freeipa

#5976 replica-promotion: is possible to set invalid IPA domain
Closed: Fixed Opened by mbasti.

Closed: Fixed
Reopen Issue

All replicas in topology should have one IPA domain (api.env.domain)

But with replica promotion is possible to set different api.env.domain for each replica.

This is blocker for DNS location feature and any dynamic records generator, also it can cause harm in 4.3.x topologies, because different domains may parse results differently, adding system SRV records will not work.

This behavior is not reproducible on 4.2, thus this is regression.

Steps to reproduce:
1. [master]# ipa-server-install --domain ipadomain.test.
1. [replica]# ipa-client-install --domain random.domain. --server ipa.replica.ipadomain.test
1. [replica]# ipa-replica-install
1. api.env.domain is random.domain, expected is ipadomain.test.

[root@vm-058-114 ~]# ipa-client-install --server vm-012.ipa.test. --domain vm-012.ipa.test
[root@vm-058-114 ~]# ipa-replica-install
[root@vm-058-114 ~]# ipa dns-update-system-records
ipa: WARNING: IPA does not manage the zone vm-012.ipa.test., please add records to your DNS server manually
  IPA DNS records:
    _kerberos-master._tcp.vm-012.ipa.test. 86400 IN SRV 0 100 88 vm-012.ipa.test.
    _kerberos-master._tcp.vm-012.ipa.test. 86400 IN SRV 0 100 88 vm-058-114.ipa.test.
...
[root@vm-058-114 ~]# ipa dnszone-find
  Zone name: ipa.test.
<nothing else>

Blocker for DNS locations, this feature will not work on replicas with invalid api.env.domain

master:

  • 9ae98420e94ea2973ecc21be0a984eac855a2a14 Replica promotion: use the correct IPA domain for replica

ipa-4-3:

  • 290e6c08c9eccb585e8b0b760115a0d442e72787 Replica promotion: use the correct IPA domain for replica

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=837369 (Red Hat Enterprise Linux 7)

The check is too strict and prevents installation even if domain used in ipa-client-install has different casing (e.g. upper case) than the domain stored in LDAP. We need to compare these two as real domain names and not strings. I will send a patch.

master:

  • 8b12ef50e1c016a5a025cf2a69271f769b585a03 client: Share validator and domain name normalization with server install

ipa-4-3:

  • 3d71c43504ea7837ea14bb9dd4a469c07337293f client: Share validator and domain name normalization with server install

ipa-4-3:

  • 8ce40940300e0e37191251a8a26bb8a4b5fcd604 Move normalize_hostname to where it is expected

Tests:

  • master: f784532d4ed6f25cf8ba12f83a7c322515434855
  • ipa-4-3: 844364bd2770b267c6e913de75b7caa926489c75

Metadata Update from @mbasti:
- Issue assigned to pspacek
- Issue set to the milestone: FreeIPA 4.3.2
Metadata
None
None
None
Lowest
defect
IPA
1
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.