diff options
Diffstat (limited to 'ipa-client')
| -rwxr-xr-x | ipa-client/ipa-install/ipa-client-install | 2 | ||||
| -rw-r--r-- | ipa-client/ipaclient/ipadiscovery.py | 52 |
2 files changed, 33 insertions, 21 deletions
diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install index 30a532227..05adf0dad 100755 --- a/ipa-client/ipa-install/ipa-client-install +++ b/ipa-client/ipa-install/ipa-client-install @@ -2132,7 +2132,7 @@ def install(options, env, fstore, statestore): # Create the discovery instance ds = ipadiscovery.IPADiscovery() - ret = ds.search(domain=options.domain, servers=options.server, hostname=hostname, ca_cert_path=get_cert_path(options.ca_cert_file)) + ret = ds.search(domain=options.domain, servers=options.server, realm=options.realm_name, hostname=hostname, ca_cert_path=get_cert_path(options.ca_cert_file)) if options.server and ret != 0: # There is no point to continue with installation as server list was diff --git a/ipa-client/ipaclient/ipadiscovery.py b/ipa-client/ipaclient/ipadiscovery.py index 0532f618e..0d574825a 100644 --- a/ipa-client/ipaclient/ipadiscovery.py +++ b/ipa-client/ipaclient/ipadiscovery.py @@ -139,7 +139,7 @@ class IPADiscovery(object): domain = domain[p+1:] return (None, None) - def search(self, domain = "", servers = "", hostname=None, ca_cert_path=None): + def search(self, domain="", servers="", realm=None, hostname=None, ca_cert_path=None): """ Use DNS discovery to identify valid IPA servers. @@ -218,13 +218,21 @@ class IPADiscovery(object): #search for kerberos root_logger.debug("[Kerberos realm search]") - krb_realm, kdc = self.ipadnssearchkrb(self.domain) - if not servers and not krb_realm: + if realm: + root_logger.debug("Kerberos realm forced") + self.realm = realm + self.realm_source = 'Forced' + else: + realm = self.ipadnssearchkrbrealm() + self.realm = realm + self.realm_source = ( + 'Discovered Kerberos DNS records from %s' % self.domain) + + if not servers and not realm: return REALM_NOT_FOUND - self.realm = krb_realm - self.kdc = kdc - self.realm_source = self.kdc_source = ( + self.kdc = self.ipadnssearchkrbkdc() + self.kdc_source = ( 'Discovered Kerberos DNS records from %s' % self.domain) # We may have received multiple servers corresponding to the domain @@ -452,11 +460,12 @@ class IPADiscovery(object): return servers - def ipadnssearchkrb(self, tdomain): + def ipadnssearchkrbrealm(self, domain=None): realm = None - kdc = None + if not domain: + domain = self.domain # now, check for a Kerberos realm the local host or domain is in - qname = "_kerberos." + tdomain + qname = "_kerberos." + domain root_logger.debug("Search DNS for TXT record of %s", qname) @@ -472,18 +481,21 @@ class IPADiscovery(object): realm = answer.strings[0] if realm: break + return realm - if realm: - # now fetch server information for the realm - domain = realm.lower() + def ipadnssearchkrbkdc(self, domain=None): + kdc = None - kdc = self.ipadns_search_srv(domain, '_kerberos._udp', 88, - break_on_first=False) + if not domain: + domain = self.domain - if kdc: - kdc = ','.join(kdc) - else: - root_logger.debug("SRV record for KDC not found! Realm: %s, SRV record: %s" % (realm, qname)) - kdc = None + kdc = self.ipadns_search_srv(domain, '_kerberos._udp', 88, + break_on_first=False) + + if kdc: + kdc = ','.join(kdc) + else: + root_logger.debug("SRV record for KDC not found! Domain: %s" % domain) + kdc = None - return realm, kdc + return kdc |