Alexander Bokovoy ae7cd4702d trust-fetch-domains: use custom krb5.conf overlay for all trust operations ... Operations in FIPS mode make impossible use of NTLMSSP when authenticating to trusted Active Directory domain controllers because RC4 cipher is not allowed. Instead, Kerberos authentication have to be used. We switched to enforce Kerberos authentication when communicating with trusted domains' domain controllers everywhere. Kerberos library uses system wide configuration which in IPA defaults to resolving location of KDCs via DNS SRV records. Once trust is established, SSSD will populate a list of closest DCs and provide them through the KDC locator plugin. But at the time the trust is established performing DNS SRV-based discovery of Kerberos KDCs might fail due to multiple reasons. It might also succeed but point to a DC that doesn't know about the account we have to use to establish trust. One edge case is when DNS SRV record points to an unreachable DC, whether due to a firewall or a network topology limitations. In such case an administrator would pass --server <server> option to 'ipa trust-add' or 'ipa trust-fetch-domains' commands. 'ipa trust-fetch-domains' runs a helper via oddjobd. This helper was already modified to support --server option and generated custom krb5.conf overlay to pin to a specific AD DC. However, this configuration was removed as soon as we finished talking to AD DCs. With switch to always use Kebreros to authenticate in retrieval of the topology information, we have to use the overlay everywhere as well. Convert the code that generated the overlay file into a context that generates the overlay and sets environment. Reuse it in other trust-related places where this matters. Oddjob helper runs as root and can write to /run/ipa for the krb5.conf overlay. Server side of 'ipa trust-add' code calls into ipaserver/dcerpc.py and runs under ipaapi so can only write to /tmp. Since it is a part of the Apache instance, it uses private /tmp mounted on tmpfs. Fixes: https://pagure.io/freeipa/issue/8664 Related: https://pagure.io/freeipa/issue/8655 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>		2021-01-22 12:21:33 -05:00
..
advise	Change FreeIPA references to IPA and Identity Management	2021-01-21 13:51:45 +01:00
dnssec	Change mkdir logic in DNSSEC	2020-12-18 20:40:36 +02:00
install	Change FreeIPA references to IPA and Identity Management	2021-01-21 13:51:45 +01:00
plugins	ipaserver/dcerpc: store forest topology as a blob in ipasam	2021-01-22 12:21:33 -05:00
secrets	NSSWrappedCertDB: accept optional symmetric algorithm	2019-09-25 12:42:06 +10:00
__init__.py	Change FreeIPA license to GPLv3+	2010-12-20 17:19:53 -05:00
dcerpc_common.py	Py3: Replace six.text_type with str	2018-09-27 16:11:18 +02:00
dcerpc.py	trust-fetch-domains: use custom krb5.conf overlay for all trust operations	2021-01-22 12:21:33 -05:00
dns_data_management.py	Lookup ipa-ca record with NSS	2020-10-10 12:54:06 +02:00
Makefile.am	Build: Makefiles for Python packages	2016-11-09 13:08:32 +01:00
masters.py	Add hidden replica feature	2019-03-28 17:57:58 +01:00
p11helper.py	Grammar: whitespace is a word	2020-06-23 10:16:29 +02:00
rpcserver.py	rpcserver: fix exception handling for FAST armor failure	2020-10-30 19:06:11 +02:00
servroles.py	Use api.env.container_sysaccounts	2020-04-28 11:28:29 +02:00
setup.cfg	Port all setup.py to setuptools	2016-10-20 18:43:37 +02:00
setup.py	Delay import of psutil to avoid AVC	2020-09-23 14:49:15 +02:00
topology.py	Py3: Remove subclassing from object	2018-09-27 11:49:04 +02:00