.4.0-8.el7.x86_64
ipa-server-4.4.0-8.el7.x86_64
sssd-1.14.0-35.el7.x86_64

ipa trustdomain-find doesnot return child domain when external trust is added to forest root domain.

[root@master custodia]# ipa trust-add --type=ad pne.qe --admin Administrator --password --range-type ipa-ad-trust --external=true
Active Directory domain administrator's password: 
-----------------------------------------------
Added Active Directory trust for realm "pne.qe"
-----------------------------------------------
  Realm name: pne.qe
  Domain NetBIOS name: PNE
  Domain Security Identifier: S-1-5-21-3912719521-1967590360-1136226524
  Trust direction: Trusting forest
  Trust type: Non-transitive external trust to a domain in another Active Directory forest
  Trust status: Established and verified

[root@master custodia]# ipa trustdomain-find pne.qe
  Domain name: pne.qe
  Domain NetBIOS name: PNE
  Domain Security Identifier: S-1-5-21-3912719521-1967590360-1136226524
  Domain enabled: True
----------------------------
Number of entries returned 1
----------------------------

[root@master custodia]# ipa trust-show pne.qe
  Realm name: pne.qe
  Domain NetBIOS name: PNE
  Domain Security Identifier: S-1-5-21-3912719521-1967590360-1136226524
  Trust direction: Trusting forest
  Trust type: Non-transitive external trust to a domain in another Active Directory forest

Comment 9 errata-xmlrpc 2016-11-04 06:00:39 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html


Note You need to log in before you can comment on or make changes to this bug.