Red Hat Bugzilla – Bug 823657
ipa-replica-manage connect fails with GSSAPI error after delete if using previous kerberos ticket
Last modified: 2015-05-19 09:48:16 EDT
Description of problem: After deleting a replica, an attempt to connect to it should return an expected error message. If the connect is run without a kerberos ticket (like after a kdestroy), or with the -p to indicate password on command line, it does. If run with a ticket that has the old server's info still listed, it fails with a GSSAPI error. Version-Release number of selected component (if applicable): ipa-server-2.2.0-14.el6.x86_64 How reproducible: Always Steps to Reproduce: 1. <setup ipa master> 2. <setup ipa replica> 3. ipa-replica-manage del $SLAVE # on master 4. ipa-replica-manage connect $SLAVE Actual results: [root@spoore-dvm1 slapd-TESTRELM-COM]# ipa-replica-manage connect spoore-dvm2.testrelm.com SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server ldap/spoore-dvm2.testrelm.com@TESTRELM.COM not found in Kerberos database) Expected results: I would expect to see the same error message that I see here: [root@kvm-guest-05 log]# ipa-replica-manage connect qe-blade-11.testrelm.com Directory Manager password: You cannot connect to a previously deleted master Additional info:
https://fedorahosted.org/freeipa/ticket/2780
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
I have not been able to reproduce this issue, following the steps in the description. [tbabej@vm-046 freeIPA-scripts]$ ipa-replica-manage list vm-046.idm.lab.bos.redhat.com: master vm-069.idm.lab.bos.redhat.com: master [tbabej@vm-046 freeIPA-scripts]$ ipa-replica-manage del vm-069.idm.lab.bos.redhat.com Deleting a master is irreversible. To reconnect to the remote master you will need to prepare a new replica file and re-install. Continue to delete? [no]: yes Deleted replication agreement from 'vm-046.idm.lab.bos.redhat.com' to 'vm-069.idm.lab.bos.redhat.com' [tbabej@vm-046 freeIPA-scripts]$ ipa-replica-manage connect vm-069.idm.lab.bos.redhat.com You cannot connect to a previously deleted master However, the ticket still has deleted replica's info listed: [tbabej@vm-046 freeIPA-scripts]$ klist Ticket cache: FILE:/tmp/krb5cc_536 Default principal: admin@IDM.LAB.BOS.REDHAT.COM Valid starting Expires Service principal 10/04/12 06:59:04 10/05/12 06:59:04 krbtgt/IDM.LAB.BOS.REDHAT.COM@IDM.LAB.BOS.REDHAT.COM 10/04/12 07:27:18 10/05/12 06:59:04 ldap/vm-046.idm.lab.bos.redhat.com@IDM.LAB.BOS.REDHAT.COM 10/04/12 07:30:40 10/05/12 06:59:04 ldap/vm-069.idm.lab.bos.redhat.com@IDM.LAB.BOS.REDHAT.COM Version: [tbabej@vm-046 freeIPA-scripts]$ rpm -qa | grep ipa ipa-pki-common-theme-9.0.3-7.el6.noarch libipa_hbac-1.9.2-0.20121005T1740Zgita87ffe4.el6.x86_64 libipa_hbac-python-1.9.2-0.20121005T1740Zgita87ffe4.el6.x86_64 ipa-admintools-2.2.0-16.el6.x86_64 python-iniparse-0.3.1-2.1.el6.noarch ipa-client-2.2.0-16.el6.x86_64 ipa-server-selinux-2.2.0-16.el6.x86_64 ipa-pki-ca-theme-9.0.3-7.el6.noarch ipa-python-2.2.0-16.el6.x86_64 ipa-server-2.2.0-16.el6.x86_64
Verified. I can no longer reproduce this one. Version :: [root@vm1 ~]# rpm -qa|grep ipa libipa_hbac-python-1.8.0-32.el6.x86_64 ipa-pki-common-theme-9.0.3-7.el6.noarch ipa-pki-ca-theme-9.0.3-7.el6.noarch ipa-server-2.2.0-16.el6.x86_64 ipa-python-2.2.0-16.el6.x86_64 ipa-client-2.2.0-16.el6.x86_64 ipa-server-selinux-2.2.0-16.el6.x86_64 libipa_hbac-1.8.0-32.el6.x86_64 python-iniparse-0.3.1-2.1.el6.noarch ipa-admintools-2.2.0-16.el6.x86_64 Manual Test Results :: [root@vm1 quickinstall]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin@TESTRELM.COM Valid starting Expires Service principal 10/08/12 17:01:12 10/09/12 17:01:10 krbtgt/TESTRELM.COM@TESTRELM.COM [root@vm1 quickinstall]# ipa-replica-manage del vm2.testrelm.com Deleting a master is irreversible. To reconnect to the remote master you will need to prepare a new replica file and re-install. Continue to delete? [no]: yes Deleted replication agreement from 'vm1.testrelm.com' to 'vm2.testrelm.com' [root@vm1 quickinstall]# ipa-replica-manage connect vm2.testrelm.com You cannot connect to a previously deleted master [root@vm1 quickinstall]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin@TESTRELM.COM Valid starting Expires Service principal 10/08/12 17:01:12 10/09/12 17:01:10 krbtgt/TESTRELM.COM@TESTRELM.COM 10/08/12 17:11:22 10/09/12 17:01:10 ldap/vm1.testrelm.com@TESTRELM.COM 10/08/12 17:11:24 10/09/12 17:01:10 ldap/vm2.testrelm.com@TESTRELM.COM
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html