[SSSD] [PATCH] Create kdcinfo and kpasswdinfo file at startup

Sumit Bose sbose at redhat.com
Fri May 7 15:23:57 UTC 2010


On Fri, May 07, 2010 at 11:00:34AM -0400, Stephen Gallagher wrote:
> On 05/07/2010 09:34 AM, Sumit Bose wrote:
> > Hi,
> >
> > this patch should solve #470 by calling be_resolve_server_send() during
> > startup.
> >
> 
> 
> Nack. As discussed off-list, we need to write a kdcinfo even when we're 
> offline at startup, so that services trying to get service tickets will 
> receive "Cannot contact any KDC for realm 'EXAMPLE.COM' while getting 
> initial credentials" instead of "Can't locate any KDC for realm 
> 'EXAMPLE.COM'" Presumably network services will handle for themselves 
> retrying to get the service ticket at a future time if it's only 
> unavailable, but if it can't find the KDC at all, it may simply refuse 
> to start.

New version attached.

bye,
Sumit
> 
> -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 8c16bbb83193f84ca26eb24e10081fe3126ae7e2 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 7 May 2010 15:28:21 +0200
Subject: [PATCH] Create kdcinfo and kpasswdinfo file at startup

---
 src/providers/ipa/ipa_common.c   |    9 ++++++++
 src/providers/krb5/krb5_common.c |   41 +++++++++++++++++++++++++++++++++++++-
 src/providers/krb5/krb5_common.h |    2 +
 3 files changed, 51 insertions(+), 1 deletions(-)

diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 3a79eb4..00708f6 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -485,6 +485,7 @@ int ipa_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
     char *realm;
     int ret;
     int i;
+    struct tevent_req *req;
 
     tmp_ctx = talloc_new(memctx);
     if (!tmp_ctx) {
@@ -579,6 +580,14 @@ int ipa_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
         goto done;
     }
 
+    req = be_resolve_server_send(memctx, ctx->ev, ctx, "IPA");
+    if (req == NULL) {
+        DEBUG(1, ("be_resolve_server_send failed.\n"));
+        ret = ENOMEM;
+        goto done;
+    }
+    tevent_req_set_callback(req, krb5_init_resolve_done, service->krb5_service);
+
     ret = EOK;
 
 done:
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index 9a2255f..53711b7 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -31,6 +31,8 @@
 #include "providers/dp_backend.h"
 #include "providers/krb5/krb5_common.h"
 
+#define DUMMY_ADDRESS "255.255.255.255"
+
 struct dp_option default_krb5_opts[] = {
     { "krb5_kdcip", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
@@ -288,7 +290,6 @@ static void krb5_resolve_callback(void *private_data, struct fo_server *server)
     return;
 }
 
-
 int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
                       const char *service_name, const char *servers,
                       const char *realm, struct krb5_service **_service)
@@ -303,6 +304,7 @@ int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
     char *server_spec;
     char *endptr;
     struct servent *servent;
+    struct tevent_req *req;
 
     tmp_ctx = talloc_new(memctx);
     if (!tmp_ctx) {
@@ -425,6 +427,14 @@ int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
         goto done;
     }
 
+    req = be_resolve_server_send(memctx, ctx->ev, ctx, service_name);
+    if (req == NULL) {
+        DEBUG(1, ("be_resolve_server_send failed.\n"));
+        ret = ENOMEM;
+        goto done;
+    }
+    tevent_req_set_callback(req, krb5_init_resolve_done, service);
+
     ret = EOK;
 
 done:
@@ -435,3 +445,32 @@ done:
     return ret;
 }
 
+void krb5_init_resolve_done(struct tevent_req *req)
+{
+    struct krb5_service *krb5_service  = tevent_req_callback_data(req,
+                                                           struct krb5_service);
+    int ret;
+    struct fo_server *srv;
+    const char *service_name;
+
+    ret = be_resolve_server_recv(req, &srv);
+    talloc_zfree(req);
+    if (ret) {
+        DEBUG(1, ("be_resolve_server request failed [%d][%s]. "
+                  "Creating dummy info file.\n", ret, strerror(ret)));
+
+        service_name = krb5_service->name;
+        if (strcmp(service_name, "IPA") == 0) {
+            service_name = SSS_KRB5KDC_FO_SRV;
+        }
+        ret = write_krb5info_file(krb5_service->realm, DUMMY_ADDRESS,
+                                  service_name);
+        if (ret != EOK) {
+            DEBUG(2, ("write_krb5info_file failed, "
+                      "authentication might fail.\n"));
+        }
+    }
+
+    return;
+}
+
diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h
index 46d7a61..aa585b3 100644
--- a/src/providers/krb5/krb5_common.h
+++ b/src/providers/krb5/krb5_common.h
@@ -76,4 +76,6 @@ errno_t write_krb5info_file(const char *realm, const char *kdc,
 int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
                       const char *service_name, const char *servers,
                       const char *realm, struct krb5_service **_service);
+
+void krb5_init_resolve_done(struct tevent_req *req);
 #endif /* __KRB5_COMMON_H__ */
-- 
1.6.6.1



More information about the sssd-devel mailing list