Hi,
attached patch moves S4U2Proxy configuration for CIFS service to
ipa-adtrust-install. Since CIFS service is only available after running
ipa-adtrust-install, we cannot reference its principal in advance. This
means bootstrap template and updates processes cannot reference it
directly or upgrading from older versions would not be possible due to
referencing non-existent principal in updates.
https://fedorahosted.org/freeipa/ticket/3041
--
/ Alexander Bokovoy
>From 2c29b1ee8e4bc0752be61889f254fb37f701dcbc Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy
Date: Mon, 8 Oct 2012 13:27:16 +0300
Subject: [PATCH 3/4] Add cifs principal to S4U2Proxy targets only when
running ipa-adtrust-install
Since CIFS principal is generated by ipa-adtrust-install and is only usable
after
setting CIFS configuration, there is no need to include it into default setup.
This should fix upgrades from 2.2 to 3.0 where CIFS principal does not exist by
default.
https://fedorahosted.org/freeipa/ticket/3041
---
install/share/bootstrap-template.ldif | 1 -
install/share/replica-s4u2proxy.ldif | 6
install/updates/60-trusts.update | 4 ---
install/updates/61-trusts-s4u2proxy.update | 9 ++
ipaserver/install/adtrustinstance.py | 46 ++
5 files changed, 42 insertions(+), 24 deletions(-)
diff --git a/install/share/bootstrap-template.ldif
b/install/share/bootstrap-template.ldif
index
24804e475427ad7e5b2ae7c69d6cfb54cafbef38..a17f2518fce89232e6339fa1fdce508dd2c8f45c
100644
--- a/install/share/bootstrap-template.ldif
+++ b/install/share/bootstrap-template.ldif
@@ -195,7 +195,6 @@ changetype: add
objectClass: groupOfPrincipals
objectClass: top
cn: ipa-cifs-delegation-targets
-memberPrincipal: cifs/$HOST@$REALM
dn: uid=admin,cn=users,cn=accounts,$SUFFIX
changetype: add
diff --git a/install/share/replica-s4u2proxy.ldif
b/install/share/replica-s4u2proxy.ldif
index
98de46fa7760965ea28fe15b29a16e88310e4992..c7ced5ee290103b1bc92e44d849835fda57ba03d
100644
--- a/install/share/replica-s4u2proxy.ldif
+++ b/install/share/replica-s4u2proxy.ldif
@@ -12,9 +12,3 @@ dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: modify
add: memberPrincipal
memberPrincipal: ldap/$FQDN@$REALM
-
-dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
-changetype: modify
-add: memberPrincipal
-memberPrincipal: cifs/$FQDN@$REALM
-
diff --git a/install/updates/60-trusts.update b/install/updates/60-trusts.update
index
cc9a771df901a90b457357c570dc06d34c0db4c8..bf2c58daa9bc6abb2bbcefecec98d0dca9a89d60
100644
--- a/install/updates/60-trusts.update
+++ b/install/updates/60-trusts.update
@@ -40,10 +40,6 @@ dn: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
default: objectClass: GroupOfNames
default: objectClass: top
default: cn: adtrust agents
-default: member:
krbprincipalname=cifs/$FQDN@$REALM,cn=services,cn=accounts,$SUFFIX
-
-dn: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
-add: member: krbprincipalname=cifs/$FQDN@$REALM,cn=services,cn=accounts,$SUFFIX
dn: cn=trusts,$SUFFIX
default: objectClass: top
diff --git a/install/updates/61-trusts-s4u2proxy.update
b/install/updates/61-trusts-s4u2proxy.update
index
4a71148bc6bfd8a5464fef21153d5357e2f4ad9d..7504a068e2a3d773eb34fc09a959d324ff0d9430
100644
--- a/install/updates/61-trusts-s4u2proxy.update
+++ b/install/updates/61-trusts-s4u2proxy.update
@@ -1,12 +1,7 @@
-dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
-add: ipaAllowedTarget:
'cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX'
-
dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
default: objectClass: groupOfPrincipals
default: objectClass: top
default: cn: ipa-cifs-delegation-targets
-default: memberPrincipal: cifs/$FQDN@$REALM
-
-dn: cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
-add: memberPrincipal: cifs/$FQDN@$REALM
+dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
+add: ipaAllowedTarget:
'cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX'
diff --git a/ipaserver/install/adtrustinstance.py
b/ipaserver/install/adtrustinstance.py
index
3f3924eb3ce9f56ac66407347645c40f96eb6430..4c4197a8a7650055a8c19ab7af31dd1477c05298
100644
--- a/ipaserver/install/adtrustinstance.py
+++ b/ipaserver/install/adtrustinstance.py
@@ -53,6 +53,13 @@ change with the command:
Try updating the policycoreutils and selinux-policy packages.
"""
+UPGRADE_ERROR = """
+Entry %(dn)s does not exist.
+This means upgrade from IPA 2.x to 3.x did not went well and required S4U2Proxy
+configuration was not set up properly. Please run ipa-ldap-updater manually
+and re-run ipa-adtrust-instal again afterwards.
+"""
+
def check_inst():
for smbfile in ['/usr/sbin/smbd', '/usr/bin/net', '/usr/bin/smbpasswd']:
if not os.path.exists(smbfile):
@@ -401,6 +408,25 @@ class ADTRUSTInstance(service.Service):
self.__add_plugin_conf('Extdom', 'ipa_extdom_extop',
