RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1731437 - ipa service-find does not list cifs service created by ipa-client-samba
Summary: ipa service-find does not list cifs service created by ipa-client-samba
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: ipa
Version: 8.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Thomas Woerner
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On: 1731433
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-19 12:25 UTC by Sergey Orlov
Modified: 2020-11-14 07:29 UTC (History)
12 users (show)

Fixed In Version: ipa-4.8.0-5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1731433
Environment:
Last Closed: 2019-11-05 20:53:20 UTC
Type: Bug
Target Upstream Version:
Embargoed:
pm-rhel: mirror+

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:3348 0 None None None 2019-11-05 20:53:33 UTC

Description Sergey Orlov 2019-07-19 12:25:05 UTC 
+++ This bug was initially created as a clone of Bug #1731433 +++

Description of problem:
ipa-client-samba utility creates cifs service, which is not listed by "ipa service-find", though it can be viewed using "ipa service-show"


Version-Release number of selected component (if applicable):
freeipa-server-4.8.0-1.fc30.x86_64

How reproducible:
Always


Steps to Reproduce:
1. Setup topology: install ipa server, run ipa-adtrust-install on server, setup ipa client.
2. run ipa-client-samba on client
3. run ipa service-find

Actual results:
cifs service for client is not listed

Expected results:
record for principal cifs/client1.testrelm.test in output


Additional info:
"ipa service-show cifs/client1.testrelm.test" shows the desired service.

Extract from /var/log/dirsrv/slapd-TESTRELM-TEST/access captured during execution of ipa service-find:
SRCH base="cn=services,cn=accounts,dc=testrelm,dc=test" scope=1 filter="(&(&(objectClass=ipaService)(!(objectClass=posixAccount))(!(|(krbPrincipalName=kadmin/*)(krbPrincipalName=K/M@*)(krbPrincipalName=krbtgt/*))))(&(objectClass=krbprincipal)(objectClass=krbprincipalaux)(objectClass=krbticketpolicyaux)(objectClass=ipaobject)(objectClass=ipaservice)(objectClass=pkiuser)))" attrs="userCertificate krbPrincipalName ipaKrbAuthzData ipaAllowedToPerform krbPrincipalAuthInd krbCanonicalName"

Thing to note here is "!(objectClass=posixAccount)"
And as the service record contains this objectClass, the record is removed from search results:
ipa service-show cifs/client1.testrelm.test --raw --all
  dn: krbprincipalname=cifs/client1.testrelm.test,cn=services,cn=accounts,dc=testrelm,dc=test
  krbcanonicalname: cifs/client1.testrelm.test
...
  objectClass: posixaccount
...


The filter was introduced in commit 789fec4381 in year 2009.
Comment 1 Rob Crittenden 2019-07-19 17:15:24 UTC 
Fixed upstream
master:
https://pagure.io/freeipa/c/e771fa59ff65545ff1e84f1cd30e06556fabcee3
Comment 2 Rob Crittenden 2019-07-19 19:17:24 UTC 
Fixed upstream
ipa-4-8:
https://pagure.io/freeipa/c/2f9cbffb6e57ded2d0107f457241f33b17869a96
Comment 4 Sergey Orlov 2019-09-02 12:48:36 UTC 
Verified for RHEL8.1 nightly compose using automatic test ipatests/test_integration/test_smb.py from https://github.com/freeipa/freeipa/pull/3576.

cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.1 Beta (Ootpa)

rpm -q ipa-client-samba
ipa-client-samba-4.8.0-5.module+el8.1.0+3809+d28f8357.x86_64

ipa-run-tests-3 ipatests/test_integration/test_smb.py -v
...
============================================================================================================ test session starts ============================================================================================================
platform linux -- Python 3.6.8, pytest-3.4.2, py-1.5.4, pluggy-0.6.0 -- /usr/bin/python3
cachedir: ipatests/.pytest_cache
rootdir: /home/sorlov/work/FREEIPA-3351-verify-samba/freeipa/ipatests, inifile:
plugins: profiling-1.6.0, sourceorder-0.5, multihost-3.0
collected 11 items                                                                                                                                                                                                                          

ipatests/test_integration/test_smb.py::TestSMB::test_samba_uninstallation_without_installation PASSED                                                                                                                                 [  9%]
ipatests/test_integration/test_smb.py::TestSMB::test_install_samba PASSED                                                                                                                                                             [ 18%]
ipatests/test_integration/test_smb.py::TestSMB::test_samba_service_listed PASSED                                                                                                                                                      [ 27%]
ipatests/test_integration/test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client PASSED                                                                                                                                     [ 36%]
ipatests/test_integration/test_smb.py::TestSMB::test_smb_access_for_ad_user_at_ipa_client PASSED                                                                                                                                      [ 45%]
ipatests/test_integration/test_smb.py::TestSMB::test_smb_mount_and_access_by_different_users PASSED                                                                                                                                   [ 54%]
ipatests/test_integration/test_smb.py::TestSMB::test_smb_mount_fails_without_kerberos_ticket PASSED                                                                                                                                   [ 63%]
ipatests/test_integration/test_smb.py::TestSMB::test_uninstall_samba PASSED                                                                                                                                                           [ 72%]
ipatests/test_integration/test_smb.py::TestSMB::test_repeated_uninstall_samba PASSED                                                                                                                                                  [ 81%]
ipatests/test_integration/test_smb.py::TestSMB::test_samba_reinstall PASSED                                                                                                                                                           [ 90%]
ipatests/test_integration/test_smb.py::TestSMB::test_cleanup PASSED                                                                                                                                                                   [100%]

======================================================================================================== 11 passed in 708.24 seconds ========================================================================================================
Comment 6 Sergey Orlov 2019-11-05 09:56:35 UTC 
Automated test for this bug:
https://github.com/freeipa/freeipa/blob/master/ipatests/test_integration/test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client
Comment 7 errata-xmlrpc 2019-11-05 20:53:20 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:3348
Note You need to log in before you can comment on or make changes to this bug.