RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 967019 - realmd in RHEL-7.0 relays/refers on FreeIPA and not IPA
Summary: realmd in RHEL-7.0 relays/refers on FreeIPA and not IPA
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: realmd
Version: 7.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: beta
: ---
Assignee: Stef Walter
QA Contact: David Spurek
URL:
Whiteboard:
Depends On:
Blocks: 917662
TreeView+ depends on / blocked
 
Reported: 2013-05-24 14:15 UTC by Patrik Kis
Modified: 2014-06-13 12:38 UTC (History)
3 users (show)

Fixed In Version: realmd-0.14.3-1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 12:38:22 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
FreeDesktop.org 66734 0 None None None Never

Description Patrik Kis 2013-05-24 14:15:36 UTC 
Description of problem:
realmd in RHEL-7 is still referring FreeIPA but what is a Fedora component, but in RHEL the component name is IPA.

Version-Release number of selected component (if applicable):
realmd-0.14.1-1.el7

How reproducible:
always

Steps to Reproduce:
1. Man page:

# man realm | grep -i freeipa
           Only discover realms which run the given server software. Possible values include active-directory or freeipa.
       Joining arbitrary kerberos realms is not supported. The realm must have a supported mechanism for joining from a client machine, such as Active Directory or FreeIPA.
       types of servers can be joined using kerberos credentials, some (like FreeIPA) insist on prompting for a password.
           Only join realms for run the given server software. Possible values include active-directory or freeipa.
           Only leave the realm which is using the given server software. Possible values include active-directory or freeipa.

2. required-package in realm discover, and also when ipa-client is missing realmd is trying to install freeipa-client during join

# realm -v discover ipa.baseos.qe
 * Resolving: _ldap._tcp.dc._msdcs.ipa.baseos.qe
 * Resolving: _ldap._tcp.ipa.baseos.qe
 * Performing LDAP DSE lookup on: 10.34.24.252
 * Successfully discovered: ipa.baseos.qe
ipa.baseos.qe
  type: kerberos
  realm-name: IPA.BASEOS.QE
  domain-name: ipa.baseos.qe
  configured: no
  server-software: freeipa
  client-software: sssd
  required-package: freeipa-client
  required-package: sssd
Comment 2 Stef Walter 2013-07-08 15:59:52 UTC 
Simo, do you know how we can tell the difference between IPA and FreeIPA (KDCs) via LDAP?
Comment 3 Simo Sorce 2013-07-08 16:35:29 UTC 
I am not sure there is a way, perhaps via the 'version' attribute in the rootDSE.
That *may* have different 389ds identification strings on Fedora vs RHEL.

... checking ...

On Fedora19 I see:
vendorName: 389 Project
vendorVersion: 389-Directory/1.3.0.5 B2013.088.023

On RHEL6.3 I see ... the same (just different version ...)

I do not think we have a way to differentiate between 'FreeIPA' and 'Red Hat Identiy Management' at the moment ...
Comment 4 Stef Walter 2013-07-08 16:38:29 UTC 
Thanks Simo, understood.

Patrik, should we change the documentation to refer to both IPA and FreeIPA? Obviously we should fix the required package on RHEL. Will do that.
Comment 5 Patrik Kis 2013-07-09 08:51:49 UTC 
(In reply to Stef Walter from comment #4)
> Thanks Simo, understood.
> 
> Patrik, should we change the documentation to refer to both IPA and FreeIPA?

Yes, that would be fine (or for me also using just IPA is ok, what is more general, IMHO).

> Obviously we should fix the required package on RHEL. Will do that.
Comment 6 Lukas "krteknet" Novy 2013-07-09 11:28:43 UTC 
I'm not really sure if that's possible, but what do you think about a popt alias translating freeipa to ipa?

Not a solution by itself but it could help in situation when user is following nonofficial/external or fedora documentation/howtos for configuring rhel.
Comment 7 Stef Walter 2013-07-09 13:18:16 UTC 
Well, we don't use popt. But I think this is appropriate for patching upstream. Using "ipa" is a more general term and covers both flavors. We would still accept "freeipa" as a command argument.
Comment 8 Simo Sorce 2013-07-09 13:25:47 UTC 
Keep in mind that in RHEL the package is called 'ipa' but the actual official name is 'Red Hat Identity Management' :-/
Comment 9 Stef Walter 2013-07-09 13:29:27 UTC 
Yeah, it's a bit confusing. But I think referring to it all as "IPA" will be the most understandable to people. Patch upstream. Will be testing in a bit.
Comment 11 Patrik Kis 2013-07-18 08:37:58 UTC 
Please note this is not only a documentation bug.
realmd still fails to install its s/w requirements (tries to install freeipa-client instead of ipa-client).

realmd-0.14.2-3.el7

 [root@rhel7 ~ ]# realm -v join ipa.baseos.qe
 * Resolving: _ldap._tcp.ipa.baseos.qe
 * Performing LDAP DSE lookup on: 10.34.24.252
 * Successfully discovered: ipa.baseos.qe
Password for admin: 
 * Couldn't find file: /usr/sbin/ipa-client-install
 * Required files: /usr/sbin/ipa-client-install, /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd
 * Resolving required packages
 ! PackageKit not available: The name org.freedesktop.PackageKit was not provided by any .service files
 ! Necessary packages are not installed: freeipa-client, oddjob, oddjob-mkhomedir, sssd
realm: Couldn't join realm: Necessary packages are not installed: freeipa-client, oddjob, oddjob-mkhomedir, sssd
Comment 12 Stef Walter 2013-07-22 14:12:15 UTC 
Pushed a patch to git master.
Comment 14 Ludek Smid 2014-06-13 12:38:22 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.