freeipa

#9542 Fix replica connection check for use with AD administrator
Closed: fixed by frenaud. Opened by twoerner.

Closed: fixed
Reopen Issue

Issue

The replica connection check is failing if for example the AD administrator Administrator@AD.EXAMPLE.COM is used for the deployment or promotion of a replica

Steps to Reproduce

  1. Deploy an AD
  2. Enable trust
  3. Enable the AD administrator to act as an IPA admin:
    ipa group-add-member admins --idoverrideusers adminstrator@
  4. Try to deploy a replica / use ipa-replica-conncheck:
    /usr/sbin/ipa-replica-conncheck --master --auto-master-check --realm --hostname --principal administrator@ --password --ca-cert-file /etc/ipa/ca.crt

Actual behavior

ERROR: Remote master check failed with following error message(s):
Insufficient access: not allowed to perform server connection check

Expected behavior

No error.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
ipa-server-4.11.0-5.el9.x86_64
ipa-client-4.11.0-5.el9.x86_64
389-ds-base-2.4.5-3.el9.x86_64
krb5-server-1.21.1-1.el9.x86_64

Metadata Update from @ftrivino:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7245
- Issue assigned to twoerner

Metadata Update from @ftrivino:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-26261

master:

  • 182dca38c2bb84acce8ab5dcfab6fb5e4abf31da principal_has_privilege: Check also idoverriseuser (ipaOriginalUid)

ipa-4-11:

  • 0951236ee1bddcada9d6436e7895e2ed138bfce9 principal_has_privilege: Check also idoverriseuser (ipaOriginalUid)

ipa-4-10:

  • 8c4f1b0dc7992ea7ca4fceaba0a607ad70ff67e6 principal_has_privilege: Check also idoverriseuser (ipaOriginalUid)

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to Privilege checks in IPA API now support ID overrides, allowing trusted Active Directory users to perform various operations like enrolling a replica.

master:

  • b5f40a304c6d1732dc980ac1f4eae1bdc98ca709 Added template for ad_master_1replica_1client
  • d422155f434240dcf450022679b7f051d7268520 ipatests: Test replica installation using AD admin.

ipa-4-12:

  • 8b703150a47bf509f37856bdc27cfa99e85e5e6b ipatests: Test replica installation using AD admin.

ipa-4-11:

  • 0613859f3e0e714ab1fbc2b7913d250305012771 ipatests: Test replica installation using AD admin.

ipa-4-10:

  • 05b6c964e757609f7d90cef4cf354aa55188c4be ipatests: Test replica installation using AD admin.
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/7245
Privilege checks in IPA API now support ID overrides, allowing trusted Active Directory users to perform various operations like enrolling a replica.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.