Issue #2540: SSSD does not update Dynamic DNS records if the IPA domain differs from machine hostname's domain - sssd

SSSD / sssd

#2540 SSSD does not update Dynamic DNS records if the IPA domain differs from machine hostname's domain

Closed: Fixed None Opened 9 years ago by pspacek.

(This was originally reported as https://fedorahosted.org/freeipa/ticket/4816.)

I have consulted this with Jakub Hrozek and he claims that SSSD always generates 'zone' directive which is always set to FreeIPA domain name. Basically this is the same problem as https://fedorahosted.org/freeipa/ticket/4780 in ipa-client-install.

In fact, the zone directive should not be generated at all because nsupdate has auto-detection logic for zone value.

This code works sometimes but it breaks when client domain is not the same as FreeIPA domain.

jhrozek commented 9 years ago

An easy fix would be to only use zone in the second hail-Mary iteration as we already do with 'server'.

pspacek commented 9 years ago

Replying to [comment:1 jhrozek]:

An easy fix would be to only use zone in the second hail-Mary iteration as we already do with 'server'.
That would make secon iteration non-functional in the same cases where it fails now. I would recommend to remove the option completely.

jhrozek commented 9 years ago

Replying to [comment:2 pspacek]:

Replying to [comment:1 jhrozek]:

An easy fix would be to only use zone in the second hail-Mary iteration as we already do with 'server'.
That would make secon iteration non-functional in the same cases where it fails now. I would recommend to remove the option completely.

Fine as long as this change is done in a major release. I would hate to break some strange deployment where the zone is actually needed.

What do you this about setting "server", do you think we should remove that, too?

pspacek commented 9 years ago

Replying to [comment:3 jhrozek]:

Replying to [comment:2 pspacek]:

Replying to [comment:1 jhrozek]:
What do you this about setting "server", do you think we should remove that, too?
IMHO current usage of server (i.e. try to do update without it and try again with explicit server = IPA server if the first attempt failed) is reasonable. It could effectivelly workaround some seriously flawed DNS configurations :-)