freeipa

#8589 Intermittent IdM Client Registration Failures
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 1812871

Description of problem:
While performing daily CI runs, we observe IdM client registration problems.
Approximately once every 4/5 CI runs. The environment consists of 2 IdM servers
(master and replica) and ~ 30 Idm clients.  All RHEL 7.7 systems.
Version-Release number of selected component (if applicable):
IdM server:  RHEL 7.7, rhel7/ipa-server:4.6.5-40
IdM clients: ipa-client-4.6.5-11.el7_7.3.x86_64
How reproducible:
The ansible based workflow configured IdM master, then IdM replica, and then 30
clients are being joined via Ansible task
Steps to Reproduce:
1. Complete IdM master and replica setup
2. Run ipa-client-install via ansible playbook targeting about 30 IdM RHEL 7.7
clients
3.
Actual results:
Observe some clients failing the ipa-join step due to authentication issue
(ACIError in HTTPD error_log, and code=17 error in client's
ipaclient-install.log)
Expected results:
All clients join IdM master or replica successfully
Additional info:

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1812871

Metadata Update from @rcritten:
- Issue assigned to rcritten

From Simo:

mod_auth_gssapi supports an additional option:
GssapiDelegCcacheUnique which set to On would cause mod_auth_gssapi to
generate unique ccache names for every new authentication.

This will collect ccaches that will need to be cleaned up. mod_auth_gssapi provides a script to clean up expired ccaches upstream in its contrib directory.

master:

  • 83813cf8f7260d4a367d129e7f6ffeb41efb51d3 Convert reset_to_default_policy into a pytest fixture
  • c6644b8566f747fa80e2c1925b79bad9f8c92bd7 Generate a unique cache for each connection
  • 865c0762aeb1ef0f237a36ea5266208bda8e22bb ipatests: test that stale caches are removed using the sweeper
  • 469274fafaac2a34463c3fe0d056f8111b97e614 Enable the ccache sweep systemd timer
  • d460f02a0ca67af18b8c448531f02e830ffe286f Increase timeout for krbtpolicy to 4800

ipa-4-9:

  • 848dffb59273493ef3abde2a86864e85c8d19eff Convert reset_to_default_policy into a pytest fixture
  • 51b186b6033bafaa39a2b0544b5cdc9c0298208c Generate a unique cache for each connection
  • 22fa1a7e5c49a677b55f71d95d47cc58e0f29c57 ipatests: test that stale caches are removed using the sweeper
  • 068d08577d97258267917f81363a1a033a681803 Enable the ccache sweep systemd timer
  • 28ed75ca0251724e34a447174ae775edca9763e2 Increase timeout for krbtpolicy to 4800

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 6b936361f673d600086338f5c2ee231c98db15c0 Add ccache sweeper files to gitignore

ipa-4-9:

  • 56b84973b9f02e74f2518bd58694b673f88f8d5e Add ccache sweeper files to gitignore
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.