freeipa

#9847 ipa trust-add fails in rawhide
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

In rawhide, ipa fails to establish trust.

Steps to Reproduce

  1. install a rawhide machine with samba-4.23.0-0.5.rc3.fc44.x86_64
  2. Install freeipa from the copr repo @freeipa/freeipa-master-nightly
  3. Configure IPA server ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --auto-forwarders --no-dnssec-validation -a Secret123 -p Secret123 -U
  4. configure IPA server for adtrust ipa-adtrust-install
  5. Configure the DNS forwardzone for the trust ipa dnsforwardzone-add ad.test --forwarder $IP_ADDR --forward-policy only
  6. try to add a trust with an AD domain ipa trust-add ad.test --type ad --admin Administrator@ad.test --password

Actual behavior

ipa trust-add fails and returns 1, with the following error message:

ipa: ERROR: CIFS server communication error: code "3221225485", message "An invalid parameter was passed to a service or function." (both may be "None")

Expected behavior

ipa trust-add should successfully establish the trust

Version/Release/Distribution

freeipa-server-4.13.0.dev202508261453+git-0.fc44.x86_64
krb5-server-1.21.3-7.fc43.x86_64
samba-4.23.0-0.5.rc3.fc44.x86_64

The error was seen in all the nightly tests relying on trust (2025-08-30 21:32), with one-way or two-way trust:
- test_integration/test_ipa_ipa_migration.py::TestIPAMigrationWithADtrust
- test_integration/test_http_kdc_proxy.py::TestHttpKdcProxy
- test_integration/test_idviews.py::TestCertsInIDOverrides
- test_integration/test_ipahealthcheck.py::TestIpaHealthCheckWithADtrust
- test_integration/test_replica_promotion.py::TestReplicaConn
- test_integration/test_smb.py::TestSMB
- test_integration/test_sssd.py::TestSSSDWithAdTrust
- test_integration/test_trust.py::TestTrust
- test_integration/test_trust.py::TestNonPosixAutoPrivateGroup
- test_integration/test_trust.py::TestPosixAutoPrivateGroup
- test_integration/test_winsyncmigrate.py::TestWinsyncMigrate

I am running the test with debug logs in https://github.com/flo-renaud/freeipa/pull/91 and will provide the logs shortly.

Looks like something is broken with our setup for kerberos creds-passing:

Using binding ncacn_np:master.ipa.test[,print,smb2]
s4_tevent: Added timed event "dcerpc_connect_timeout_handler": 0x7f6e8802ddd0
s4_tevent: Added timed event "composite_trigger": 0x7f6e8802e340
s4_tevent: Added timed event "composite_trigger": 0x7f6e8802e510
s4_tevent: Running timer event 0x7f6e8802e340 "composite_trigger"
s4_tevent: Destroying timer event 0x7f6e8802e510 "composite_trigger"
s4_tevent: Destroying timer event 0x7f6e8802e340 "composite_trigger"
Mapped to DCERPC endpoint \pipe\lsarpc
added interface ens4 ip=192.168.121.195 bcast=192.168.121.255 netmask=255.255.255.0
added interface ens4 ip=192.168.121.195 bcast=192.168.121.255 netmask=255.255.255.0
resolve_lmhosts: Attempting lmhosts lookup for name master.ipa.test<0x20>
getlmhostsent: lmhost entry: 127.0.0.1 localhost 
s4_tevent: Added timed event "composite_trigger": 0x7f6e8802e510
s4_tevent: Running timer event 0x7f6e8802e510 "composite_trigger"
s4_tevent: Destroying timer event 0x7f6e8802e510 "composite_trigger"
s4_tevent: Added timed event "tevent_req_timedout": 0x7f6e88030ba0
Connecting to 192.168.121.195 at port 445
s4_tevent: Added timed event "tevent_req_timedout": 0x7f6e880327b0
s4_tevent: Destroying timer event 0x7f6e88030ba0 "tevent_req_timedout"
socket options: SO_KEEPALIVE=0, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=0, TCP_KEEPCNT=9, TCP_KEEPIDLE=7200, TCP_KEEPINTVL=75, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=2626560, SO_RCVBUF=131072, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0
s4_tevent: Destroying timer event 0x7f6e880327b0 "tevent_req_timedout"
s4_tevent: Added timed event "tevent_req_timedout": 0x7f6e8802e510
s4_tevent: Schedule immediate event "tevent_req_trigger": 0x7f6e88032f70
s4_tevent: Cancel immediate event 0x7f6e88032f70 "tevent_req_trigger"
s4_tevent: Schedule immediate event "tevent_req_trigger": 0x7f6e88032f70
s4_tevent: Run immediate event "tevent_req_trigger": 0x7f6e88032f70
s4_tevent: Destroying timer event 0x7f6e8802e510 "tevent_req_timedout"
s4_tevent: Schedule immediate event "tevent_req_trigger": 0x7f6e88031910
s4_tevent: Run immediate event "tevent_req_trigger": 0x7f6e88031910
s4_tevent: Added timed event "tevent_req_timedout": 0x7f6e8802f5b0
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gssapi_krb5
Failed to get kerberos credentials (kerberos required): The credential cache is invalid
Cannot obtain client GSS credentials we need to contact (null) : The credential cache is invalid
s4_tevent: Schedule immediate event "tevent_req_trigger": 0x7f6e88031ec0
gensec_update_send: gssapi_krb5[0x7f6e88034150]: subreq: 0x7f6e88031db0
gensec_update_send: spnego[0x7f6e88010b40]: subreq: 0x7f6e880338b0
s4_tevent: Run immediate event "tevent_req_trigger": 0x7f6e88031ec0
gensec_update_done: gssapi_krb5[0x7f6e88034150]: NT_STATUS_INVALID_PARAMETER tevent_req[0x7f6e88031db0/../../source4/auth/gensec/gensec_gssapi.c:1120]: state[3] error[-7963671676338569203 (0x917B5ACDC000000D)]  state[struct gensec_gssapi_update_state (0x7f6e88031f90)] timer[(nil)] finish[../../source4/auth/gensec/gensec_gssapi.c:1134]
gensec_spnego_client_negTokenInit_step: gssapi_krb5: creating NEG_TOKEN_INIT for cifs/master.ipa.test failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
gensec_update_done: spnego[0x7f6e88010b40]: NT_STATUS_INVALID_PARAMETER tevent_req[0x7f6e880338b0/../../auth/gensec/spnego.c:1614]: state[3] error[-7963671676338569203 (0x917B5ACDC000000D)]  state[struct gensec_spnego_update_state (0x7f6e88033a90)] timer[(nil)] finish[../../auth/gensec/spnego.c:2032]
s4_tevent: Destroying timer event 0x7f6e8802f5b0 "tevent_req_timedout"
s4_tevent: Destroying timer event 0x7f6e8802ddd0 "dcerpc_connect_timeout_handler"
[Mon Sep 01 15:22:29.630351 2025] [wsgi:error] [pid 32924:tid 33396] [remote 192.168.121.195:34770] ipa: INFO: [jsonserver_kerb] admin@IPA.TEST: trust_add/1('ad.test', trust_type='ad', realm_admin='Administrator@ad.test', realm_passwd='********', version='2.254'): RemoteRetrieveError
[Mon Sep 01 15:22:33.029004 2025] [:warn] [pid 32928:tid 33046] [client 192.168.121.195:48636] failed to set perms (3140) on file (/run/ipa/ccaches/admin@IPA.TEST-hRDU7V)!, referer: https://master.ipa.test/ipa/xml

