diff options
| author | Alexander Bokovoy <abokovoy@redhat.com> | 2014-02-26 17:43:34 +0200 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-02-27 14:33:15 +0100 |
| commit | 42108d1c0dc552e5dbc249507bfe59a1ef1d4c8e (patch) | |
| tree | 0ea5afd3051565b34c252822e0842ca0fc3b94cc | |
| parent | 906b60ee8a728f2d1c557e73d05d7557e388c97f (diff) | |
| download | freeipa-42108d1c0dc552e5dbc249507bfe59a1ef1d4c8e.tar.gz freeipa-42108d1c0dc552e5dbc249507bfe59a1ef1d4c8e.tar.xz freeipa-42108d1c0dc552e5dbc249507bfe59a1ef1d4c8e.zip | |
ipaserver/dcerpc: catch the case of insuffient permissions when establishing trust
We attempt to delete the trust that might exist already. If there are not enough
privileges to do so, we wouldn't be able to create trust at the next step and it will fail.
However, failure to create trust will be due to the name collision as we already had
the trust with the same name before. Thus, raise access denied exception here
to properly indicate wrong access level instead of returning NT_STATUS_OBJECT_NAME_COLLISION.
https://fedorahosted.org/freeipa/ticket/4202
Reviewed-By: Martin Kosek <mkosek@redhat.com>
| -rw-r--r-- | ipaserver/dcerpc.py | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py index d809c416b..5972e6222 100644 --- a/ipaserver/dcerpc.py +++ b/ipaserver/dcerpc.py @@ -892,8 +892,11 @@ class TrustDomainInstance(object): dname.string = another_domain.info['dns_domain'] res = self._pipe.QueryTrustedDomainInfoByName(self._policy_handle, dname, lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) self._pipe.DeleteTrustedDomain(self._policy_handle, res.info_ex.sid) - except RuntimeError, e: - pass + except RuntimeError, (num, message): + # Ignore anything but access denied (NT_STATUS_ACCESS_DENIED) + if num == -1073741790: + raise access_denied_error + try: trustdom_handle = self._pipe.CreateTrustedDomainEx2(self._policy_handle, info, self.auth_info, security.SEC_STD_DELETE) except RuntimeError, (num, message): |