freeipa

#9702 ipa trust-add fails in FIPS mode with an internal error has occurred
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

In FIPS mode, the command ipa trust-add fails with an internal error has occurred.

Steps to Reproduce

  1. Install a machine in FIPS mode, configure ipa server
  2. Execute ipa trust-add in one-way mode

Actual behavior

The command fails with ipa: ERROR: an internal error has occurred

/var/log/httpd/error_log:

to set perms (3140) on file (/run/ipa/ccaches/admin@UFREEIPA.TEST-r3n4qZ)!, referer: https://master.ufreeipa.test/ipa/xml
] ipa: ERROR: non-public: OSError: encryption failed
] Traceback (most recent call last):
]   File "/usr/lib/python3.13/site-packages/ipaserver/rpcserver.py", line 417, in wsgi_execute
]     result = command(*args, **options)
]   File "/usr/lib/python3.13/site-packages/ipalib/frontend.py", line 477, in __call__
]     return self.__do_call(*args, **options)
]            ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
]   File "/usr/lib/python3.13/site-packages/ipalib/frontend.py", line 544, in __do_call
]     ret = self.run(*args, **options)
]   File "/usr/lib/python3.13/site-packages/ipalib/frontend.py", line 885, in run
]     return self.execute(*args, **options)
]            ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
]   File "/usr/lib/python3.13/site-packages/ipaserver/plugins/trust.py", line 769, in execute
]     result = self.execute_ad(full_join, *keys, **options)
]   File "/usr/lib/python3.13/site-packages/ipaserver/plugins/trust.py", line 1030, in execute_ad
]     result = self.trustinstance.join_ad_full_credentials(
]         keys[-1],
]     ...<3 lines>...
]         trust_type
]     )
]   File "/usr/lib/python3.13/site-packages/ipaserver/dcerpc.py", line 1847, in join_ad_full_credentials
]     self.remote_domain.establish_trust(self.local_domain,
]     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
]                                        trustdom_pass,
]                                        ^^^^^^^^^^^^^^
]                                        trust_type,
]                                        ^^^^^^^^^^^
]                                        trust_external)
]                                        ^^^^^^^^^^^^^^^
]   File "/usr/lib/python3.13/site-packages/ipaserver/dcerpc.py", line 1397, in establish_trust
]     self.generate_auth(trustdom_secret)
]     ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
]   File "/usr/lib/python3.13/site-packages/ipaserver/dcerpc.py", line 1068, in generate_auth
]     encrypted_trustpass = arcfour_encrypt(self._pipe.session_key,
]                                           trustpass_blob)
]   File "/usr/lib64/python3.13/site-packages/samba/__init__.py", line 353, in arcfour_encrypt
]     return arcfour_crypt_blob(data, key)
] OSError: encryption failed
] ipa: INFO: [jsonserver_session] admin@UFREEIPA.TEST: trust_add/1('ad-szhf.test', trust_type='ad', realm_admin='Administrator@ad-szhf.test', realm_passwd='********', range_type='ipa-ad-trust', version='2.254'): InternalError

Packages:
freeipa-server-4.13.0.dev202411150939+git-0.fc41.x86_64
crypto-policies-20241029-1.git8baf557.fc41.noarch
samba-4.21.1-7.fc41.x86_64

try:
    from samba.trust_utils import CreateTrustedDomainRelax
except ImportError:
    CreateTrustedDomainRelax = None
try:
    from samba import arcfour_encrypt
except ImportError:
    if CreateTrustedDomainRelax is None:
        raise ImportError("No supported Samba Python bindings")

IPA should not really use arcfour_encrypt() in FIPS mode, it should switch to the CreateTrustedDomainRelax method. This means CreateTrustedDomainRelax is not available. 

commit 85d0ab38f7ce4e74854e1f4960de33901bd8904a
Author: Andreas Schneider <asn@samba.org>
Date:   Thu Mar 21 10:08:33 2024 +0100
    python:samba: Rename trust_utils.py to lsa_utils.py
    Signed-off-by: Andreas Schneider <asn@samba.org>
    Reviewed-by: Andrew Bartlett <abartlet@samba.org>

So we need to try lsa_utils first, then trust_utils, then fallback to use of arcfour_encrypt.

PR: https://github.com/freeipa/freeipa/pull/7597

Metadata Update from @abbra:
- Issue assigned to abbra

master:

  • aa81bd25f1442b408f4788d7082b42c3536b39bd ipaserver/dcerpc: support Samba 4.21

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-68447, https://issues.redhat.com/browse/RHEL-68448

ipa-4-12:

  • c306c613399cdd9a2c716b83ce0d47d320aec2a8 ipaserver/dcerpc: support Samba 4.21

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

fips test-failure

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.