From c4859813a5fd89082c9c05a3808f9b6cb97ca5d0 Mon Sep 17 00:00:00 2001 From: Tomas Babej Date: Wed, 15 Jul 2015 15:38:50 +0200 Subject: [PATCH] dcerpc: Expand explanation for WERR_ACCESS_DENIED It's possible for AD to contact a wrong IPA server in case the DNS SRV records on the AD sides are not properly configured. Mention this case in the error message as well. https://fedorahosted.org/freeipa/ticket/5013 Reviewed-By: Petr Vobornik --- ipaserver/dcerpc.py | 36 +++++++++++++++++++++++++++++------- 1 file changed, 29 insertions(+), 7 deletions(-) diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py index a1da0a641064f59a79639d97489ff73181787a4a..97f6c1694c20f26af0861b86a1ae1adf7a970a59 100644 --- a/ipaserver/dcerpc.py +++ b/ipaserver/dcerpc.py @@ -1084,22 +1084,44 @@ class TrustDomainInstance(object): result = retrieve_netlogon_info_2(None, self, netlogon.NETLOGON_CONTROL_TC_VERIFY, another_domain.info['dns_domain']) - if (result and (result.flags and netlogon.NETLOGON_VERIFY_STATUS_RETURNED)): - if (result.pdc_connection_status[0] != 0) and (result.tc_connection_status[0] != 0): + + if result and result.flags and netlogon.NETLOGON_VERIFY_STATUS_RETURNED: + if result.pdc_connection_status[0] != 0 and result.tc_connection_status[0] != 0: if result.pdc_connection_status[1] == "WERR_ACCESS_DENIED": # Most likely AD DC hit another IPA replica which yet has no trust secret replicated + # Sleep and repeat again self.validation_attempts += 1 if self.validation_attempts < 10: sleep(5) return self.verify_trust(another_domain) - raise errors.ACIError( - info=_('IPA master denied trust validation requests from AD DC ' - '%(count)d times. Most likely AD DC contacted a replica ' - 'that has no trust information replicated yet.') - % dict(count=self.validation_attempts)) + + # If we get here, we already failed 10 times + srv_record_templates = ( + '_ldap._tcp.%s', + '_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.%s' + ) + + srv_records = ', '.join( + [srv_record % api.env.domain + for srv_record in srv_record_templates] + ) + + error_message = _( + 'IPA master denied trust validation requests from AD ' + 'DC %(count)d times. Most likely AD DC contacted a ' + 'replica that has no trust information replicated ' + 'yet. Additionally, please check that AD DNS is able ' + 'to resolve %(records)s SRV records to the correct ' + 'IPA server.') % dict(count=self.validation_attempts, + records=srv_records) + + raise errors.ACIError(info=error_message) + raise assess_dcerpc_exception(*result.pdc_connection_status) + return True + return False -- 2.4.3