freeipa

#8364 Nightly test failure while establishing trust: Cannot find specified domain or server name
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

The nightly tests establishing an AD trust are failing in ipa trust-add step with the following error:

Cannot find specified domain or server name

See for instance in PR 225:
- test_idviews: report
- test_smb: report
- test_sssd: report
- test_trust: report

Before establishing the trust, the dnsforwardzone to ad.test is properly added but the command displays a warning:

DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:513 RUN ['ipa', 'dnsforwardzone-add', 'ad.test', '--forwarder', '192.168.122.123', '--forward-policy', 'only']
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:557 ipa: WARNING: DNSSEC validation failed: record 'ad.test. SOA' failed DNSSEC validation on server 192.168.122.98.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:557 Please verify your DNSSEC configuration or disable DNSSEC validation on all IPA servers.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:557 Server will check DNS forwarder(s).
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:557 This may take some time, please wait ...
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:557   Zone name: ad.test.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:557   Active zone: TRUE
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:557   Zone forwarders: 192.168.122.123
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:557   Forward policy: only
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd72:transport.py:217 Exit code: 0

I suspect the issue is linked to the new config of bind (see commit a5cbdb5), using configuration snippet in /etc/named/ipa-options-ext.conf
The tests are disabling dnssec_validation using the pre-snippet way by editing /etc/named.conf but they need to be adapted and update /etc/named/ipa-options-ext.conf instead.

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/4800
- Issue set to the milestone: FreeIPA 4.8.7

master:

  • 14876657794949e8acfeb63e7ccaa512becde7e1 ipatests: fix the disable_dnssec_validation method

Metadata Update from @frenaud:
- Issue set to the milestone: FreeIPA 4.8.8 (was: FreeIPA 4.8.7)

ipa-4-8:

  • 7f19fda0d1fbd4431b0bd704f5c242e499e66e98 ipatests: fix the disable_dnssec_validation method

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.