IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Enable LDAP debug output in client to display TLS errors in join

Browse Source 
If ipa-join fails due to a TLS connection error when doing an
LDAP-based enroll then nothing is logged by default except an
Invalid Password error which is misleading (because the failure
occurs during the bind).

The only way that debugging would have been sufficient is if
the user passed --debug to ipa-client-install which is not great.

This log level is otherwise very quiet and only logs one or two
lines on errors which is perfect.

https://pagure.io/freeipa/issue/7728

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
This commit is contained in:
Rob Crittenden 2018-10-09 17:13:36 -04:00
parent 1ef0fe8bb8
commit 1e76f100a5
1 changed files with 35 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
client/ipa-join.c
View File

@ -197,33 +197,31 @@ callRPC(char * user_agent,
/* The caller is responsible for unbinding the connection if ld is not NULL */
static LDAP *
connect_ldap(const char *hostname, const char *binddn, const char *bindpw) {
connect_ldap(const char *hostname, const char *binddn, const char *bindpw,
int *ret) {
LDAP *ld = NULL;
int ret;
int ldapdebug = 0;
char *uri;
int ldapdebug = 2;
char *uri = NULL;
struct berval bindpw_bv;
if (debug) {
ldapdebug = 2;
ret = ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldapdebug);
if (ret != LDAP_OPT_SUCCESS) {
goto fail;
}
*ret = ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldapdebug);
if (*ret != LDAP_OPT_SUCCESS) {
goto fail;
}
ret = asprintf(&uri, "ldaps://%s:636", hostname);
if (ret == -1) {
*ret = asprintf(&uri, "ldaps://%s:636", hostname);
if (*ret == -1) {
fprintf(stderr, _("Out of memory!"));
*ret = LDAP_NO_MEMORY;
goto fail;
}
ret = ipa_ldap_init(&ld, uri);
if (ret != LDAP_SUCCESS) {
*ret = ipa_ldap_init(&ld, uri);
if (*ret != LDAP_SUCCESS) {
goto fail;
}
ret = ipa_tls_ssl_init(ld, uri, DEFAULT_CA_CERT_FILE);
if (ret != LDAP_SUCCESS) {
*ret = ipa_tls_ssl_init(ld, uri, DEFAULT_CA_CERT_FILE);
if (*ret != LDAP_SUCCESS) {
fprintf(stderr, _("Unable to enable SSL in LDAP\n"));
goto fail;
}
@ -238,15 +236,11 @@ connect_ldap(const char *hostname, const char *binddn, const char *bindpw) {
bindpw_bv.bv_len = 0;
}
ret = ldap_sasl_bind_s(ld, binddn, LDAP_SASL_SIMPLE, &bindpw_bv,
NULL, NULL, NULL);
*ret = ldap_sasl_bind_s(ld, binddn, LDAP_SASL_SIMPLE, &bindpw_bv,
NULL, NULL, NULL);
if (ret != LDAP_SUCCESS) {
int err;
ldap_get_option(ld, LDAP_OPT_RESULT_CODE, &err);
if (debug)
fprintf(stderr, _("Bind failed: %s\n"), ldap_err2string(err));
if (*ret != LDAP_SUCCESS) {
fprintf(stderr, _("Bind failed: %s\n"), ldap_err2string(*ret));
goto fail;
}
@ -309,7 +303,7 @@ get_root_dn(const char *ipaserver, char **ldap_base)
struct berval **defvals;
int ret, rval = 0;
ld = connect_ldap(ipaserver, NULL, NULL);
ld = connect_ldap(ipaserver, NULL, NULL, &ret);
if (!ld) {
rval = 14;
goto done;
@ -429,11 +423,23 @@ join_ldap(const char *ipaserver, char *hostname, char ** binddn, const char *bin
rval = 3;
goto done;
}
ld = connect_ldap(ipaserver, *binddn, bindpw);
ld = connect_ldap(ipaserver, *binddn, bindpw, &ret);
if (!ld) {
if (!quiet)
fprintf(stderr, _("Incorrect password.\n"));
rval = 15;
if (quiet)
goto done;
switch(ret) {
case LDAP_NO_MEMORY:
rval = 3;
break;
case LDAP_INVALID_CREDENTIALS: /* incorrect password */
case LDAP_INAPPROPRIATE_AUTH: /* no password set */
rval = 15;
break;
default: /* LDAP connection error catch-all */
rval = 14;
break;
}
goto done;
}