summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMartin Kosek <mkosek@redhat.com>2011-03-21 14:50:05 +0100
committerMartin Kosek <mkosek@redhat.com>2011-05-17 08:56:22 +0200
commit95b4040f6b4f43b864dce86648f09a1402889af9 (patch)
treee198e1845ad099fc60117296ed812c72d5847101
parenta7f9814ab702cfa42988e47e80f44b57a195ad1e (diff)
downloadfreeipa-95b4040f6b4f43b864dce86648f09a1402889af9.tar.gz
freeipa-95b4040f6b4f43b864dce86648f09a1402889af9.tar.xz
freeipa-95b4040f6b4f43b864dce86648f09a1402889af9.zip
KDC autodiscovery may fail when domain is not realm
When ipa-client-install autodiscovers IPA server values it doesn't fill the fixed KDC address to Kerberos configuration file. However, when realm != domain or the autodiscovered values are overridden, installation may fail because it cannot find the KDC. This patch adds a failover to use static KDC address in case when such an issue occurs. https://fedorahosted.org/freeipa/ticket/1100
-rwxr-xr-xipa-client/ipa-install/ipa-client-install15
-rw-r--r--ipa-client/ipaclient/ipadiscovery.py26
2 files changed, 26 insertions, 15 deletions
diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install
index 2bcd4b916..79ed6fa87 100755
--- a/ipa-client/ipa-install/ipa-client-install
+++ b/ipa-client/ipa-install/ipa-client-install
@@ -386,7 +386,7 @@ def hardcode_ldap_server(cli_server):
return
-def configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, dnsok, options, filename):
+def configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, filename):
krbconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
krbconf.setOptionAssignment(" = ")
@@ -399,7 +399,7 @@ def configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, d
#[libdefaults]
libopts = [{'name':'default_realm', 'type':'option', 'value':cli_realm}]
- if not dnsok or options.force:
+ if not dnsok or not cli_kdc or options.force:
libopts.append({'name':'dns_lookup_realm', 'type':'option', 'value':'false'})
libopts.append({'name':'dns_lookup_kdc', 'type':'option', 'value':'false'})
else:
@@ -413,7 +413,7 @@ def configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, d
opts.append({'name':'empty', 'type':'empty'})
#the following are necessary only if DNS discovery does not work
- if not dnsok or options.force:
+ if not dnsok or not cli_kdc or options.force:
#[realms]
kropts =[{'name':'kdc', 'type':'option', 'value':cli_server+':88'},
{'name':'admin_server', 'type':'option', 'value':cli_server+':749'},
@@ -716,6 +716,11 @@ def main():
print >>sys.stderr, "due to network or firewall settings."
return ret
+ cli_kdc = ds.getKDCName()
+ if dnsok and not cli_kdc:
+ print >>sys.stderr, "DNS domain '%s' is not configured for automatic KDC address lookup." % ds.getRealmName().lower()
+ print >>sys.stderr, "KDC address will be set to fixed value.\n"
+
if dnsok:
print "Discovery was successful!"
elif not options.unattended:
@@ -772,7 +777,7 @@ def main():
try:
(krb_fd, krb_name) = tempfile.mkstemp()
os.close(krb_fd)
- if configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, dnsok, options, krb_name):
+ if configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, krb_name):
sys.exit("Test kerberos configuration failed")
env['KRB5_CONFIG'] = krb_name
join_args = ["/usr/sbin/ipa-join", "-s", cli_server]
@@ -864,7 +869,7 @@ def main():
if not options.on_master:
# Configure krb5.conf
fstore.backup_file("/etc/krb5.conf")
- if configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, dnsok, options, "/etc/krb5.conf"):
+ if configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, "/etc/krb5.conf"):
return 1
print "Configured /etc/krb5.conf for IPA realm " + cli_realm
diff --git a/ipa-client/ipaclient/ipadiscovery.py b/ipa-client/ipaclient/ipadiscovery.py
index 0df23eb97..d149412ec 100644
--- a/ipa-client/ipaclient/ipadiscovery.py
+++ b/ipa-client/ipaclient/ipadiscovery.py
@@ -68,6 +68,9 @@ class IPADiscovery:
def getRealmName(self):
return self.realm
+ def getKDCName(self):
+ return self.kdc
+
def getBaseDN(self):
return self.basedn
@@ -139,20 +142,20 @@ class IPADiscovery:
else:
return -2 #no ldap server found
-
- #search for kerberos TODO: move this after ipacheckldap()
- logging.debug("[ipadnssearchkrb]")
- krbret = self.ipadnssearchkrb(self.domain)
- if not krbret:
- return -3 #no krb server found
-
- self.realm = krbret[0]
-
else: #server forced on us, this means DNS doesn't work :/
self.domain = domain
self.server = server
+ #search for kerberos
+ logging.debug("[ipadnssearchkrb]")
+ krbret = self.ipadnssearchkrb(self.domain)
+ if not server and not krbret[0]:
+ return -3 # realm for autodiscovery not found
+
+ self.realm = krbret[0]
+ self.kdc = krbret[1]
+
logging.debug("[ipacheckldap]")
# check ldap now
ldapret = self.ipacheckldap(self.server, self.realm)
@@ -303,7 +306,7 @@ class IPADiscovery:
if realm:
# now fetch server information for the realm
- qname = "_kerberos._udp." + tdomain
+ qname = "_kerberos._udp." + realm.lower()
# terminate the name
if not qname.endswith("."):
qname += "."
@@ -318,4 +321,7 @@ class IPADiscovery:
else:
kdc = qname
+ if not kdc:
+ logging.debug("SRV record for KDC not found! Realm: %s, SRV record: %s" % (realm, qname))
+
return [realm, kdc]