From 936e27f75961c67e619ecfa641e256ce80662d68 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Feb 14 2020 07:24:58 +0000
Subject: adtrust: print DNS records for external DNS case after role is enabled
We cannot gather information about required DNS records before "ADTrust
Controller" role is enabled on this server. As result, we need to call
the step to add DNS records after the role was enabled.
Fixes: https://pagure.io/freeipa/issue/8192
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
---
diff --git a/install/tools/ipa-adtrust-install.in b/install/tools/ipa-adtrust-install.in
index 1abfea9..7d94b71 100644
--- a/install/tools/ipa-adtrust-install.in
+++ b/install/tools/ipa-adtrust-install.in
@@ -214,7 +214,13 @@ def main():
# Enable configured services and update DNS SRV records
service.sync_services_state(api.env.host)
- api.Command.dns_update_system_records()
+
+ dns_help = adtrust.generate_dns_service_records_help(api)
+ if dns_help:
+ for line in dns_help:
+ service.print_msg(line, sys.stdout)
+ else:
+ api.Command.dns_update_system_records()
print("""
=============================================================================
diff --git a/ipaserver/install/adtrust.py b/ipaserver/install/adtrust.py
index 70c4359..6c14e84 100644
--- a/ipaserver/install/adtrust.py
+++ b/ipaserver/install/adtrust.py
@@ -26,6 +26,8 @@ from ipaserver.install import installutils
from ipaserver.install import adtrustinstance
from ipaserver.install import service
from ipaserver.install.plugins.adtrust import update_host_cifs_keytabs
+from ipaserver.install.bindinstance import dns_zone_exists
+from ipaserver.dns_data_management import IPASystemRecords
if six.PY3:
@@ -436,6 +438,41 @@ def install(standalone, options, fstore, api):
add_new_adtrust_agents(api, options)
+def generate_dns_service_records_help(api):
+ """
+ Return list of instructions to create DNS service records for Windows
+ if in case DNS is not enabled and the DNS zone is not managed by IPA.
+ In case IPA manages the DNS zone, nothing is returned.
+ """
+
+ zone = api.env.domain
+
+ err_msg = []
+
+ ret = api.Command['dns_is_enabled']()
+ if not ret['result']:
+ err_msg.append("DNS management was not enabled at install time.")
+ else:
+ if not dns_zone_exists(zone):
+ err_msg.append(
+ "DNS zone %s cannot be managed as it is not defined in "
+ "IPA" % zone)
+
+ if err_msg:
+ err_msg.append("Add the following service records to your DNS "
+ "server for DNS zone %s: " % zone)
+ system_records = IPASystemRecords(api, all_servers=True)
+ adtrust_records = system_records.get_base_records(
+ [api.env.host], ["AD trust controller"],
+ include_master_role=False, include_kerberos_realm=False)
+ for r_name, node in adtrust_records.items():
+ for rec in IPASystemRecords.records_list_from_node(r_name, node):
+ err_msg.append(rec)
+ return err_msg
+
+ return None
+
+
@group
class ADTrustInstallInterface(ServiceAdminInstallInterface):
"""
diff --git a/ipaserver/install/adtrustinstance.py b/ipaserver/install/adtrustinstance.py
index 8699d53..a59e85d 100644
--- a/ipaserver/install/adtrustinstance.py
+++ b/ipaserver/install/adtrustinstance.py
@@ -32,10 +32,8 @@ import socket
import six
-from ipaserver.dns_data_management import IPASystemRecords
from ipaserver.install import service
from ipaserver.install import installutils
-from ipaserver.install.bindinstance import dns_zone_exists
from ipaserver.install.replication import wait_for_task
from ipalib import errors, api
from ipalib.util import normalize_zone
@@ -586,43 +584,6 @@ class ADTRUSTInstance(service.Service):
logger.critical("Failed to remove old key for %s",
self.principal)
- def srv_rec(self, host, port, prio):
- return "%(prio)d 100 %(port)d %(host)s" % dict(host=host,prio=prio,port=port)
-
- def __add_dns_service_records(self):
- """
- Add DNS service records for Windows if DNS is enabled and the DNS zone
- is managed. If there are already service records for LDAP and Kerberos
- their values are used. Otherwise default values are used.
- """
-
- zone = api.env.domain
-
- err_msg = None
-
- ret = api.Command['dns_is_enabled']()
- if not ret['result']:
- err_msg = "DNS management was not enabled at install time."
- else:
- if not dns_zone_exists(zone):
- err_msg = (
- "DNS zone %s cannot be managed as it is not defined in "
- "IPA" % zone)
-
- if err_msg:
- self.print_msg(err_msg)
- self.print_msg("Add the following service records to your DNS " \
- "server for DNS zone %s: " % zone)
- system_records = IPASystemRecords(api, all_servers=True)
- adtrust_records = system_records.get_base_records(
- [self.fqdn], ["AD trust controller"],
- include_master_role=False, include_kerberos_realm=False)
- for r_name, node in adtrust_records.items():
- for rec in IPASystemRecords.records_list_from_node(r_name, node):
- self.print_msg(rec)
- else:
- api.Command.dns_update_system_records()
-
def __configure_selinux_for_smbd(self):
try:
tasks.set_selinux_booleans(constants.SELINUX_BOOLEAN_ADTRUST,
@@ -876,8 +837,6 @@ class ADTRUSTInstance(service.Service):
self.step("map BUILTIN\\Guests to nobody group",
self.__map_Guests_to_nobody)
self.step("configuring smbd to start on boot", self.__enable)
- self.step("adding special DNS service records", \
- self.__add_dns_service_records)
if self.enable_compat:
self.step("enabling trusted domains support for older clients via Schema Compatibility plugin",
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
index 6b08b70..afce0d7 100644
--- a/ipaserver/install/server/install.py
+++ b/ipaserver/install/server/install.py
@@ -984,6 +984,12 @@ def install(installer):
service.enable_services(host_name)
api.Command.dns_update_system_records()
+ if options.setup_adtrust:
+ dns_help = adtrust.generate_dns_service_records_help(api)
+ if dns_help:
+ for line in dns_help:
+ service.print_msg(line, sys.stdout)
+
if not options.setup_dns:
# After DNS and AD trust are configured and services are
# enabled, create a dummy instance to dump DNS configuration.
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
index 536f0db..71ea091 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
@@ -1351,6 +1351,12 @@ def install(installer):
# enabled-service case, also perform update in hidden replica case.
api.Command.dns_update_system_records()
+ if options.setup_adtrust:
+ dns_help = adtrust.generate_dns_service_records_help(api)
+ if dns_help:
+ for line in dns_help:
+ service.print_msg(line, sys.stdout)
+
ca_servers = find_providing_servers('CA', api.Backend.ldap2, api=api)
api.Backend.ldap2.disconnect()