I have manually enrolled and configured the client. I am able to log into the client and access nfs4 shares. What I am wondering is if there are anything that the client would miss by joining this way. The client authenticate to the ipa-server through sssd. I would like to know if HBAC and centrally managed SUDO and other policy enforcements will fail to work because the manual enrolment. Note that host certificate was not generated because of the manual joining. Thanks <div class="gmail_quote">On Tue, Mar 22, 2011 at 12:25 PM, Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> <div class="im">On 03/22/2011 10:34 AM, <a href="mailto:ide4you@gmail.com">ide4you@gmail.com</a> wrote: > Thanks Rob, > > However the client is a fedora 13 box. > There is no client rpm for fedora 13 </div>We do not build F13 any more as the packages and functionality they provide deviated so far between F14-F15 and F13. <div><div></div><div class="h5"> > ------Original Message------ > From: Rob Crittenden > To: Uzor Ide > Cc: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> > Subject: Re: [Freeipa-users] ipa client install > Sent: Mar 22, 2011 9:44 AM > > Uzor Ide wrote: >> Hi >> >> Is there a requirement for the same version of client as the server. >> I've just install freeipa server version 2.0 rc3. While on the client >> side, I have a previously installed client version 2.0 beta1. It would >> not join the realm. I had run the client install script to remove the >> client from the another 2.0 beta1 server. >> But when I try to run against the new server, to join the server version >> 2.0 rc3 realm, the discovery goes on smoothly after which I get the >> following >> >> >> Continue to configure the system with these values? [no]: yes >> >> Joining realm failed: Operation failed! unsupported extended operation >> child exited with 9 >> Certificate subject base is: o=uzdomainco >> >> The client's kerberos keytab is not update and non of the config files >> are update. >> However when you use the command ipa host-find on the server the host is >> listed. >> >> Any ideas what the issue would be? >> >> thanks >> >> ide > A change was made in 2.0rc2 in the release that made pre rc2 clients > unable to join rc2 and beyond servers. We changed the LDAP extended > operation OID used for doing online enrollment and retrieving keytabs > which is why the older clients now fail (we had inadvertently used them > in more than one place). > > You should be able to just upgrade the client rpm and enrollment will work. > > rob > > Sent on the TELUS Mobility network with BlackBerry > </div></div>> _______________________________________________ > Freeipa-users mailing list > <a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > > -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a href="http://www.redhat.com/carveoutcosts/" target="_blank">www.redhat.com/carveoutcosts/</a> _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </blockquote></div>