Issue

When installing an IPA server instance on a platform which installs the named keytab in a non-standard location (such as Debian), the installation fails.

This is due to the krb5_keytab directive not being used in the named configuration template, resulting in a failure to authenticate with the LDAP server once named starts up and tries to load dynamic DNS entries. The keytab is properly created in the overridden location, but if the directive is not specified, bind defaults to using /etc/bind/krb5.keytab which - in this configuration - does not exist.

The nonstandard location is the way it is on some platforms for various reasons, ranging from historical to philosophical - nevertheless, it is a configurable option that IPA seemingly supports but is currently broken.

Steps to Reproduce

1. Override NAMED_KEYTAB in ipaplatform/paths.py or the paths.py file in the platform you are testing on with a path other than the default (/etc/bind/krb5.keytab)
2. Run ipa-server-install
3. Observe failure when named attempts to start or DNS lookups are made to entires stored in LDAP

Actual behavior

ipa-install-server fails to configure a working instance. named fails to authenticate with the LDAP server.

Expected behavior

ipa-install-server successfully configures a working instance. named authenticates successfully with the keytab in the nonstandard location.

Version/Release/Distribution

freeipa-server 4.10.1 (testing on Debian)

Additional Information

I can't seem to edit the metadata of the issue, but on-review should be set to https://github.com/freeipa/freeipa/pull/6705

Modifications or additions to the server upgrade procedure should not be required, since existing installs would already either be using the default keytab path (and as such would not need the directive) or have manually configured it themselves (in which case their configuration shouldn't be altered).