Require that service principals resolve to a DNS A record.

There is a --force option for those who know what they are doing.

433483

ipa-admintools/ipa-addservice

@@ -36,12 +36,17 @@ import getpass
 import errno
 
 def usage():
-    print "ipa-addservice principal"
+    print "ipa-addservice [--force] principal"
     sys.exit(1)
 
 def parse_options():
     parser = OptionParser()
 
+    parser.add_option("--force", action="store_true", default=False,
+                      help="Force a service principal name")
+    parser.add_option("--usage", action="store_true",
+                      help="Program usage")
+
     args = ipa.config.init_config(sys.argv)
     options, args = parser.parse_args(args)
 
@@ -60,7 +65,7 @@ def main():
     client = ipaclient.IPAClient()
 
     try:
-        client.add_service_principal(princ_name)
+        client.add_service_principal(princ_name, "%d" % options.force)
 
     except Exception, e:
         print str(e)

ipa-admintools/man/ipa-addservice.1

@@ -21,8 +21,7 @@
 ipa\-addservice \- Add a service principal
 
 .SH "SYNOPSIS"
-ipa\-addservice \fIprincipal\fR
-
+ipa\-addservice [\fIOPTION\fR]... \fIprincipal\fR
 .SH "DESCRIPTION"
 Adds a service principal \fIprincipal\fR.
 
@@ -42,6 +41,12 @@ rpc
 snmp
 
 The IPA server automatically appends the Kerberos realm for which it is configured. You cannot specify a different realm.
+
+The hostname must resolve to a DNS A record in order to ensure that it will work with Kerberos. Use the \-\-force flag to force the creation of a principal.
+.SH "OPTIONS"
+.TP 
+\fB\-\-force\fR
+Force the creation of the given principal name.
 .SH "EXAMPLES"
 .TP 
 ipa\-addservice HTTP/www.example.com