freeipa

#9551 filter out subdomains from realmdomains list when submitting to a trusted AD DCs
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

When get_realmdomains() method is called, it will filter out subdomains of the IPA primary domain. This is required because Active Directory domain controllers are assuming subdomains already covered by the main domain namespace.

MS-LSAD 3.1.4.7.16.1, 'Forest Trust Collision Generation' defines the method of validating the forest trust information. They are the same as rules in [MS-ADTS] section 6.1.6. Specifically,

  • A top-level name must not be superior to an enabled top-level name for another trusted domain object, unless the current trusted domain object has a corresponding exclusion record.

In practice, we filtered those subdomains already but the code wasn't invalidating a previously retrieved forest trust information.

This can be reproduced by adding few subdomains of the IPA domain manually to realmdomains list and then attempting to establish trust with an AD forest:

# ipa realmdomains-mod --add-domain foo.ipa2.test --force
ipa: WARNING: The _kerberos TXT record from domain foo.ipa2.test could not be created (foo.ipa2.test.: DNS zone not found).
This can happen if the zone is not managed by IPA. Please create the record manually, containing the following value: 'IPA2.TEST'
  Domain: ipa2.test, foo.ipa2.test
# ipa realmdomains-mod --add-domain bar.ipa2.test --force
ipa: WARNING: The _kerberos TXT record from domain bar.ipa2.test could not be created (bar.ipa2.test.: DNS zone not found).
This can happen if the zone is not managed by IPA. Please create the record manually, containing the following value: 'IPA2.TEST'
  Domain: ipa2.test, foo.ipa2.test, bar.ipa2.test
# ipa trust-add win2022-mfpp.test --password
Active Directory domain administrator's password: 
Active Directory domain administrator: Administrator@WIN2022-MFPP.TEST
ipa: ERROR: an internal error has occurred

PR: https://github.com/freeipa/freeipa/pull/7265

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-28559

master:

  • f9a1d74f5ea63a63880abf8d4b5568664c372417 dcerpc: invalidate forest trust info cache when filtering out realm domains

ipa-4-11:

  • e95201fe2f816fc5cc795793782ea71642994a94 dcerpc: invalidate forest trust info cache when filtering out realm domains

ipa-4-10:

  • fc736aaa00082d2a5e23431453a335d6c8035e06 dcerpc: invalidate forest trust info cache when filtering out realm domains

ipa-4-9:

  • 656a11ae961f8d1afad54567cfe8ccb53e084a67 dcerpc: invalidate forest trust info cache when filtering out realm domains

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to When trust to Active Directory is established, trust topology communicated to the trusted Active Directory domain controllers may have contained conflicting information. This information is now refreshed and conflicts are removed as a part of the process to establish trust.
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.