freeipa（2）客户端配置

yum -y install ipa-client

2）客户端配置
a)修改/etc/resolv.conf，将ipa server上的dns ip作为首选dns

b)ipa-client-install开始配置，输出大致如下

[root@cg ipa]# ipa-client-install DNS discovery failed to determine your DNS domain Provide the domain name of your IPA server (ex: example.com): mytest.org Provide your IPA server name (ex: ipa.example.com): ihost.mytest.org The failure to use DNS to find your IPA server indicates that your resolv.conf file is not properly configured. Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: yes Hostname: cg.mytest.org Realm: MYTEST.ORG DNS Domain: mytest.org IPA Server: ihost.mytest.org BaseDN: dc=mytest,dc=org Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin Synchronizing time with KDC... Password for admin@MYTEST.ORG: Successfully retrieved CA cert     Subject:     CN=Certificate Authority,O=MYTEST.ORG     Issuer:      CN=Certificate Authority,O=MYTEST.ORG     Valid From:  Tue Oct 07 03:20:26 2014 UTC     Valid Until: Sat Oct 07 03:20:26 2034 UTC Enrolled in IPA realm MYTEST.ORG Created /etc/ipa/default.conf New SSSD config will be created Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm MYTEST.ORG trying https://ihost.mytest.org/ipa/xml Forwarding 'env' to server u'https://ihost.mytest.org/ipa/xml' Hostname (cg.mytest.org) not found in DNS Failed to update DNS records. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub Forwarding 'host_mod' to server u'https://ihost.mytest.org/ipa/xml' Could not update DNS SSHFP records. SSSD enabled Configured /etc/openldap/ldap.conf NTP enabled Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Client configuration complete.

如果遇到错误“LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.“
说明client和server之间证书出现问题（来自ipa server发布的证书不被client信任）
一般是因为clent上之前从其他ipa server拿过证书，直接删掉client上的/etc/ipa/ca.crt即可。

3）与ovirt-engine集成
engine-manage-domains add --domain=mytest.org --provider=ipa --user=admin --add-permissions
如果遇到错误"Kerberos Error", 则要确认能否反向解析kdc服务地址，如下输出是正确的，如果解析不出来，则需要去ipa server上确认dns配置正确。
如果遇到错误“No LDAP servers can be obtained”，则可能是客户端的resolv.conf文件配置错误，可以尝试把ipa-server的ip作为第一个dns。

[root@cg log]# dig SRV _kerberos._tcp.mytest.org ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1 <<>> SRV _kerberos._tcp.mytest.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 342 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION: ;_kerberos._tcp.mytest.org.    IN    SRV ;; ANSWER SECTION: _kerberos._tcp.mytest.org. 604800 IN    SRV    0 100 88 ihost.mytest.org. ;; AUTHORITY SECTION: mytest.org.        604800    IN    NS    ihost.mytest.org. ;; ADDITIONAL SECTION: ihost.mytest.org.    604800    IN    A    192.168.1.104 ;; Query time: 43 msec ;; SERVER: 192.168.1.104#53(192.168.1.104) ;; WHEN: Tue Oct  7 14:55:19 2014 ;; MSG SIZE  rcvd: 109 [root@cg log]# engine-manage-domains add --domain=mytest.org --provider=ipa --user=admin --add-permissions Enter password: Successfully added domain mytest.org. oVirt Engine restart is required in order for the changes to take place (service ovirt-engine restart). Manage Domains completed successfully

如果添加AD域服务器，使用类似的方法，注意必须以administrator用户加入域控

[root@ehost vdsm]# vi /etc/hosts                 //能够解析自己的域名，realm和ad域控相同 [root@ehost vdsm]# vi /etc/resolv.conf        //ad域控作为首选dns [root@ehost vdsm]# engine-manage-domains add --domain=casc.cn --provider=activedirectory --user=administrator --add-permissions Enter password: Successfully added domain casc.cn. oVirt Engine restart is required in order for the changes to take place (service ovirt-engine restart). Manage Domains completed successfully [root@ehost vdsm]# service ovirt-engine restart Stopping oVirt Engine:                                     [  OK  ] Starting oVirt Engine:                                     [  OK  ] [root@ehost vdsm]# [root@ehost vdsm]# [root@ehost vdsm]# engine-manage-domains list Domain: casc.cn     User name: administrator@CASC.CN Manage Domains completed successfully

4）切换ipa服务器
（1）engine-manage-domains delete --domain=mytest.org
（2）ipa-client-install --uninstall
（3）reboot
即可清除本客户端所有原ipa设置，重新执行上述步骤即可。

5）密码过期问题
现象：ovirt-engine登路页面提示密码过期，ipa server log中提示“CLIENT KEY EXPIRED”
解决办法：
按照http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/pwd-expiration.html中的说明，修改用户的

krbPasswordExpiration

属性，但无论使用user-mod还是ldapmodify，都提示“Insufficient access“，没有权限修改。
最终使用如下命令修改成功
ldapmodify -x -D 'cn=directory manager' -W -h ipa.cg.cn -p 389 -vv -f ldap.ldif
[root@ipa home]# cat ldap.ldif
dn: uid=test,cn=users,cn=accounts,dc=cg,dc=cn
changetype: modify
replace: krbpasswordexpiration
krbpasswordexpiration: 20150202203734Z

6）web界面无法登录问题，提示会话已过期
#service ipa restart
然后重新登录web