adtrust: print DNS records for external DNS case after role is enabled

We cannot gather information about required DNS records before "ADTrust
Controller" role is enabled on this server. As result, we need to call
the step to add DNS records after the role was enabled.

Fixes: https://pagure.io/freeipa/issue/8192
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

install/tools/ipa-adtrust-install.in

@@ -214,6 +214,12 @@ def main():
 
     # Enable configured services and update DNS SRV records
     service.sync_services_state(api.env.host)
+
+    dns_help = adtrust.generate_dns_service_records_help(api)
+    if dns_help:
+        for line in dns_help:
+            service.print_msg(line, sys.stdout)
+    else:
         api.Command.dns_update_system_records()
 
     print("""

ipaserver/install/adtrust.py

@@ -26,6 +26,8 @@ from ipaserver.install import installutils
 from ipaserver.install import adtrustinstance
 from ipaserver.install import service
 from ipaserver.install.plugins.adtrust import update_host_cifs_keytabs
+from ipaserver.install.bindinstance import dns_zone_exists
+from ipaserver.dns_data_management import IPASystemRecords
 
 
 if six.PY3:
@@ -436,6 +438,41 @@ def install(standalone, options, fstore, api):
         add_new_adtrust_agents(api, options)
 
 
+def generate_dns_service_records_help(api):
+    """
+    Return list of instructions to create DNS service records for Windows
+    if in case DNS is not enabled and the DNS zone is not managed by IPA.
+    In case IPA manages the DNS zone, nothing is returned.
+    """
+
+    zone = api.env.domain
+
+    err_msg = []
+
+    ret = api.Command['dns_is_enabled']()
+    if not ret['result']:
+        err_msg.append("DNS management was not enabled at install time.")
+    else:
+        if not dns_zone_exists(zone):
+            err_msg.append(
+                "DNS zone %s cannot be managed as it is not defined in "
+                "IPA" % zone)
+
+    if err_msg:
+        err_msg.append("Add the following service records to your DNS "
+                       "server for DNS zone %s: " % zone)
+        system_records = IPASystemRecords(api, all_servers=True)
+        adtrust_records = system_records.get_base_records(
+            [api.env.host], ["AD trust controller"],
+            include_master_role=False, include_kerberos_realm=False)
+        for r_name, node in adtrust_records.items():
+            for rec in IPASystemRecords.records_list_from_node(r_name, node):
+                err_msg.append(rec)
+        return err_msg
+
+    return None
+
+
 @group
 class ADTrustInstallInterface(ServiceAdminInstallInterface):
     """

ipaserver/install/adtrustinstance.py

@@ -32,10 +32,8 @@ import socket
 
 import six
 
-from ipaserver.dns_data_management import IPASystemRecords
 from ipaserver.install import service
 from ipaserver.install import installutils
-from ipaserver.install.bindinstance import dns_zone_exists
 from ipaserver.install.replication import wait_for_task
 from ipalib import errors, api
 from ipalib.util import normalize_zone
@@ -586,43 +584,6 @@ class ADTRUSTInstance(service.Service):
                     logger.critical("Failed to remove old key for %s",
                                     self.principal)
 
-    def srv_rec(self, host, port, prio):
-        return "%(prio)d 100 %(port)d %(host)s" % dict(host=host,prio=prio,port=port)
-
-    def __add_dns_service_records(self):
-        """
-        Add DNS service records for Windows if DNS is enabled and the DNS zone
-        is managed. If there are already service records for LDAP and Kerberos
-        their values are used. Otherwise default values are used.
-        """
-
-        zone = api.env.domain
-
-        err_msg = None
-
-        ret = api.Command['dns_is_enabled']()
-        if not ret['result']:
-            err_msg = "DNS management was not enabled at install time."
-        else:
-            if not dns_zone_exists(zone):
-                err_msg = (
-                    "DNS zone %s cannot be managed as it is not defined in "
-                    "IPA" % zone)
-
-        if err_msg:
-            self.print_msg(err_msg)
-            self.print_msg("Add the following service records to your DNS " \
-                           "server for DNS zone %s: " % zone)
-            system_records = IPASystemRecords(api, all_servers=True)
-            adtrust_records = system_records.get_base_records(
-                [self.fqdn], ["AD trust controller"],
-                include_master_role=False, include_kerberos_realm=False)
-            for r_name, node in adtrust_records.items():
-                for rec in IPASystemRecords.records_list_from_node(r_name, node):
-                    self.print_msg(rec)
-        else:
-            api.Command.dns_update_system_records()
-
     def __configure_selinux_for_smbd(self):
         try:
             tasks.set_selinux_booleans(constants.SELINUX_BOOLEAN_ADTRUST,
@@ -876,8 +837,6 @@ class ADTRUSTInstance(service.Service):
         self.step("map BUILTIN\\Guests to nobody group",
                   self.__map_Guests_to_nobody)
         self.step("configuring smbd to start on boot", self.__enable)
-        self.step("adding special DNS service records", \
-                  self.__add_dns_service_records)
 
         if self.enable_compat:
             self.step("enabling trusted domains support for older clients via Schema Compatibility plugin",

ipaserver/install/server/install.py

@@ -984,6 +984,12 @@ def install(installer):
     service.enable_services(host_name)
     api.Command.dns_update_system_records()
 
+    if options.setup_adtrust:
+        dns_help = adtrust.generate_dns_service_records_help(api)
+        if dns_help:
+            for line in dns_help:
+                service.print_msg(line, sys.stdout)
+
     if not options.setup_dns:
         # After DNS and AD trust are configured and services are
         # enabled, create a dummy instance to dump DNS configuration.

ipaserver/install/server/replicainstall.py

@@ -1351,6 +1351,12 @@ def install(installer):
     # enabled-service case, also perform update in hidden replica case.
     api.Command.dns_update_system_records()
 
+    if options.setup_adtrust:
+        dns_help = adtrust.generate_dns_service_records_help(api)
+        if dns_help:
+            for line in dns_help:
+                service.print_msg(line, sys.stdout)
+
     ca_servers = find_providing_servers('CA', api.Backend.ldap2, api=api)
     api.Backend.ldap2.disconnect()