<div dir="ltr"><div class="gmail_extra">On Sat, Jan 26, 2013 at 2:13 AM, Charlie Derwent <span dir="ltr"><<a href="mailto:shelltoesuperstar@gmail.com" target="_blank">shelltoesuperstar@gmail.com</a>></span> wrote:<br>
<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div>Hi Fred</div>
<div> </div><div>Little unsure about what you mean here. What is it you're trying to do exactly? Do you mean you can't run IPA commands on your satellite server? Do you just need to install ipa-admin-tools? </div>
<div> </div><div>Do you mean IPA commands don't work on a IPA client until the client is enrolled? That would make sense as how else would the server authenticate the commands?</div><div><br></div></div></blockquote>
<div><br></div><div>First of all, the RFE solves my problem.</div><div><br></div><div>The discussion was how it might be solved without the RFE in my use case.</div><div><br></div><div>We redeploy systems using Satellite Web UI. What Satellite basically does when requesting a re-install is scheduling a remote command on the system. This remote command is "koan" (kickstart-over-a-network). <a href="http://linux.die.net/man/1/koan">Koan</a> will prep the system so it will re-install at the next reboot using the correct kickstart profile, usually through PXE.</div>
<div><br></div><div>Now, this to-be-redeployed system is also an IPA-client. In the kickstart file for this system we have "ipa-client-install -w <password> --unattend etc" for unattended enrolledment. The part that is missing is the unattended un-enrollment prior to the systems re-install.</div>
<div><br></div><div>I am trying to find a place in the workflow up untill the reboot-before-reinstall sequence to have a script started that does this. Koan would be the ideal candidate, but it does not give this possibility.</div>
<div><br></div><div>The RFE solves this problem. I can save the keytab before re-installation and get it back afterwards. Then I can call ipa-client-install with the old keytab to enroll the client, revoke the old keytab and get a new one in one go.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">I have already also asked about this on the satellite-user mailing-list.<br clear="all"><div><br></div><div>Fred</div><div><br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div> </div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">
<div> </div>
</div><div class=""><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jan 25, 2013 at 8:35 AM, Fred van Zwieten <span dir="ltr"><<a href="mailto:fvzwieten@vxcompany.com" target="_blank">fvzwieten@vxcompany.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><span style="font-family:arial,sans-serif;font-size:13.33px">And, using the ipa command is only possible on ipa clients.</span><div style="font-family:arial,sans-serif;font-size:13.33px">
<br></div></div><div style="font-family:arial,sans-serif;font-size:13.33px">Although our Satellite server is an IPA client, I am (as of yet) unable to execute ipa commands from any ipa client prior to the re-install request from Satellite. There is, afaik, no such thing as a pre-reinstall hook or anything like that.</div>
<div>
<div style="font-family:arial,sans-serif;font-size:13.33px"><br></div><div style="font-family:arial,sans-serif;font-size:13.33px">As for the ipa-host-mod --password=foo thing. You can first run the command "ipa disable-host <fqdn> and _then_ run "ipa host-mod <fqdn> --password=foo</div>
</div><div class="gmail_extra"><br clear="all"><div><div><br>Met vriendelijke groeten,<br><b><br><font style="color:rgb(51,102,255)" color="#000099">Fre</font><font style="color:rgb(51,102,255)" color="#000099">d van Zwieten</font><br style="color:rgb(51,102,255)">
</b>
<div><font color="#3333ff"><span style="color:rgb(0,0,153)"><b style="color:rgb(51,102,255)">Enterprise Open Source Services</b><br></span></font></div>
<div><b><br><span style="color:rgb(51,102,255)">Consultant</span></b><br><font size="1"><i>(vrijdags afwezig)</i></font></div>
<div><br><b><span style="color:rgb(255,0,0)">VX Company IT Services B.V.</span></b><br><span style="color:rgb(0,0,153)"><b><span style="color:rgb(255,0,0)">T</span></b><span style="color:rgb(255,255,255)"> <span style="color:rgb(51,102,255)">(035) 539 09 50 mobiel (06) 41 68 28 48</span></span></span><span style="color:rgb(51,102,255)"></span><br style="color:rgb(0,0,153)">
<span style="color:rgb(0,0,153)"><b><span style="color:rgb(255,0,0)">F</span></b> <span style="color:rgb(51,102,255)">(035) 539 09 08</span></span><br style="color:rgb(0,0,153)"><span style="color:rgb(0,0,153)"><b style="color:rgb(255,0,0)">E</b><span style="color:rgb(51,102,255)"> </span></span><a style="color:rgb(51,102,255)" href="mailto:fvzwieten@vxcompany.com" target="_blank">fvzwieten@vxcompany.com</a><br style="color:rgb(0,0,153)">
<span style="color:rgb(0,0,153)"><b style="color:rgb(255,0,0)">I</b> </span><a style="color:rgb(51,102,255)" href="http://www.vxcompany.com/" target="_blank">www.vxcompany.com</a></div></div>
<br><br></div><div class="gmail_quote"><div>On Fri, Jan 25, 2013 at 3:40 AM, Simo Sorce <span dir="ltr"><<a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>></span> wrote:<br></div><blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid" class="gmail_quote">
<div><div>
<div><div>On Thu, 2013-01-24 at 21:36 -0500, Matthew Barr wrote:<br>
> On Jan 24, 2013, at 6:53 PM, Dmitri Pal <<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>> wrote:<br>
> ><br>
> > Yes you can set it again. This is how we envisioned the feature to be used.<br>
> > If it does not work it is a bug.<br>
><br>
><br>
> ipa-server-2.2.0-16.el6.x86_64, Centos 6.3<br>
><br>
> [mbarr@ipa ~]$ ipa host-mod <a href="http://wiki01.ayisnap.com" target="_blank">wiki01.ayisnap.com</a> --password=foo<br>
> ipa: ERROR: invalid 'password': Password cannot be set on enrolled host.<br>
<br>
</div></div>Matthew this is indeed the correct behavior, previous information from<br>
Dmitri was not correct.<br>
<br>
Once a host is enrolled you cannot reset the OTP password as that would<br>
effectively mean destroying the hosts credentials while the host is<br>
enrolled. Currently the IPA workflow expects you unenroll the client<br>
first.<br>
<span><font color="#888888"><br>
Simo.<br>
<br>
--<br>
Simo Sorce * Red Hat, Inc * New York<br>
</font></span></div></div><div><div><br><div>
_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
</div></div></div></blockquote></div><br></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div></div>