Bug 924009 - Allow client to re-enroll without first unenrolling
Allow client to re-enroll without first unenrolling
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa (Show other bugs)
Unspecified Unspecified
medium Severity unspecified
: rc
: ---
Assigned To: Rob Crittenden
Namita Soman
Depends On:
  Show dependency treegraph
Reported: 2013-03-20 18:25 EDT by Dmitri Pal
Modified: 2013-11-21 15:52 EST (History)
4 users (show)

See Also:
Fixed In Version: ipa-3.0.0-36.el6
Doc Type: Bug Fix
Doc Text:
Cause: Identity Management client installer did not allow re-enrolling an already enrolled client. Consequence: When a machine or a VM with a configured Identity Management client is removed or decommissioned without unenrolling the client first, all succeeding client enrollments will fail until the client entry is removed from Identity Management sever. Fix: --force-join option was added to the IdM client installer. Result: Privileged administrator may re-enroll an Identity Management client.
Story Points: ---
Clone Of:
Last Closed: 2013-11-21 15:52:15 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Dmitri Pal 2013-03-20 18:25:50 EDT
This bug is created as a clone of upstream ticket:

The use case is a client as a VM.

Kickstart process creates VM and enrolls client.

client dies

Kickstart process deletes VM and enrolls client.

Fail, already enrolled.

There is no entity in the middle that can run host-delete or host-disable.

The desire is to either add a new flag (e.g. --autoclean), or extend the meaning of --force, to have the client detect that it is already enrolled, call host-disable, then enroll.

It is expected to only work when doing a delegated enrollment. OTP will not work.
Comment 1 Martin Kosek 2013-03-25 05:55:01 EDT
Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/a7ccc198a731d0e48319a73bcb2dd98c34de262a

To reenroll the client, a new option of ipa-client-install can be used:

    --force-join        Force client enrollment even if already enrolled
Comment 7 Martin Kosek 2013-09-17 04:43:57 EDT
I just found out, that the backported patch for this feature was incomplete as it misses some required changes in ipa-join. This leads to ipa-client-install --force-join returning an error.
Comment 9 Martin Kosek 2013-09-17 10:01:23 EDT
Fixed in ipa-3.0.0-36.el6.
Comment 10 Martin Kosek 2013-09-25 07:17:59 EDT
Reproduction scenario:
1. Install IPA server
2. Install IPA client
3. Shutdown IPA server so that client will not be correctly unenrolled
4. --uninstall IPA client
5. Start IPA server
6. Try installing IPA client again - it won't be allowed unless --force-join flag is used
Comment 11 Kaleem 2013-10-11 05:33:57 EDT

ipa-client version:
[root@rhel65-client ~]# rpm -q ipa-client
[root@rhel65-client ~]#

Steps of verification:

(1)Un-installing client and IPA server not reachable while un-installing client

[root@rhel65-client ~]# iptables -A INPUT -j REJECT -p all --source;ipa-client-install --uninstall -U;iptables -F
Unenrolling client from IPA server
Unenrolling host failed: Error obtaining initial credentials: Cannot contact any KDC for requested realm.

Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
nslcd daemon is not installed, skip configuration
Client uninstall complete.
[root@rhel65-client ~]# 

(2)Re-enrollment client with --force-join 

[root@rhel65-client ~]# ipa-client-install -U --force-join --domain=testrelm.com --realm=TESTRELM.COM -p admin -w xxxxxxxx --server=rhel65-replica.testrelm.com
Hostname: rhel65-client.testrelm.com
DNS Domain: testrelm.com
IPA Server: rhel65-replica.testrelm.com
BaseDN: dc=testrelm,dc=com

Synchronizing time with KDC...
Enrolled in IPA realm TESTRELM.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm TESTRELM.COM
trying https://rhel65-replica.testrelm.com/ipa/xml
Forwarding 'env' to server u'https://rhel65-replica.testrelm.com/ipa/xml'
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub
Forwarding 'host_mod' to server u'https://rhel65-replica.testrelm.com/ipa/xml'
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.
[root@rhel65-client ~]#
Comment 13 errata-xmlrpc 2013-11-21 15:52:15 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.