From 10478ac8a1105f6971f245315b5b943b47631e71 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 23 Feb 2012 21:56:07 -0500
Subject: Only warn if ipa-getkeytab doesn't get all requested enctypes.

Older client machines may request DES keys not supported in newer
KDCs. Thsi was causing the entire request to fail as well as client
enrollment.

https://fedorahosted.org/freeipa/ticket/2424
---
 ipa-client/ipa-getkeytab.c | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

(limited to 'ipa-client/ipa-getkeytab.c')

diff --git a/ipa-client/ipa-getkeytab.c b/ipa-client/ipa-getkeytab.c
index 28ef5b5a5..aa9336f2e 100644
--- a/ipa-client/ipa-getkeytab.c
+++ b/ipa-client/ipa-getkeytab.c
@@ -548,6 +548,7 @@ static int ldap_set_keytab(krb5_context krbctx,
 	int kvno, i;
 	ber_tag_t rtag;
 	ber_int_t *encs = NULL;
+	int successful_keys = 0;
 
 	/* cant' return more than nkeys, sometimes less */
 	encs = calloc(keys->nkeys + 1, sizeof(ber_int_t));
@@ -587,12 +588,14 @@ static int ldap_set_keytab(krb5_context krbctx,
 		goto error_out;
 	}
 
+#ifdef LDAP_OPT_X_SASL_NOCANON
         /* Don't do DNS canonicalization */
 	ret = ldap_set_option(ld, LDAP_OPT_X_SASL_NOCANON, LDAP_OPT_ON);
 	if (ret != LDAP_SUCCESS) {
 	    fprintf(stderr, _("Unable to set LDAP_OPT_X_SASL_NOCANON\n"));
 	    goto error_out;
 	}
+#endif
 
 	version = LDAP_VERSION3;
 	ret = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version);
@@ -620,7 +623,13 @@ static int ldap_set_keytab(krb5_context krbctx,
 						   LDAP_SASL_QUIET,
 						   ldap_sasl_interact, princ);
 		if (ret != LDAP_SUCCESS) {
-			fprintf(stderr, _("SASL Bind failed!\n"));
+			char *msg=NULL;
+#ifdef LDAP_OPT_DIAGNOSTIC_MESSAGE
+			ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE,
+				(void*)&msg);
+#endif
+			fprintf(stderr, "SASL Bind failed %s (%d) %s!\n",
+				ldap_err2string(ret), ret, msg ? msg : "");
 			goto error_out;
 		}
 	}
@@ -705,16 +714,34 @@ static int ldap_set_keytab(krb5_context krbctx,
 
 	rtag = ber_scanf(sctrl, "{i{", &kvno);
 	if (rtag == LBER_ERROR) {
-		fprintf(stderr, _("ber_scanf() failed, Invalid control ?!\n"));
+		fprintf(stderr, _("ber_scanf() failed, unable to find kvno ?!\n"));
 		goto error_out;
 	}
 
 	for (i = 0; i < keys->nkeys; i++) {
 		ret = ber_scanf(sctrl, "{i}", &encs[i]);
 		if (ret == LBER_ERROR) {
-                    fprintf(stderr, _("ber_scanf() failed, Invalid control ?!\n"));
-                    goto error_out;
-                }
+			char enc[79]; /* fit std terminal or truncate */
+			krb5_error_code krberr;
+			krberr = krb5_enctype_to_string(
+				keys->ksdata[i].enctype, enc, 79);
+			if (krberr) {
+				fprintf(stderr, _("Failed to retrieve "
+					"encryption type type #%d\n"),
+					keys->ksdata[i].enctype);
+			} else {
+				fprintf(stderr, _("Failed to retrieve "
+					"encryption type %s (#%d)\n"),
+					enc, keys->ksdata[i].enctype);
+			}
+                } else {
+			successful_keys++;
+		}
+	}
+
+	if (successful_keys == 0) {
+		fprintf(stderr, _("Failed to retrieve any keys"));
+		goto error_out;
 	}
 
 	ret = filter_keys(krbctx, keys, encs);
-- 
cgit