Bug 967019 - realmd in RHEL-7.0 relays/refers on FreeIPA and not IPA
realmd in RHEL-7.0 relays/refers on FreeIPA and not IPA
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: realmd (Show other bugs)
7.0
Unspecified Unspecified
high Severity high
: beta
: ---
Assigned To: Stef Walter
David Spurek
:
Depends On:
Blocks: 917662
  Show dependency treegraph
 
Reported: 2013-05-24 10:15 EDT by Patrik Kis
Modified: 2014-06-13 08:38 EDT (History)
3 users (show)

See Also:
Fixed In Version: realmd-0.14.3-1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-13 08:38:22 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
FreeDesktop.org 66734 None None None Never

  None (edit)
Description Patrik Kis 2013-05-24 10:15:36 EDT
Description of problem:
realmd in RHEL-7 is still referring FreeIPA but what is a Fedora component, but in RHEL the component name is IPA.

Version-Release number of selected component (if applicable):
realmd-0.14.1-1.el7

How reproducible:
always

Steps to Reproduce:
1. Man page:

# man realm | grep -i freeipa
           Only discover realms which run the given server software. Possible values include active-directory or freeipa.
       Joining arbitrary kerberos realms is not supported. The realm must have a supported mechanism for joining from a client machine, such as Active Directory or FreeIPA.
       types of servers can be joined using kerberos credentials, some (like FreeIPA) insist on prompting for a password.
           Only join realms for run the given server software. Possible values include active-directory or freeipa.
           Only leave the realm which is using the given server software. Possible values include active-directory or freeipa.

2. required-package in realm discover, and also when ipa-client is missing realmd is trying to install freeipa-client during join

# realm -v discover ipa.baseos.qe
 * Resolving: _ldap._tcp.dc._msdcs.ipa.baseos.qe
 * Resolving: _ldap._tcp.ipa.baseos.qe
 * Performing LDAP DSE lookup on: 10.34.24.252
 * Successfully discovered: ipa.baseos.qe
ipa.baseos.qe
  type: kerberos
  realm-name: IPA.BASEOS.QE
  domain-name: ipa.baseos.qe
  configured: no
  server-software: freeipa
  client-software: sssd
  required-package: freeipa-client
  required-package: sssd
Comment 2 Stef Walter 2013-07-08 11:59:52 EDT
Simo, do you know how we can tell the difference between IPA and FreeIPA (KDCs) via LDAP?
Comment 3 Simo Sorce 2013-07-08 12:35:29 EDT
I am not sure there is a way, perhaps via the 'version' attribute in the rootDSE.
That *may* have different 389ds identification strings on Fedora vs RHEL.

... checking ...

On Fedora19 I see:
vendorName: 389 Project
vendorVersion: 389-Directory/1.3.0.5 B2013.088.023

On RHEL6.3 I see ... the same (just different version ...)

I do not think we have a way to differentiate between 'FreeIPA' and 'Red Hat Identiy Management' at the moment ...
Comment 4 Stef Walter 2013-07-08 12:38:29 EDT
Thanks Simo, understood.

Patrik, should we change the documentation to refer to both IPA and FreeIPA? Obviously we should fix the required package on RHEL. Will do that.
Comment 5 Patrik Kis 2013-07-09 04:51:49 EDT
(In reply to Stef Walter from comment #4)
> Thanks Simo, understood.
> 
> Patrik, should we change the documentation to refer to both IPA and FreeIPA?

Yes, that would be fine (or for me also using just IPA is ok, what is more general, IMHO).

> Obviously we should fix the required package on RHEL. Will do that.
Comment 6 Lukas "krteknet" Novy 2013-07-09 07:28:43 EDT
I'm not really sure if that's possible, but what do you think about a popt alias translating freeipa to ipa?

Not a solution by itself but it could help in situation when user is following nonofficial/external or fedora documentation/howtos for configuring rhel.
Comment 7 Stef Walter 2013-07-09 09:18:16 EDT
Well, we don't use popt. But I think this is appropriate for patching upstream. Using "ipa" is a more general term and covers both flavors. We would still accept "freeipa" as a command argument.
Comment 8 Simo Sorce 2013-07-09 09:25:47 EDT
Keep in mind that in RHEL the package is called 'ipa' but the actual official name is 'Red Hat Identity Management' :-/
Comment 9 Stef Walter 2013-07-09 09:29:27 EDT
Yeah, it's a bit confusing. But I think referring to it all as "IPA" will be the most understandable to people. Patch upstream. Will be testing in a bit.
Comment 11 Patrik Kis 2013-07-18 04:37:58 EDT
Please note this is not only a documentation bug.
realmd still fails to install its s/w requirements (tries to install freeipa-client instead of ipa-client).

realmd-0.14.2-3.el7

 [root@rhel7 ~ ]# realm -v join ipa.baseos.qe
 * Resolving: _ldap._tcp.ipa.baseos.qe
 * Performing LDAP DSE lookup on: 10.34.24.252
 * Successfully discovered: ipa.baseos.qe
Password for admin: 
 * Couldn't find file: /usr/sbin/ipa-client-install
 * Required files: /usr/sbin/ipa-client-install, /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd
 * Resolving required packages
 ! PackageKit not available: The name org.freedesktop.PackageKit was not provided by any .service files
 ! Necessary packages are not installed: freeipa-client, oddjob, oddjob-mkhomedir, sssd
realm: Couldn't join realm: Necessary packages are not installed: freeipa-client, oddjob, oddjob-mkhomedir, sssd
Comment 12 Stef Walter 2013-07-22 10:12:15 EDT
Pushed a patch to git master.
Comment 14 Ludek Smid 2014-06-13 08:38:22 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.