summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-09-08 13:47:37 -0400
committerEndi S. Dewata <edewata@redhat.com>2011-09-10 00:03:32 +0000
commitd3c24bb0a65dae85e665ebc617ab4f084c2299fd (patch)
tree4107495c31c62b4603c6bce514e5ae3d78b65109
parent75a859dc5de196a0b6925f5a6c254472a95bf599 (diff)
downloadfreeipa-d3c24bb0a65dae85e665ebc617ab4f084c2299fd.zip
freeipa-d3c24bb0a65dae85e665ebc617ab4f084c2299fd.tar.gz
freeipa-d3c24bb0a65dae85e665ebc617ab4f084c2299fd.tar.xz
Don't allow a OTP to be set on an enrolled host
Setting a password invalidates the existing keytab https://fedorahosted.org/freeipa/ticket/1719
-rw-r--r--ipalib/plugins/host.py8
1 files changed, 8 insertions, 0 deletions
diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py
index 76f2045..6c6ad7d 100644
--- a/ipalib/plugins/host.py
+++ b/ipalib/plugins/host.py
@@ -604,6 +604,14 @@ class host_mod(LDAPUpdate):
)
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
+ # Allow an existing OTP to be reset but don't allow a OTP to be
+ # added to an enrolled host.
+ if 'userpassword' in options:
+ entry = {}
+ self.obj.get_password_attributes(ldap, dn, entry)
+ if not entry['has_password'] and entry['has_keytab']:
+ raise errors.ValidationError(name='password', error=_('Password cannot be set on enrolled host.'))
+
# Once a principal name is set it cannot be changed
if 'cn' in entry_attrs:
raise errors.ACIError(info='cn is immutable')