From aece880d8f53d3f641a5a1ca3df494eb352117b1 Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Fri, 15 Jul 2011 09:00:20 +0200 Subject: Fix ipa-dns-install When DNS plugin is installed via ipa-dns-install and user has a valid Kerberos ticket at the time, the DNS installation is corrupt and named won't start, reporting Preauthentication error. When the non-DM identity is used for authentication, krbprincipalkey attribute in DNS service LDAP record is not created, thus leading to the error. This patch makes sure that authentication with Directory Manager password is used every time. https://fedorahosted.org/freeipa/ticket/1483 --- install/tools/ipa-dns-install | 32 +++++++++++++------------------- 1 file changed, 13 insertions(+), 19 deletions(-) diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install index eb1336e51..cc091dd08 100755 --- a/install/tools/ipa-dns-install +++ b/install/tools/ipa-dns-install @@ -145,25 +145,19 @@ def main(): print "" # Create a BIND instance - bind = bindinstance.BindInstance(fstore, options.dm_password) - - valid_password = False - while not valid_password: - # try the connection - try: - bind.ldap_connect() - bind.ldap_disconnect() - valid_password = True - except ldap.LOCAL_ERROR, e: - if not bind.dm_password: - if options.unattended: - sys.exit("\nIn unattended mode you need to provide at least the -p option") - else: - bind.dm_password = read_password("Directory Manager", confirm=False, validate=False) - except ldap.INVALID_CREDENTIALS, e: - if options.unattended: - sys.exit("\nPassword is not valid!") - bind.dm_password = read_password("Directory Manager", confirm=False, validate=False) + if options.unattended and not options.dm_password: + sys.exit("\nIn unattended mode you need to provide at least the -p option") + + dm_password = options.dm_password or read_password("Directory Manager", + confirm=False, validate=False) + bind = bindinstance.BindInstance(fstore, dm_password) + + # try the connection + try: + bind.ldap_connect() + bind.ldap_disconnect() + except ldap.INVALID_CREDENTIALS, e: + sys.exit("Password is not valid!") if bind.dm_password: api.Backend.ldap2.connect(bind_dn="cn=Directory Manager", bind_pw=bind.dm_password) -- cgit