Bug 1502663 - pkinit-status command fails after an upgrade from a pre-4.5 IPA
Summary: pkinit-status command fails after an upgrade from a pre-4.5 IPA
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL:
Whiteboard:
: 1518147 1544673 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-16 11:54 UTC by Petr Vobornik
Modified: 2018-04-10 16:49 UTC (History)
10 users (show)

Fixed In Version: ipa-4.5.4-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-10 16:48:21 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0918 None None None 2018-04-10 16:49:12 UTC

Description Petr Vobornik 2017-10-16 11:54:00 UTC
Cloned from upstream: https://pagure.io/freeipa/issue/7144

If we issue pkinit-status after an upgrade from a pre-4.5 version, the command would fail.

Comment 2 Petr Vobornik 2017-10-16 11:54:17 UTC
Upstream ticket:
https://pagure.io/freeipa/issue/7144

Comment 3 Petr Vobornik 2017-10-16 11:55:00 UTC
ipa-4-5:
    fee3adb pkinit: don't fail when no pkinit servers found

Comment 5 Nikhil Dehadrai 2018-01-10 12:54:22 UTC
ipa-server-version:ipa-server-4.5.4-7.el7.x86_64

Tested the bug on the basis of following observations:
1. Tested that when 'ipa pkinit-status' command is run on IPA configured with plain installation, the command is successful.
2. When the same command is run on an upgrade IPA-server:

A) From RHEL 73z (ipa-server-4.4.0-14.el7_3.7.x86_64) to RHEL 7.5
- ipa pkinit-status command FAILS initially but works upon clearing cache

[root@auto-hv-01-guest07 ~]# rpm -q ipa-server
ipa-server-4.4.0-14.el7_3.7.x86_64
[root@auto-hv-01-guest07 ~]# kinit admin
Password for admin@TESTRELM.TEST: 
[root@auto-hv-01-guest07 ~]# ipa pkinit-status
ipa: ERROR: unknown command 'pkinit-status'
[root@auto-hv-01-guest07 ~]# yum -y update 'ipa-server*' sssd nss

Upon clearing cache at ' ~/.cache/ipa/schema' and then re-running the same command returns
[root@auto-hv-01-guest07 ~]# ipa pkinit-status
-----------------
0 servers matched
-----------------
----------------------------
Number of entries returned 0
----------------------------
[root@auto-hv-01-guest07 ~]# 



B) From RHEL 74z (ipa-server-4.5.0-22.el7_4.x86_64) to RHEL 7.5
- ipa pkinit-status command SUCCESSFUL


[root@nightcrawler ~]# rpm -q ipa-server
ipa-server-4.5.0-22.el7_4.x86_64
[root@nightcrawler ~]# ipa pkinit-status
ipa: ERROR: did not receive Kerberos credentials
[root@nightcrawler ~]# kinit admin
Password for admin@TESTRELM.TEST: 
[root@nightcrawler ~]# ipa pkinit-status
----------------
1 server matched
----------------
  Server name: nightcrawler.testrelm.test
  PKINIT status: enabled
----------------------------
Number of entries returned 1
----------------------------
[root@nightcrawler ~]# tail -1 /var/log/ipaupgrade.log 
2018-01-10T12:36:11Z INFO The ipa-server-upgrade command was successful
[root@nightcrawler ~]# rpm -q ipa-server
ipa-server-4.5.4-7.el7.x86_64
[root@nightcrawler ~]# kinit admin
Password for admin@TESTRELM.TEST: 
[root@nightcrawler ~]# ipa pkinit-status
----------------
1 server matched
----------------
  Server name: nightcrawler.testrelm.test
  PKINIT status: enabled
----------------------------
Number of entries returned 1
----------------------------

Is this expected behavior or anything I am missing?

Comment 6 fbarreto 2018-01-10 18:27:23 UTC
standa, could you help us here (since you're the author of the patch)?

Comment 7 Standa Laznicka 2018-01-11 08:34:36 UTC
I did not find any secret information in comment 5 so I made it public should anyone looking into this BZ be interested about what's happening.

We can see that the pkinit-status is actually working and your question is more related to how IPA works with PKINIT rather than about the patch, but that's alright.

A proper support of PKINIT was added in freeIPA 4.5 and ever since then, freeIPA is installed with PKINIT enabled by default. In earlier versions of freeIPA, we did not have direct support of PKINIT in installers and thus we consider PKINIT disabled there and we don't enable it on upgrade. Hence the results.

So the short answer is - yes, this is expected.

Comment 8 Nikhil Dehadrai 2018-01-11 10:45:14 UTC
ipa-server-version:ipa-server-4.5.4-7.el7.x86_64

Tested the bug on the basis of following observations:
1. Tested that when 'ipa pkinit-status' command is run on IPA configured with plain installation, the command is successful.
2. When the same command is run on an upgrade IPA-server:

A) From RHEL 73z (ipa-server-4.4.0-14.el7_3.7.x86_64) to RHEL 7.5

[root@auto-hv-01-guest07 ~]# rpm -q ipa-server
ipa-server-4.4.0-14.el7_3.7.x86_64
[root@auto-hv-01-guest07 ~]# kinit admin
Password for admin@TESTRELM.TEST: 
[root@auto-hv-01-guest07 ~]# ipa pkinit-status
ipa: ERROR: unknown command 'pkinit-status'
[root@auto-hv-01-guest07 ~]# yum -y update 'ipa-server*' sssd nss

Upon clearing cache at ' ~/.cache/ipa/schema' and then re-running the same command returns
[root@auto-hv-01-guest07 ~]# ipa pkinit-status
-----------------
0 servers matched
-----------------
----------------------------
Number of entries returned 0
----------------------------
[root@auto-hv-01-guest07 ~]# 



B) From RHEL 74z (ipa-server-4.5.0-22.el7_4.x86_64) to RHEL 7.5

[root@nightcrawler ~]# rpm -q ipa-server
ipa-server-4.5.0-22.el7_4.x86_64
[root@nightcrawler ~]# ipa pkinit-status
ipa: ERROR: did not receive Kerberos credentials
[root@nightcrawler ~]# kinit admin
Password for admin@TESTRELM.TEST: 
[root@nightcrawler ~]# ipa pkinit-status
----------------
1 server matched
----------------
  Server name: nightcrawler.testrelm.test
  PKINIT status: enabled
----------------------------
Number of entries returned 1
----------------------------
[root@nightcrawler ~]# tail -1 /var/log/ipaupgrade.log 
2018-01-10T12:36:11Z INFO The ipa-server-upgrade command was successful
[root@nightcrawler ~]# rpm -q ipa-server
ipa-server-4.5.4-7.el7.x86_64
[root@nightcrawler ~]# kinit admin
Password for admin@TESTRELM.TEST: 
[root@nightcrawler ~]# ipa pkinit-status
----------------
1 server matched
----------------
  Server name: nightcrawler.testrelm.test
  PKINIT status: enabled
----------------------------
Number of entries returned 1
----------------------------

Thus on the basis of above observations and comment#7, marking status of bug to 'Verified'

Comment 9 Rob Crittenden 2018-02-13 18:19:03 UTC
*** Bug 1544673 has been marked as a duplicate of this bug. ***

Comment 10 Florence Blanc-Renaud 2018-02-15 13:54:22 UTC
*** Bug 1518147 has been marked as a duplicate of this bug. ***

Comment 13 errata-xmlrpc 2018-04-10 16:48:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0918


Note You need to log in before you can comment on or make changes to this bug.