When DNS plugin is installed via ipa-dns-install and user has a valid
Kerberos ticket at the time, the DNS installation is corrupt and named
won't start, reporting Preauthentication error.

When the non-DM identity is used for authentication, krbprincipalkey
attribute in DNS service LDAP record is not created, thus leading
to the error. This patch makes sure that authentication with Directory
Manager password is used every time.

https://fedorahosted.org/freeipa/ticket/1483

>From 4a781b99e531c8f51121daf024d1a785c30b684e Mon Sep 17 00:00:00 2001
From: Martin Kosek <mko...@redhat.com>
Date: Fri, 15 Jul 2011 09:00:20 +0200
Subject: [PATCH] Fix ipa-dns-install

When DNS plugin is installed via ipa-dns-install and user has a valid
Kerberos ticket at the time, the DNS installation is corrupt and named
won't start, reporting Preauthentication error.

When the non-DM identity is used for authentication, krbprincipalkey
attribute in DNS service LDAP record is not created, thus leading
to the error. This patch makes sure that authentication with Directory
Manager password is used every time.

https://fedorahosted.org/freeipa/ticket/1483
---
 install/tools/ipa-dns-install |   30 ++++++++++++------------------
 1 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install
index b5295b5c7567c3d559ad808d1752d79c1d915573..d1b2fd59ed14b3f2577ffe4f4fbbe9b07b63a2ad 100755
--- a/install/tools/ipa-dns-install
+++ b/install/tools/ipa-dns-install
@@ -141,25 +141,19 @@ def main():
         print ""
 
     # Create a BIND instance
-    bind = bindinstance.BindInstance(fstore, options.dm_password)
+    if options.unattended and not options.dm_password:
+        sys.exit("\nIn unattended mode you need to provide at least the -p option")
 
-    valid_password = False
-    while not valid_password:
-        # try the connection
-        try:
-            bind.ldap_connect()
-            bind.ldap_disconnect()
-            valid_password = True
-        except ldap.LOCAL_ERROR, e:
-            if not bind.dm_password:
-                if options.unattended:
-                    sys.exit("\nIn unattended mode you need to provide at least the -p option")
-                else:
-                    bind.dm_password = read_password("Directory Manager", confirm=False, validate=False)
-        except ldap.INVALID_CREDENTIALS, e:
-            if options.unattended:
-                sys.exit("\nPassword is not valid!")
-            bind.dm_password = read_password("Directory Manager", confirm=False, validate=False)
+    dm_password = options.dm_password or read_password("Directory Manager",
+                                             confirm=False, validate=False)
+    bind = bindinstance.BindInstance(fstore, dm_password)
+
+    # try the connection
+    try:
+        bind.ldap_connect()
+        bind.ldap_disconnect()
+    except ldap.INVALID_CREDENTIALS, e:
+        sys.exit("Password is not valid!")
 
     create_reverse = True
     if options.unattended:
-- 
1.7.6

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to