From e54a16ae1ce45af4c250dbbbb13893b9a8dc2190 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Mon, 17 Mar 2008 14:09:44 -0400 Subject: Allow the realm to be included in the name passed to add_service_principal() This is more kerberos-like and it doesn't hurt anything, we just won't allow realms other than our own to be used. 437566 --- ipa-server/xmlrpc-server/funcs.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'ipa-server/xmlrpc-server/funcs.py') diff --git a/ipa-server/xmlrpc-server/funcs.py b/ipa-server/xmlrpc-server/funcs.py index cb282340..43bcf986 100644 --- a/ipa-server/xmlrpc-server/funcs.py +++ b/ipa-server/xmlrpc-server/funcs.py @@ -1820,9 +1820,12 @@ class IPAServer: # Don't let the user set the realm if name.find('@') > 0: - raise ipaerror.gen_exception(ipaerror.INPUT_INVALID_PARAMETER) - - princ_name = name + "@" + self.realm + r = name[name.find('@')+1:] + if (r != self.realm): + raise ipaerror.gen_exception(ipaerror.INPUT_REALM_MISMATCH) + princ_name = name + else: + princ_name = name + "@" + self.realm conn = self.getConnection(opts) if not self.__is_service_unique(name, opts): -- cgit