[freeipa PR#3337][opened] [Backport][ipa-4-6] trust-fetch-domains: make sure we use right KDC when --server is spec…
Title: #3337: [Backport][ipa-4-6] trust-fetch-domains: make sure we use right KDC when --server is spec…
Since we are authenticating against AD DC before talking to it (by using
trusted domain object's credentials), we need to override krb5.conf
configuration in case --server option is specified.
The context is a helper which is launched out of process with the help
of oddjobd. The helper takes existing trusted domain object, uses its
credentials to authenticate and then runs LSA RPC calls against that
trusted domain's domain controller. Previous code directed Samba
bindings to use the correct domain controller. However, if a DC visible
to MIT Kerberos is not reachable, we would not be able to obtain TGT and
the whole process will fail.
trust_add.execute() was calling out to the D-Bus helper without passing
the options (e.g. --server) so there was no chance to get that option
visible by the oddjob helper.
Also we need to make errors in the oddjob helper more visible to
error_log. Thus, move error reporting for a normal communication up from
the exception catching.
Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3337/head:pr3337
git checkout pr3337
3 years, 9 months