pagure

#4148 When AD user has no ID override defined, the user's Kerberos credentials cannot be used to access IPA API
Closed: Invalid Opened by amore.

Closed: Invalid
Reopen Issue

[description of the issue]
AD user's Kerberos credentials cannot be used to access IPA API and throws internal error and traceback.

Steps to Reproduce:
1: Establish trust with : --range-type=ipa-ad-trust --two-way=True
2: kdestroy -A
3: kinit administrator@AD.TEST
4: ssh -o StrictHostKeyChecking=no -K -l administrator@ad.test ipa.internal.test
5: klist -l
6: ipa trust-find

Actual behavior:
ipa: ERROR: cannot connect to 'https://ipaqavma.internal.test/ipa/json': Internal Server Error

Expected behavior:
IPA API should be successful from AD user

Version Affected:
ipa-idoverride-memberof-plugin-0.0.4-6.module+el8+2555+b334d87b.x86_64
ipa-server-4.7.1-7.module+el8+2555+b334d87b.x86_64
ipa-server-trust-ad-4.7.1-7.module+el8+2555+b334d87b.x86_64

The expected fix should actually be a better recovery from the error. Since we cannot really execute operations as a user from a trusted domain over IPA API unless there is an ID override for this user in the default trust view, a message should be shown that makes clear to the user 'ipa CLI' is not enabled for him/her.

(this should have been opened against https://pagure.io/freeipa/new_issue)

I was going to ask this, did you mean to report this to https://pagure.io/freeipa ?

Yes, we re-reported it to https://pagure.io/freeipa/issue/7818

Yes this need to close this was supposed to be in freeipa but i have already created one https://pagure.io/freeipa/issue/7818

Metadata Update from @amore:
- Issue close_status updated to: Invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.