freeipa

#8678 Nightly failure (master) in test_trust.py::TestTrust::test_establish_forest_trust_with_shared_secret
Closed: fixed by rcritten. Opened by frenaud.

Closed: fixed
Reopen Issue

The nightly test test_trust.py::TestTrust::test_establish_forest_trust_with_shared_secret is failing in the master branch, see PR #664 with the following logs and report:

self = <ipatests.test_integration.test_trust.TestTrust object at 0x7f9c14e1bd60>
    def test_establish_forest_trust_with_shared_secret(self):
        tasks.configure_dns_for_trust(self.master, self.ad)
        tasks.configure_windows_dns_for_trust(self.ad, self.master)
        # this is a workaround for
        # https://bugzilla.redhat.com/show_bug.cgi?id=1711958
        self.master.run_command(
            ['ipa', 'dnsrecord-add', self.master.domain.name,
             self.srv_gc_record_name,
             '--srv-rec', self.srv_gc_record_value])
        # create windows side of trust using powershell bindings
        # to .Net functions
        ps_cmd = (
            '[System.DirectoryServices.ActiveDirectory.Forest]'
            '::getCurrentForest()'
            '.CreateLocalSideOfTrustRelationship("{}", 1, "{}")'.format(
                self.master.domain.name, self.shared_secret))
>       self.ad.run_command(['powershell', '-c', ps_cmd])
test_integration/test_trust.py:614: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../pytest_multihost/host.py:271: in run_command
    command.wait()
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <pytest_multihost.transport.SSHCommand object at 0x7f9c14c3e5e0>
raiseonerr = True
    def wait(self, raiseonerr=DEFAULT):
        """Wait for the remote process to exit
        Raises an exception if the exit code is not 0, unless ``raiseonerr`` is
        true.
        When ``raiseonerr`` is not specified as argument, the ``raiseonerr``
        attribute is used.
        """
        if raiseonerr is DEFAULT:
            raiseonerr = self.raiseonerr
        if self._done:
            return self.returncode
        self._end_process()
        self._done = True
        if raiseonerr and self.returncode:
            self.log.error('Exit code: %s', self.returncode)
>           raise subprocess.CalledProcessError(self.returncode, self.argv)
E           subprocess.CalledProcessError: Command '['powershell', '-c', '[System.DirectoryServices.ActiveDirectory.Forest]::getCurrentForest().CreateLocalSideOfTrustRelationship("ipa.test", 1, "qwertyuiopQq!1")']' returned non-zero exit status 1.
../pytest_multihost/transport.py:215: CalledProcessError

The powershell command is failing with the following output:

DEBUG    ipatests.pytest_ipa.integration.host.WinHost.ad-root.cmd8:transport.py:513 RUN ['powershell', '-c', '[System.DirectoryServices.ActiveDirectory.Forest]::getCurrentForest().CreateLocalSideOfTrustRelationship("ipa.test", 1, "qwertyuiopQq!1")']
DEBUG    ipatests.pytest_ipa.integration.host.WinHost.ad-root.cmd8:transport.py:557 Could not chdir to home directory /home/Administrator: No such file or directory
DEBUG    ipatests.pytest_ipa.integration.host.WinHost.ad-root.cmd8:transport.py:557 bash: line 1: cd: /home/Administrator: No such file or directory
DEBUG    ipatests.pytest_ipa.integration.host.WinHost.ad-root.cmd8:transport.py:557 bash: line 2: /home/Administrator/env.sh: No such file or directory
DEBUG    ipatests.pytest_ipa.integration.host.WinHost.ad-root.cmd8:transport.py:557 Exception calling "CreateLocalSideOfTrustRelationship" with "3" argument(s): 
DEBUG    ipatests.pytest_ipa.integration.host.WinHost.ad-root.cmd8:transport.py:557 "A forest trust relationship exists between "ad.test" and "ipa.test"."
DEBUG    ipatests.pytest_ipa.integration.host.WinHost.ad-root.cmd8:transport.py:557 At line:1 char:1

