Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1136087 - engine-manage-domains always searches for KDC servers over DNS, even when --resolve-kdc is not set
Summary: engine-manage-domains always searches for KDC servers over DNS, even when --r...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Virtualization Manager
Classification: Red Hat
Component: ovirt-engine-config
Version: 3.4.1-1
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: 3.5.0
Assignee: Yair Zaslavsky
QA Contact: Ondra Machacek
URL:
Whiteboard: infra
: 1143836 (view as bug list)
Depends On:
Blocks: rhev3.5beta 1156165
TreeView+ depends on / blocked
 
Reported: 2014-09-01 15:56 UTC by Evgheni Dereveanchin
Modified: 2018-12-06 17:57 UTC (History)
14 users (show)

Fixed In Version: vt3
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-02-11 18:08:51 UTC
oVirt Team: Infra
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0158 normal SHIPPED_LIVE Important: Red Hat Enterprise Virtualization Manager 3.5.0 2015-02-11 22:38:50 UTC
oVirt gerrit 32279 master MERGED aaa: engine-manads-domains always tries to look for KDC in DNS Never
oVirt gerrit 32285 ovirt-engine-3.5 MERGED aaa: engine-manads-domains always tries to look for KDC in DNS Never

Description Evgheni Dereveanchin 2014-09-01 15:56:23 UTC
Description of problem:
it is impossible to add an IPA domain to RHEV if DNS is not working. 

Version-Release number of selected component (if applicable):
3.4.1

How reproducible:
Always

Steps to Reproduce:
1. configure RHEV-M 3.4.1
2. set up a test IPA domain not resolvable via DNS from the RHEV-M
3. try to add the domain without --resolve-kdc option (according to docs this should not trigger DNS queries)

# engine-manage-domains add --domain=test.lan --provider=IPA --user=admin --ldap-servers=10.0.0.1 --password-file=passwd

Actual results:
* DNS queries are performed
* the process erorrs out with message:
    No KDC can be obtained for domain test.lan

Expected results:
* server from --ldap-servers is used as KDC
* the domain is added successfully

Additional info:
* This behavior seems to be the opposite of BZ#1031778
* same behavior occurs if LDAP server is added to /etc/hosts and the hostname is used instead of the IP

Comment 3 Florian Faltermeier 2014-09-04 14:21:46 UTC
Hello,

if it's possible please add an argument to the engine-manage-domains command,
that seperate kdc servers can be addded. In some environments it is common to separate KDC from LDAP. This should be working properly without a DNS lookup. Especially an additional AD exists in the environment.

Thank you!

Regards,
Florian

Comment 4 Eyal Edri 2014-09-10 20:21:34 UTC
fixed in vt3, moving to on_qa.
if you believe this bug isn't released in vt3, please report to rhev-integ@redhat.com

Comment 5 Ondra Machacek 2014-09-16 15:35:49 UTC
I didn't find how to configure IPA to accept IP address with ldapserver param.

But as bz says the ovirt now connect KDC which is specified in ldapserver parameter.

but it couldn't work as it tries ldap/10.0.0.1@REALM,
and there is no documented way how to ad such service into IPA as it needs
to be hostname not an IP address.

Comment 6 Martin Tessun 2014-09-19 14:35:47 UTC
*** Bug 1143836 has been marked as a duplicate of this bug. ***

Comment 7 Yair Zaslavsky 2014-10-06 12:35:45 UTC
I don't know how to configure the IPA server to do that.
Bare in mind the bug is about the DNS queries being sent for KDC.
I verified it by checking that there is no outoging traffic on the DNS port that resolves KDCs.

Comment 8 Martin Tessun 2014-10-06 13:38:48 UTC
Hi Yair,

test is relatively easy:

1. Remove all SRV entries to the services for IPA from DNS
   e.g.:
   _ldap._tcp IN SRV 0 100 389 ldap1.example.com.
   _ldap._tcp IN SRV 0 100 389 ldap2.example.com.
   _kerberos IN TXT EXAMPLE.COM
   _kerberos._tcp IN SRV 0 0 88 krb1.example.com.
   _kerberos._tcp IN SRV 0 0 88 krb2.example.com.

2. Make sure LDAP and KRB reside on the same server.
3. run engine-manage-domains add --domain=<domain> --provider=IPA --user=<IPA> --ldap-servers=<IP>

The authentication should work now and the IPA server should be added correctly to the RHEV-M, as it uses the IP provided with --ldap-servers for the kerberos as well.

Let me know if you have any further questions on how to configure IPA.

