Hide Forgot
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/2209 Hello, I've found out that if you have clients outside the server domain and when having conflicting SRV records (AD-records) in the client domain. ipa client enrollment will fail or getting timeouts to IPA services. Solution to this is to add dns_discovery_domain to sssd.conf. ipa-client-install needs to be able to handle this scenario.
fixed upstream. master: 96390ca3e5f9fb89fe930e62dbd267a2de0af1d1 ipa-2-2: 034f6d7d85d6d120f6934f10247c2fe417bd5514
Verified. dns_discovery_domain is added in sssd.conf dns_discovery_domain = testrelm.com ipa-client version: =================== [root@dhcp201-198 ~]# rpm -q ipa-client ipa-client-3.0.0-8.el6.i686 [root@dhcp201-198 ~]# [root@dhcp201-198 ~]# ipa-client-install -p admin -w xxxxxxxx --server=rhel64master.testrelm.com --domain=testrelm.com -U Hostname: dhcp201-198.englab.pnq.redhat.com Realm: TESTRELM.COM DNS Domain: testrelm.com IPA Server: rhel64master.testrelm.com BaseDN: dc=testrelm,dc=com Synchronizing time with KDC... Enrolled in IPA realm TESTRELM.COM Created /etc/ipa/default.conf New SSSD config will be created Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm TESTRELM.COM trying https://rhel64master.testrelm.com/ipa/xml Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Forwarding 'host_mod' to server u'http://rhel64master.testrelm.com/ipa/xml' Could not update DNS SSHFP records. SSSD enabled Configured /etc/openldap/ldap.conf Unable to find 'admin' user with 'getent passwd admin'! Recognized configuration: SSSD NTP enabled Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Client configuration complete. [root@dhcp201-198 ~]# [root@dhcp201-198 ~]# cat /etc/sssd/sssd.conf [domain/testrelm.com] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = testrelm.com id_provider = ipa auth_provider = ipa access_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt ipa_hostname = dhcp201-198.englab.pnq.redhat.com chpass_provider = ipa ipa_server = _srv_, rhel64master.testrelm.com dns_discovery_domain = testrelm.com [sssd] services = nss, pam, ssh config_file_version = 2 domains = testrelm.com ... [root@dhcp201-198 ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html