IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Don't block when kinit_pkinit() fails

Browse Source 
Installation of ipa-client with PKINIT authentication can block when
there is a problem with PKINIT, e.g. KDC does not accept the cert or the
anchor chain is incomplete. `kinit` falls back to password
authentication and asks the user to enter a password.

`kinit` does not have an option to force non-interactive mode. Sending
`\n` to stdin seems to be the only solution here.

Fixes: https://pagure.io/freeipa/issue/9333
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Christian Heimes
2023-02-21 12:39:04 +01:00
committed by Florence Blanc-Renaud
parent 0a8a392248
commit 8803938570
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ipalib/install/kinit.py
View File

@@ -172,4 +172,6 @@ def kinit_pkinit(
# this workaround enables us to capture stderr and put it
# into the raised exception in case of unsuccessful authentication
run(args, env=env, raiseonerr=True, capture_error=True)
# Unsuccessful pkinit can lead to a password prompt. Send \n to skip
# prompt.
run(args, env=env, stdin="\n", raiseonerr=True, capture_error=True)