freeipa

#6866 ipa trust-fetch-domains: ValidationError: invalid 'Credentials': Missing credentials for cross-forest communication
Closed: fixed Opened by pvoborni.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1438366

Description of problem: ipa trust-fetch-domains command displays
'ValidationError: invalid 'Credentials': Missing credentials for cross-forest
communication'
Version-Release number of selected component (if applicable):
ipa-server-dns-4.5.0-4.el7.noarch
ipa-server-trust-ad-4.5.0-4.el7.x86_64
ipa-server-common-4.5.0-4.el7.noarch
ipa-server-4.5.0-4.el7.x86_64
samba-4.6.2-0.el7.x86_64
How reproducible: Always
Steps to Reproduce:
1. Add trust
[root@autohv01 ~]# ipa trust-add --two-way=true
2. ipa trustdomain-find
[root@autohv01 ~]# ipa trustdomain-find ipaad2008r2.test
  Domain name: ipaad2008r2.test
  Domain NetBIOS name: IPAAD2008R2
  Domain Security Identifier: S-1-5-21-1765444267-4284514389-3232425237
  Domain enabled: True
  Domain name: ipasub2008r2-1.ipaad2008r2.test
  Domain NetBIOS name: IPASUB2008R2-1
  Domain Security Identifier: S-1-5-21-469193889-4273894478-2486872656
  Domain enabled: True
----------------------------
Number of entries returned 2
----------------------------
3.ipa trustdomain-disable ipaad2008r2.test ipasub2008r2-1.ipaad2008r2.test
-------------------------------------------------------
Disabled trust domain "ipasub2008r2-1.ipaad2008r2.test"
-------------------------------------------------------
  Domain name: ipasub2008r2-1.ipaad2008r2.test
  Domain NetBIOS name: IPASUB2008R2-1
  Domain Security Identifier: S-1-5-21-469193889-4273894478-2486872656
  Domain enabled: False
----------------------------
Number of entries returned 1
----------------------------
4. [root@autohv01 ~]# ipa trust-fetch-domains ipaad2008r2.test
Actual results:
ipa: DEBUG: importing all plugin modules in
ipaclient.remote_plugins.schema$0878133d...
ipa: DEBUG: importing plugin module
ipaclient.remote_plugins.schema$0878133d.plugins
ipa: DEBUG: importing all plugin modules in ipaclient.plugins...
ipa: DEBUG: importing plugin module ipaclient.plugins.automember
ipa: DEBUG: importing plugin module ipaclient.plugins.automount
ipa: DEBUG: importing plugin module ipaclient.plugins.ca
ipa: DEBUG: importing plugin module ipaclient.plugins.cert
ipa: DEBUG: importing plugin module ipaclient.plugins.certmap
ipa: DEBUG: importing plugin module ipaclient.plugins.certprofile
ipa: DEBUG: importing plugin module ipaclient.plugins.dns
ipa: DEBUG: importing plugin module ipaclient.plugins.hbacrule
ipa: DEBUG: importing plugin module ipaclient.plugins.hbactest
ipa: DEBUG: importing plugin module ipaclient.plugins.host
ipa: DEBUG: importing plugin module ipaclient.plugins.idrange
ipa: DEBUG: importing plugin module ipaclient.plugins.internal
ipa: DEBUG: importing plugin module ipaclient.plugins.location
ipa: DEBUG: importing plugin module ipaclient.plugins.migration
ipa: DEBUG: importing plugin module ipaclient.plugins.misc
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey
ipa: DEBUG: importing plugin module ipaclient.plugins.passwd
ipa: DEBUG: importing plugin module ipaclient.plugins.permission
ipa: DEBUG: importing plugin module ipaclient.plugins.rpcclient
ipa: DEBUG: importing plugin module ipaclient.plugins.server
ipa: DEBUG: importing plugin module ipaclient.plugins.service
ipa: DEBUG: importing plugin module ipaclient.plugins.sudorule
ipa: DEBUG: importing plugin module ipaclient.plugins.topology
ipa: DEBUG: importing plugin module ipaclient.plugins.trust
