diff options
| author | Rob Crittenden <rcritten@redhat.com> | 2011-08-26 10:42:40 -0400 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2011-08-25 20:43:33 -0400 |
| commit | aad2aecb34b723cd322f46ea4aa7c349e9f5f465 (patch) | |
| tree | db7f072ebd76304900ac2c31558ae93ba37b0828 /ipa-client/ipa-getkeytab.c | |
| parent | fc898bc607b065c38d177cfb5db771b7549a7f3f (diff) | |
| download | freeipa-aad2aecb34b723cd322f46ea4aa7c349e9f5f465.tar.gz freeipa-aad2aecb34b723cd322f46ea4aa7c349e9f5f465.tar.xz freeipa-aad2aecb34b723cd322f46ea4aa7c349e9f5f465.zip | |
Disable reverse lookups in ipa-join and ipa-getkeytab
This prevents broken DNS from causing enrollment problems.
https://fedorahosted.org/freeipa/ticket/1693
Diffstat (limited to 'ipa-client/ipa-getkeytab.c')
| -rw-r--r-- | ipa-client/ipa-getkeytab.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/ipa-client/ipa-getkeytab.c b/ipa-client/ipa-getkeytab.c index 01b8d7bc5..b884e8d9f 100644 --- a/ipa-client/ipa-getkeytab.c +++ b/ipa-client/ipa-getkeytab.c @@ -577,6 +577,13 @@ static int ldap_set_keytab(krb5_context krbctx, goto error_out; } + /* Don't do DNS canonicalization */ + ret = ldap_set_option(ld, LDAP_OPT_X_SASL_NOCANON, LDAP_OPT_ON); + if (ret != LDAP_SUCCESS) { + fprintf(stderr, _("Unable to set LDAP_OPT_X_SASL_NOCANON\n")); + goto error_out; + } + version = LDAP_VERSION3; ret = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); if (ret != LDAP_SUCCESS) { |