IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Do not add trust to AD in case of IPA realm-domain mismatch

Browse Source 
Make sure that trust-add command fails when admin attempts
to add an Active Directory trust when the realm name and
the domain name of the IPA server do not match.

https://fedorahosted.org/freeipa/ticket/3923
This commit is contained in:
Tomas Babej 2013-09-18 12:55:19 +02:00 committed by Martin Kosek
parent 6a124160a5
commit 8ebb76177d
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
ipalib/plugins/trust.py
View File

@ -360,6 +360,19 @@ sides.
error=_('only "ad" is supported')
)
# If domain name and realm does not match, IPA server is not be able
# to estabilish trust with Active Directory.
realm_not_matching_domain = (api.env.domain.upper() != api.env.realm)
if options['trust_type'] == u'ad' and realm_not_matching_domain:
raise errors.ValidationError(
name=_('Realm-domain mismatch'),
error=_('To estabilish trust with Active Directory, the '
'domain name and the realm name of the IPA server '
'must match')
)
self.trustinstance = ipaserver.dcerpc.TrustDomainJoins(self.api)
if not self.trustinstance.configured:
raise errors.NotFound(