diff options
| author | Tomas Babej <tbabej@redhat.com> | 2013-09-18 12:55:19 +0200 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2013-10-03 12:02:04 +0200 |
| commit | 8dec70f0906cd3a61fa1067593b594c600d2f263 (patch) | |
| tree | c160a36de75c669bcad47ca9606660096e1e22b0 | |
| parent | 0ca99a15b0a49a9b45a3514f32f8ba06cf826451 (diff) | |
| download | freeipa.git-8dec70f0906cd3a61fa1067593b594c600d2f263.tar.gz freeipa.git-8dec70f0906cd3a61fa1067593b594c600d2f263.tar.xz freeipa.git-8dec70f0906cd3a61fa1067593b594c600d2f263.zip | |
Do not add trust to AD in case of IPA realm-domain mismatch
Make sure that trust-add command fails when admin attempts
to add an Active Directory trust when the realm name and
the domain name of the IPA server do not match.
https://fedorahosted.org/freeipa/ticket/3923
| -rw-r--r-- | ipalib/plugins/trust.py | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py index 3c117b49..3d050299 100644 --- a/ipalib/plugins/trust.py +++ b/ipalib/plugins/trust.py @@ -360,6 +360,19 @@ sides. error=_('only "ad" is supported') ) + # If domain name and realm does not match, IPA server is not be able + # to estabilish trust with Active Directory. + + realm_not_matching_domain = (api.env.domain.upper() != api.env.realm) + + if options['trust_type'] == u'ad' and realm_not_matching_domain: + raise errors.ValidationError( + name=_('Realm-domain mismatch'), + error=_('To estabilish trust with Active Directory, the ' + 'domain name and the realm name of the IPA server ' + 'must match') + ) + self.trustinstance = ipaserver.dcerpc.TrustDomainJoins(self.api) if not self.trustinstance.configured: raise errors.NotFound( |