diff options
| author | Alexander Bokovoy <abokovoy@redhat.com> | 2016-08-15 18:32:25 +0300 |
|---|---|---|
| committer | Martin Babinsky <mbabinsk@redhat.com> | 2016-08-22 13:38:18 +0200 |
| commit | 9b3819ea94d3fd8e866d38ccba2051446d057ecd (patch) | |
| tree | 4225dec0cf7f7237f682f226f759a745d10ebd87 /ipaserver/dcerpc.py | |
| parent | 6332cb3125a42c1bf2680309b5480155e40d3d87 (diff) | |
| download | freeipa-9b3819ea94d3fd8e866d38ccba2051446d057ecd.tar.gz freeipa-9b3819ea94d3fd8e866d38ccba2051446d057ecd.tar.xz freeipa-9b3819ea94d3fd8e866d38ccba2051446d057ecd.zip | |
trust: make sure external trust topology is correctly rendered
When external trust is established, it is by definition is
non-transitive: it is not possible to obtain Kerberos tickets to any
service outside the trusted domain.
Reflect this reality by only accepting UPN suffixes from the external
trust -- since the trusted domain is a part of another forest and UPN
suffixes are forest-wide, there could be user accounts in the trusted
domain that use forest-wide UPN suffix but it will be impossible to
reach the forest root via the externally trusted domain.
Also, an argument to netr_DsRGetForestTrustInformation() has to be
either forest root domain name or None (NULL). Otherwise we'll get
an error as explained in MS-NRPC 3.5.4.7.5.
https://fedorahosted.org/freeipa/ticket/6021
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Diffstat (limited to 'ipaserver/dcerpc.py')
| -rw-r--r-- | ipaserver/dcerpc.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py index a1c12f16a..4d98485e1 100644 --- a/ipaserver/dcerpc.py +++ b/ipaserver/dcerpc.py @@ -1449,7 +1449,7 @@ def fetch_domains(api, mydomain, trustdomain, creds=None, server=None): # Older FreeIPA versions used netr_DsrEnumerateDomainTrusts call # but it doesn't provide information about non-domain UPNs associated # with the forest, thus we have to use netr_DsRGetForestTrustInformation - domains = netr_pipe.netr_DsRGetForestTrustInformation(td.info['dc'], '', 0) + domains = netr_pipe.netr_DsRGetForestTrustInformation(td.info['dc'], None, 0) return domains domains = None |