|
 |
3f51ca |
From 20f2650a8a23d288571fde552ed1c242cd972d88 Mon Sep 17 00:00:00 2001
|
|
|
3f51ca |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
3f51ca |
Date: Fri, 27 Oct 2017 09:05:20 +0200
|
|
|
3f51ca |
Subject: [PATCH] Fix ipa-replica-conncheck when called with --principal
|
|
|
3f51ca |
|
|
|
3f51ca |
ipa-replica-conncheck can be called with --principal / --password or
|
|
|
3f51ca |
with an existing Kerberos credential cache in order to supply the
|
|
|
3f51ca |
authorized identity logging in to the master machine (in
|
|
|
3f51ca |
auto-master-check mode).
|
|
|
3f51ca |
|
|
|
3f51ca |
In domain-level 0, the tool is called with --principal and password
|
|
|
3f51ca |
and tries to obtain a TGT by performing kinit, but does not set the
|
|
|
3f51ca |
env var KRB5CCNAME. Subsequent calls to IPA API do not use the
|
|
|
3f51ca |
credential cache and fail. In this case, ipa-replica-conncheck falls
|
|
|
3f51ca |
back to using SSH to check master connectivity instead of IPA API,
|
|
|
3f51ca |
and the ssh check is less robust.
|
|
|
3f51ca |
|
|
|
3f51ca |
The code should set the KRB5CCNAME env var for IPA API to use the
|
|
|
3f51ca |
credential cache.
|
|
|
3f51ca |
|
|
|
3f51ca |
Fixes:
|
|
|
3f51ca |
https://pagure.io/freeipa/issue/7221
|
|
|
3f51ca |
|
|
|
3f51ca |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
3f51ca |
---
|
|
|
3f51ca |
install/tools/ipa-replica-conncheck | 3 +++
|
|
|
3f51ca |
1 file changed, 3 insertions(+)
|
|
|
3f51ca |
|
|
|
3f51ca |
diff --git a/install/tools/ipa-replica-conncheck b/install/tools/ipa-replica-conncheck
|
|
|
3f51ca |
index 03281d1c7b6ee9f1d4cabebceb0c7e64b09601c0..545cdf00ca74289e6532a40de4c9abad5af4cee0 100755
|
|
|
3f51ca |
--- a/install/tools/ipa-replica-conncheck
|
|
|
3f51ca |
+++ b/install/tools/ipa-replica-conncheck
|
|
|
3f51ca |
@@ -534,6 +534,9 @@ def main():
|
|
|
3f51ca |
if result.returncode != 0:
|
|
|
3f51ca |
raise RuntimeError("Could not get ticket for master server: %s" %
|
|
|
3f51ca |
result.error_output)
|
|
|
3f51ca |
+ # Now that the cred cache file is initialized,
|
|
|
3f51ca |
+ # use it for the IPA API calls
|
|
|
3f51ca |
+ os.environ['KRB5CCNAME'] = CCACHE_FILE
|
|
|
3f51ca |
|
|
|
3f51ca |
try:
|
|
|
3f51ca |
root_logger.info("Check RPC connection to remote master")
|
|
|
3f51ca |
--
|
|
|
3f51ca |
2.9.5
|
|
|
3f51ca |
|