diff options
| author | Tomas Babej <tbabej@redhat.com> | 2015-08-06 10:54:47 +0200 |
|---|---|---|
| committer | Martin Basti <mbasti@redhat.com> | 2015-08-17 17:09:02 +0200 |
| commit | 5fd2a893e65ba6cc888de930f76b2e48ba460b8d (patch) | |
| tree | c1b9cc6623421156e73a70fa6b1556b3d124f1a5 | |
| parent | 5d5240b9db3b9e6f29351c65272a363b253cd2d3 (diff) | |
| download | freeipa-5fd2a893e65ba6cc888de930f76b2e48ba460b8d.tar.gz freeipa-5fd2a893e65ba6cc888de930f76b2e48ba460b8d.tar.xz freeipa-5fd2a893e65ba6cc888de930f76b2e48ba460b8d.zip | |
trusts: Detect domain clash with IPA domain when adding a AD trust
When IPA is deployed in the same domain as AD, trust-add fails since
the names of the local domain and trusted domain ranges is the same
- it's always DOMAIN.NAME_id_range.
When adding a trusted domain, we look for previous ranges for
this domain (which may have been left behind by previous trust
attempts). Since AD and IPA are in the same domain, we find
a local domain range, which does not have a SID.
Detect such domain collisions early and bail out with an appropriate
error message.
https://fedorahosted.org/freeipa/ticket/4549
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
| -rw-r--r-- | ipalib/plugins/trust.py | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py index 35e75d8ed..4302c3ac3 100644 --- a/ipalib/plugins/trust.py +++ b/ipalib/plugins/trust.py @@ -670,6 +670,14 @@ sides. error=_('only "ad" is supported') ) + # Detect IPA-AD domain clash + if self.api.env.domain.lower() == trusted_realm_domain.lower(): + raise errors.ValidationError( + name=_('domain'), + error=_('Cannot establish a trust to AD deployed in the same ' + 'domain as IPA. Such setup is not supported.') + ) + # If domain name and realm does not match, IPA server is not be able # to establish trust with Active Directory. |