Hi,

 Check for the presence of the forest root DNS domain of the AD realm
among the IPA realm domains prior to esablishing the trust.

This prevents creation of a failing setup, as trusts would not work
properly in this case.

https://fedorahosted.org/freeipa/ticket/4799

Tomas
From 03dabf99d538747051f1c898e6a58162425e7b28 Mon Sep 17 00:00:00 2001
From: Tomas Babej <tba...@redhat.com>
Date: Wed, 15 Jul 2015 14:22:48 +0200
Subject: [PATCH] trusts: Check for AD root domain among our trusted domains

Check for the presence of the forest root DNS domain of the AD realm
among the IPA realm domains prior to esablishing the trust.

This prevents creation of a failing setup, as trusts would not work
properly in this case.

https://fedorahosted.org/freeipa/ticket/4799
---
 ipalib/plugins/trust.py | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py
index 196df5926e7965dc1f0165f301bd5ac11528d1cd..f28f2fdca9ef31b5b143f988616a75b25cc60016 100644
--- a/ipalib/plugins/trust.py
+++ b/ipalib/plugins/trust.py
@@ -640,6 +640,8 @@ sides.
                            self.params['realm_passwd'].label, confirm=False)
 
     def validate_options(self, *keys, **options):
+        trusted_realm_domain = keys[-1]
+
         if not _bindings_installed:
             raise errors.NotFound(
                 name=_('AD Trust setup'),
@@ -692,6 +694,22 @@ sides.
                 )
             )
 
+        # Obtain a list of IPA realm domains
+        result = self.api.Command.realmdomains_show()['result']
+        realm_domains = result['associateddomain']
+
+        # Do not allow the AD's trusted realm domain in the list
+        # of our realm domains
+        if trusted_realm_domain.lower() in realm_domains:
+            raise errors.ValidationError(
+                name=_('AD Trust setup'),
+                error=_(
+                    'Trusted domain %(domain)s is included among '
+                    'IPA realm domains. It needs to be removed '
+                    'prior to establishing the trust.'
+                ) % dict(domain=trusted_realm_domain)
+            )
+
         self.realm_server = options.get('realm_server')
         self.realm_admin = options.get('realm_admin')
         self.realm_passwd = options.get('realm_passwd')
@@ -702,7 +720,7 @@ sides.
             if len(names) > 1:
                 # realm admin name is in UPN format, user@realm, check that
                 # realm is the same as the one that we are attempting to trust
-                if keys[-1].lower() != names[-1].lower():
+                if trusted_realm_domain.lower() != names[-1].lower():
                     raise errors.ValidationError(
                         name=_('AD Trust setup'),
                         error=_(
-- 
2.1.0

-- 
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to