summaryrefslogtreecommitdiffstats
path: root/daemons
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-02-10 22:26:46 -0500
committerRob Crittenden <rcritten@redhat.com>2011-02-14 14:07:17 -0500
commitc9431749a0078df8bdf13490daac5f3467cc1c02 (patch)
tree502606e9c1617aea71b7aa9a79d3a8ed46fb7d46 /daemons
parentb46faf9dfc4ba0d78cccea749b47296767964234 (diff)
downloadfreeipa-c9431749a0078df8bdf13490daac5f3467cc1c02.tar.gz
freeipa-c9431749a0078df8bdf13490daac5f3467cc1c02.tar.xz
freeipa-c9431749a0078df8bdf13490daac5f3467cc1c02.zip
Let 389-ds start up even if Kerboros is not configured yet.
The situation is if during installation /etc/krb5.conf either doesn't exist or configures no realms then 389-ds won't start up at all, causing the installation to fail. This will let the server start up in a degraded mode. Also need to make the sub_dict in ldapupdate.py handle no realm otherwise the installation will abort enabling the compat plugin. ticket 606
Diffstat (limited to 'daemons')
-rw-r--r--daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c27
-rw-r--r--daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c9
-rw-r--r--daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_common.c1
3 files changed, 29 insertions, 8 deletions
diff --git a/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c b/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c
index 34fba02c..ec1c3967 100644
--- a/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c
+++ b/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c
@@ -101,6 +101,13 @@ ipaenrollement_secure(Slapi_PBlock *pb, char **errMesg)
goto done;
}
+ if (NULL == realm) {
+ *errMesg = "Kerberos realm is not set.\n";
+ LOG_FATAL("%s", errMesg);
+ rc = LDAP_OPERATIONS_ERROR;
+ goto done;
+ }
+
if ((0 == is_ssl) && (sasl_ssf <= 1)) {
*errMesg = "Operation requires a secure connection.\n";
rc = LDAP_CONFIDENTIALITY_REQUIRED;
@@ -144,6 +151,13 @@ ipa_join(Slapi_PBlock *pb)
char *principal = NULL;
struct berval retbval;
+ if (NULL == realm) {
+ errMesg = "Kerberos realm is not set.\n";
+ LOG_FATAL("%s", errMesg);
+ rc = LDAP_OPERATIONS_ERROR;
+ goto done;
+ }
+
/* Get Bind DN */
slapi_pblock_get(pb, SLAPI_CONN_DN, &bindDN);
@@ -363,18 +377,21 @@ ipaenrollment_start(Slapi_PBlock *pb)
krberr = krb5_init_context(&krbctx);
if (krberr) {
LOG_FATAL("krb5_init_context failed\n");
- return LDAP_OPERATIONS_ERROR;
+ /* Yes, we failed, but it is because /etc/krb5.conf doesn't exist
+ * or is misconfigured. Start up in a degraded mode.
+ */
+ goto done;
}
- ret = krb5_get_default_realm(krbctx, &realm);
- if (ret) {
+ krberr = krb5_get_default_realm(krbctx, &realm);
+ if (krberr) {
+ realm = NULL;
LOG_FATAL("Failed to get default realm?!\n");
- ret = LDAP_OPERATIONS_ERROR;
+ goto done;
}
if (slapi_pblock_get(pb, SLAPI_TARGET_DN, &config_dn) != 0) {
LOG_FATAL("No config DN?\n");
- ret = LDAP_OPERATIONS_ERROR;
goto done;
}
sdn = slapi_sdn_new_dn_byref(config_dn);
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
index 7a4591f8..d76b7f7c 100644
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
@@ -1069,7 +1069,10 @@ static int ipapwd_start( Slapi_PBlock *pb )
krberr = krb5_init_context(&krbctx);
if (krberr) {
LOG_FATAL("krb5_init_context failed\n");
- return LDAP_OPERATIONS_ERROR;
+ /* Yes, we failed, but it is because /etc/krb5.conf doesn't exist
+ * or is misconfigured. Start up in a degraded mode.
+ */
+ return LDAP_SUCCESS;
}
if (slapi_pblock_get(pb, SLAPI_TARGET_DN, &config_dn) != 0) {
@@ -1079,8 +1082,8 @@ static int ipapwd_start( Slapi_PBlock *pb )
}
if (ipapwd_getEntry(config_dn, &config_entry, NULL) != LDAP_SUCCESS) {
- LOG_FATAL("No config Entry?\n");
- ret = LDAP_OPERATIONS_ERROR;
+ LOG_FATAL("No config Entry extop?\n");
+ ret = LDAP_SUCCESS;
goto done;
}
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_common.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_common.c
index 6f4f02e0..5ff214e5 100644
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_common.c
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipapwd_common.c
@@ -311,6 +311,7 @@ static struct ipapwd_krbcfg *ipapwd_getConfig(void)
ret = ipapwd_getEntry(ipa_etc_config_dn, &config_entry, NULL);
if (ret != LDAP_SUCCESS) {
LOG_FATAL("No config Entry?\n");
+ goto free_and_error;
} else {
tmparray = slapi_entry_attr_get_charray(config_entry,
"ipaConfigString");