Bug 1441593
| Summary: | error adding authenticator indicators to host | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | German Parente <gparente> | ||||
| Component: | ipa | Assignee: | Pavel Picka <ppicka> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Pavel Picka <ppicka> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.4 | CC: | fbarreto, ksiddiqu, mbasti, mike, pvoborni, rcritten, tscherf | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | ipa-4.5.0-12.el7 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2017-08-01 09:48:56 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
German Parente
2017-04-12 09:49:26 UTC
A theory: I'm not sure if objectclasses attr is normalized to lower case chars. If not then following can be the culprit:
ipaserver/plugins/host.py:
if 'krbprincipalauthind' in entry_attrs:
if 'objectclass' not in entry_attrs:
entry_attrs_old = ldap.get_entry(dn, ['objectclass'])
entry_attrs['objectclass'] = entry_attrs_old['objectclass']
if 'krbprincipalaux' not in entry_attrs['objectclass']:
entry_attrs['objectclass'].append('krbprincipalaux')
I.e. the entry has:
objectClass: ipaobject
objectClass: nshost
objectClass: ipahost
objectClass: pkiuser
objectClass: ipaservice
objectClass: ieee802device
objectClass: ipasshhost
objectClass: top
objectClass: ipaSshGroupOfPubKeys
objectClass: krbPrincipalAux
objectClass: krbticketpolicyaux
So, krbPrincipalAux is not krbprincipalaux and therefore it tries to add krbprincipalaux which results in error 20.
I have confirmed your assumption:
1)
ipa host-add testnewhost.gparente.local --raw --all --force
2)
ldapmodify -D "cn=directory manager" -w secret12 << EOF
dn: fqdn=testnewhost.gparente.local,cn=computers,cn=accounts,dc=gparente,dc=local
changetype: modify
replace: objectclass
objectClass: ipaobject
objectClass: ieee802device
objectClass: nshost
objectClass: ipaservice
objectClass: pkiuser
objectClass: ipahost
objectClass: krbprincipal
objectClass: KrbPrincipalAux
objectClass: ipasshhost
objectClass: top
objectClass: ipaSshGroupOfPubKeys
EOF
ipa host-mod --auth-ind=otp testnewhost.gparente.local
Fails.
This diff is fixing the bug:
diff /usr/lib/python2.7/site-packages/ipaserver/plugins/host.py.ori /usr/lib/python2.7/site-packages/ipaserver/plugins/host.py
962c962
< if 'krbprincipalaux' not in entry_attrs['objectclass']:
---
> if 'krbprincipalaux' not in set(obj.lower() for obj in entry_attrs['objectclass']):
Confirming this as a bug as well and the fix you noted worked for me. Upstream ticket: https://pagure.io/freeipa/issue/6911 Fixed upstream master: https://pagure.io/freeipa/c/d51af28bdbef8386b6d3bde683be2fc5f73b904e ipa-4-5: https://pagure.io/freeipa/c/81ae5f4d655bb052c6c0961760dba34e70dcd3c3 Created attachment 1285365 [details]
output
Verified ipa-server-4.5.0-14.el7.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2304 |