mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-13 01:31:56 -06:00
3b79deae53
When we define a group mapping for BUILTIN\Guests to 'nobody' group in
we run 'net groupmap add ...' with a default /etc/samba/smb.conf which
is now configured to use ipasam passdb module. We authenticate to LDAP
with GSSAPI in ipasam passdb module initialization.
If GSSAPI authentication failed (KDC is offline, for example, during
server upgrade), 'net groupmap add' crashes after ~10 attempts to
re-authenticate. This is intended behavior in smbd/winbindd as they
cannot work anymore. However, for the command line tools there are
plenty of operations where passdb module is not needed.
Additionally, GSSAPI authentication uses the default ccache in the
environment and a key from /etc/samba/samba.keytab keytab. This means
that if you'd run 'net *' as root, it will replace whatever Kerberos
tickets you have with a TGT for cifs/`hostname` and a service ticket to
ldap/`hostname` of IPA master.
Apply a simple solution to avoid using /etc/samba/smb.conf when we
set up the group mapping by specifying '-s /dev/null' in 'net groupmap'
call.
For upgrade code this is enough as in
|
||
|---|---|---|
| .. | ||
| plugins | ||
| server | ||
| __init__.py | ||
| adtrust.py | ||
| adtrustinstance.py | ||
| bindinstance.py | ||
| ca.py | ||
| cainstance.py | ||
| certs.py | ||
| conncheck.py | ||
| custodiainstance.py | ||
| dns.py | ||
| dnskeysyncinstance.py | ||
| dogtag.py | ||
| dogtaginstance.py | ||
| dsinstance.py | ||
| httpinstance.py | ||
| installutils.py | ||
| ipa_backup.py | ||
| ipa_cacert_manage.py | ||
| ipa_kra_install.py | ||
| ipa_ldap_updater.py | ||
| ipa_otptoken_import.py | ||
| ipa_pkinit_manage.py | ||
| ipa_replica_install.py | ||
| ipa_restore.py | ||
| ipa_server_certinstall.py | ||
| ipa_server_install.py | ||
| ipa_server_upgrade.py | ||
| ipa_winsync_migrate.py | ||
| kra.py | ||
| krainstance.py | ||
| krbinstance.py | ||
| ldapupdate.py | ||
| odsexporterinstance.py | ||
| opendnssecinstance.py | ||
| otpdinstance.py | ||
| replication.py | ||
| schemaupdate.py | ||
| service.py | ||
| sysupgrade.py | ||
| upgradeinstance.py | ||