99b6f7
From f3292de4abee43c35c25d7ecd8b3638173fb24b8 Mon Sep 17 00:00:00 2001
99b6f7
From: Alexander Bokovoy <abokovoy@redhat.com>
99b6f7
Date: Tue, 12 Nov 2013 11:36:22 +0200
99b6f7
Subject: [PATCH 6/6] Map NT_STATUS_INVALID_PARAMETER to most likely error
99b6f7
 cause: clock skew
99b6f7
99b6f7
When we get NT_STATUS_INVALID_PARAMETER in response to establish
99b6f7
DCE RPC pipe with Kerberos, the most likely reason is clock skew.
99b6f7
Suggest that it is so in the error message.
99b6f7
99b6f7
https://fedorahosted.org/freeipa/ticket/4024
99b6f7
---
99b6f7
 ipaserver/dcerpc.py | 3 +++
99b6f7
 1 file changed, 3 insertions(+)
99b6f7
99b6f7
diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py
99b6f7
index 86bb42884067ec91477d8efb37a5e7729ad50315..0dde3473b12b857ff269a936ad9a07d098405c45 100644
99b6f7
--- a/ipaserver/dcerpc.py
99b6f7
+++ b/ipaserver/dcerpc.py
99b6f7
@@ -82,6 +82,9 @@ def is_sid_valid(sid):
99b6f7
     -1073741614: access_denied_error,
99b6f7
     -1073741603:
99b6f7
         errors.ValidationError(name=_('AD domain controller'), error=_('unsupported functional level')),
99b6f7
+    -1073741811: # NT_STATUS_INVALID_PARAMETER
99b6f7
+        errors.RemoteRetrieveError(
99b6f7
+            reason=_('AD domain controller complains about communication sequence. It may mean unsynchronized time on both sides, for example')),
99b6f7
 }
99b6f7
 
99b6f7
 dcerpc_error_messages = {
99b6f7
-- 
99b6f7
1.8.3.1
99b6f7