IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

trust upgrade: ensure that host is member of adtrust agents

Browse Source 
After an upgrade, the group cn=adtrust agents may be missing some members.
Each ad trust controller must appear twice as member:
- krbprincipalname=cifs/hostname@realm,cn=services,cn=accounts,basedn
- fqdn=hostname,cn=computers,cn=accounts,basedn

Add an upgrade plugin that builds a list of hostnames from the cifs
principals and adds if needed fqdn=hostname...

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1778777
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
This commit is contained in:
Florence Blanc-Renaud
2019-12-03 12:56:22 +01:00
parent 2319b38c8f
commit 2c9b212cf0
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
install/updates/90-post_upgrade_plugins.update
View File

@@ -14,6 +14,7 @@ plugin: update_tdo_gidnumber
plugin: update_tdo_to_new_layout
plugin: update_host_cifs_keytabs
plugin: update_tdo_default_read_keys_permissions
plugin: update_adtrust_agents_members
plugin: update_ca_renewal_master
plugin: update_idrange_type
plugin: update_pacs