summaryrefslogtreecommitdiffstats
path: root/ipa-client
diff options
context:
space:
mode:
Diffstat (limited to 'ipa-client')
-rwxr-xr-xipa-client/ipa-install/ipa-client-install2
-rw-r--r--ipa-client/ipaclient/ipadiscovery.py52
2 files changed, 33 insertions, 21 deletions
diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install
index 30a532227..05adf0dad 100755
--- a/ipa-client/ipa-install/ipa-client-install
+++ b/ipa-client/ipa-install/ipa-client-install
@@ -2132,7 +2132,7 @@ def install(options, env, fstore, statestore):
# Create the discovery instance
ds = ipadiscovery.IPADiscovery()
- ret = ds.search(domain=options.domain, servers=options.server, hostname=hostname, ca_cert_path=get_cert_path(options.ca_cert_file))
+ ret = ds.search(domain=options.domain, servers=options.server, realm=options.realm_name, hostname=hostname, ca_cert_path=get_cert_path(options.ca_cert_file))
if options.server and ret != 0:
# There is no point to continue with installation as server list was
diff --git a/ipa-client/ipaclient/ipadiscovery.py b/ipa-client/ipaclient/ipadiscovery.py
index 0532f618e..0d574825a 100644
--- a/ipa-client/ipaclient/ipadiscovery.py
+++ b/ipa-client/ipaclient/ipadiscovery.py
@@ -139,7 +139,7 @@ class IPADiscovery(object):
domain = domain[p+1:]
return (None, None)
- def search(self, domain = "", servers = "", hostname=None, ca_cert_path=None):
+ def search(self, domain="", servers="", realm=None, hostname=None, ca_cert_path=None):
"""
Use DNS discovery to identify valid IPA servers.
@@ -218,13 +218,21 @@ class IPADiscovery(object):
#search for kerberos
root_logger.debug("[Kerberos realm search]")
- krb_realm, kdc = self.ipadnssearchkrb(self.domain)
- if not servers and not krb_realm:
+ if realm:
+ root_logger.debug("Kerberos realm forced")
+ self.realm = realm
+ self.realm_source = 'Forced'
+ else:
+ realm = self.ipadnssearchkrbrealm()
+ self.realm = realm
+ self.realm_source = (
+ 'Discovered Kerberos DNS records from %s' % self.domain)
+
+ if not servers and not realm:
return REALM_NOT_FOUND
- self.realm = krb_realm
- self.kdc = kdc
- self.realm_source = self.kdc_source = (
+ self.kdc = self.ipadnssearchkrbkdc()
+ self.kdc_source = (
'Discovered Kerberos DNS records from %s' % self.domain)
# We may have received multiple servers corresponding to the domain
@@ -452,11 +460,12 @@ class IPADiscovery(object):
return servers
- def ipadnssearchkrb(self, tdomain):
+ def ipadnssearchkrbrealm(self, domain=None):
realm = None
- kdc = None
+ if not domain:
+ domain = self.domain
# now, check for a Kerberos realm the local host or domain is in
- qname = "_kerberos." + tdomain
+ qname = "_kerberos." + domain
root_logger.debug("Search DNS for TXT record of %s", qname)
@@ -472,18 +481,21 @@ class IPADiscovery(object):
realm = answer.strings[0]
if realm:
break
+ return realm
- if realm:
- # now fetch server information for the realm
- domain = realm.lower()
+ def ipadnssearchkrbkdc(self, domain=None):
+ kdc = None
- kdc = self.ipadns_search_srv(domain, '_kerberos._udp', 88,
- break_on_first=False)
+ if not domain:
+ domain = self.domain
- if kdc:
- kdc = ','.join(kdc)
- else:
- root_logger.debug("SRV record for KDC not found! Realm: %s, SRV record: %s" % (realm, qname))
- kdc = None
+ kdc = self.ipadns_search_srv(domain, '_kerberos._udp', 88,
+ break_on_first=False)
+
+ if kdc:
+ kdc = ','.join(kdc)
+ else:
+ root_logger.debug("SRV record for KDC not found! Domain: %s" % domain)
+ kdc = None
- return realm, kdc
+ return kdc