NAS-138474 / 26.0.0-BETA.3 / Require DNS updates for the IPA directory service (by anodos325) (by bugclerk)#19271
Merged
Conversation
Creating the SMB and NFS Kerberos service principals during an IPA
join uses FreeIPA's service-add, which refuses to add a service to a
host that has no DNS A/AAAA record. register_dns() creates that
record, so it is a prerequisite for service-principal setup rather
than an optional step.
With DNS updates disabled the join aborted at register_dns() before
the service principals were created, leaving smbd unable to start:
krb5_kt_start_seq_get on FILE:/etc/ipa/smb.keytab failed
(No such file or directory)
Reject enable_dns_updates=False for IPA at validation time with a
clear message, since DNS updates are currently required to properly
support kerberized services.
Also roll back the local configuration written during a failed join
(host keytab, kerberos realm, CA certificate, and the IPA config
files). The post-enrollment steps move into _ipa_configure_and_register
so _ipa_join can wrap them and unroll on any failure. Previously a
partial join left that state behind, so the next attempt short-circuited
as already-joined and never retried registration, leaving the server
HEALTHY but with SMB and NFS broken. This also consolidates the rollback
the kerberos start error handler used to perform on its own.
(cherry picked from commit 1d6ea3c)
(cherry picked from commit 4809ec1)
Contributor
Author
anodos325
approved these changes
Jul 7, 2026
Contributor
Author
|
JIRA ticket https://ixsystems.atlassian.net/browse/NAS-138474 is targeted to the following versions which have not received their corresponding PRs: 26.0.0-RC.1 |
Contributor
Author
|
This PR has been merged and conversations have been locked. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Creating the SMB and NFS Kerberos service principals during an IPA
join uses FreeIPA's service-add, which refuses to add a service to a
host that has no DNS A/AAAA record. register_dns() creates that
record, so it is a prerequisite for service-principal setup rather
than an optional step.
With DNS updates disabled the join aborted at register_dns() before
the service principals were created, leaving smbd unable to start:
Reject enable_dns_updates=False for IPA at validation time with a
clear message, since DNS updates are currently required to properly
support kerberized services.
Original PR: #19263
Original PR: #19268