Hide Forgot
Cloned from upstream: https://pagure.io/freeipa/issue/7144 If we issue pkinit-status after an upgrade from a pre-4.5 version, the command would fail.
Upstream ticket: https://pagure.io/freeipa/issue/7144
ipa-4-5: fee3adb pkinit: don't fail when no pkinit servers found
ipa-server-version:ipa-server-4.5.4-7.el7.x86_64 Tested the bug on the basis of following observations: 1. Tested that when 'ipa pkinit-status' command is run on IPA configured with plain installation, the command is successful. 2. When the same command is run on an upgrade IPA-server: A) From RHEL 73z (ipa-server-4.4.0-14.el7_3.7.x86_64) to RHEL 7.5 - ipa pkinit-status command FAILS initially but works upon clearing cache [root@auto-hv-01-guest07 ~]# rpm -q ipa-server ipa-server-4.4.0-14.el7_3.7.x86_64 [root@auto-hv-01-guest07 ~]# kinit admin Password for admin@TESTRELM.TEST: [root@auto-hv-01-guest07 ~]# ipa pkinit-status ipa: ERROR: unknown command 'pkinit-status' [root@auto-hv-01-guest07 ~]# yum -y update 'ipa-server*' sssd nss Upon clearing cache at ' ~/.cache/ipa/schema' and then re-running the same command returns [root@auto-hv-01-guest07 ~]# ipa pkinit-status ----------------- 0 servers matched ----------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@auto-hv-01-guest07 ~]# B) From RHEL 74z (ipa-server-4.5.0-22.el7_4.x86_64) to RHEL 7.5 - ipa pkinit-status command SUCCESSFUL [root@nightcrawler ~]# rpm -q ipa-server ipa-server-4.5.0-22.el7_4.x86_64 [root@nightcrawler ~]# ipa pkinit-status ipa: ERROR: did not receive Kerberos credentials [root@nightcrawler ~]# kinit admin Password for admin@TESTRELM.TEST: [root@nightcrawler ~]# ipa pkinit-status ---------------- 1 server matched ---------------- Server name: nightcrawler.testrelm.test PKINIT status: enabled ---------------------------- Number of entries returned 1 ---------------------------- [root@nightcrawler ~]# tail -1 /var/log/ipaupgrade.log 2018-01-10T12:36:11Z INFO The ipa-server-upgrade command was successful [root@nightcrawler ~]# rpm -q ipa-server ipa-server-4.5.4-7.el7.x86_64 [root@nightcrawler ~]# kinit admin Password for admin@TESTRELM.TEST: [root@nightcrawler ~]# ipa pkinit-status ---------------- 1 server matched ---------------- Server name: nightcrawler.testrelm.test PKINIT status: enabled ---------------------------- Number of entries returned 1 ---------------------------- Is this expected behavior or anything I am missing?
standa, could you help us here (since you're the author of the patch)?
I did not find any secret information in comment 5 so I made it public should anyone looking into this BZ be interested about what's happening. We can see that the pkinit-status is actually working and your question is more related to how IPA works with PKINIT rather than about the patch, but that's alright. A proper support of PKINIT was added in freeIPA 4.5 and ever since then, freeIPA is installed with PKINIT enabled by default. In earlier versions of freeIPA, we did not have direct support of PKINIT in installers and thus we consider PKINIT disabled there and we don't enable it on upgrade. Hence the results. So the short answer is - yes, this is expected.
ipa-server-version:ipa-server-4.5.4-7.el7.x86_64 Tested the bug on the basis of following observations: 1. Tested that when 'ipa pkinit-status' command is run on IPA configured with plain installation, the command is successful. 2. When the same command is run on an upgrade IPA-server: A) From RHEL 73z (ipa-server-4.4.0-14.el7_3.7.x86_64) to RHEL 7.5 [root@auto-hv-01-guest07 ~]# rpm -q ipa-server ipa-server-4.4.0-14.el7_3.7.x86_64 [root@auto-hv-01-guest07 ~]# kinit admin Password for admin@TESTRELM.TEST: [root@auto-hv-01-guest07 ~]# ipa pkinit-status ipa: ERROR: unknown command 'pkinit-status' [root@auto-hv-01-guest07 ~]# yum -y update 'ipa-server*' sssd nss Upon clearing cache at ' ~/.cache/ipa/schema' and then re-running the same command returns [root@auto-hv-01-guest07 ~]# ipa pkinit-status ----------------- 0 servers matched ----------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@auto-hv-01-guest07 ~]# B) From RHEL 74z (ipa-server-4.5.0-22.el7_4.x86_64) to RHEL 7.5 [root@nightcrawler ~]# rpm -q ipa-server ipa-server-4.5.0-22.el7_4.x86_64 [root@nightcrawler ~]# ipa pkinit-status ipa: ERROR: did not receive Kerberos credentials [root@nightcrawler ~]# kinit admin Password for admin@TESTRELM.TEST: [root@nightcrawler ~]# ipa pkinit-status ---------------- 1 server matched ---------------- Server name: nightcrawler.testrelm.test PKINIT status: enabled ---------------------------- Number of entries returned 1 ---------------------------- [root@nightcrawler ~]# tail -1 /var/log/ipaupgrade.log 2018-01-10T12:36:11Z INFO The ipa-server-upgrade command was successful [root@nightcrawler ~]# rpm -q ipa-server ipa-server-4.5.4-7.el7.x86_64 [root@nightcrawler ~]# kinit admin Password for admin@TESTRELM.TEST: [root@nightcrawler ~]# ipa pkinit-status ---------------- 1 server matched ---------------- Server name: nightcrawler.testrelm.test PKINIT status: enabled ---------------------------- Number of entries returned 1 ---------------------------- Thus on the basis of above observations and comment#7, marking status of bug to 'Verified'
*** Bug 1544673 has been marked as a duplicate of this bug. ***
*** Bug 1518147 has been marked as a duplicate of this bug. ***
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0918