Some client errors were rather generic or outright misleading. This
cleans up some return values and displays output from the ipa-enrollment
extended operation.
ticket https://fedorahosted.org/freeipa/ticket/1417
>From 89cda040e7ae1f6b1aa97d2df8af25467c7ba410 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <[email protected]>
Date: Wed, 6 Jul 2011 10:30:24 -0400
Subject: [PATCH] Make ipa-client-install error messages more understandable and relevant.
* Check remote LDAP server to see if it is a V2 server
* Replace numeric return values with alphanumeric constants
* Display the error message from the ipa-enrollment extended op
* Remove generic join failed error message when XML-RPC fails
* Don't display Certificate subject base when enrollment fails
* Return proper error message when LDAP bind fails
https://fedorahosted.org/freeipa/ticket/1417
---
ipa-client/ipa-install/ipa-client-install | 19 ++++++++---------
ipa-client/ipa-join.c | 24 +++++++++++-----------
ipa-client/ipaclient/ipadiscovery.py | 31 +++++++++++++++++++++-------
3 files changed, 44 insertions(+), 30 deletions(-)
diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install
index 884dd213b82bf5c29d6cb4928fde6789057b16af..55f2cfac8e11c0c413be6042fc3027670c44b9fd 100755
--- a/ipa-client/ipa-install/ipa-client-install
+++ b/ipa-client/ipa-install/ipa-client-install
@@ -28,7 +28,7 @@ try:
import logging
import tempfile
import getpass
- import ipaclient.ipadiscovery
+ from ipaclient import ipadiscovery
import ipaclient.ipachangeconf
import ipaclient.ntpconf
from ipapython.ipautil import run, user_input, CalledProcessError, file_exists
@@ -693,15 +693,15 @@ def main():
sys.exit('Invalid hostname \'%s\', must be lower-case.' % hostname)
# Create the discovery instance
- ds = ipaclient.ipadiscovery.IPADiscovery()
+ ds = ipadiscovery.IPADiscovery()
ret = ds.search(domain=options.domain, server=options.server)
- if ret == -10:
+ if ret == ipadiscovery.BAD_HOST_CONFIG:
print >>sys.stderr, "Can't get the fully qualified name of this host"
print >>sys.stderr, "Please check that the client is properly configured"
return ret
- if ret == -1 or not ds.getDomainName():
+ if ret == ipadiscovery.NO_LDAP_SERVER or not ds.getDomainName():
logging.debug("Domain not found")
if options.domain:
cli_domain = options.domain
@@ -719,7 +719,7 @@ def main():
cli_domain = ds.getDomainName()
logging.debug("will use domain: %s\n", cli_domain)
- if ret == -2 or not ds.getServerName():
+ if ret == ipadiscovery.NO_LDAP_SERVER or not ds.getServerName():
logging.debug("IPA Server not found")
if options.server:
cli_server = options.server
@@ -738,6 +738,9 @@ def main():
cli_server = ds.getServerName()
logging.debug("will use server: %s\n", cli_server)
+ if ret == ipadiscovery.NOT_IPA_SERVER:
+ print >>sys.stderr, "%s is not an IPA v2 Server." % cli_server
+ return ret
if ret != 0:
print >>sys.stderr, "Failed to verify that "+cli_server+" is an IPA Server."
print >>sys.stderr, "This may mean that the remote server is not up or is not reachable"
@@ -851,11 +854,7 @@ def main():
(stdout, stderr, returncode) = run(join_args, raiseonerr=False, env=env)
if returncode != 0:
- if returncode == 17: # XML-RPC fault - possible IPA v1/v2 incompatibility
- print "Joining realm failed because of failing XML-RPC request."
- print " This error may be caused by incompatible server/client major versions."
- else:
- print >>sys.stderr, "Joining realm failed: %s" % stderr,
+ print >>sys.stderr, "Joining realm failed: %s" % stderr,
if not options.force:
return 1
print " Use ipa-getkeytab to obtain a host principal for this server."
