403b09
From 2026313385db9ff2d1e74b22b7e2c6be7f7a9705 Mon Sep 17 00:00:00 2001
403b09
From: Alexander Bokovoy <abokovoy@redhat.com>
403b09
Date: Mon, 15 Aug 2016 18:32:25 +0300
403b09
Subject: [PATCH] trust: make sure external trust topology is correctly
403b09
 rendered
403b09
403b09
When external trust is established, it is by definition is
403b09
non-transitive: it is not possible to obtain Kerberos tickets to any
403b09
service outside the trusted domain.
403b09
403b09
Reflect this reality by only accepting UPN suffixes from the external
403b09
trust -- since the trusted domain is a part of another forest and UPN
403b09
suffixes are forest-wide, there could be user accounts in the trusted
403b09
domain that use forest-wide UPN suffix but it will be impossible to
403b09
reach the forest root via the externally trusted domain.
403b09
403b09
Also, an argument to netr_DsRGetForestTrustInformation() has to be
403b09
either forest root domain name or None (NULL). Otherwise we'll get
403b09
an error as explained in MS-NRPC 3.5.4.7.5.
403b09
403b09
https://fedorahosted.org/freeipa/ticket/6021
403b09
403b09
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
403b09
---
403b09
 ipaserver/dcerpc.py        |  2 +-
403b09
 ipaserver/plugins/trust.py | 28 +++++++++++++++++-----------
403b09
 2 files changed, 18 insertions(+), 12 deletions(-)
403b09
403b09
diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py
403b09
index a1c12f16a655493808d50e6adb95e618a664a98c..4d98485e17a9113322b7e38629fc43b593e99fd9 100644
403b09
--- a/ipaserver/dcerpc.py
403b09
+++ b/ipaserver/dcerpc.py
403b09
@@ -1449,7 +1449,7 @@ def fetch_domains(api, mydomain, trustdomain, creds=None, server=None):
403b09
         # Older FreeIPA versions used netr_DsrEnumerateDomainTrusts call
403b09
         # but it doesn't provide information about non-domain UPNs associated
403b09
         # with the forest, thus we have to use netr_DsRGetForestTrustInformation
403b09
-        domains = netr_pipe.netr_DsRGetForestTrustInformation(td.info['dc'], '', 0)
403b09
+        domains = netr_pipe.netr_DsRGetForestTrustInformation(td.info['dc'], None, 0)
403b09
         return domains
403b09
 
403b09
     domains = None
403b09
diff --git a/ipaserver/plugins/trust.py b/ipaserver/plugins/trust.py
403b09
index f2e0b1ee4b261ddc4f29477f46b7f4027af18892..8a25b560f9ae086ba8524cca22f39e8f67696146 100644
403b09
--- a/ipaserver/plugins/trust.py
403b09
+++ b/ipaserver/plugins/trust.py
403b09
@@ -1663,6 +1663,23 @@ def add_new_domains_from_trust(myapi, trustinstance, trust_entry, domains, **opt
403b09
                     for x, y in six.iteritems(domains['suffixes'])
403b09
                     if x not in domains['domains'])
403b09
 
403b09
+    try:
403b09
+        dn = myapi.Object.trust.get_dn(trust_name, trust_type=u'ad')
403b09
+        ldap = myapi.Backend.ldap2
403b09
+        entry = ldap.get_entry(dn)
403b09
+        tlns = entry.get('ipantadditionalsuffixes', [])
403b09
+        tlns.extend(x for x in suffixes if x not in tlns)
403b09
+        entry['ipantadditionalsuffixes'] = tlns
403b09
+        ldap.update_entry(entry)
403b09
+    except errors.EmptyModlist:
403b09
+        pass
403b09
+
403b09
+    is_nontransitive = int(trust_entry.get('ipanttrustattributes',
403b09
+                           [0])[0]) & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE
403b09
+
403b09
+    if is_nontransitive:
403b09
+        return result
403b09
+
403b09
     for dom in six.itervalues(domains['domains']):
403b09
         dom['trust_type'] = u'ad'
403b09
         try:
403b09
@@ -1686,17 +1703,6 @@ def add_new_domains_from_trust(myapi, trustinstance, trust_entry, domains, **opt
403b09
             # Ignore updating duplicate entries
403b09
             pass
403b09
 
403b09
-    try:
403b09
-        dn = myapi.Object.trust.get_dn(trust_name, trust_type=u'ad')
403b09
-        ldap = myapi.Backend.ldap2
403b09
-        entry = ldap.get_entry(dn)
403b09
-        tlns = entry.get('ipantadditionalsuffixes', [])
403b09
-        tlns.extend(x for x in suffixes if x not in tlns)
403b09
-        entry['ipantadditionalsuffixes'] = tlns
403b09
-        ldap.update_entry(entry)
403b09
-    except errors.EmptyModlist:
403b09
-        pass
403b09
-
403b09
     return result
403b09
 
403b09
 
403b09
-- 
403b09
2.7.4
403b09