[Freeipa-users] EXTERNAL: Re: Client Installation Error

[Rob Crittenden]

Joseph, Matthew (EXP) wrote:
> Hey Rob,
>
> I'm running 2.0.0-23.el6.x86-64.
> So if I upgrade to the version you listed below then I should be all good?
>
> Is this a known problem with just 2.0.0-23 or is it also previous versions?

It depends on the mix of curl, xmlrpc-c and ipa-client.

The incompatibility was added in libcurl-7.19.7-26.el6_1.1 to address 
CVE-2011-2192.

xmlrpc-c added new delegation support in 1.16.24-1200.1840.el6_1.1

So you either need older versions of all, or newer versions of all.

rob

>
> Thanks,
>
> Matt
>
> -----Original Message-----
> From: Rob Crittenden [mailto:rcritten at redhat.com]
> Sent: Tuesday, April 02, 2013 2:58 PM
> To: Joseph, Matthew (EXP); freeipa-users at redhat.com
> Subject: EXTERNAL: Re: [Freeipa-users] Client Installation Error
>
> Joseph, Matthew (EXP) wrote:
>> Hey,
>>
>> I'm trying to add a client to IPA and I'm getting the following error;
>>
>> Joining realm failed because of failing XML-RPC request
>>
>> This error may be caused by incompatible server/client major versions.
>>
>> Client is running Red Hat 6.1 with the following IPA and Curl packages
>> installed;
>>
>> Ipa-*-2.0.0-23
>>
>> Curl-7.19.7-26
>>
>> Libcurl-7.19.7-26
>>
>> Server is running Red Hat 6.3 with the following IPA and Curl Packages
>> installed;
>>
>> Ipa-*-2.2.0-16
>>
>> Curl-7.19.7-26
>>
>> Libcurl-7.19.7-26
>>
>>   From what I've seen from other people is that the issue is with
>> libcurl blocking GSSAPI requests. Is that still the case?
>>
>> If so what are my options here to get around this problem? I assume I
>> can downgrade my Curl but will that affect anything major?
>>
>> Thanks,
>>
>> Matt
>
> Exactly what version of ipa-client do you have installed? You need
> 2.0.0-23.el6_1.2 to fix ticket delegation.
>
> rob
>