A closer look at the previous test test_trust.py::TestTrust::test_remove_external_rootdomain_trust shows that the trust was not removed from AD side:

INFO     ipatests.pytest_ipa.integration.host.Host.master.IPAOpenSSHTransport:transport.py:391 RUN ['rpcclient', 'ad.test', '-U\\Administrator%Secret123', '-c', 'deletetrustdom ipa.test']
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd684:transport.py:513 RUN ['rpcclient', 'ad.test', '-U\\Administrator%Secret123', '-c', 'deletetrustdom ipa.test']
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd684:transport.py:557 Cannot connect to server.  Error was NT_STATUS_UNSUCCESSFUL
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd684:transport.py:217 Exit code: 1

Need to investigate why the removal failed.

I think we need to switch creds in rpcclient to FQDN: instead of \\Administrator use Administrator@ad.domain.

Verified on local system with Samba 4.13+:

[root@master samba]# rpcclient win2016.test -U \\\\Administrator%Secret123
Cannot connect to server.  Error was NT_STATUS_LOGON_FAILURE
[root@master samba]# rpcclient win2016.test -U Administrator@win2016.test%Secret123
rpcclient $>

PR: https://github.com/freeipa/freeipa/pull/5473

@frenaud I didn't add a test commit to run test_trust because we still use F32 for gating where test_trust passes. Please review.

master:

  • afcb06006c46073838ca196ac6d235854c91b854 Add design document for using AD users/groups in SUDO rules
  • 172e4b977048af7cdb244b52aec08a024749962e baseldap: refactor validator support in add_external_pre_callback
  • 5fae809d921c58b6450d4d10f46b9013e1e31da1 baseldap: when adding external objects, differentiate between them and failures
  • 0ffdfc70f26e6f863c69c2ff03219e96dd5fd618 idviews: add extended validator for users from trusted domains
  • a37db297f036390c6b75eca77fa88422df4f51a0 sudorule-add-user: allow to reference users and groups from trusted domains directly
  • 349322e3fb6da88a964d53e6f157743b29e40d30 sudorule runAs: allow to add users and groups from trusted domains directly
  • 09e06e05641be5e71d5a1a6a273cb0c3c0c4531b ipatests: fix test_sudorule_plugin's wrong argument use
  • 642b81e99f6f267c2c24a47816a2f9ae7464a858 test_trust: add tests for using AD users and groups in SUDO rules
  • c91a1a078aea9996d30854ede1ce266f74a6176f ipatests: when talking to AD DCs, use FQDN credentials
  • 08d720982876926ba555b94fdde6c84469b20868 baseldap: allow rejecting unknown objects instead of adding to an external attr

ipa-4-9:

  • 16b30cbe5e4f1fd8965ed27ba2ca9b4b7b295e9c Add design document for using AD users/groups in SUDO rules
  • 132d7fb0ed21e2e7cc69366e2141ae69e7864afb baseldap: refactor validator support in add_external_pre_callback
  • ffc2edf61efccbcbd4294fbc8a8613decea299a3 baseldap: when adding external objects, differentiate between them and failures
  • a3563d1c35fbe9e6e96199ead211ec3b4ff1d2d2 idviews: add extended validator for users from trusted domains
  • 054a068f4705cd715789ceda75fa709404d5f884 sudorule-add-user: allow to reference users and groups from trusted domains directly
  • 78043bfb5e2a3b1fc0fae6d55ba605ba469ce5ae sudorule runAs: allow to add users and groups from trusted domains directly
  • f4d3c91e7f80659268e006dffa5f064b29b45c98 ipatests: fix test_sudorule_plugin's wrong argument use
  • a7c56fde7727bfad3f885cf50e21182cdc46024e test_trust: add tests for using AD users and groups in SUDO rules
  • 64b70be65698b12927795a7a8b79ef7aada010b8 ipatests: when talking to AD DCs, use FQDN credentials
  • 51ca38772f41d3a26a4253a732338d09a69f9647 baseldap: allow rejecting unknown objects instead of adding to an external attr

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

test-failure tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.