The samba logs are here and httpd/error_log here

This is due to changes we added in Samba code to support some of IAKERB activity. Specifically, the following commit:

commit 6085b737ba702582765840e21cc88d6007dacecf
Author: Andreas Schneider <asn@samba.org>
Date:   Fri Apr 11 13:49:22 2025 +0200
    auth:creds: Do a kinit if we have a password and the ccache is empty
    This implements the same behaviour for s4 clients as we have with s3
    clients.

It slightly changes the logic for gssproxy-enabled ccaches which weren't considered non-initialized before. In gssproxy case ccache contains encrypted credential that is only accessed over GSSAPI and is marked otherwise as expired (timestamp 0, i.e. beginning of the UNIX time). In general, its properties can only be investigated via GSSAPI acquisition.

Filed https://bugzilla.samba.org/show_bug.cgi?id=15902 to track the issue.

Submitted a proposed fix: https://gitlab.com/samba-team/samba/-/merge_requests/4197

I'm going to create a COPR repo with this change to test it.

@frenaud I am building a fixed samba package in https://copr.fedorainfracloud.org/coprs/abbra/samba-test-bz15902/builds/, can you please try it in your PR once it is ready?

@abbra
I ran the test with your copr in this PR: https://github.com/freeipa/freeipa/pull/7919
The logs show that your build was installed: samba-4.23.0-0.6.rc3.fc44.x86_64
and the test results are green: report.html.

The test I picked installs a trust and run ipa-healthcheck. From my POV your patch correctly fixes the issue.

Thank you. I asked for the review upstream.

@frenaud could you please open a bug in Fedora for F43?

@abbra
https://bugzilla.redhat.com/show_bug.cgi?id=2392626 samba-4.23.0-0.5.rc3 breaks ipa trust-add

Metadata Update from @frenaud:
- Issue tagged with: test-failure, tracker

Metadata Update from @abbra:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/IDM-3086
- Issue untagged with: test-failure, tracker

Metadata Update from @frenaud:
- Issue tagged with: test-failure, tracker

Issue fixed in f44 with samba-4.23.0-0.8.rc3.fc44.x86_64
bodhi update https://bodhi.fedoraproject.org/updates/FEDORA-2025-710d9a89d7

The update in f43 is waiting for the freeze to be lifted from Fedora 43
bodhi update https://bodhi.fedoraproject.org/updates/FEDORA-2025-cb15b4a48c

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

test-failure tracker

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.