freeipa

Clone
Source Code
GIT

#9542 Fix replica connection check for use with AD administrator
Closed: fixed 9 months ago by frenaud. Opened 11 months ago by twoerner.

Closed: fixed
Reopen Issue

Issue

The replica connection check is failing if for example the AD administrator Administrator@AD.EXAMPLE.COM is used for the deployment or promotion of a replica

Steps to Reproduce

  1. Deploy an AD
  2. Enable trust
  3. Enable the AD administrator to act as an IPA admin:
    ipa group-add-member admins --idoverrideusers adminstrator@<ad_domain>
  4. Try to deploy a replica / use ipa-replica-conncheck:
    /usr/sbin/ipa-replica-conncheck --master <server_fqdn> --auto-master-check --realm <REALM> --hostname <replica_fqdn> --principal administrator@<ad_domain> --password <AD admin password> --ca-cert-file /etc/ipa/ca.crt

Actual behavior

ERROR: Remote master check failed with following error message(s):
Insufficient access: not allowed to perform server connection check

Expected behavior

No error.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
ipa-server-4.11.0-5.el9.x86_64
ipa-client-4.11.0-5.el9.x86_64
389-ds-base-2.4.5-3.el9.x86_64
krb5-server-1.21.1-1.el9.x86_64

Metadata Update from @ftrivino:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7245
- Issue assigned to twoerner
11 months ago

Metadata Update from @ftrivino:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-26261
11 months ago

master:

  • 182dca3 principal_has_privilege: Check also idoverriseuser (ipaOriginalUid)

ipa-4-11:

  • 0951236 principal_has_privilege: Check also idoverriseuser (ipaOriginalUid)

ipa-4-10:

  • 8c4f1b0 principal_has_privilege: Check also idoverriseuser (ipaOriginalUid)

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
9 months ago

Metadata Update from @abbra:
- Custom field changelog adjusted to Privilege checks in IPA API now support ID overrides, allowing trusted Active Directory users to perform various operations like enrolling a replica.
8 months ago

master:

  • b5f40a3 Added template for ad_master_1replica_1client
  • d422155 ipatests: Test replica installation using AD admin.

ipa-4-12:

  • 8b70315 ipatests: Test replica installation using AD admin.

ipa-4-11:

  • 0613859 ipatests: Test replica installation using AD admin.

ipa-4-10:

  • 05b6c96 ipatests: Test replica installation using AD admin.

Log in to comment on this ticket.

Metadata
None
None
None
None
None
None
None
None
None
None
None
None
None
None
https://github.com/freeipa/freeipa/pull/7245
None
None
None
None
None
Privilege checks in IPA API now support ID overrides, allowing trusted Active Directory users to perform various operations like enrolling a replica.
None
Powered by Pagure 5.14.1
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.