Bug 1438366
| Summary: | ipa trust-fetch-domains: ValidationError: invalid 'Credentials': Missing credentials for cross-forest communication | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Sudhir Menon <sumenon> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Sudhir Menon <sumenon> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | abokovoy, ksiddiqu, pvoborni, rcritten, sumenon, tscherf |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.5.0-6.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-01 09:47:49 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Sudhir Menon
2017-04-03 08:45:11 UTC
Do I get it right that the issue is that you got: ipa: ERROR: invalid 'Credentials': Missing credentials for cross-forest communication But expected: ValidationError: invalid 'Credentials': Missing credentials for cross-forest communication should be fixed. And I'll assume that "should be fixed" was not part of the message. Is it correct? Petr, Sorry for the confusion here. Actual Result:- When "ipa trust-fetch-domains domainname" command is run below message is displayed on the console and httpd error log file. ===Console Output=== i.e "ipa: ERROR: invalid 'Credentials': Missing credentials for cross-forest communication" ===/var/log/httpd/error_log=== ValidationError: invalid 'Credentials': Missing credentials for cross-forest communication Expected Result:- When the command is run, rather than the error message it should display proper output like below depending on whether there is new domain to be fetched or not. [root@master ~]# ipa trust-fetch-domains ipaad2008r2.test ------------------------------- New trust domains were found ------------------------------- ---------------------------- Number of entries returned 1 ---------------------------- [root@master ~]# ipa trust-fetch-domains ipaad2008r2.test ------------------------------- No new trust domains were found ------------------------------- ---------------------------- Number of entries returned 0 ---------------------------- Yes, we should stop special casing two-way trust and simply redirect all activities that require HTTP/.. principal's TGT to oddjobd helper. Upstream ticket: https://pagure.io/freeipa/issue/6866 Should be fixed together with bug 1438348 use the commits bellow: Fixed upstream master: https://pagure.io/freeipa/c/aef77b3529540ad12939a2cc54996c341c5d49d3 https://pagure.io/freeipa/c/e560899cce20ca7773a5ce46a1c29db1349e8ec7 ipa-4-5: https://pagure.io/freeipa/c/bbb23fc87a51218960d54f9eccc23405c5c5ded6 https://pagure.io/freeipa/c/45e1998c51e281c8371ae31762016cb1ddec406f Verified on RHEL7.4 using ipa-server-4.5.0-11.el7.x86_64 389-ds-base-1.3.6.1-13.el7.x86_64 pki-ca-10.4.1-4.el7.noarch krb5-server-1.15.1-8.el7.x86_64 sssd-1.15.2-29.el7.x86_64 [root@master ~]# ipa trust-add --two-way=true Realm name: pne.qe Active Directory domain administrator: administrator Active Directory domain administrator's password: ----------------------------------------------- Added Active Directory trust for realm "pne.qe" ----------------------------------------------- Realm name: pne.qe Domain NetBIOS name: PNE Domain Security Identifier: S-1-5-21-2202318585-426110948-4011710778 Trust direction: Two-way trust Trust type: Active Directory domain Trust status: Established and verified [root@master ~]# ipa trustdomain-find pne.qe Domain name: chd.pne.qe Domain NetBIOS name: CHD Domain Security Identifier: S-1-5-21-1608447083-2050507822-1235286152 Domain enabled: True Domain name: pne.qe Domain NetBIOS name: PNE Domain Security Identifier: S-1-5-21-2202318585-426110948-4011710778 Domain enabled: True ---------------------------- Number of entries returned 2 ---------------------------- [root@master ~]# ipa trustdomain-disable pne.qe chd.pne.qe ---------------------------------- Disabled trust domain "chd.pne.qe" ---------------------------------- [root@master ~]# ipa trust-fetch-domains pne.qe ---------------------------------------------------------------------------------------- List of trust domains successfully refreshed. Use trustdomain-find command to list them. ---------------------------------------------------------------------------------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@master ~]# ipa trustdomain-find pne.qe Domain name: chd.pne.qe Domain NetBIOS name: CHD Domain Security Identifier: S-1-5-21-1608447083-2050507822-1235286152 Domain enabled: False Domain name: pne.qe Domain NetBIOS name: PNE Domain Security Identifier: S-1-5-21-2202318585-426110948-4011710778 Domain enabled: True ---------------------------- Number of entries returned 2 ---------------------------- Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2304 |