<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hi Rob,</span></div><div><span><br></span></div><div><span> Thanks a lot for confirming the effect and clear and plain explanation of 'external host' idea. I've filed a feature request type bug as you have recommended. The bug link is here for your reference: </span><span class="Apple-style-span" style="font-family: 'DejaVu Sans', 'Liberation Sans', sans-serif; font-weight: bold; "><a href="https://bugzilla.redhat.com/show_bug.cgi?id=821907" style="color: rgb(0, 102, 204); text-decoration: none; "><b>Bug 821907</b></a> -<span id="summary_alias_container"> <span id="short_desc_nonedit_display">Feature Request: convert once External Hosts into Member Hosts after ipa-client-install</span> ..</span></span></div><div><br></div><div> I'll follow your steps to test the replication recovery on another thread now.</div><div><br></div><div>Thanks again for your help.</div><div><br></div><div>--Gelen.</div><div><br></div><div><br></div><div><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Rob Crittenden <rcritten@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> Gelen James <hahaha_30k@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "dpal@redhat.com" <dpal@redhat.com>; "Freeipa-users@redhat.com" <Freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, May 15, 2012 9:41 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] Bug or feature regarding External Host in IPA net groups?<br> </font> </div> <br> Gelen James wrote:<br>><br>> Hi all,<br>><br>> Not sure whether it is bug or a feature, but when I evaluate the IPA net<br>> groups, the 'external host' feature brings me some unexpected results.<br>> I'll listed them below -- I am running IPA 2.1.3-9 on Redhat 6.2.<br>><br>> 1, when I added a host into IPA netgroup in command line mode, 'ipa<br>> netgroup-add-member <netgroup> --hosts=<client>'. When the host is not<br>> yet installed/configured into an IPA client, it shows in 'external host'<br>> category, in the output of 'ipa netgroup-find <netgroup>' command.<br>> The 'external host' doesn't show up in the Web interface for IPA net<br>> group. But it does show up when run 'ipa net group-find', or even<br>> 'getent <netgroup>' by sssd.<br>><br>> 2, After the 'external host' is configured into an IPA client -- 'ipa<br>> user-find <client> proves it' -- it is still reported as 'external host'<br>> by command 'ipa netgroup-find', and still not show up in web interface<br>> neither. Could this is a bug?<br>><br>> 3, because of #2 above, when this machine is reconfigured, and removed<br>> with 'ipa user-del <client>', it is show up in the containing netgroups<br>> and nested netgroups, and has to be removed manually. :(<br>><br>> 4, This could be a real bug: You can add an 'external host' with either<br>> a host's bare name, or FQDN name. Then after the machine is installed,<br>> and you would like to remove it from 'external host' category with<br>> command 'ipa user-del <client>', it will remove the FQDN name entry<br>> only! and leave the bare name there forever, until you delete the whole<br>> containing netgroup!<br>><br>> [root@ipaclient02 ~]# ipa netgroup-find external-ng<br>> -------------------<br>> 1 netgroups matched<br>> -------------------<br>> Netgroup name: external-ng<br>> Description: netgroup for external hosts<br>> NIS domain name: example.com<br>> Member of netgroups: nest-external-ng<br>> External host: <a target="_blank" href="http://dnsmaster.example.com">dnsmaster.example.com</a>, ipaclient02,<br>> <a target="_blank" href="http://ipaclient02.mac.example.com">ipaclient02.mac.example.com</a><br>><br>> ----------------------------<br>> Number of entries returned 1<br>> ----------------------------<br>><br>> [root@ipaclient02 ~]# getent netgroup external-ng<br>> external-ng (dnsmaster.example.com, -, example.com)<br>> (ipaclient02.mac.example.com, -, example.com)<br>><br>> [root@ipaclient02 ~]# ipa netgroup-remove-member external-ng<br>> --hosts=ipaclient02<br>> Netgroup name: external-ng<br>> Description: netgroup for external hosts<br>> NIS domain name: example.com<br>> Member of netgroups: nest-external-ng<br>> External host: dnsmaster.example.com, ipaclient02<br>> ---------------------------<br>> Number of members removed 1<br>> ---------------------------<br>><br>> [root@ipaclient02 ~]# ipa netgroup-remove-member external-ng<br>> --hosts=ipaclient02<br>> Netgroup name: external-ng<br>> Description: netgroup for external hosts<br>> NIS domain name: example.com<br>> Member of netgroups: nest-external-ng<br>> External host: dnsmaster.example.com, ipaclient02<br>> Failed hosts/hostgroups:<br>> member host: <a target="_blank" href="http://ipaclient02.example.com">ipaclient02.example.com</a>: This entry is not a member<br>> ---------------------------<br>> Number of members removed 0<br>> ---------------------------<br>> [root@ipaclient02 ~]#<br>><br><br>An external host is one that is never expected to be added as a host in <br>IPA, however we don't prevent it. There is no reconciliation done if an <br>external host is added as an IPA host, as you've seen. If you'd like <br>this please file an enhancement request at <a href="https://fedorahosted.org/freeipa/" target="_blank">https://fedorahosted.org/freeipa/</a><br><br>In 3.0 we have added validation of external host names. Whether this <br>will prevent a bare name or not I'm not sure. I don't know why we would <br>care whether it was fully qualified or not, though yeah, it appears we <br>are automatically adding the domain. I tested this in 2.2 and it worked <br>as expected, a bare name was deletable.<br><br>rob<br><br><br> </div> </div> </div></body></html>