diff options
author | Alexander Bokovoy <abokovoy@redhat.com> | 2012-07-16 13:12:42 +0300 |
---|---|---|
committer | Alexander Bokovoy <abokovoy@redhat.com> | 2012-07-18 16:55:57 +0300 |
commit | dadfbf9d153bcf8f7ce659981698ffa2292b3967 (patch) | |
tree | 8731760a4a4ef25aeeb1810431cac18611807bd5 | |
parent | 2d75d8cc055887f354db947aac1d33e961e9c80c (diff) | |
download | freeipa-dadfbf9d153bcf8f7ce659981698ffa2292b3967.tar.gz freeipa-dadfbf9d153bcf8f7ce659981698ffa2292b3967.tar.xz freeipa-dadfbf9d153bcf8f7ce659981698ffa2292b3967.zip |
Handle various forms of admin accounts when establishing trusts
Realm administrator account may be specified using different form:
Administrator, DOM\Administrator, Administrator@DOMAIN
This patch introduces handling of the second two forms:
- In DOM\Administrator only user name is used, short domain name
is then taken from a discovered record from the AD DC
- In Administrator@DOMAIN first DOMAIN is verified to be the same
as the domain we are establishing trust to, and then user name
is taken, together with short domain name taken from a discovered
record from the AD DC
Note that we do not support using to-be-trusted domain's trusted domains'
accounts to establish trust as there is basically zero chance to verify
that things will work with them. In addition, in order to establish trust
one needs to belong to Enterprise Admins group in AD or have specially
delegated permissions. These permissions are unlikely delegated to the
ones in already trusted domain.
https://fedorahosted.org/freeipa/ticket/2864
-rw-r--r-- | ipalib/plugins/trust.py | 8 | ||||
-rw-r--r-- | ipaserver/dcerpc.py | 5 |
2 files changed, 13 insertions, 0 deletions
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py index 2932835e0..792e6cac2 100644 --- a/ipalib/plugins/trust.py +++ b/ipalib/plugins/trust.py @@ -180,6 +180,14 @@ class trust_add(LDAPCreate): # generate random trustdom password to do work on both sides if 'realm_admin' in options: realm_admin = options['realm_admin'] + names = realm_admin.split('@') + if len(names) > 1: + # realm admin name is in UPN format, user@realm, check that + # realm is the same as the one that we are attempting to trust + if keys[-1].lower() != names[-1].lower(): + raise errors.ValidationError(name=_('AD Trust setup'), + error=_('Trusted domain and administrator account use different realms')) + realm_admin = names[0] if 'realm_passwd' not in options: raise errors.ValidationError(name=_('AD Trust setup'), error=_('Realm administrator password should be specified')) diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py index 07e40c2d3..6b830f65b 100644 --- a/ipaserver/dcerpc.py +++ b/ipaserver/dcerpc.py @@ -363,6 +363,11 @@ class TrustDomainJoins(object): rd.read_only = True if realm_admin and realm_passwd: if 'name' in rd.info: + names = realm_admin.split('\\') + if len(names) > 1: + # realm admin is in DOMAIN\user format + # strip DOMAIN part as we'll enforce the one discovered + realm_admin = names[-1] auth_string = u"%s\%s%%%s" % (rd.info['name'], realm_admin, realm_passwd) td = get_instance(self) td.creds.parse_string(auth_string) |