RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1502663 - pkinit-status command fails after an upgrade from a pre-4.5 IPA
Summary: pkinit-status command fails after an upgrade from a pre-4.5 IPA
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL:
Whiteboard:
: 1518147 1544673 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-16 11:54 UTC by Petr Vobornik
Modified: 2021-03-11 16:00 UTC (History)
10 users (show)

Fixed In Version: ipa-4.5.4-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-10 16:48:21 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0918 0 None None None 2018-04-10 16:49:12 UTC

Description Petr Vobornik 2017-10-16 11:54:00 UTC 
Cloned from upstream: https://pagure.io/freeipa/issue/7144

If we issue pkinit-status after an upgrade from a pre-4.5 version, the command would fail.
Comment 2 Petr Vobornik 2017-10-16 11:54:17 UTC 
Upstream ticket:
https://pagure.io/freeipa/issue/7144
Comment 3 Petr Vobornik 2017-10-16 11:55:00 UTC 
ipa-4-5:
    fee3adb pkinit: don't fail when no pkinit servers found
Comment 5 Nikhil Dehadrai 2018-01-10 12:54:22 UTC 
ipa-server-version:ipa-server-4.5.4-7.el7.x86_64

Tested the bug on the basis of following observations:
1. Tested that when 'ipa pkinit-status' command is run on IPA configured with plain installation, the command is successful.
2. When the same command is run on an upgrade IPA-server:

A) From RHEL 73z (ipa-server-4.4.0-14.el7_3.7.x86_64) to RHEL 7.5
- ipa pkinit-status command FAILS initially but works upon clearing cache

[root@auto-hv-01-guest07 ~]# rpm -q ipa-server
ipa-server-4.4.0-14.el7_3.7.x86_64
[root@auto-hv-01-guest07 ~]# kinit admin
Password for admin: 
[root@auto-hv-01-guest07 ~]# ipa pkinit-status
ipa: ERROR: unknown command 'pkinit-status'
[root@auto-hv-01-guest07 ~]# yum -y update 'ipa-server*' sssd nss

Upon clearing cache at ' ~/.cache/ipa/schema' and then re-running the same command returns
[root@auto-hv-01-guest07 ~]# ipa pkinit-status
-----------------
0 servers matched
-----------------
----------------------------
Number of entries returned 0
----------------------------
[root@auto-hv-01-guest07 ~]# 



B) From RHEL 74z (ipa-server-4.5.0-22.el7_4.x86_64) to RHEL 7.5
- ipa pkinit-status command SUCCESSFUL


[root@nightcrawler ~]# rpm -q ipa-server
ipa-server-4.5.0-22.el7_4.x86_64
[root@nightcrawler ~]# ipa pkinit-status
ipa: ERROR: did not receive Kerberos credentials
[root@nightcrawler ~]# kinit admin
Password for admin: 
[root@nightcrawler ~]# ipa pkinit-status
----------------
1 server matched
----------------
  Server name: nightcrawler.testrelm.test
  PKINIT status: enabled
----------------------------
Number of entries returned 1
----------------------------
[root@nightcrawler ~]# tail -1 /var/log/ipaupgrade.log 
2018-01-10T12:36:11Z INFO The ipa-server-upgrade command was successful
[root@nightcrawler ~]# rpm -q ipa-server
ipa-server-4.5.4-7.el7.x86_64
[root@nightcrawler ~]# kinit admin
Password for admin: 
[root@nightcrawler ~]# ipa pkinit-status
----------------
1 server matched
----------------
  Server name: nightcrawler.testrelm.test
  PKINIT status: enabled
----------------------------
Number of entries returned 1
----------------------------

Is this expected behavior or anything I am missing?
Comment 6 fbarreto 2018-01-10 18:27:23 UTC 
standa, could you help us here (since you're the author of the patch)?
Comment 7 Standa Laznicka 2018-01-11 08:34:36 UTC 
I did not find any secret information in comment 5 so I made it public should anyone looking into this BZ be interested about what's happening.

We can see that the pkinit-status is actually working and your question is more related to how IPA works with PKINIT rather than about the patch, but that's alright.

A proper support of PKINIT was added in freeIPA 4.5 and ever since then, freeIPA is installed with PKINIT enabled by default. In earlier versions of freeIPA, we did not have direct support of PKINIT in installers and thus we consider PKINIT disabled there and we don't enable it on upgrade. Hence the results.

So the short answer is - yes, this is expected.
Comment 8 Nikhil Dehadrai 2018-01-11 10:45:14 UTC 
ipa-server-version:ipa-server-4.5.4-7.el7.x86_64

Tested the bug on the basis of following observations:
1. Tested that when 'ipa pkinit-status' command is run on IPA configured with plain installation, the command is successful.
2. When the same command is run on an upgrade IPA-server:

A) From RHEL 73z (ipa-server-4.4.0-14.el7_3.7.x86_64) to RHEL 7.5

[root@auto-hv-01-guest07 ~]# rpm -q ipa-server
ipa-server-4.4.0-14.el7_3.7.x86_64
[root@auto-hv-01-guest07 ~]# kinit admin
Password for admin: 
[root@auto-hv-01-guest07 ~]# ipa pkinit-status
ipa: ERROR: unknown command 'pkinit-status'
[root@auto-hv-01-guest07 ~]# yum -y update 'ipa-server*' sssd nss

Upon clearing cache at ' ~/.cache/ipa/schema' and then re-running the same command returns
[root@auto-hv-01-guest07 ~]# ipa pkinit-status
-----------------
0 servers matched
-----------------
----------------------------
Number of entries returned 0
----------------------------
[root@auto-hv-01-guest07 ~]# 



B) From RHEL 74z (ipa-server-4.5.0-22.el7_4.x86_64) to RHEL 7.5

[root@nightcrawler ~]# rpm -q ipa-server
ipa-server-4.5.0-22.el7_4.x86_64
[root@nightcrawler ~]# ipa pkinit-status
ipa: ERROR: did not receive Kerberos credentials
[root@nightcrawler ~]# kinit admin
Password for admin: 
[root@nightcrawler ~]# ipa pkinit-status
----------------
1 server matched
----------------
  Server name: nightcrawler.testrelm.test
  PKINIT status: enabled
----------------------------
Number of entries returned 1
----------------------------
[root@nightcrawler ~]# tail -1 /var/log/ipaupgrade.log 
2018-01-10T12:36:11Z INFO The ipa-server-upgrade command was successful
[root@nightcrawler ~]# rpm -q ipa-server
ipa-server-4.5.4-7.el7.x86_64
[root@nightcrawler ~]# kinit admin
Password for admin: 
[root@nightcrawler ~]# ipa pkinit-status
----------------
1 server matched
----------------
  Server name: nightcrawler.testrelm.test
  PKINIT status: enabled
----------------------------
Number of entries returned 1
----------------------------

Thus on the basis of above observations and comment#7, marking status of bug to 'Verified'
Comment 9 Rob Crittenden 2018-02-13 18:19:03 UTC 
*** Bug 1544673 has been marked as a duplicate of this bug. ***
Comment 10 Florence Blanc-Renaud 2018-02-15 13:54:22 UTC 
*** Bug 1518147 has been marked as a duplicate of this bug. ***
Comment 13 errata-xmlrpc 2018-04-10 16:48:21 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0918
Note You need to log in before you can comment on or make changes to this bug.