freeipa

#5769 ipa-client-install fails to update DNS if service principal for SOA master does not exist
Closed: Invalid Opened by pdf.

Closed: Invalid
Reopen Issue

I have a public zone that I register clients against, that has 'fake_mname' disabled, and an SOA master that does not match an IPA master, so there's no DNS service principal available for that hostname. The result (with recent IPA versions, I'm pretty sure this used to work) is that DNS updates fail with the error:

tkey query failed: GSSAPI error: Major = Unspecified GSS failure.  Minor code may provide more information, Minor = Server DNS/ns0.example.com@example.com not found in Kerberos database.

Debug log attached, where: example.com is the domain; ns0.example.com is the SOA master; ipamaster.example.com is the IPA master; and ipaclient.example.com is the joining client.

I worked around this by creating a service principal and adding it to the keytab for named, but I'm fairly certain that this configuration used to work, perhaps the update mechanism has changed?

This might work in the past because IPA was always generating 'server' directive for nsupdate.

That accidentally worked around your misconfiguration but broke other use-cases.

The solution with keytab you found is actually the correct one, there has to be a Kerberos key (or alias) for MNAME in SOA record.

Having said that, I'm inclined to closing this as wontfix.

Might be worth a documentation update - I suspect this is not all that common a configuration, but I didn't see any notice of the potentially breaking change in the upgrade notes.

AFAIK this change was done several releases ago and it affects only invalid configurations so the effect is questionable ...

Anyway, I'm sorry we caused you inconvenience and thank you for taking your time to report it.

notabug, this is expected behavior for this misconfigured case

Metadata Update from @pdf:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE
Metadata
None
None
None
Normal
defect
IPA
0
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.