mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-10-24 22:27:41 -05:00
Julien Rische
56261bbba4
The final call to ipadb_reinit_mspac() in ipadb_get_connection() is not considered essential for the function to succeed, as there might be cases where the required pieces of information to generate PACs are not yet configured in the database. However, in environments where 389ds is overwhelmed, the LDAP connection established at the beginning of ipadb_get_connection() might already be lost while executing ipadb_reinit_mspac(). Connection errors were not distinguished from configuration errors, which could result in ipadb_get_connection() succeeding while the LDAP context is set to null, leading to a KDC crash on the next LDAP request. ipadb_get_connection() now explicitly checks the value of the LDAP context before returning. Fixes: https://pagure.io/freeipa/issue/9777 Reviewed-By: Rob Crittenden <rcritten@redhat.com>