UBC Physics & Astronomy
Scientific Linux Configuration Guide

IPA Client installation on Scientific Linux release 6.4 (Carbon)

Error: 
[root@phobos ~]# ipa-client-install
Traceback (most recent call last):
  File "/usr/sbin/ipa-client-install", line 2335, in 
    sys.exit(main())
  File "/usr/sbin/ipa-client-install", line 2321, in main
    rval = install(options, env, fstore, statestore)
  File "/usr/sbin/ipa-client-install", line 1686, in install
    ret = ds.search(domain=options.domain, server=options.server, hostname=hostname, ca_cert_path=get_cert_path(options.ca_cert_file))
  File "/usr/lib/python2.6/site-packages/ipaclient/ipadiscovery.py", line 230, in search
    ldapret = self.ipacheckldap(self.server, self.realm, ca_cert_path=ca_cert_path)
  File "/usr/lib/python2.6/site-packages/ipaclient/ipadiscovery.py", line 298, in ipacheckldap
    basedn = get_ipa_basedn(lh)
  File "/usr/lib/python2.6/site-packages/ipapython/ipautil.py", line 817, in get_ipa_basedn
    contexts = entries[0][1]['namingcontexts']
KeyError: 'namingcontexts'

Solution:

I was able to make the ipa-client-install work by specifying the domain and server:

[root@phobos ~]# ipa-client-install --domain=phas.ubc.ca --server=ipa.phas.ubc.ca 
Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]: yes
Hostname: phobos.phas.ubc.ca
Realm: PHAS.UBC.CA
DNS Domain: phas.ubc.ca
IPA Server: ipa02.phas.ubc.ca
BaseDN: dc=phas,dc=ubc,dc=ca

Continue to configure the system with these values? [no]: yes
User authorized to enroll computers: admin
Synchronizing time with KDC...
Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.
Password for admin@PHAS.UBC.CA: 
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=PHAS.UBC.CA
    Issuer:      CN=Certificate Authority,O=PHAS.UBC.CA
    Valid From:  Thu May 23 21:15:34 2013 UTC
    Valid Until: Mon May 23 21:15:34 2033 UTC

Enrolled in IPA realm PHAS.UBC.CA
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm PHAS.UBC.CA
trying https://ipa02.phas.ubc.ca/ipa/xml
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub
Forwarding 'host_mod' to server u'https://ipa02.phas.ubc.ca/ipa/xml'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.
[root@phobos ~]# getent passwd rapugrad
rapugrad:*:15240:400:Rons Undergrad Test Acct:/home2/rapugrad:/bin/bash

Not sure yet why the DNS SSHFP records were not updated but for now this is not an issue.

--------------------------------------------------------------------------
[root@phobos ~]# cat /etc/ipa/default.conf
#File modified by ipa-client-install

[global]
basedn = dc=phas,dc=ubc,dc=ca
realm = PHAS.UBC.CA
domain = phas.ubc.ca
server = ipa02.phas.ubc.ca
xmlrpc_uri = https://ipa02.phas.ubc.ca/ipa/xml
enable_ra = True
[root@phobos ~]# cat /etc/ipa/default.conf 
#File modified by ipa-client-install

[global]
basedn = dc=phas,dc=ubc,dc=ca
realm = PHAS.UBC.CA
domain = phas.ubc.ca
server = ipa02.phas.ubc.ca
xmlrpc_uri = https://ipa02.phas.ubc.ca/ipa/xml
enable_ra = True

--------------------------------------------------------------------------
[root@phobos ~]# cat /etc/sssd/sssd.conf 
[domain/phas.ubc.ca]

cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = phas.ubc.ca
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = phobos.phas.ubc.ca
chpass_provider = ipa
ipa_server = _srv_, ipa02.phas.ubc.ca
ldap_tls_cacert = /etc/ipa/ca.crt
[sssd]
services = nss, pam, ssh
config_file_version = 2

domains = phas.ubc.ca
[nss]

[pam]

[sudo]

[autofs]

[ssh]

[pac]

--------------------------------------------------------------------------
[root@phobos ~]# cat /etc/krb5.conf
#File modified by ipa-client-install

includedir /var/lib/sss/pubconf/krb5.include.d/

[libdefaults]
  default_realm = PHAS.UBC.CA
  dns_lookup_realm = false
  dns_lookup_kdc = false
  rdns = false
  ticket_lifetime = 24h
  forwardable = yes

[realms]
  PHAS.UBC.CA = {
    kdc = ipa02.phas.ubc.ca:88
    master_kdc = ipa02.phas.ubc.ca:88
    admin_server = ipa02.phas.ubc.ca:749
    default_domain = phas.ubc.ca
    pkinit_anchors = FILE:/etc/ipa/ca.crt
  }

[domain_realm]
  .phas.ubc.ca = PHAS.UBC.CA
  phas.ubc.ca = PHAS.UBC.CA

--------------------------------------------------------------------------
[root@phobos ~]# cat /etc/openldap/ldap.conf
#File modified by ipa-client-install

URI ldaps://ipa02.phas.ubc.ca
BASE dc=phas,dc=ubc,dc=ca
TLS_CACERT /etc/ipa/ca.crt

For more assistance contact Ron Parachoniak, rap@phas.ubc.ca
 
webmaster@phas.ubc.ca [Dept. Home Page] Last updated: