Compare commits
No commits in common. 'c9' and 'i9c-beta' have entirely different histories.
@ -0,0 +1,74 @@
|
||||
From 19923985b69ccd5f2a33a067bfc3ed020889377e Mon Sep 17 00:00:00 2001
|
||||
From: Sumit Bose <sbose@redhat.com>
|
||||
Date: Tue, 13 Jun 2023 18:02:52 +0200
|
||||
Subject: [PATCH 1/3] service: allow multiple names and _srv_ ad_server option
|
||||
|
||||
realmd checks if the 'ad_server' option is set in sssd.conf before
|
||||
calling adcli to remove the host from the AD server. If set the value is
|
||||
used as value for dcli's '--domain-controller' option. But if multiple
|
||||
names are set in sssd.conf this currently fails because the whole string
|
||||
is used.
|
||||
|
||||
With this patch the 'ad_server' option is properly evaluated and only
|
||||
the first domain controller name is used.
|
||||
---
|
||||
service/realm-sssd-ad.c | 36 +++++++++++++++++++++++++++++++++++-
|
||||
1 file changed, 35 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c
|
||||
index 2817e73..096b6c5 100644
|
||||
--- a/service/realm-sssd-ad.c
|
||||
+++ b/service/realm-sssd-ad.c
|
||||
@@ -649,6 +649,40 @@ realm_sssd_ad_generic_finish (RealmKerberosMembership *realm,
|
||||
return g_task_propagate_boolean (G_TASK (result), error);
|
||||
}
|
||||
|
||||
+static gchar *get_ad_server_from_config (RealmKerberos *realm)
|
||||
+{
|
||||
+ RealmSssd *sssd = REALM_SSSD (realm);
|
||||
+ RealmIniConfig *config;
|
||||
+ const gchar *section;
|
||||
+ gchar **servers;
|
||||
+ gchar *tmp;
|
||||
+ size_t c;
|
||||
+ gchar *value = NULL;
|
||||
+
|
||||
+ config = realm_sssd_get_config (sssd);
|
||||
+ section = realm_sssd_get_config_section (sssd);
|
||||
+
|
||||
+ if (section == NULL) {
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ servers = realm_ini_config_get_list (config, section, "ad_server", ",");
|
||||
+ /* Only use the first server defined given in 'ad_server' and ignore
|
||||
+ * '_srv_'. */
|
||||
+ if (servers != NULL) {
|
||||
+ for (c = 0; servers[c] != NULL; c++) {
|
||||
+ tmp = g_strstrip (servers[c]);
|
||||
+ if (strcasecmp ("_srv_", tmp) != 0) {
|
||||
+ value = g_strdup (tmp);
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+ g_strfreev (servers);
|
||||
+ }
|
||||
+
|
||||
+ return value;
|
||||
+}
|
||||
+
|
||||
static void
|
||||
realm_sssd_ad_discover_myself (RealmKerberos *realm,
|
||||
RealmDisco *disco)
|
||||
@@ -665,7 +699,7 @@ realm_sssd_ad_discover_myself (RealmKerberos *realm,
|
||||
if (section == NULL)
|
||||
return;
|
||||
|
||||
- value = realm_ini_config_get (config, section, "ad_server");
|
||||
+ value = get_ad_server_from_config (realm);
|
||||
g_free (disco->explicit_server);
|
||||
disco->explicit_server = value;
|
||||
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -0,0 +1,69 @@
|
||||
From f648ae06012d1de137f12095d1bd7aaacb382042 Mon Sep 17 00:00:00 2001
|
||||
From: Sumit Bose <sbose@redhat.com>
|
||||
Date: Wed, 10 Jan 2024 09:18:20 +0100
|
||||
Subject: [PATCH] tools: fix ccache handling for leave operation
|
||||
|
||||
krb5_cc_initialize() must be called before anything can be written into
|
||||
a ccache.
|
||||
|
||||
While checking the available credential types the order/preference was
|
||||
not respected.
