|
 |
c58629 |
From 20f2650a8a23d288571fde552ed1c242cd972d88 Mon Sep 17 00:00:00 2001
|
|
|
c58629 |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
c58629 |
Date: Fri, 27 Oct 2017 09:05:20 +0200
|
|
|
c58629 |
Subject: [PATCH] Fix ipa-replica-conncheck when called with --principal
|
|
|
c58629 |
|
|
|
c58629 |
ipa-replica-conncheck can be called with --principal / --password or
|
|
|
c58629 |
with an existing Kerberos credential cache in order to supply the
|
|
|
c58629 |
authorized identity logging in to the master machine (in
|
|
|
c58629 |
auto-master-check mode).
|
|
|
c58629 |
|
|
|
c58629 |
In domain-level 0, the tool is called with --principal and password
|
|
|
c58629 |
and tries to obtain a TGT by performing kinit, but does not set the
|
|
|
c58629 |
env var KRB5CCNAME. Subsequent calls to IPA API do not use the
|
|
|
c58629 |
credential cache and fail. In this case, ipa-replica-conncheck falls
|
|
|
c58629 |
back to using SSH to check master connectivity instead of IPA API,
|
|
|
c58629 |
and the ssh check is less robust.
|
|
|
c58629 |
|
|
|
c58629 |
The code should set the KRB5CCNAME env var for IPA API to use the
|
|
|
c58629 |
credential cache.
|
|
|
c58629 |
|
|
|
c58629 |
Fixes:
|
|
|
c58629 |
https://pagure.io/freeipa/issue/7221
|
|
|
c58629 |
|
|
|
c58629 |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
c58629 |
---
|
|
|
c58629 |
install/tools/ipa-replica-conncheck | 3 +++
|
|
|
c58629 |
1 file changed, 3 insertions(+)
|
|
|
c58629 |
|
|
|
c58629 |
diff --git a/install/tools/ipa-replica-conncheck b/install/tools/ipa-replica-conncheck
|
|
|
c58629 |
index 03281d1c7b6ee9f1d4cabebceb0c7e64b09601c0..545cdf00ca74289e6532a40de4c9abad5af4cee0 100755
|
|
|
c58629 |
--- a/install/tools/ipa-replica-conncheck
|
|
|
c58629 |
+++ b/install/tools/ipa-replica-conncheck
|
|
|
c58629 |
@@ -534,6 +534,9 @@ def main():
|
|
|
c58629 |
if result.returncode != 0:
|
|
|
c58629 |
raise RuntimeError("Could not get ticket for master server: %s" %
|
|
|
c58629 |
result.error_output)
|
|
|
c58629 |
+ # Now that the cred cache file is initialized,
|
|
|
c58629 |
+ # use it for the IPA API calls
|
|
|
c58629 |
+ os.environ['KRB5CCNAME'] = CCACHE_FILE
|
|
|
c58629 |
|
|
|
c58629 |
try:
|
|
|
c58629 |
root_logger.info("Check RPC connection to remote master")
|
|
|
c58629 |
--
|
|
|
c58629 |
2.9.5
|
|
|
c58629 |
|