ipa: DEBUG: importing plugin module ipaclient.plugins.user
ipa: DEBUG: importing plugin module ipaclient.plugins.vault
ipa: DEBUG: found session_cookie in persistent storage for principal
'admin@TESTREAL.TEST', cookie: 'ipa_session=MagBearerToken=huWt5qjTB%2flQu7qOjG
PEo%2fosJ0WzT8%2fXqqAaAQ6dUazMmWHmWJZktarmh%2f%2b0JnFPzPgYW9gX5qLwemhl58DNFxi9H
VqmvF5ivsfTpeWO2hKk1GnMoS4WOT2uUcyOBBOcRQjeti5Jj4YDDYOCB9K1XzobAgGlC2vyRaWXjl7d
1izmTvuKdnv4YGjKMTIzzj4R'
ipa: DEBUG: setting session_cookie into context 'ipa_session=MagBearerToken=huW
t5qjTB%2flQu7qOjGPEo%2fosJ0WzT8%2fXqqAaAQ6dUazMmWHmWJZktarmh%2f%2b0JnFPzPgYW9gX
5qLwemhl58DNFxi9HVqmvF5ivsfTpeWO2hKk1GnMoS4WOT2uUcyOBBOcRQjeti5Jj4YDDYOCB9K1Xzo
bAgGlC2vyRaWXjl7d1izmTvuKdnv4YGjKMTIzzj4R;'
ipa: INFO: trying https://autohv01.testreal.test/ipa/session/json
ipa: DEBUG: Created connection context.rpcclient_52203344
ipa: DEBUG: raw: trust_fetch_domains(u'ipaad2008r2.test', version=u'2.224')
ipa: DEBUG: trust_fetch_domains(u'ipaad2008r2.test', version=u'2.224')
ipa: INFO: Forwarding 'trust_fetch_domains/1' to json server
'https://autohv01.testreal.test/ipa/session/json'
ipa: DEBUG: New HTTP connection (autohv01.testreal.test)
ipa: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=hu
Wt5qjTB%2flQu7qOjGPEo%2fosJ0WzT8%2fXqqAaAQ6dUazMmWHmWJZktarmh%2f%2b0JnFPzPgYW9g
X5qLwemhl58DNFxi9HVqmvF5ivsfTpeWO2hKk1GnMoS4WOT2uUcyOBBOcRQjeti5Jj4YDDYOCB9K1Xz
obAgGlC2vyRaWXjl7d1izmTvuKdnv4YGjKMTIzzj4R&expiry=1491208631328301;Max-Age=1800
;path=/ipa;httponly;secure;']'
ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=huWt5qjTB%2flQu7qOjGPEo%
2fosJ0WzT8%2fXqqAaAQ6dUazMmWHmWJZktarmh%2f%2b0JnFPzPgYW9gX5qLwemhl58DNFxi9HVqmv
F5ivsfTpeWO2hKk1GnMoS4WOT2uUcyOBBOcRQjeti5Jj4YDDYOCB9K1XzobAgGlC2vyRaWXjl7d1izm
TvuKdnv4YGjKMTIzzj4R;' for principal admin@TESTREAL.TEST
ipa: DEBUG: Destroyed connection context.rpcclient_52203344
ipa: ERROR: invalid 'Credentials': Missing credentials for cross-forest
communication
2. /var/log/httpd/error_log
[Mon Apr 03 04:21:11.665932 2017] [:warn] [pid 31808] [client
2620:52:0:1322:5054:ff:fef8:fbe4:48266] failed to set perms (3140) on file
(/var/run/ipa/ccaches/admin@TESTREAL.TEST)!, referer:
https://autohv01.testreal.test/ipa/xml
[Mon Apr 03 04:21:11.667158 2017] [:error] [pid 31804] ipa: DEBUG: WSGI
wsgi_dispatch.__call__:
[Mon Apr 03 04:21:11.667218 2017] [:error] [pid 31804] ipa: DEBUG: WSGI
jsonserver_session.__call__:
[Mon Apr 03 04:21:11.678497 2017] [:error] [pid 31804] ipa: DEBUG: Created
connection context.ldap2_93915247484880
[Mon Apr 03 04:21:11.678547 2017] [:error] [pid 31804] ipa: DEBUG: WSGI
jsonserver.__call__:
[Mon Apr 03 04:21:11.678578 2017] [:error] [pid 31804] ipa: DEBUG: WSGI
WSGIExecutioner.__call__:
[Mon Apr 03 04:21:11.683516 2017] [:error] [pid 31804] ipa: DEBUG: raw:
trust_fetch_domains(u'ipaad2008r2.test', version=u'2.224')
[Mon Apr 03 04:21:11.683657 2017] [:error] [pid 31804] ipa: DEBUG:
trust_fetch_domains(u'ipaad2008r2.test', rights=False, all=False, raw=False,
version=u'2.224')
[Mon Apr 03 04:21:11.683920 2017] [:error] [pid 31804] ipa: DEBUG: raw:
adtrust_is_enabled(version=u'2.224')
[Mon Apr 03 04:21:11.683988 2017] [:error] [pid 31804] ipa: DEBUG:
adtrust_is_enabled(version=u'2.224')
[Mon Apr 03 04:21:11.686732 2017] [:error] [pid 31804] ipa: DEBUG: retrieving
schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-TESTREAL-TEST.socket
conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x556a5ad20248>
[Mon Apr 03 04:21:11.923133 2017] [:error] [pid 31804] ipa: DEBUG: raw:
