c58629
From 20f2650a8a23d288571fde552ed1c242cd972d88 Mon Sep 17 00:00:00 2001
c58629
From: Florence Blanc-Renaud <flo@redhat.com>
c58629
Date: Fri, 27 Oct 2017 09:05:20 +0200
c58629
Subject: [PATCH] Fix ipa-replica-conncheck when called with --principal
c58629
c58629
ipa-replica-conncheck can be called with --principal / --password or
c58629
with an existing Kerberos credential cache in order to supply the
c58629
authorized identity logging in to the master machine (in
c58629
auto-master-check mode).
c58629
c58629
In domain-level 0, the tool is called with --principal and password
c58629
and tries to obtain a TGT by performing kinit, but does not set the
c58629
env var KRB5CCNAME. Subsequent calls to IPA API do not use the
c58629
credential cache and fail. In this case, ipa-replica-conncheck falls
c58629
back to using SSH to check master connectivity instead of IPA API,
c58629
and the ssh check is less robust.
c58629
c58629
The code should set the KRB5CCNAME env var for IPA API to use the
c58629
credential cache.
c58629
c58629
Fixes:
c58629
https://pagure.io/freeipa/issue/7221
c58629
c58629
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
c58629
---
c58629
 install/tools/ipa-replica-conncheck | 3 +++
c58629
 1 file changed, 3 insertions(+)
c58629
c58629
diff --git a/install/tools/ipa-replica-conncheck b/install/tools/ipa-replica-conncheck
c58629
index 03281d1c7b6ee9f1d4cabebceb0c7e64b09601c0..545cdf00ca74289e6532a40de4c9abad5af4cee0 100755
c58629
--- a/install/tools/ipa-replica-conncheck
c58629
+++ b/install/tools/ipa-replica-conncheck
c58629
@@ -534,6 +534,9 @@ def main():
c58629
                 if result.returncode != 0:
c58629
                     raise RuntimeError("Could not get ticket for master server: %s" %
c58629
                                         result.error_output)
c58629
+                # Now that the cred cache file is initialized,
c58629
+                # use it for the IPA API calls
c58629
+                os.environ['KRB5CCNAME'] = CCACHE_FILE
c58629
 
c58629
             try:
c58629
                 root_logger.info("Check RPC connection to remote master")
c58629
-- 
c58629
2.9.5
c58629