freeipa

#6523 Review dns_lookup_kdc option for ipa-client-install
Closed: fixed by abbra. Opened by jstephen.

Closed: fixed
Reopen Issue

When certain options are passed to ipa-client-install, DNS discovery is disabled causing the dns_lookup_realm and dns_lookup_kdc krb5.conf options to be set to 'False'. If an AD trust is added then login attempts will fail on IDM clients(SSSD calls the krb5_child using libkrb5 to discover the AD realm KDC to communicate with) as no explicit AD realm information gets added to krb5.conf on IDM clients, only the IDM realm section KDC information. This can be fixed by setting dns_lookup_kdc to 'True'

The concern here is IPA administrators will not be aware of this, or an AD trust is added months later and these krb5.conf options are forgotten.

According to the man page if dns_lookup_kdc is true libkrb5 will still check the kdc entries in the realm section. Could there be consideration for setting the dns_lookup options to true by default and adding a new option for ipa-client-install to set dns_lookup_kdc = false explicitly?

Reproducer steps:

  • Install IDM Server
  • Install IDM Client with --server argument
  • Configure AD Trust
  • Attempt to login as AD user on IDM client, fails if dns_lookup_kdc = false

Metadata Update from @jstephen:
- Issue assigned to someone
- Issue set to the milestone: Future Releases

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1482965 (was: todo)

Issue linked to bug 1482965

Metadata Update from @pvoborni:
- Issue close_status updated to: None
- Issue priority set to: important (was: normal)

master:

  • 18a1e7ee5c4b99f8c1362e5a549b88c22d8145df ipatests: make sure dns_lookup_kdc is always true
  • e7827a6f0cd1785f914ec317f0be19535ea96e83 ipa-client-install: unilaterally set dns_lookup_kdc to True

ipa-4-8:

  • 1f282c29042e35717b1c9f037bb6bb4a8da16063 ipatests: make sure dns_lookup_kdc is always true
  • bff0994362d5640a820d8242eb012cd14174f732 ipa-client-install: unilaterally set dns_lookup_kdc to True

ipa-4-9:

  • 3c965a07f6cca68a039bbaae5d6a54067f5f38c5 ipatests: make sure dns_lookup_kdc is always true
  • 352f2beeb77b3a08fabc94ccb08d0b561b457408 ipa-client-install: unilaterally set dns_lookup_kdc to True

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • b707af1c687839764774370dcf2acdbb21b0b413 ipatests: do not set dns_lookup to true

ipa-4-9:

  • 8d7697af269e68e051ce969ae9cc835f5ba6a3b7 ipatests: do not set dns_lookup to true

ipa-4-8:

  • 1164ccbcc3948cc46c50d43258c149dde3c2b751 ipatests: do not set dns_lookup to true
Metadata
None
None
None
Low
defect
IPA
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.