trust_show(u'ipaad2008r2.test', all=True, raw=True, version=u'2.224')
[Mon Apr 03 04:21:11.923295 2017] [:error] [pid 31804] ipa: DEBUG:
trust_show(u'ipaad2008r2.test', rights=False, all=True, raw=True,
version=u'2.224')
[Mon Apr 03 04:21:12.159803 2017] [:error] [pid 31804] ipa: DEBUG: WSGI
wsgi_execute PublicError: Traceback (most recent call last):
[Mon Apr 03 04:21:12.159830 2017] [:error] [pid 31804]   File
"/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 367, in
wsgi_execute
[Mon Apr 03 04:21:12.159831 2017] [:error] [pid 31804]     result =
command(*args, **options)
[Mon Apr 03 04:21:12.159832 2017] [:error] [pid 31804]   File
"/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 447, in __call__
[Mon Apr 03 04:21:12.159834 2017] [:error] [pid 31804]     return
self.__do_call(*args, **options)
[Mon Apr 03 04:21:12.159836 2017] [:error] [pid 31804]   File
"/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 475, in __do_call
[Mon Apr 03 04:21:12.159837 2017] [:error] [pid 31804]     ret =
self.run(*args, **options)
[Mon Apr 03 04:21:12.159838 2017] [:error] [pid 31804]   File
"/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 797, in run
[Mon Apr 03 04:21:12.159839 2017] [:error] [pid 31804]     return
self.execute(*args, **options)
[Mon Apr 03 04:21:12.159841 2017] [:error] [pid 31804]   File
"/usr/lib/python2.7/site-packages/ipaserver/plugins/trust.py", line 1776, in
execute
[Mon Apr 03 04:21:12.159842 2017] [:error] [pid 31804]     res =
fetch_domains_from_trust(self.api, trustinstance, **options)
[Mon Apr 03 04:21:12.159844 2017] [:error] [pid 31804]   File
"/usr/lib/python2.7/site-packages/ipaserver/plugins/trust.py", line 1661, in
fetch_domains_from_trust
[Mon Apr 03 04:21:12.159845 2017] [:error] [pid 31804]     server=server)
[Mon Apr 03 04:21:12.159846 2017] [:error] [pid 31804]   File
"/usr/lib/python2.7/site-packages/ipaserver/dcerpc.py", line 1433, in
fetch_domains
[Mon Apr 03 04:21:12.159847 2017] [:error] [pid 31804]     error=_('Missing
credentials for '
[Mon Apr 03 04:21:12.159848 2017] [:error] [pid 31804] ValidationError: invalid
'Credentials': Missing credentials for cross-forest communication
[Mon Apr 03 04:21:12.159849 2017] [:error] [pid 31804]
[Mon Apr 03 04:21:12.159995 2017] [:error] [pid 31804] ipa: INFO:
[jsonserver_session] admin@TESTREAL.TEST:
trust_fetch_domains/1(u'ipaad2008r2.test', version=u'2.224'): ValidationError
[Mon Apr 03 04:21:12.160750 2017] [:error] [pid 31804] ipa: DEBUG: Destroyed
connection context.ldap2_93915247484880
Expected results: ValidationError: invalid 'Credentials': Missing credentials
for cross-forest communication should be fixed.

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1438366

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1438366

Actually fixed as a part of https://github.com/freeipa/freeipa/pull/682 - #6859

master:

aef77b3529540ad12939a2cc54996c341c5d49d3 ipaserver/dcerpc: unify error processing
e560899cce20ca7773a5ce46a1c29db1349e8ec7 trust: always use oddjobd helper for fetching trust information

ipa-4-5:

bbb23fc87a51218960d54f9eccc23405c5c5ded6 ipaserver/dcerpc: unify error processing
45e1998c51e281c8371ae31762016cb1ddec406f trust: always use oddjobd helper for fetching trust information

Metadata Update from @pvoborni:
- Issue priority set to: blocker

closing based on the previous comment (fixed in #6859). @abbra please reopen if this is wrong.

Metadata Update from @pvoborni:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.