freeipa

#6967 Joining realm failed: No permission to join this host to the IPA domain
Closed: invalid Opened by rajgw.

Closed: invalid
Reopen Issue

I am working to Set Up Centralized Linux Authentication with FreeIPA on fedora23, so I follow this document

  1. freeipa-server==> https://www.digitalocean.com/community/tutorials/how-to-set-up-centralized-linux-authentication-with-freeipa-on-centos-7

  2. freeipa-client ==> https://www.digitalocean.com/community/tutorials/how-to-configure-a-freeipa-client-on-centos-7

I have configured based on this tutorials its works fine.

I have create new user in freeipa-server, using below command:

ipa user-add raj --first=raj --last=test --password

--> its created in freeipa-server.

After, I try to configure freeipa-client machine using this user(raj). But its throw "Joining realm failed: No permission to join this host to the IPA domain" error.

full report:

  # ipa-client-install --mkhomedir
    Using existing certificate '/etc/ipa/ca.crt'.
    DNS discovery failed to determine your DNS domain
    Provide the domain name of your IPA server (ex: example.com): freeipa-server.test.mobi
    Provide your IPA server name (ex: ipa.example.com): freeipa-server.test.mobi
    The failure to use DNS to find your IPA server indicates that your resolv.conf file is not properly configured.
    Autodiscovery of servers for failover cannot work with this configuration.
    If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
    Proceed with fixed values and no DNS discovery? [no]: yes
    Client hostname: freeipa-client.test.mobi
    Realm: FREEIPA-SERVER.TEST.MOBI
    DNS Domain: freeipa-server.test.mobi
    IPA Server: freeipa-server.test.mobi
    BaseDN: dc=freeipa-server,dc=test,dc=mobi
    Continue to configure the system with these values? [no]: yes
    Synchronizing time with KDC...
    Attempting to sync time using ntpd.  Will timeout after 15 seconds
    User authorized to enroll computers: raj
    Password for raj@FREEIPA-SERVER.TEST.MOBI:
    Joining realm failed: No permission to join this host to the IPA domain.
    Installation failed. Rolling back changes.
    IPA client is not configured on this system.

But, if i use "admin" as a "User authorized to enroll computers" its works fine.

Suggest What i miss and How to create a user in freeipa-server for freeip-client configuration.

Hello,

First of all, the official documentation which describes the client installation process is to be found on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/setting-up-clients.html.

If you look into the log you sent, you will find:
Joining realm failed: No permission to join this host to the IPA domain.
This alone should give you some pointer that your created user is missing something, obviously you don't want anyone adding any computer they think of to your IPA domain.

To be able to add new client machines to IPA, your user needs at least Host Administrators privilege (see the following discussion https://www.redhat.com/archives/freeipa-users/2015-March/msg00557.html).

That being said, these privileges are not being discussed in the official documentation either. I wonder whether they should.

true, one must assign appropriate role/privileges/permissions to a user in order to enroll a host. Do make is simpler a new role will be created - see #6852

So closing because this is a not a bug.

Metadata Update from @pvoborni:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.