Red Hat Bugzilla – Bug 924009
Allow client to re-enroll without first unenrolling
Last modified: 2013-11-21 15:52:15 EST
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/3482 The use case is a client as a VM. Kickstart process creates VM and enrolls client. client dies Kickstart process deletes VM and enrolls client. Fail, already enrolled. There is no entity in the middle that can run host-delete or host-disable. The desire is to either add a new flag (e.g. --autoclean), or extend the meaning of --force, to have the client detect that it is already enrolled, call host-disable, then enroll. It is expected to only work when doing a delegated enrollment. OTP will not work.
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/a7ccc198a731d0e48319a73bcb2dd98c34de262a To reenroll the client, a new option of ipa-client-install can be used: --force-join Force client enrollment even if already enrolled
I just found out, that the backported patch for this feature was incomplete as it misses some required changes in ipa-join. This leads to ipa-client-install --force-join returning an error.
Fixed in ipa-3.0.0-36.el6.
Reproduction scenario: 1. Install IPA server 2. Install IPA client 3. Shutdown IPA server so that client will not be correctly unenrolled 4. --uninstall IPA client 5. Start IPA server 6. Try installing IPA client again - it won't be allowed unless --force-join flag is used
Verified. ipa-client version: =================== [root@rhel65-client ~]# rpm -q ipa-client ipa-client-3.0.0-37.el6.x86_64 [root@rhel65-client ~]# Steps of verification: ====================== (1)Un-installing client and IPA server not reachable while un-installing client [root@rhel65-client ~]# iptables -A INPUT -j REJECT -p all --source 10.65.207.74;ipa-client-install --uninstall -U;iptables -F Unenrolling client from IPA server Unenrolling host failed: Error obtaining initial credentials: Cannot contact any KDC for requested realm. Removing Kerberos service principals from /etc/krb5.keytab Disabling client Kerberos and LDAP configurations Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted Restoring client configuration files nslcd daemon is not installed, skip configuration Client uninstall complete. [root@rhel65-client ~]# (2)Re-enrollment client with --force-join [root@rhel65-client ~]# ipa-client-install -U --force-join --domain=testrelm.com --realm=TESTRELM.COM -p admin -w xxxxxxxx --server=rhel65-replica.testrelm.com Hostname: rhel65-client.testrelm.com Realm: TESTRELM.COM DNS Domain: testrelm.com IPA Server: rhel65-replica.testrelm.com BaseDN: dc=testrelm,dc=com Synchronizing time with KDC... Enrolled in IPA realm TESTRELM.COM Created /etc/ipa/default.conf New SSSD config will be created Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm TESTRELM.COM trying https://rhel65-replica.testrelm.com/ipa/xml Forwarding 'env' to server u'https://rhel65-replica.testrelm.com/ipa/xml' Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub Forwarding 'host_mod' to server u'https://rhel65-replica.testrelm.com/ipa/xml' SSSD enabled Configured /etc/openldap/ldap.conf NTP enabled Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Client configuration complete. [root@rhel65-client ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1651.html