IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

trusts: format Kerberos principal properly when fetching trust topology

Browse Source 
For bidirectional trust if we have AD administrator credentials, we
should be using them with Kerberos authentication. If we don't have
AD administrator credentials, we should be using
HTTP/ipa.master@IPA.REALM credentials. This means we should ask
formatting 'creds' object in Kerberos style.

For one-way trust we'll be fetching trust topology as TDO object,
authenticating with pre-created Kerberos credentials cache, so in all
cases we do use Kerberos authentication to talk to Active Directory
domain controllers over cross-forest trust link.

Part of trust refactoring series.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1250190
Fixes: https://fedorahosted.org/freeipa/ticket/5182
Reviewed-By: Tomas Babej <tbabej@redhat.com>
This commit is contained in:
Alexander Bokovoy 2015-08-20 15:12:42 +03:00 committed by Jan Cholasta
parent 584788a91a
commit 1255dbf2fd
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ipalib/plugins/trust.py
View File

@ -1487,7 +1487,12 @@ class trustdomain_del(LDAPDelete):
def fetch_domains_from_trust(myapi, trustinstance, trust_entry, **options):
trust_name = trust_entry['cn'][0]
creds = generate_creds(trustinstance, style=CRED_STYLE_SAMBA, **options)
# We want to use Kerberos if we have admin credentials even with SMB calls
# as eventually use of NTLMSSP will be deprecated for trusted domain operations
# If admin credentials are missing, 'creds' will be None and fetch_domains
# will use HTTP/ipa.master@IPA.REALM principal, e.g. Kerberos authentication
# as well.
creds = generate_creds(trustinstance, style=CRED_STYLE_KERBEROS, **options)
server = options.get('realm_server', None)
domains = ipaserver.dcerpc.fetch_domains(myapi,
trustinstance.local_flatname,