diff --git a/ipa-client/ipa-join.c b/ipa-client/ipa-join.c
index 21c087b68ca8813f0e89281b770772915c0dc543..95f2939cd9812d70aab6d29fb526ac9eb7b5479d 100644
--- a/ipa-client/ipa-join.c
+++ b/ipa-client/ipa-join.c
@@ -475,15 +475,9 @@ join_ldap(const char *ipaserver, char *hostname, const char ** binddn, const cha
/* Now rebind as the host */
ld = connect_ldap(ipaserver, *binddn, bindpw);
if (!ld) {
- if (has_principal) {
- if (!quiet)
- fprintf(stderr, _("Host is already joined.\n"));
- rval = 13;
- } else {
- if (!quiet)
- fprintf(stderr, _("Incorrect password.\n"));
- rval = 15;
- }
+ if (!quiet)
+ fprintf(stderr, _("Incorrect password.\n"));
+ rval = 15;
goto done;
}
@@ -491,13 +485,19 @@ join_ldap(const char *ipaserver, char *hostname, const char ** binddn, const cha
valrequest.bv_len = strlen(hostname);
if ((rc = ldap_extended_operation_s(ld, JOIN_OID, &valrequest, NULL, NULL, &oidresult, &valresult)) != LDAP_SUCCESS) {
+ char *s = NULL;
+#ifdef LDAP_OPT_DIAGNOSTIC_MESSAGE
+ ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, &s);
+#else
+ ldap_get_option(ld, LDAP_OPT_ERROR_STRING, &s);
+#endif
if (!quiet)
- fprintf(stderr, _("principal not found in host entry\n"));
+ fprintf(stderr, _("Enrollment failed. %s\n"), s);
if (debug) {
fprintf(stderr, "ldap_extended_operation_s failed: %s",
ldap_err2string(rc));
}
- rval = 18;
+ rval = 13;
goto ldap_done;
}
@@ -1003,7 +1003,7 @@ join(const char *server, const char *hostname, const char *bindpw, const char *k
}
cleanup:
- if (NULL != subject && !quiet)
+ if (NULL != subject && !quiet && rval == 0)
fprintf(stderr, _("Certificate subject base is: %s\n"), subject);
free((char *)princ);
diff --git a/ipa-client/ipaclient/ipadiscovery.py b/ipa-client/ipaclient/ipadiscovery.py
index d149412ec7907c0a72ad5a237bd14279e1bfcf51..e4bbaf2a77678736f64f26c4676ed8ceddb25e93 100644
--- a/ipa-client/ipaclient/ipadiscovery.py
+++ b/ipa-client/ipaclient/ipadiscovery.py
@@ -26,6 +26,13 @@ import ldap
from ldap import LDAPError
from ipapython.ipautil import run, CalledProcessError
+
+NOT_FQDN = -1
+NO_LDAP_SERVER = -2
+REALM_NOT_FOUND = -3
+NOT_IPA_SERVER = -4
+BAD_HOST_CONFIG = -10
+
class IPADiscovery:
def __init__(self):
@@ -110,12 +117,12 @@ class IPADiscovery:
# get the local host name
hostname = socket.getfqdn()
if not hostname:
- return -10 #bad host configuration
+ return BAD_HOST_CONFIG
# first, check for an LDAP server for the local domain
p = hostname.find(".")
if p == -1: #no domain name
- return -1
+ return NOT_FQDN
domain = hostname[p+1:]
# Get the list of domains from /etc/resolv.conf, we'll search
@@ -133,14 +140,14 @@ class IPADiscovery:
self.domain = domain
break
if not self.domain: #no ldap server found
- return -1
+ return NO_LDAP_SERVER
else:
logging.debug("[ipadnssearchldap]")
self.server = self.ipadnssearchldap(domain)
if self.server:
self.domain = domain
else:
- return -2 #no ldap server found
+ return NO_LDAP_SERVER
else: #server forced on us, this means DNS doesn't work :/
@@ -151,7 +158,7 @@ class IPADiscovery:
logging.debug("[ipadnssearchkrb]")
krbret = self.ipadnssearchkrb(self.domain)
if not server and not krbret[0]:
- return -3 # realm for autodiscovery not found
+ return REALM_NOT_FOUND
self.realm = krbret[0]
self.kdc = krbret[1]
@@ -161,7 +168,7 @@ class IPADiscovery:
ldapret = self.ipacheckldap(self.server, self.realm)
if not ldapret:
- return -4 # not an IPA server (or broken config)
+ return NOT_IPA_SERVER
self.server = ldapret[0]
self.realm = ldapret[1]
@@ -169,6 +176,14 @@ class IPADiscovery:
return 0
def ipacheckldap(self, thost, trealm):
+ """
+ Given a host and kerberos realm verify that it is an IPA LDAP
+ server hosting the realm. The connection is an SSL connection
+ so the remote IPA CA cert must be available at
+ http://HOST/ipa/config/ca.crt
+
+ Returns a list [host, realm] or an empty list on error.
+ """
lret = []
lres = []
@@ -219,7 +234,7 @@ class IPADiscovery:
linfo = lret[0][1][lattr][0].lower()
break
- if not linfo:
+ if not linfo or linfo.lower() != 'ipa v2.0':
return []
#search and return known realms
@@ -323,5 +338,5 @@ class IPADiscovery:
if not kdc:
logging.debug("SRV record for KDC not found! Realm: %s, SRV record: %s" % (realm, qname))
-
+
return [realm, kdc]
--
1.7.4
_______________________________________________
Freeipa-devel mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/freeipa-devel
