From 6d3e68480293b50cf3ac40ad09f3ab48de764089 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Mon, 24 Nov 2014 15:07:49 +0200
Subject: [PATCH] AD trust: improve trust validation
Trust validation requires AD DC to contact IPA server to verify that trust account
actually works. It can fail due to DNS or firewall issue or if AD DC was able to
resolve IPA master(s) via SRV records, it still may contact a replica that has
no trust data replicated yet.
In case AD DC still returns 'access denied', wait 5 seconds and try validation again.
Repeat validation until we hit a limit of 10 attempts, at which point raise
exception telling what's happening.
https://fedorahosted.org/freeipa/ticket/4764
Reviewed-By: Tomas Babej <tbabej@redhat.com>
---
ipaserver/dcerpc.py | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py
index caeca3c4ab357193aef4d0e6a373240acfdf1993..e342c4973746a113c0ad4f15a1e6050583461ccf 100644
--- a/ipaserver/dcerpc.py
+++ b/ipaserver/dcerpc.py
@@ -58,6 +58,7 @@ import pysss
from ipaplatform.paths import paths
from ldap.filter import escape_filter_chars
+from time import sleep
__doc__ = _("""
Classes to manage trust joins using DCE-RPC calls
@@ -93,6 +94,8 @@ dcerpc_error_codes = {
dcerpc_error_messages = {
"NT_STATUS_OBJECT_NAME_NOT_FOUND":
errors.NotFound(reason=_('Cannot find specified domain or server name')),
+ "WERR_NO_LOGON_SERVERS":
+ errors.RemoteRetrieveError(reason=_('AD DC was unable to reach any IPA domain controller. Most likely it is a DNS or firewall issue')),
"NT_STATUS_INVALID_PARAMETER_MIX":
errors.RequirementError(name=_('At least the domain or IP address should be specified')),
}
@@ -699,6 +702,7 @@ class TrustDomainInstance(object):
self._policy_handle = None
self.read_only = False
self.ftinfo_records = None
+ self.validation_attempts = 0
def __gen_lsa_connection(self, binding):
if self.creds is None:
@@ -1011,9 +1015,18 @@ class TrustDomainInstance(object):
netlogon.NETLOGON_CONTROL_TC_VERIFY,
another_domain.info['dns_domain'])
if (result and (result.flags and netlogon.NETLOGON_VERIFY_STATUS_RETURNED)):
- # netr_LogonControl2Ex() returns non-None result only if overall call
- # result was WERR_OK which means verification was correct.
- # We only check that it was indeed status for verification process
+ if (result.pdc_connection_status[0] != 0) and (result.tc_connection_status[0] != 0):
+ if result.pdc_connection_status[1] == "WERR_ACCESS_DENIED":
+ # Most likely AD DC hit another IPA replica which yet has no trust secret replicated
+ # Sleep and repeat again
+ self.validation_attempts += 1
+ if self.validation_attempts < 10:
+ sleep(5)
+ return self.verify_trust(another_domain)
+ raise errors.ACIError(reason=_('IPA master denied trust validation requests from AD DC '
+ '%(count)d times. Most likely AD DC contacted a replica '
+ 'that has no trust information replicated yet.' % (self.validation_attempts)))
+ raise assess_dcerpc_exception(*result.pdc_connection_status)
return True
return False
--
2.1.0