IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix client krb5 domain mapping and DNS

Browse Source 
Add Kerberos mapping for clients outside of server domain. Otherwise
certmonger had problems issuing the certificate. Also make sure that
client DNS records on the server are set before certmonger is started
and certificate is requested.

Based on Lars Sjostrom patch.

https://fedorahosted.org/freeipa/ticket/2006
This commit is contained in:
Martin Kosek 2011-10-21 11:18:26 +02:00
parent 40f9f52a76
commit bb6e720393
1 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
ipa-client/ipa-install/ipa-client-install
View File

@ -546,7 +546,7 @@ def hardcode_ldap_server(cli_server):
return return
def configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, filename): def configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, filename, client_domain):
krbconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer") krbconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
krbconf.setOptionAssignment(" = ") krbconf.setOptionAssignment(" = ")
@ -589,6 +589,12 @@ def configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, c
#[domain_realm] #[domain_realm]
dropts = [{'name':'.'+cli_domain, 'type':'option', 'value':cli_realm}, dropts = [{'name':'.'+cli_domain, 'type':'option', 'value':cli_realm},
{'name':cli_domain, 'type':'option', 'value':cli_realm}] {'name':cli_domain, 'type':'option', 'value':cli_realm}]
#add client domain mapping if different from server domain
if cli_domain != client_domain:
dropts.append({'name':'.'+client_domain, 'type':'option', 'value':cli_realm})
dropts.append({'name':client_domain, 'type':'option', 'value':cli_realm})
opts.append({'name':'domain_realm', 'type':'section', 'value':dropts}) opts.append({'name':'domain_realm', 'type':'section', 'value':dropts})
opts.append({'name':'empty', 'type':'empty'}) opts.append({'name':'empty', 'type':'empty'})
@ -895,6 +901,8 @@ def install(options, env, fstore, statestore):
cli_domain = ds.getDomainName() cli_domain = ds.getDomainName()
logging.debug("will use domain: %s\n", cli_domain) logging.debug("will use domain: %s\n", cli_domain)
client_domain = hostname[hostname.find(".")+1:]
if ret in (ipadiscovery.NO_LDAP_SERVER, ipadiscovery.NOT_IPA_SERVER) \ if ret in (ipadiscovery.NO_LDAP_SERVER, ipadiscovery.NOT_IPA_SERVER) \
or not ds.getServerName(): or not ds.getServerName():
logging.debug("IPA Server not found") logging.debug("IPA Server not found")
@ -1015,7 +1023,7 @@ def install(options, env, fstore, statestore):
print "Unable to sync time with IPA NTP server, assuming the time is in sync." print "Unable to sync time with IPA NTP server, assuming the time is in sync."
(krb_fd, krb_name) = tempfile.mkstemp() (krb_fd, krb_name) = tempfile.mkstemp()
os.close(krb_fd) os.close(krb_fd)
if configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, krb_name): if configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, krb_name, client_domain):
print "Test kerberos configuration failed" print "Test kerberos configuration failed"
return CLIENT_INSTALL_ERROR return CLIENT_INSTALL_ERROR
env['KRB5_CONFIG'] = krb_name env['KRB5_CONFIG'] = krb_name
@ -1115,17 +1123,15 @@ def install(options, env, fstore, statestore):
if not options.on_master: if not options.on_master:
# Configure krb5.conf # Configure krb5.conf
fstore.backup_file("/etc/krb5.conf") fstore.backup_file("/etc/krb5.conf")
if configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, "/etc/krb5.conf"): if configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options, "/etc/krb5.conf", client_domain):
return CLIENT_INSTALL_ERROR return CLIENT_INSTALL_ERROR
print "Configured /etc/krb5.conf for IPA realm " + cli_realm print "Configured /etc/krb5.conf for IPA realm " + cli_realm
configure_certmonger(fstore, subject_base, cli_realm, hostname, options)
#Try to update the DNS records, failure is not fatal
if not options.on_master:
client_dns(cli_server, hostname, options.dns_updates) client_dns(cli_server, hostname, options.dns_updates)
configure_certmonger(fstore, subject_base, cli_realm, hostname, options)
#Name Server Caching Daemon. Disable for SSSD, use otherwise (if installed) #Name Server Caching Daemon. Disable for SSSD, use otherwise (if installed)
nscd = ipaservices.knownservices.nscd nscd = ipaservices.knownservices.nscd
if nscd.is_installed(): if nscd.is_installed():