Cheers,
Martin

Comment 9 Yair Zaslavsky 2014-10-06 23:42:11 UTC
(In reply to Martin Tessun from comment #8)
> Hi Yair,
> 
> test is relatively easy:
> 
> 1. Remove all SRV entries to the services for IPA from DNS
>    e.g.:
>    _ldap._tcp IN SRV 0 100 389 ldap1.example.com.
>    _ldap._tcp IN SRV 0 100 389 ldap2.example.com.
>    _kerberos IN TXT EXAMPLE.COM
>    _kerberos._tcp IN SRV 0 0 88 krb1.example.com.
>    _kerberos._tcp IN SRV 0 0 88 krb2.example.com.
> 
> 2. Make sure LDAP and KRB reside on the same server.
> 3. run engine-manage-domains add --domain=<domain> --provider=IPA
> --user=<IPA> --ldap-servers=<IP>
> 
> The authentication should work now and the IPA server should be added
> correctly to the RHEV-M, as it uses the IP provided with --ldap-servers for
> the kerberos as well.
> 
> Let me know if you have any further questions on how to configure IPA.
> 
> Cheers,
> Martin

Ondra, is this what you checked?

Comment 10 Ondra Machacek 2014-10-07 09:19:00 UTC
Yes. When I do steps described in #comment 8, then manage-domains send TGS-REQ
ldap/<IP>. 

It's not possible to add service with IP address in IPA as only fqdn is supported.

Or should manage-domain use reverse lookup and use TGS-REQ ldap/hostname ?

Comment 11 Alon Bar-Lev 2014-10-07 09:23:12 UTC
using host by ip in kerberos is not supported as reverse dns should not be trusted in most cases.

anyway, I suggest to focus our resources in the new ldap implementation, all issues with existing are known and should not be fixed.

Comment 12 Martin Tessun 2014-10-07 09:37:32 UTC
Sorry, of course IP should have been the dns name of the ldap server. I was just copying the statement from above.

So after not having the SRV entries any more in the DNS, the above should work:

# engine-manage-domains --domain=<domain> --provider=IPA --user=<IPA> --ldap-servers=<SERVERS>

According to the man page this should also be SERVERS:

       --ldap-servers=SERVERS
           A comma delimited list of LDAP servers to be set to the domain.

So now (without any DNS SRV entries), the above command should succeed, as long as the kerberos is running on the same server as the LDAP service.

Comment 13 Ondra Machacek 2014-10-07 10:04:26 UTC
It will succeed only if <SERVERS> are fqdns and not ip addresses.

Comment 14 Martin Tessun 2014-10-16 06:43:32 UTC
(In reply to Ondra Machacek from comment #13)
> It will succeed only if <SERVERS> are fqdns and not ip addresses.

Yes, and that's exactly the way it should be. (Therefore stating <SERVERS> and not <IP>).

So I think if this test succeeded the way I described in c#8 then everything works as expected.

So no reverse lookup is expected.

Comment 15 Yair Zaslavsky 2014-10-16 07:23:39 UTC
(In reply to Martin Tessun from comment #14)
> (In reply to Ondra Machacek from comment #13)
> > It will succeed only if <SERVERS> are fqdns and not ip addresses.
> 
> Yes, and that's exactly the way it should be. (Therefore stating <SERVERS>
> and not <IP>).
> 
> So I think if this test succeeded the way I described in c#8 then everything
> works as expected.
> 
> So no reverse lookup is expected.

Ok, so is the bug verified?

Comment 16 Ondra Machacek 2014-10-22 08:26:17 UTC
Yes.

There is no SRV records in DNS.

rhevm-manage-domains add --domain=brq-openldap.rhev.lab.eng.brq.redhat.com --user=user1 --provider=openldap --ldap-servers=brq-openldap.rhev.lab.eng.brq.redhat.com
Enter password:
The domain brq-openldap.rhev.lab.eng.brq.redhat.com has been added to the engine as an authentication source but no users from that domain have been granted permissions within the oVirt Manager.
Users from this domain can be granted permissions by editing the domain using action edit and specifying --add-permissions or from the Web administration interface logging in as admin@internal user.
oVirt Engine restart is required in order for the changes to take place (service ovirt-engine restart).
Manage Domains completed successfully

There are no SRV queries to DNS and I can work with user from this domain without
any problem.

Comment 19 Ondra Machacek 2014-10-22 14:18:29 UTC
Works OK for IPA. No DNS queries for SRV record.

rhevm-manage-domains add --domain=brq-ipa.rhev.lab.eng.brq.redhat.com --user=vdcadmin --provider=ipa --ldap-servers=brq-ipa.rhev.lab.eng.brq.redhat.com
Enter password:
The domain brq-ipa.rhev.lab.eng.brq.redhat.com has been added to the engine as an authentication source but no users from that domain have been granted permissions within the oVirt Manager.
Users from this domain can be granted permissions by editing the domain using action edit and specifying --add-permissions or from the Web administration interface logging in as admin@internal user.
oVirt Engine restart is required in order for the changes to take place (service ovirt-engine restart).
Manage Domains completed successfully

Comment 21 errata-xmlrpc 2015-02-11 18:08:51 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0158.html


Note You need to log in before you can comment on or make changes to this bug.