Fix ipa-dns-install

When DNS plugin is installed via ipa-dns-install and user has a valid
Kerberos ticket at the time, the DNS installation is corrupt and named
won't start, reporting Preauthentication error.

When the non-DM identity is used for authentication, krbprincipalkey
attribute in DNS service LDAP record is not created, thus leading
to the error. This patch makes sure that authentication with Directory
Manager password is used every time.

https://fedorahosted.org/freeipa/ticket/1483

1 files changed, 13 insertions, 19 deletions

diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install
index eb1336e51..cc091dd08 100755
--- a/install/tools/ipa-dns-install
+++ b/install/tools/ipa-dns-install
@@ -145,25 +145,19 @@ def main():
         print ""
 
     # Create a BIND instance
-    bind = bindinstance.BindInstance(fstore, options.dm_password)
-
-    valid_password = False
-    while not valid_password:
-        # try the connection
-        try:
-            bind.ldap_connect()
-            bind.ldap_disconnect()
-            valid_password = True
-        except ldap.LOCAL_ERROR, e:
-            if not bind.dm_password:
-                if options.unattended:
-                    sys.exit("\nIn unattended mode you need to provide at least the -p option")
-                else:
-                    bind.dm_password = read_password("Directory Manager", confirm=False, validate=False)
-        except ldap.INVALID_CREDENTIALS, e:
-            if options.unattended:
-                sys.exit("\nPassword is not valid!")
-            bind.dm_password = read_password("Directory Manager", confirm=False, validate=False)
+    if options.unattended and not options.dm_password:
+        sys.exit("\nIn unattended mode you need to provide at least the -p option")
+
+    dm_password = options.dm_password or read_password("Directory Manager",
+                                             confirm=False, validate=False)
+    bind = bindinstance.BindInstance(fstore, dm_password)
+
+    # try the connection
+    try:
+        bind.ldap_connect()
+        bind.ldap_disconnect()
+    except ldap.INVALID_CREDENTIALS, e:
+        sys.exit("Password is not valid!")
 
     if bind.dm_password:
         api.Backend.ldap2.connect(bind_dn="cn=Directory Manager", bind_pw=bind.dm_password)