IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 07:33:27 -06:00
Code Issues Packages Projects Releases Wiki Activity

trust: do not fetch subdomains in case shared secret was used to set up the trust

Browse Source 
Until incoming trust is validated from AD side, we cannot run any operations
against AD using the trust. Also, Samba currently does not suport verifying
trust against the other party (returns WERR_NOT_SUPPORTED).

This needs to be added to the documentation:

   When using 'ipa trust-add ad.domain --trust-secret', one has to manually
   validate incoming trust using forest trust properties in AD Domains and
   Trusts tool.

   Once incoming trust is validated at AD side, use IPA command
   'ipa trust-fetch-domains ad.domain' to retrieve topology of the AD forest.
   From this point on the trust should be usable.

https://fedorahosted.org/freeipa/ticket/4246

Reviewed-By: Martin Kosek <mkosek@redhat.com>
This commit is contained in:
Alexander Bokovoy 2014-03-12 19:01:00 +02:00 committed by Martin Kosek
parent 6195870e82
commit 34d644ebdf
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ipalib/plugins/trust.py
View File

@ -462,7 +462,8 @@ sides.
# for AD trusts, regardless of the type of idranges associated with it
# Note that fetch_domains_from_trust will add needed ranges for
# the algorithmic ID mapping case.
if options.get('trust_type') == u'ad':
if (options.get('trust_type') == u'ad' and
options.get('trust_secret') is None):
domains = fetch_domains_from_trust(self, self.trustinstance,
result['result'], **options)