freeipa

#9852 Nightly tests failure (rawhide): ipactl restart fails to restart winbindd
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

In rawhide, 2 of our nightly tests are failing when restarting ipa services in the call that restarts winbindd:
- test_integration/test_http_kdc_proxy.py::TestHttpKdcProxy::test_ad_user_login_on_client_with_kdcproxy[True]: https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-rawhide/master/2025-09-06_19-30/rawhide/test_http_kdc_proxy/1/report.html?sort=result
- test_integration/test_trust.py::TestTrust::test_extdom_plugin: https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-rawhide/master/2025-09-06_19-30/rawhide/test_trust/1/report.html?sort=result

Steps to Reproduce

  1. install ipa server and establish trust with an AD DC
  2. restart ipa services with ipactl restart

Actual behavior

# ipactl restart
ipa: ERROR: stderr: Failed to restart winbind Service
Shutting down
Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed
Aborting ipactl

Expected behavior

Should successfully restart all the services

Version/Release/Distribution

freeipa-server-4.13.0.dev202509051518+git-0.fc44.x86_64
samba-4.23.0-0.8.rc3.fc44.x86_64

Additional info:

The journal shows the following error:

Sep 06 20:32:08 master.ufreeipa.test systemd[1]: Starting winbind.service - Samba Winbind Daemon...
Sep 06 20:32:08 master.ufreeipa.test winbindd[38659]: GSSAPI client step 1
Sep 06 20:32:08 master.ufreeipa.test winbindd[38659]: GSSAPI client step 1
Sep 06 20:32:08 master.ufreeipa.test winbindd[38659]: GSSAPI client step 1
Sep 06 20:32:08 master.ufreeipa.test winbindd[38659]: GSSAPI client step 2
Sep 06 20:32:09 master.ufreeipa.test winbindd[38659]: [2025/09/06 20:32:09.036275,  0, pid=38659, effective(0, 0), real(0, 0), class=winbind, traceid=1] ../../source3/winbindd/winbindd_util.c:1312(add_trusted_domains_dc)
Sep 06 20:32:09 master.ufreeipa.test winbindd[38659]:   add_trusted_domains_dc: Can't find winbindd domain [AD-24E2]
Sep 06 20:32:09 master.ufreeipa.test winbindd[38659]: [2025/09/06 20:32:09.036297,  0, pid=38659, effective(0, 0), real(0, 0), class=winbind, traceid=1] ../../source3/winbindd/winbindd_util.c:1608(init_domain_list)
Sep 06 20:32:09 master.ufreeipa.test winbindd[38659]:   init_domain_list: init_domain_list_dc failed
Sep 06 20:32:09 master.ufreeipa.test winbindd[38659]: [2025/09/06 20:32:09.036308,  0, pid=38659, effective(0, 0), real(0, 0), class=winbind, traceid=1] ../../source3/winbindd/winbindd.c:1191(winbindd_register_handlers)
Sep 06 20:32:09 master.ufreeipa.test winbindd[38659]:   unable to initialize domain list
Sep 06 20:32:09 master.ufreeipa.test systemd[1]: winbind.service: Main process exited, code=exited, status=1/FAILURE
Sep 06 20:32:09 master.ufreeipa.test systemd[1]: winbind.service: Failed with result 'exit-code'.
Sep 06 20:32:09 master.ufreeipa.test systemd[1]: Failed to start winbind.service - Samba Winbind Daemon.

Metadata Update from @abbra:
- Issue assigned to abbra

Short summary of the investigations:

  • FreeIPA incorrectly sets up forest trust information structure to have version 0 instead of version 1 (as required by the MS-DRSR spec). In Samba 4.23 this causes to ignore trusted domains reported by FreeIPA.
  • When the version issue is fixed, we found out that winbindd associates wrong security channel type and missing routing domain information to the trusted domains reported by FreeIPA, resulting in winbindd thinking that these domains are unreachable.

Next step is to find out how to affect the security channel type in winbindd.

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7928

PR: https://github.com/freeipa/freeipa/pull/7928

master:

  • 96c3d2d1ad6c947678a15928de258f462c3ea4ed dcerpc: make sure forest trust info structure version is 1
  • ae8e850708b118b3da9c9ebc2d5cf8b085d845df dcerpc: Support Samba 4.23
  • 6594c9d5e3fa89cde013c55d94d64caff70c1731 ipasam: simplify error handling in fill_pdb_trusted_domain
  • 3c3a094500f2e89fe759e5580d2d96b08857cf1c ipasam: address signedness warnings
  • 516ad5a82147ccd1cbec1fdddfb36b2d0a90fb40 ipasam: define prototypes

ipa-4-12:

  • 7d4b5541b2de30a91cd1f14b790bfa33dca8ea5f dcerpc: make sure forest trust info structure version is 1
  • 486558c63e4b0db6673e863a6bd89e885f8106dd dcerpc: Support Samba 4.23
  • fcd0f0c6e07200e90628f108c7566b0ede7879b8 ipasam: simplify error handling in fill_pdb_trusted_domain
  • cb36c3d9969ce0c0beacb43c7d4ea29da652c499 ipasam: address signedness warnings
  • fc40c7cdcfa3e59d5122248f3ed9faa135de22a6 ipasam: define prototypes

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-128161, https://issues.redhat.com/browse/RHEL-128185
Metadata

test-failure

None
None
None
https://github.com/freeipa/freeipa/pull/7928
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.