+++ This bug was initially created as a clone of Bug #682850 +++ Description of problem: From https://fedorahosted.org/sssd/ticket/807 See https://fedorahosted.org/freeipa/ticket/1001 and the bug linked from there. The problem is that IPA seems to be deriving its Base DN from the Kerberos realm. SSSD derives it from IPA domain. In 99% of cases the two are the same, but there's no requirement on it, so we should use the realm, too.
IPA SERVER RHEL 6.1: ipa-server-2.0.0-23.el6.x86_64 ipa-client-2.0.0-23.el6.x86_64 sssd-1.5.1-34.el6.x86_64 Installation command: ipa-server-install --setup-dns --forwarder=10.14.63.12 --hostname=hostname.testrelm -r QWQW -n testrelm -p bigsecret -P bigsecret -a bigsecret -U Installation successful # kinit admin Password for admin@QWQW: [root@myhost]# # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin@QWQW Valid starting Expires Service principal 05/31/11 15:04:59 06/01/11 15:04:57 krbtgt/QWQW@QWQW IPA CLIENT RHEL 5.7: ipa-client-2.0-14.el5 sssd-1.5.1-35.el5 Installation command: ipa-client-install --domain=testrelm --realm=QWQW -p admin -w bigsecret -U --server=hostname.testrelm Discovery was successful! Realm: QWQW DNS Domain: testrelm IPA Server: qe-blade-04.testrelm BaseDN: dc=qwqw kinit(v5): Cannot resolve network address for KDC in realm QWQW while getting initial credentials
Setting this back to assigned as the problem is with the ipa-client https://fedorahosted.org/freeipa/ticket/1100 This fix is not included in RHEL 5.7 ipa-client, therefore it is not possible to verify this bug.
Same result with RHEL 5 ipa-client scratch build: ipa-client-install --domain=testrelm --realm=QWQW -p mysecret -w mysecret -U --server=ipaserver.testrelm DNS domain 'qwqw' is not configured for automatic KDC address lookup. KDC address will be set to fixed value. Discovery was successful! Realm: QWQW DNS Domain: testrelm IPA Server: ipaserver.testrelm BaseDN: dc=qwqw kinit(v5): Cannot contact any KDC for realm 'QWQW' while getting initial credentials # rpm -q ipa-client ipa-client-2.0-15.el5
oh well slightly different ... "DNS domain 'qwqw' is not configured for automatic KDC address lookup. KDC address will be set to fixed value."
Wasn't executing the correct command "-p" is principal # ipa-client-install --domain=testrelm --realm=QWQW -p admin -w mysecret -U --server=ipaserver.testrelm DNS domain 'qwqw' is not configured for automatic KDC address lookup. KDC address will be set to fixed value. Discovery was successful! Realm: QWQW DNS Domain: testrelm IPA Server: ipaserver.testrelm BaseDN: dc=qwqw Enrolled in IPA realm QWQW Created /etc/ipa/default.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm QWQW Warning: Hostname (client.testrelm) not found in DNS Failed to update DNS A record. (Command '/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt' returned non-zero exit status -6) Failed to stop the NSCD daemon SSSD enabled Kerberos 5 enabled NTP enabled Client configuration complete. # kinit jennyg Password for jennyg@QWQW: Password expired. You must change it now. Enter new password: Enter it again: # cat /etc/ipa/default.conf #File modified by ipa-client-install [global] basedn = dc=qwqw realm = QWQW domain = testrelm server = ipaserver.testrelm xmlrpc_uri = https://ipaserver.testrelm/ipa/xml enable_ra = True # cat /etc/sssd/sssd.conf [sssd] services = nss, pam config_file_version = 2 domains = testrelm [nss] [pam] [domain/testrelm] cache_credentials = True krb5_realm = QWQW ipa_domain = testrelm id_provider = ipa auth_provider = ipa access_provider = ipa chpass_provider = ipa ipa_server = _srv_, ipaserver.testrelm # cat /etc/krb5.conf #File modified by ipa-client-install [libdefaults] default_realm = QWQW dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes [realms] QWQW = { kdc = ipaserver.testrelm:88 admin_server = ipaserver.testrelm:749 default_domain = testrelm pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .testrelm = QWQW testrelm = QWQW [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false }
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2011-0975.html