Can I join older clients to a newer server?

[Janez Molicnik]

I have IPA server installed on CentOS Linux 7.6. (IPA VERSION: 4.6.4, API_VERSION: 2.229),
but I have some older servers, that run older versions of CentOS:
- on the ones that have CentOS version 6.x, there is only version 3.0.0 of ipa-client
available in repository
- on the ones that have CentOS version 7 or lower that 7.6 there is only version 4.4.0 of
ipa-client available in repository

On the page about the client ( https://www.freeipa.org/page/Client ) I have found some
compatibility notes, but the article talks mainly about connecting newer clients to older
servers. What about the other way around? Which problems can I expect when I connect older
clients to the newer server? Will I have to configure SSSD manually?

[Rob Crittenden]

Janez Molicnik via FreeIPA-users wrote:
>  I have IPA server installed on CentOS Linux 7.6. (IPA VERSION: 4.6.4,
> API_VERSION: 2.229), but I have some older servers, that run older versions of CentOS:
>  - on the ones that have CentOS version 6.x, there is only version 3.0.0 of ipa-client
> available in repository
>  - on the ones that have CentOS version 7 or lower that 7.6 there is only version 4.4.0 of
> ipa-client available in repository
>  
>  On the page about the client ( https://www.freeipa.org/page/Client ) I have found some
> compatibility notes, but the article talks mainly about connecting newer clients to older
> servers. What about the other way around? Which problems can I expect when I connect older
> clients to the newer server? Will I have to configure SSSD manually? 
It should work basically the same way. SSSD will be configured.

The differences will be in the capabilities on the clients due to older 
versions of software (krb5, sssd, sudo, etc).

rob

[Janez Molicnik]

Thank you for replying. I am having trouble joining freeipa-clients version 3.0 to the 4.6
server - I've got many errors I managed to get by, but the latest I didn't crack
yet. 

We use our own certificate (not selfsigned, from SECTIGO) for HTTPS and LDAP and I get
this error:

"Joining realm failed: libcurl failed to execute the HTTP POST transaction.  Peer
certificate cannot be authenticated with known CA certificates
Installation failed. Rolling back changes."

Apparently the older clients needs a known CA authority? Does anybody know how to proceed?

[Janez Molicnik]

Hey, just an update..

I've managed to successfully install the ipa-client when I copied the /etc/ipa/ca.crt
file from ipa-server to the new would be ipa-client that accepted the certificate this
time and finally installed.

Kind greetings,
Janez

[Rob Crittenden]

Janez Molicnik via FreeIPA-users wrote:
>  Hey, just an update..
>  
>  I've managed to successfully install the ipa-client when I copied the /etc/ipa/ca.crt
> file from ipa-server to the new would be ipa-client that accepted the certificate this
> time and finally installed. 
You can also use the option --ca-cert-file to point to a PEM file
containing the certificate chain.

rob