|
 |
541bac |
From 81c98e367ba4bc8d77668acd31e462ad31cf12be Mon Sep 17 00:00:00 2001
|
|
|
541bac |
From: Sumit Bose <sbose@redhat.com>
|
|
|
541bac |
Date: Tue, 27 Oct 2020 14:47:31 +0100
|
|
|
541bac |
Subject: [PATCH 5/7] enroll: make adcli_enroll_add_keytab_for_service_account
|
|
|
541bac |
public
|
|
|
541bac |
|
|
|
541bac |
Determine keytab name more early to catch errors more early.
|
|
|
541bac |
|
|
|
541bac |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
|
|
|
541bac |
---
|
|
|
541bac |
library/adenroll.c | 13 +++++++------
|
|
|
541bac |
library/adenroll.h | 2 ++
|
|
|
541bac |
tools/computer.c | 6 ++++++
|
|
|
541bac |
3 files changed, 15 insertions(+), 6 deletions(-)
|
|
|
541bac |
|
|
|
541bac |
diff --git a/library/adenroll.c b/library/adenroll.c
|
|
|
541bac |
index 44383cc..05bb085 100644
|
|
|
541bac |
--- a/library/adenroll.c
|
|
|
541bac |
+++ b/library/adenroll.c
|
|
|
541bac |
@@ -2276,9 +2276,10 @@ adcli_enroll_add_description_for_service_account (adcli_enroll *enroll)
|
|
|
541bac |
return ADCLI_SUCCESS;
|
|
|
541bac |
}
|
|
|
541bac |
|
|
|
541bac |
-static adcli_result
|
|
|
541bac |
+adcli_result
|
|
|
541bac |
adcli_enroll_add_keytab_for_service_account (adcli_enroll *enroll)
|
|
|
541bac |
{
|
|
|
541bac |
+ adcli_result res;
|
|
|
541bac |
krb5_context k5;
|
|
|
541bac |
krb5_error_code code;
|
|
|
541bac |
char def_keytab_name[MAX_KEYTAB_NAME_LEN];
|
|
|
541bac |
@@ -2286,11 +2287,14 @@ adcli_enroll_add_keytab_for_service_account (adcli_enroll *enroll)
|
|
|
541bac |
int ret;
|
|
|
541bac |
|
|
|
541bac |
if (adcli_enroll_get_keytab_name (enroll) == NULL) {
|
|
|
541bac |
- k5 = adcli_conn_get_krb5_context (enroll->conn);
|
|
|
541bac |
- return_unexpected_if_fail (k5 != NULL);
|
|
|
541bac |
+ res = _adcli_krb5_init_context (&k5;;
|
|
|
541bac |
+ if (res != ADCLI_SUCCESS) {
|
|
|
541bac |
+ return res;
|
|
|
541bac |
+ }
|
|
|
541bac |
|
|
|
541bac |
code = krb5_kt_default_name (k5, def_keytab_name,
|
|
|
541bac |
sizeof (def_keytab_name));
|
|
|
541bac |
+ krb5_free_context (k5);
|
|
|
541bac |
return_unexpected_if_fail (code == 0);
|
|
|
541bac |
|
|
|
541bac |
lc_dom_name = strdup (adcli_conn_get_domain_name (enroll->conn));
|
|
|
541bac |
@@ -2326,9 +2330,6 @@ adcli_enroll_join (adcli_enroll *enroll,
|
|
|
541bac |
|
|
|
541bac |
if (enroll->is_service) {
|
|
|
541bac |
res = adcli_enroll_add_description_for_service_account (enroll);
|
|
|
541bac |
- if (res == ADCLI_SUCCESS) {
|
|
|
541bac |
- res = adcli_enroll_add_keytab_for_service_account (enroll);
|
|
|
541bac |
- }
|
|
|
541bac |
} else {
|
|
|
541bac |
res = ensure_default_service_names (enroll);
|
|
|
541bac |
}
|
|
|
541bac |
diff --git a/library/adenroll.h b/library/adenroll.h
|
|
|
541bac |
index 7765ed4..11a30c8 100644
|
|
|
541bac |
--- a/library/adenroll.h
|
|
|
541bac |
+++ b/library/adenroll.h
|
|
|
541bac |
@@ -146,6 +146,8 @@ const char * adcli_enroll_get_keytab_name (adcli_enroll *enroll);
|
|
|
541bac |
void adcli_enroll_set_keytab_name (adcli_enroll *enroll,
|
|
|
541bac |
const char *value);
|
|
|
541bac |
|
|
|
541bac |
+adcli_result adcli_enroll_add_keytab_for_service_account (adcli_enroll *enroll);
|
|
|
541bac |
+
|
|
|
541bac |
krb5_enctype * adcli_enroll_get_keytab_enctypes (adcli_enroll *enroll);
|
|
|
541bac |
|
|
|
541bac |
void adcli_enroll_set_keytab_enctypes (adcli_enroll *enroll,
|
|
|
541bac |
diff --git a/tools/computer.c b/tools/computer.c
|
|
|
541bac |
index 63fd374..98a0472 100644
|
|
|
541bac |
--- a/tools/computer.c
|
|
|
541bac |
+++ b/tools/computer.c
|
|
|
541bac |
@@ -1166,6 +1166,12 @@ adcli_tool_computer_managed_service_account (adcli_conn *conn,
|
|
|
541bac |
|
|
|
541bac |
adcli_enroll_set_is_service (enroll, true);
|
|
|
541bac |
adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);
|
|
|
541bac |
+ res = adcli_enroll_add_keytab_for_service_account (enroll);
|
|
|
541bac |
+ if (res != ADCLI_SUCCESS) {
|
|
|
541bac |
+ warnx ("Failed to set domain specific keytab name");
|
|
|
541bac |
+ adcli_enroll_unref (enroll);
|
|
|
541bac |
+ return 2;
|
|
|
541bac |
+ }
|
|
|
541bac |
|
|
|
541bac |
res = adcli_enroll_load (enroll);
|
|
|
541bac |
if (res != ADCLI_SUCCESS) {
|
|
|
541bac |
--
|
|
|
541bac |
2.28.0
|
|
|
541bac |
|