[Bug 297487] net/freeipa-client: make host enrollment work on FreeBSD

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297487

            Bug ID: 297487
           Summary: net/freeipa-client: make host enrollment work on
                    FreeBSD
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: [email protected]
          Reporter: [email protected]
          Assignee: [email protected]
             Flags: maintainer-feedback?([email protected])

Created attachment 273693
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273693&action=edit
Patch

I was testing FreeIPA client enrollment against a FreeBSD IPA server (built
from a not-yet-committed update to net/freeipa-server) and hit two problems
that keep ipa-client-install from ever finishing on FreeBSD.

1) ipa-join can't find ipa-getkeytab

The join goes through, but the install aborts right afterwards:

Enrolled in IPA realm IPA.LOCAL
...
Failed to obtain host TGT: Major (458752): No credentials were supplied,
or the credentials were unavailable or inaccessible,
Minor (2529639107): No credentials cache found
Installation failed. Rolling back changes.

The install log shows the reason. ipa-join does the join over JSON-RPC and then
forks ipa-getkeytab to pull down the host keytab:

DEBUG args=['/usr/local/sbin/ipa-join', ..., '-k', '/etc/krb5.keytab']
DEBUG Process finished, return code=0
DEBUG stderr=ipa-getkeytab not found

client/ipa-join.c has the path to ipa-getkeytab hardcoded as
/usr/sbin/ipa-getkeytab, which is the Linux location; on FreeBSD the binary is
in ${PREFIX}/sbin. The exec fails, but because the join RPC itself succeeded
ipa-join still returns 0, so the installer prints "Enrolled ..." and moves on
while /etc/krb5.keytab was never written. The kinit against that keytab then
finds no credentials and the whole install rolls back.

patch-client_ipa-join.c points that path at /usr/local/sbin/ipa-getkeytab.

2) nsswitch never gets the sss source

With the keytab fixed the enrollment completes, but id and getent still don't
return any IPA users. The FreeBSD modify_nsswitch_pam_stack() in
ipaplatform/freebsd/tasks.py was a stub that just returns None, so
ipa-client-install never touches nsswitch.conf and it stays at the FreeBSD
default:

passwd: compat
group: compat

The NSS module itself is there — security/sssd2 installs
/usr/local/lib/nss_sss.so.1 — it just never gets wired up. The base
implementation of the method uses authselect/authconfig, neither of which
exists here. patch-ipaplatform_freebsd_tasks.py implements the method so it
adds the sss source:

passwd: files sss
group: files sss

With both patches in place ipa-client-install runs to completion and getent
passwd / id resolve accounts from the IPA server.

-- 
You are receiving this mail because:
You are the assignee for the bug.