Bug 682850 – IPA provider should use realm instead of ipa_domain for base DN

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 682850 - IPA provider should use realm instead of ipa_domain for base DN

Summary:	IPA provider should use realm instead of ipa_domain for base DN

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	sssd (Show other bugs)
Sub Component:
Version:	6.1
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Stephen Gallagher
QA Contact:	Chandrasekar Kannan
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:	682853
	Show dependency tree / graph

Reported:	2011-03-07 14:12 EST by Rob Crittenden
Modified:	2015-01-04 18:46 EST (History)
CC List:	6 users (show)

See Also:
Fixed In Version:	sssd-1.5.1-12.el6
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Clones:	682853 (view as bug list)
Environment:
Last Closed:	2011-05-19 07:38:58 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0560	normal	SHIPPED_LIVE	Low: sssd security, bug fix, and enhancement update	2011-05-19 07:38:17 EDT

Groups: None (edit)

Description Rob Crittenden 2011-03-07 14:12:43 EST

Description of problem:

From https://fedorahosted.org/sssd/ticket/807

See https://fedorahosted.org/freeipa/ticket/1001 and the bug linked from there.

The problem is that IPA seems to be deriving its Base DN from the Kerberos realm. SSSD derives it from IPA domain. In 99% of cases the two are the same, but there's no requirement on it, so we should use the realm, too.

Comment 2 Namita Soman 2011-04-07 14:16:36 EDT

Verified using:
sssd-1.5.5-0.20110405T0615z.el6.x86_64

installed ipa server as -
ipa-server-install --setup-dns --forwarder=10.14.63.12 -p Secret123 -P Secret123 -a Secret123 -r QWQW

and verified sssd.conf, and default.conf have the right entries:
sssd.conf:
section for [domain/testrelm] includes:
krb5_realm = QWQW
ipa_domain = testrelm

section for [domain/default] includes:
krb5_realm = QWQW

default.conf includes:
basedn=dc=qwqw
realm=QWQW
domain=testrelm
xmlrpc_uri=https://rhel61-server5.testrelm/ipa/xml
ldap_uri=ldapi://%2fvar%2frun%2fslapd-QWQW.socket

also verified kinit 
# kinit admin
Password for admin@QWQW:

Comment 3 errata-xmlrpc 2011-05-19 07:38:58 EDT

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0560.html

Comment 4 errata-xmlrpc 2011-05-19 09:09:49 EDT

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0560.html

Note You need to log in before you can comment on or make changes to this bug.