freeipa

#8478 Do SRV discovery in ipa-getkeytab if -s and -H aren't provided
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Request for enhancement

As an administrator I'd like to run ipa-getkeytab and let it find an IPA server rather than specifying one on the command-line or relying on /etc/ipa/default.conf. If multiple servers are discovered keep trying on connection errors but fail hard on anything else.

This will make automation of ipa-getkeytab much simpler as it can find and potentially try multiple servers until the keytab is obtained.

To make it less invasive, I'd suggest we simply add a special value for -s <server> option: if a server name specified is _srv_, then we do dynamic discovery instead of using /etc/ipa/default.conf.

This would be in line with SSSD way of representing dynamic discovery that is already implemented and would be an explicit action by an administrator asking the specific behavior.

certmonger has srv handling code we could lift for this but I'm not aware of any library that provides this capability. It's a couple hundred LoC in certmonger.

Metadata Update from @rcritten:
- Issue assigned to rcritten

https://github.com/freeipa/freeipa/pull/5905

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1988383

Issue linked to Bugzilla: Bug 1988383

master:

  • ae05970ea72dbc5039bfbc1729c2819e21b5d26d ipa-getkeytab: add option to discover servers using DNS SRV
  • fece03d446d95afdbcc1894fb67ee6942887b2f2 ipa-getkeytab: fix compiler warnings
  • 7729b1c8ffc6b08ef19c541b38e461a6516d27f9 ipatests: test ipa-getkeytab server option

ipa-4-9:

  • 42206df69adc9c1eefa3ee576891b2ae3ac269e0 ipa-getkeytab: add option to discover servers using DNS SRV
  • 0114d24ea160676b784ef7010c19bbacc67ceea0 ipa-getkeytab: fix compiler warnings
  • 7a13200fd8b92dd90ebc4b6416ef25659df8aa71 ipatests: test ipa-getkeytab server option

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.