IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

improve the handling of krb5-related errors in dnssec daemons

Browse Source 
ipa-dnskeysync* and ipa-ods-exporter handle kerberos errors more gracefully
instead of crashing with tracebacks.

https://fedorahosted.org/freeipa/ticket/5229

Reviewed-By: Martin Basti <mbasti@redhat.com>
This commit is contained in:
Martin Babinsky
2015-08-18 18:33:37 +02:00
committed by Martin Basti
parent 27988f1b83
commit 3506938a75
3 changed files with 20 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
daemons/dnssec/ipa-ods-exporter
View File

@@ -20,6 +20,7 @@ from datetime import datetime
import dateutil.tz
import dns.dnssec
import fcntl
from krbV import Krb5Error
import logging
import os
import subprocess
@@ -482,7 +483,14 @@ ipalib.api.finalize()
PRINCIPAL = str('%s/%s' % (DAEMONNAME, ipalib.api.env.host))
log.debug('Kerberos principal: %s', PRINCIPAL)
ccache_name = os.path.join(WORKDIR, 'ipa-ods-exporter.ccache')
ipautil.kinit_keytab(PRINCIPAL, paths.IPA_ODS_EXPORTER_KEYTAB, ccache_name)
try:
ipautil.kinit_keytab(PRINCIPAL, paths.IPA_ODS_EXPORTER_KEYTAB, ccache_name,
attempts=5)
except Krb5Error as e:
log.critical('Kerberos authentication failed: %s', e)
sys.exit(1)
os.environ['KRB5CCNAME'] = ccache_name
log.debug('Got TGT')