Description of problem:

It seem like IPA DNS delegation may not work as expected.
If I have a test system running named to host a zone like sub1.example.com, and add a A and NS records on an IPA server to delegate that zone to the test system, the IPA server does not seem to be able to resolve DNS entries recorded in the zone sub1.example.com

initially reported in the FreeIPA user list, reference:
https://www.redhat.com/archives/freeipa-users/2012-February/msg00015.html


Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 6.2 (Santiago)
Linux ipaserver1.example.com 2.6.32-220.el6.x86_64 #1 SMP Wed Nov 9 08:03:13 EST 2011 x86_64 x86_64 x86_64 GNU/Linux

ipa-server-2.1.3-9.el6.x86_64
krb5-server-1.9-22.el6_2.1.x86_64
krb5-server-ldap-1.9-22.el6_2.1.x86_64
pki-java-tools-9.0.3-20.el6.noarch
pki-symkey-9.0.3-20.el6.x86_64
krb5-libs-1.9-22.el6_2.1.x86_64
ipa-client-2.1.3-9.el6.x86_64
pki-common-9.0.3-20.el6.noarch
pki-silent-9.0.3-20.el6.noarch
ipa-server-selinux-2.1.3-9.el6.x86_64
ipa-pki-common-theme-9.0.3-7.el6.noarch
krb5-pkinit-openssl-1.9-22.el6_2.1.x86_64
pam_krb5-2.3.11-9.el6.x86_64
krb5-workstation-1.9-22.el6_2.1.x86_64
ipa-python-2.1.3-9.el6.x86_64
pki-setup-9.0.3-20.el6.noarch
pki-util-9.0.3-20.el6.noarch
pki-selinux-9.0.3-20.el6.noarch
ipa-admintools-2.1.3-9.el6.x86_64
pki-ca-9.0.3-20.el6.noarch
ipa-pki-ca-theme-9.0.3-7.el6.noarch
pki-native-tools-9.0.3-20.el6.x86_64


How reproducible:
aleays


Steps to Reproduce:

1. have a test system with named, test.sub1.example.com
vi /etc/named.conf
...snip...
zone "sub1.example.com" IN {
        type master;
        file "data/sub1.example.com";
        allow-update { none; };
        allow-query { otherhosts; };
        allow-transfer { none; };
};

zone "5.14.10.in-addr.arpa" IN {
        type master;
        file "data/5.14.10.in-addr.arpa";
        allow-update { none; };
        allow-query { otherhosts; };
        allow-transfer { none; };
};

2. on test.sub1.example.com
create a named configuration, to host a sub domain, sub1.example.com, with an A record for test.sub1.example.com and test2.example.com

vi /var/named/chroot/var/named/data/sub1.example.com
;
@               IN      SOA     ipaclient2.example.com. dns.ipaclient2.example.com. (
                2010040108
                10800
                3600
                604800
                86400 )
;
                IN NS ipaclient2.example.com.
;
ipaclient2            IN A 10.14.5.39
test            IN A 10.14.5.39
test2            IN A 10.14.5.39
;

/etc/init.d/named start


3. have an IPA server already configured, ipaserver1.example.com

4. add A and NS NDS records on ipaserver1.example.com to delegate sub1.example.com

[root@ipaserver1 ~]# kinit admin
Password for admin:
[root@ipaserver1 ~]# 
[root@ipaserver1 ~]# ipa dnsrecord-add example.com test.sub1 --a-rec=10.14.5.39
  Record name: test.sub1
  A record: 10.14.5.39
[root@ipaserver1 ~]# 
[root@ipaserver1 ~]# host test.sub1.example.com
test.sub1.example.com has address 10.14.5.39
[root@ipaserver1 ~]#
[root@ipaserver1 ~]# ipa dnsrecord-add example.com sub1 --ns-rec=test.sub1.example.com
  Record name: sub1
  NS record: test.sub1.example.com
[root@ipaserver1 ~]#


5. verify configuration, positive test to get A record of DNS server for sub1.example.com :

[root@ipaserver1 ~]# dig -t a test.sub1.example.com

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> -t a test.sub1.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39449
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION: 
;test.sub1.example.com.         IN      A

;; ANSWER SECTION:   
test.sub1.example.com.  86400   IN      A       10.14.5.39

;; AUTHORITY SECTION:
example.com.            86400   IN      NS      ipaserver1.example.com.

;; ADDITIONAL SECTION:
ipaserver1.example.com. 86400   IN      A       10.14.5.36

;; Query time: 14 msec
;; SERVER: 10.14.5.36#53(10.14.5.36)
;; WHEN: Mon Apr  9 19:27:07 2012
;; MSG SIZE  rcvd: 96

[root@ipaserver1 ~]# 



6. verify a DNS entry test2.sub1.example.com exist in test.sub1.example.com :


[root@ipaserver1 ~]# dig -t a test2.sub1.example.com @test.sub1.example.com

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> -t a test2.sub1.example.com @test.sub1.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36070
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION: 
;test2.sub1.example.com.                IN      A

;; ANSWER SECTION:   
test2.sub1.example.com. 86400   IN      A       10.14.5.39

;; AUTHORITY SECTION:
sub1.example.com.       86400   IN      NS      ipaclient2.example.com.

;; Query time: 2 msec
;; SERVER: 10.14.5.39#53(10.14.5.39)
;; WHEN: Mon Apr  9 19:29:04 2012
;; MSG SIZE  rcvd: 81

[root@ipaserver1 ~]# 


7. do the same test but query the IPA server, it does not resolve.


Actual results:

[root@ipaserver1 ~]# dig -t a test2.sub1.example.com

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> -t a test2.sub1.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43595
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION: 
;test2.sub1.example.com.                IN      A

;; AUTHORITY SECTION:
example.com.            3600    IN      SOA     ipaserver1.example.com. admin.example.com. 2012 3600 900 1209 3600

;; Query time: 2 msec
;; SERVER: 10.14.5.36#53(10.14.5.36)
;; WHEN: Mon Apr  9 19:28:37 2012
;; MSG SIZE  rcvd: 93

[root@ipaserver1 ~]# 



Expected results:

DNS resolution of delegated zones.


Additional info:

issue with bind-dyndb-ldap plugin ?