freeipa

#8402 [RFE] ipa-client-install forces nsupdate to bind with gssapi
Closed: fixed by abbra. Opened by fcami.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1854557

[+] Description of problem:
 - During the ipa-client-install, nsupdate runs but tries to bind with GSSAPI.
If the bind fails, nsupdate stops.
[+] How reproducible:
 - Always
[+] Steps to Reproduce:
 1. Run ipa-client-install.
[+] Expected results:
 - nsupdate tries to bind with gssapi but then tries unsecure if gssapi fails

Metadata Update from @fcami:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1854557

In:
https://github.com/freeipa/freeipa/blob/0df4e8813d573f3e6ad1d084823764cf40a4b5c9/ipaclient/install/client.py#L1337

nsupdate is called with -g:
[paths.NSUPDATE, '-g', UPDATE_FILE]

This could be easily enhanced with a second call without -g ; if the first call fails, SSSD's configuration must be switched to 'dyndns_auth' = 'none' .

Metadata Update from @fcami:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/4909

master:

  • 72f44b5596027a42fc6038b5f8dcd9e6c3854f73 ipa-client-install: remove fsync in do_nsupdate()
  • 20c7bd5eba6a8be36abf5dfd03daf235ee113d1d ipa-client-install: invoke nsupdate twice (GSS-TSIG, plain)
  • 2e31e8479a94e75ad33cf50f6eee106283b44b0d ipa-client-install: update sssd.conf if nsupdate requires -g

ipa-4-9:

  • e82f2538326af62802a587dbd66ff1a06514af60 ipa-client-install: remove fsync in do_nsupdate()
  • a8588c5006a61855cb178643916a02513df3fa31 ipa-client-install: invoke nsupdate twice (GSS-TSIG, plain)
  • 3cbd24dd04ece7ab24c5cbd3448a46aeb02363f8 ipa-client-install: update sssd.conf if nsupdate requires -g

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @fcami:
- Custom field changelog adjusted to Invoke nsupdate without authentication if the GSS-TSIG attempt fails at install time ; configure SSSD to use nsupdate without GSS-TSIG in this case.

master:

  • dabf2763f8be750596f9f6e998bce985793e89a8 ipatests: Test unsecure nsupdate.

ipa-4-9:

  • 4fdab0c94c4e17e42e5f38a0e671bea39bcc9b74 ipatests: Test unsecure nsupdate.
Metadata
None
None
None
None
None
Invoke nsupdate without authentication if the GSS-TSIG attempt fails at install time ; configure SSSD to use nsupdate without GSS-TSIG in this case.
https://github.com/freeipa/freeipa/pull/4909
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.