Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5044

adcli testjoin does not detect domain name correctly

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • adcli-0.9.3.1-1.el10
    • None
    • Low
    • rhel-idm-sssd
    • ssg_idm
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Bug Fix
    • Hide
      .`adcli` testjoin correctly identifies the joined domain in multi-principal keytabs

      Before this update, the `adcli testjoin` command unconditionally used the domain or realm from the first entry found in the keytab file to perform its diagnostic test. As a consequence, on systems where the keytab contained principals from multiple domains, `adcli testjoin` would often attempt to connect to an incorrect domain and fail with a "Realm not local to KDC" error.

      With this release, `adcli` uses the realm from the keytab as the domain name when the domain is not explicitly specified. As a result, users can reliably verify domain connectivity without encountering false authentication failures.
      Show
      .`adcli` testjoin correctly identifies the joined domain in multi-principal keytabs Before this update, the `adcli testjoin` command unconditionally used the domain or realm from the first entry found in the keytab file to perform its diagnostic test. As a consequence, on systems where the keytab contained principals from multiple domains, `adcli testjoin` would often attempt to connect to an incorrect domain and fail with a "Realm not local to KDC" error. With this release, `adcli` uses the realm from the keytab as the domain name when the domain is not explicitly specified. As a result, users can reliably verify domain connectivity without encountering false authentication failures.
    • Done
    • Done
    • Done
    • None
    • 57,005

      Description of problem:

      After successful joining to domain:
      adcli join ... adwin.renesas.com

      I receive this Kerberos keytab:

      [root@slsrvadm-02v ~]# klist -k
      Keytab name: FILE:/etc/krb5.keytab
      KVNO Principal
      ---- --------------------------------------------------------------------------
      2 slsrvadm-02v2$@ADWIN.RENESAS.COM
      2 host/slsrvadm-02v2@ADWIN.RENESAS.COM
      2 slsrvadm-02v2$@ADWIN.RENESAS.COM
      2 host/slsrvadm-02v2@ADWIN.RENESAS.COM
      2 host/slsrvadm-02v.diasemi.com@ADWIN.RENESAS.COM
      2 RestrictedKrbHost/slsrvadm-02v2@ADWIN.RENESAS.COM
      2 host/slsrvadm-02v.diasemi.com@ADWIN.RENESAS.COM
      2 RestrictedKrbHost/slsrvadm-02v2@ADWIN.RENESAS.COM
      2 RestrictedKrbHost/slsrvadm-02v.diasemi.com@ADWIN.RENESAS.COM
      2 RestrictedKrbHost/slsrvadm-02v.diasemi.com@ADWIN.RENESAS.COM

      ... however 'adcli testjoin' complains about 'diasemi.com' domain which I did not join:

      [root@slsrvadm-02v ~]# adcli testjoin
      adcli: couldn't connect to diasemi.com domain: Couldn't get kerberos ticket for machine account: slsrvadm-02v2: Realm not local to KDC
      Please check
      https://red.ht/support_rhel_ad
      to get help for common issues.

      and as per the man page, I can't supply domain name to adcli testjoin

              sbose@redhat.com Sumit Bose
              ovalouse Ondrej Valousek (Inactive)
              Sumit Bose Sumit Bose
              Shridhar Gadekar Shridhar Gadekar
              Dominika Borges Dominika Borges
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated: