Active Directory Integration test day invitation

[Jakub Hrozek]

The realmd and SSSD development teams are happy to invite you to a Fedora
Test Day that will be held on Thursday, May 9th.

We invite you to take part in testing of the new features that will become
available in upcoming upstream releases of realmd and SSSD and would be
a part of Fedora 19. The features are mostly focused on better Active
Directory integration and to some extent easier way of joining clients to
an IPA domain using realmd.

To read more about the test day and suggested tests use the following link
   
https://fedoraproject.org/wiki/Test_Day:2013-05-09_SSSD_Improvements_and_...

The tests in particular can be previewed using this link:
    https://fedoraproject.org/wiki/Category:Active_Directory_Test_Cases
    https://fedoraproject.org/wiki/Category:FreeIPA_Test_Cases

Even if you do not plan on following the test cases themselves, consider
joining the test day to see if the new realmd or SSSD features are usable
and working in your environment or just to see if your current workflow
is not affected in any way by the recent changes in either SSSD or realmd.

Thank you for your help and participation!

[steve]

On 06/05/13 18:49, Jakub Hrozek wrote:
>  The realmd and SSSD development teams are happy to invite you to a
> Fedora
>  Test Day that will be held on Thursday, May 9th. 
Hi
We'd like to test the AD dns updates and understand that
dyndns_update = True

is available on the live cd you mention.

Question: we already have a test lan with linux boxes joined to a Samba 
4 AD. Would it be possible to perform the AD test on this setup simply 
by building 1.10.0beta1 which is available on the sssd site?
Cheers,
Steve

[Jakub Hrozek]

On Tue, May 07, 2013 at 09:30:15AM +0200, steve wrote:
>  On 06/05/13 18:49, Jakub Hrozek wrote:
>  >The realmd and SSSD development teams are happy to invite you to a Fedora
>  >Test Day that will be held on Thursday, May 9th.
>  
>  Hi
>  We'd like to test the AD dns updates and understand that
>  dyndns_update = True
>  
>  is available on the live cd you mention.
>   
Yes

>  Question: we already have a test lan with linux boxes joined to a
>  Samba 4 AD. Would it be possible to perform the AD test on this
>  setup simply by building 1.10.0beta1 which is available on the sssd
>  site?
>  Cheers,
>  Steve 
Yes, it would. I will be adding a couple of fixes related to SSH/IPA
integration and how we process the NetBIOS name atop 1.10beta1, but
unless you'd like to test those fixes, you can just go with the
1.10beta1 tarball.

[steve]

On 06/05/13 18:49, Jakub Hrozek wrote:
>  The realmd and SSSD development teams are happy to invite you to a
> Fedora
>  Test Day that will be held on Thursday, May 9th.
>
>  We invite you to take part in testing of the new features that will become
>  available in upcoming upstream releases of realmd and SSSD and would be
>  a part of Fedora 19. The features are mostly focused on better Active
>  Directory integration and to some extent easier way of joining clients to
>  an IPA domain using realmd.
>
>  To read more about the test day and suggested tests use the following link
>      
> https://fedoraproject.org/wiki/Test_Day:2013-05-09_SSSD_Improvements_and_...
>
>  The tests in particular can be previewed using this link:
>       https://fedoraproject.org/wiki/Category:Active_Directory_Test_Cases
>       https://fedoraproject.org/wiki/Category:FreeIPA_Test_Cases
>
>  Even if you do not plan on following the test cases themselves, consider
>  joining the test day to see if the new realmd or SSSD features are usable
>  and working in your environment or just to see if your current workflow
>  is not affected in any way by the recent changes in either SSSD or realmd.
>
>  Thank you for your help and participation! 
Re: testing dyndns_update

Confirmed 1.10.0beta1:
dyndns_update
is working against a Samba4 AD

But there are some TSIG errors as in the current thread on this list:
https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html

Cheers,
Steve

[Jakub Hrozek]

On Thu, May 09, 2013 at 05:57:19PM +0200, steve wrote:
>  On 06/05/13 18:49, Jakub Hrozek wrote:
>  >The realmd and SSSD development teams are happy to invite you to a Fedora
>  >Test Day that will be held on Thursday, May 9th.
>  >
>  >We invite you to take part in testing of the new features that will become
>  >available in upcoming upstream releases of realmd and SSSD and would be
>  >a part of Fedora 19. The features are mostly focused on better Active
>  >Directory integration and to some extent easier way of joining clients to
>  >an IPA domain using realmd.
>  >
>  >To read more about the test day and suggested tests use the following link
>  >    
> https://fedoraproject.org/wiki/Test_Day:2013-05-09_SSSD_Improvements_and_...
>  >
>  >The tests in particular can be previewed using this link:
>  >     https://fedoraproject.org/wiki/Category:Active_Directory_Test_Cases
>  >     https://fedoraproject.org/wiki/Category:FreeIPA_Test_Cases
>  >
>  >Even if you do not plan on following the test cases themselves, consider
>  >joining the test day to see if the new realmd or SSSD features are usable
>  >and working in your environment or just to see if your current workflow
>  >is not affected in any way by the recent changes in either SSSD or realmd.
>  >
>  >Thank you for your help and participation!
>  
>  Re: testing dyndns_update
>  
>  Confirmed 1.10.0beta1:
>  dyndns_update
>  is working against a Samba4 AD
>  
>  But there are some TSIG errors as in the current thread on this list:
>  https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html 
Thank you very much for testing, Steve!

[steve]

> >
> > Re: testing dyndns_update
> >
> > Confirmed 1.10.0beta1:
> > dyndns_update
> > is working against a Samba4 AD
> >
> > But there are some TSIG errors as in the current thread on this list:
> > https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html
>
>  Thank you very much for testing, Steve! 
Hi Jakub
No problem.
Any chance of taking a look at those tsig errors? It's working, but not 
sure why we get the errors. Not urgent.
Steve

[Jakub Hrozek]

On Thu, May 09, 2013 at 06:31:03PM +0200, steve wrote:
>  >>
>  >>Re: testing dyndns_update
>  >>
>  >>Confirmed 1.10.0beta1:
>  >>dyndns_update
>  >>is working against a Samba4 AD
>  >>
>  >>But there are some TSIG errors as in the current thread on this list:
>  >>https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html
>  >
>  >Thank you very much for testing, Steve!
>  
>  Hi Jakub
>  No problem.
>  Any chance of taking a look at those tsig errors? It's working, but
>  not sure why we get the errors. Not urgent.
>  Steve 
I'm afraid I would forget so I will file a ticket and we'll take a look
post-beta:
https://fedorahosted.org/sssd/ticket/1919

We're trying to get all the features in for the 1.10 beta now, we'll get
back to fixing bugs later when the features are in.

[steve]

On 09/05/13 19:45, Jakub Hrozek wrote:
>  On Thu, May 09, 2013 at 06:31:03PM +0200, steve wrote:
> >>>
> >>> Re: testing dyndns_update
> >>>
> >>> Confirmed 1.10.0beta1:
> >>> dyndns_update
> >>> is working against a Samba4 AD
> >>>
> >>> But there are some TSIG errors as in the current thread on this list:
> >>> https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html
> >>
> >> Thank you very much for testing, Steve!
> >
> > Hi Jakub
> > No problem.
> > Any chance of taking a look at those tsig errors? It's working, but
> > not sure why we get the errors. Not urgent.
> > Steve
>
>  I'm afraid I would forget so I will file a ticket and we'll take a look
>  post-beta:
>  https://fedorahosted.org/sssd/ticket/1919
>
>  We're trying to get all the features in for the 1.10 beta now, we'll get
>  back to fixing bugs later when the features are in. 
Hi
Although the new client IP is recognised and updated correctly, nothing 
is written to the dns zone on the DC. Test: we can't ping the client 
from the DC. But we can still login even after we have deliberately 
changed the IP of the client. The correct IP is sent to the DC for 
ticket requests etc.

[Jakub Hrozek]

On Sat, May 11, 2013 at 09:39:02AM +0200, steve wrote:
>  On 09/05/13 19:45, Jakub Hrozek wrote:
>  >On Thu, May 09, 2013 at 06:31:03PM +0200, steve wrote:
>  >>>>
>  >>>>Re: testing dyndns_update
>  >>>>
>  >>>>Confirmed 1.10.0beta1:
>  >>>>dyndns_update
>  >>>>is working against a Samba4 AD
>  >>>>
>  >>>>But there are some TSIG errors as in the current thread on this list:
>  >>>>https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html
>  >>>
>  >>>Thank you very much for testing, Steve!
>  >>
>  >>Hi Jakub
>  >>No problem.
>  >>Any chance of taking a look at those tsig errors? It's working, but
>  >>not sure why we get the errors. Not urgent.
>  >>Steve
>  >
>  >I'm afraid I would forget so I will file a ticket and we'll take a look
>  >post-beta:
>  >https://fedorahosted.org/sssd/ticket/1919
>  >
>  >We're trying to get all the features in for the 1.10 beta now, we'll get
>  >back to fixing bugs later when the features are in.
>  
>  Hi
>  Although the new client IP is recognised and updated correctly, nothing is
>  written to the dns zone on the DC. Test: we can't ping the client from the
>  DC. But we can still login even after we have deliberately changed the IP of
>  the client. The correct IP is sent to the DC for ticket requests etc. 
Hi,

can you please add "debug_level = 0x07F0" to the [domain] section of
sssd.conf, restart the SSSD and then attach or paste the file
/var/log/sssd/sssd_$yourdomain.log ?

In particular, I'm interested if the nsupdate message as created by the
functions like be_nsupdate_create_fwd_msg() is correct and the update
was sent or not.

[steve]

On 09/05/13 19:45, Jakub Hrozek wrote:
>  On Thu, May 09, 2013 at 06:31:03PM +0200, steve wrote:
> >>>
> >>> Re: testing dyndns_update
> >>>
> >>> Confirmed 1.10.0beta1:
> >>> dyndns_update
> >>> is working against a Samba4 AD
> >>>
> >>> But there are some TSIG errors as in the current thread on this list:
> >>> https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html
> >>
> >> Thank you very much for testing, Steve!
> >
> > Hi Jakub
> > No problem.
> > Any chance of taking a look at those tsig errors? It's working, but
> > not sure why we get the errors. Not urgent.
> > Steve
>
>  I'm afraid I would forget so I will file a ticket and we'll take a look
>  post-beta:
>  https://fedorahosted.org/sssd/ticket/1919
>
>  We're trying to get all the features in for the 1.10 beta now, we'll get
>  back to fixing bugs later when the features are in. 
Hi
The TSIG error is almost certainly due to the Samba4 internal DNS. I 
switched to bind-DLZ on the DC and now it works fine. Maybe cancel the 
ticket?
Thanks,
Steve

[Jakub Hrozek]

On Sat, May 11, 2013 at 06:28:13PM +0200, steve wrote:
>  On 09/05/13 19:45, Jakub Hrozek wrote:
>  >On Thu, May 09, 2013 at 06:31:03PM +0200, steve wrote:
>  >>>>
>  >>>>Re: testing dyndns_update
>  >>>>
>  >>>>Confirmed 1.10.0beta1:
>  >>>>dyndns_update
>  >>>>is working against a Samba4 AD
>  >>>>
>  >>>>But there are some TSIG errors as in the current thread on this list:
>  >>>>https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html
>  >>>
>  >>>Thank you very much for testing, Steve!
>  >>
>  >>Hi Jakub
>  >>No problem.
>  >>Any chance of taking a look at those tsig errors? It's working, but
>  >>not sure why we get the errors. Not urgent.
>  >>Steve
>  >
>  >I'm afraid I would forget so I will file a ticket and we'll take a look
>  >post-beta:
>  >https://fedorahosted.org/sssd/ticket/1919
>  >
>  >We're trying to get all the features in for the 1.10 beta now, we'll get
>  >back to fixing bugs later when the features are in.
>  
>  Hi
>  The TSIG error is almost certainly due to the Samba4 internal DNS. I
>  switched to bind-DLZ on the DC and now it works fine. Maybe cancel the
>  ticket?
>  Thanks,
>  Steve 
OK, then I'm going to close the ticket and we can reopen if this issue
seems like it's cause by the SSSD not using the proper TSIG options.

[steve]

On 13/05/13 11:11, Jakub Hrozek wrote:
>  On Sat, May 11, 2013 at 06:28:13PM +0200, steve wrote:
> > On 09/05/13 19:45, Jakub Hrozek wrote:
> >> On Thu, May 09, 2013 at 06:31:03PM +0200, steve wrote:
> >>>>>
> >>>>> Re: testing dyndns_update
> >>>>>
> >>>>> Confirmed 1.10.0beta1:
> >>>>> dyndns_update
> >>>>> is working against a Samba4 AD
> >>>>>
> >>>>> But there are some TSIG errors as in the current thread on this
> list:
> >>>>>
> https://lists.fedorahosted.org/pipermail/sssd-devel/2013-May/014943.html
> >>>>
> >>>> Thank you very much for testing, Steve!
> >>>
> >>> Hi Jakub
> >>> No problem.
> >>> Any chance of taking a look at those tsig errors? It's working, but
> >>> not sure why we get the errors. Not urgent.
> >>> Steve
> >>
> >> I'm afraid I would forget so I will file a ticket and we'll take a look
> >> post-beta:
> >> https://fedorahosted.org/sssd/ticket/1919
> >>
> >> We're trying to get all the features in for the 1.10 beta now, we'll get
> >> back to fixing bugs later when the features are in.
> >
> > Hi
> > The TSIG error is almost certainly due to the Samba4 internal DNS. I
> > switched to bind-DLZ on the DC and now it works fine. Maybe cancel the
> > ticket?
> > Thanks,
> > Steve
>
>  OK, then I'm going to close the ticket and we can reopen if this issue
>  seems like it's cause by the SSSD not using the proper TSIG options. 
OK. Sorry to have caused you trouble. I've raised the issue on the samba 
list too as other users are having similar errors. It is not due to sssd.
Thanks