IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

AD trust: improve trust validation

Browse Source 
Trust validation requires AD DC to contact IPA server to verify that trust account
actually works. It can fail due to DNS or firewall issue or if AD DC was able to
resolve IPA master(s) via SRV records, it still may contact a replica that has
no trust data replicated yet.

In case AD DC still returns 'access denied', wait 5 seconds and try validation again.
Repeat validation until we hit a limit of 10 attempts, at which point raise
exception telling what's happening.

https://fedorahosted.org/freeipa/ticket/4764

Reviewed-By: Tomas Babej <tbabej@redhat.com>
This commit is contained in:
Alexander Bokovoy 2014-11-24 15:07:49 +02:00 committed by Tomas Babej
parent 94bc7a9431
commit 538e023107
1 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
ipaserver/dcerpc.py
View File

@ -58,6 +58,7 @@ import pysss
from ipaplatform.paths import paths
from ldap.filter import escape_filter_chars
from time import sleep
__doc__ = _("""
Classes to manage trust joins using DCE-RPC calls
@ -93,6 +94,8 @@ dcerpc_error_codes = {
dcerpc_error_messages = {
"NT_STATUS_OBJECT_NAME_NOT_FOUND":
errors.NotFound(reason=_('Cannot find specified domain or server name')),
"WERR_NO_LOGON_SERVERS":
errors.RemoteRetrieveError(reason=_('AD DC was unable to reach any IPA domain controller. Most likely it is a DNS or firewall issue')),
"NT_STATUS_INVALID_PARAMETER_MIX":
errors.RequirementError(name=_('At least the domain or IP address should be specified')),
}
@ -699,6 +702,7 @@ class TrustDomainInstance(object):
self._policy_handle = None
self.read_only = False
self.ftinfo_records = None
self.validation_attempts = 0
def __gen_lsa_connection(self, binding):
if self.creds is None:
@ -1011,9 +1015,18 @@ class TrustDomainInstance(object):
netlogon.NETLOGON_CONTROL_TC_VERIFY,
another_domain.info['dns_domain'])
if (result and (result.flags and netlogon.NETLOGON_VERIFY_STATUS_RETURNED)):
# netr_LogonControl2Ex() returns non-None result only if overall call
# result was WERR_OK which means verification was correct.
# We only check that it was indeed status for verification process
if (result.pdc_connection_status[0] != 0) and (result.tc_connection_status[0] != 0):
if result.pdc_connection_status[1] == "WERR_ACCESS_DENIED":
# Most likely AD DC hit another IPA replica which yet has no trust secret replicated
# Sleep and repeat again
self.validation_attempts += 1
if self.validation_attempts < 10:
sleep(5)
return self.verify_trust(another_domain)
raise errors.ACIError(reason=_('IPA master denied trust validation requests from AD DC '
'%(count)d times. Most likely AD DC contacted a replica '
'that has no trust information replicated yet.' % (self.validation_attempts)))
raise assess_dcerpc_exception(*result.pdc_connection_status)
return True
return False