Description of problem:
When running ipa-client-install on a system whose clock is not in sync with the master, kinit fails and enrollment is aborted. Manual checking of current time at the master and adjusting on the client-to-be is then needed.
It would be better to sync the time from the master before kinit to prevent this usability issue.
Version-Release number of selected component (if applicable):
RHEL 6.1 / IPA 2.1
Started with time on master at 13:45, and on client at 15:45
debug logs indicate:
Synchronizing time with KDC...
root : DEBUG args=/usr/sbin/ntpdate -U ntp -s -b rhel62-server1.testrelm
.....where rhel62-server1.testrelm is the master IPA server.
after install, time on client matches master and is at 13:50
verified using ipa-client-2.1.2-2.el6.x86_64
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
Cause: If IPA client is installed and there is a too big time difference between the client and an IPA server, KDC running on the IPA server machine may refuse any Kerberos authentication request from the client.
Consequence: Installation may fail as it cannot get a valid Kerberos ticket during the process
Fix: Always try to synchronize the time with the NTP servers configured for the client domain or the IPA server itself
Result: If the time synchronization succeeds, the time on the client machine is fixed and Kerberos authentication and the installation itself should successfully continue
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.