Bug 1568857 - Wrong error message in case domain level should be set to 1 again.
Summary: Wrong error message in case domain level should be set to 1 again.
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: ipa
Version: 8.0
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-18 10:42 UTC by Thorsten Scherf
Modified: 2019-09-23 11:09 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-09-23 11:09:17 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)

Description Thorsten Scherf 2018-04-18 10:42:54 UTC
Description of problem:

$ ipa domainlevel-get
-----------------------
Current domain level: 1
-----------------------

This is ok:
$ ipa domainlevel-set 0
ipa: ERROR: Domain Level cannot be lowered.

But this is not ok:
$ ipa domainlevel-set 1
ipa: ERROR: Domain Level cannot be raised to 1, server client.example.com does not support it.



Version-Release number of selected component (if applicable):
Current ipa-server from RHEL-7.5. Also tested with upstream.

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:
IPA says the master does not support the desired domain level.

Expected results:
IPA should say that the domain level is already set to 1 and no modification needs to be performed.


Additional info:

Comment 2 fbarreto 2018-04-23 22:05:15 UTC
Upstream ticket:
https://pagure.io/freeipa/issue/7511

Comment 4 Florence Blanc-Renaud 2018-12-21 17:17:23 UTC
Hi Thorsten,
when you reproduced the issue, which principal was authenticated?

I am able to to reproduce if I do
# kinit -kt /etc/krb5.keytab
# ipa domainlevel-set 1
ipa: ERROR: Domain Level cannot be raised to 1, server server.example.com does not support it.

But if I kinit as admin:
# kinit admin
Password for admin@EXAMPLE.COM: 
# ipa domainlevel-set 1
ipa: ERROR: no modifications to be performed

I suspect the issue is linked to ipaMinDomainLevel and ipaMaxDomainLevel not readable by all the users.

Comment 7 Florence Blanc-Renaud 2019-09-23 11:09:17 UTC
Customer confirmed that he gets the expected output when the command is run with an admin TGT, hence closing as works for me.


Note You need to log in before you can comment on or make changes to this bug.