|
||||
|
||||
Resolves: https://issues.redhat.com/browse/SSSD-6420
|
||||
---
|
||||
tools/realm-client.c | 25 ++++++++++++++++---------
|
||||
1 file changed, 16 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/tools/realm-client.c b/tools/realm-client.c
|
||||
index c386e64..06420ea 100644
|
||||
--- a/tools/realm-client.c
|
||||
+++ b/tools/realm-client.c
|
||||
@@ -498,13 +498,16 @@ are_credentials_supported (GVariant *supported,
|
||||
GVariantIter iter;
|
||||
const gchar *type;
|
||||
const gchar *owner;
|
||||
-
|
||||
- g_variant_iter_init (&iter, supported);
|
||||
- while (g_variant_iter_loop (&iter, "(&s&s)", &type, &owner)) {
|
||||
- if (g_strcmp0 (credential_type_1, type) == 0 ||
|
||||
- g_strcmp0 (credential_type_2, type) == 0) {
|
||||
- *ret_owner = owner;
|
||||
- return type;
|
||||
+ const gchar *list[] = {credential_type_1, credential_type_2, NULL};
|
||||
+ size_t c;
|
||||
+
|
||||
+ for (c = 0; list[c] != NULL; c++) {
|
||||
+ g_variant_iter_init (&iter, supported);
|
||||
+ while (g_variant_iter_loop (&iter, "(&s&s)", &type, &owner)) {
|
||||
+ if (g_strcmp0 (list[c], type) == 0) {
|
||||
+ *ret_owner = owner;
|
||||
+ return type;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -622,8 +625,6 @@ copy_to_ccache (krb5_context krb5,
|
||||
memset (&mcred, 0, sizeof (mcred));
|
||||
mcred.client = principal;
|
||||
mcred.server = server;
|
||||
- mcred.times.starttime = g_get_real_time () / G_TIME_SPAN_MILLISECOND;
|
||||
- mcred.times.endtime = mcred.times.starttime;
|
||||
|
||||
code = krb5_cc_retrieve_cred (krb5, def_ccache, KRB5_TC_MATCH_TIMES,
|
||||
&mcred, &creds);
|
||||
@@ -639,6 +640,12 @@ copy_to_ccache (krb5_context krb5,
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
+ code = krb5_cc_initialize (krb5, ccache, creds.client);
|
||||
+ if (code != 0) {
|
||||
+ g_debug ("krb5_cc_initialize failed: %s", krb5_get_error_message (krb5, code));
|
||||
+ return FALSE;
|
||||
+ }
|
||||
+
|
||||
code = krb5_cc_store_cred (krb5, ccache, &creds);
|
||||
krb5_free_cred_contents (krb5, &creds);
|
||||
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -0,0 +1,88 @@
|
||||
From d691c679c1531b3eb457c494141bafdc4e0bc692 Mon Sep 17 00:00:00 2001
|
||||
From: Sumit Bose <sbose@redhat.com>
|
||||
Date: Fri, 1 Dec 2023 12:14:06 +0100
|
||||
Subject: [PATCH 2/3] service: fix error message when removing host from AD
|
||||
|
||||
If there is an error while trying to remove the host from AD with the
|
||||
help of adcli the error message talks about "joining" which might be
|
||||
irritating when figuring out the reason for the failure. This patch
|
||||
adds a better message when leaving the domain.
|
||||
---
|
||||
service/realm-adcli-enroll.c | 34 +++++++++++++++++++++++++++-------
|
||||
1 file changed, 27 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/service/realm-adcli-enroll.c b/service/realm-adcli-enroll.c
|
||||
index e0d752b..c913987 100644
|
||||
--- a/service/realm-adcli-enroll.c
|
||||
+++ b/service/realm-adcli-enroll.c
|
||||
@@ -25,9 +25,10 @@
|
||||
#include "realm-settings.h"
|
||||
|
||||
static void
|
||||
-on_join_process (GObject *source,
|
||||
- GAsyncResult *result,
|
||||
- gpointer user_data)
|
||||
+on_join_leave_process (GObject *source,
|
||||
+ GAsyncResult *result,
|
||||
+ gpointer user_data,
|
||||
+ gboolean is_join)
|
||||
{
|
||||
GTask *task = G_TASK (user_data);
|
||||
GError *error = NULL;
|
||||
@@ -39,15 +40,18 @@ on_join_process (GObject *source,
|
||||
switch (status) {
|
||||
case 2: /* ADCLI_ERR_UNEXPECTED */
|
||||
g_set_error (&error, REALM_ERROR, REALM_ERROR_INTERNAL,
|
||||
- "Internal unexpected error joining the domain");
|
||||
+ is_join ? "Internal unexpected error joining the domain"
|
||||
+ : "Internal unexpected error removing host from the domain");
|
||||
break;
|
||||
case 6: /* ADCLI_ERR_CREDENTIALS */
|
||||
g_set_error (&error, REALM_ERROR, REALM_ERROR_AUTH_FAILED,
|
||||
- "Insufficient permissions to join the domain");
|
||||
+ is_join ? "Insufficient permissions to join the domain"
|
||||
+ : "Insufficient permissions to remove the host from the domain");
|
||||
break;
|
||||
default:
|
||||
g_set_error (&error, REALM_ERROR, REALM_ERROR_FAILED,
|
||||
- "Failed to join the domain");
|
||||
+ is_join ? "Failed to join the domain"
|
||||
+ : "Failed to remove the host from the domain");
|
||||
break;
|
||||
}
|
||||
}
|
||||
@@ -64,6 +68,22 @@ on_join_process (GObject *source,
|
||||
g_object_unref (task);
|
||||
}
|
||||
|
||||
+static void
|
||||
+on_join_process (GObject *source,
|
||||
+ GAsyncResult *result,
|
||||
+ gpointer user_data)
|
||||
+{
|
||||
+ on_join_leave_process (source, result, user_data, TRUE);
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+on_leave_process (GObject *source,
|
||||
+ GAsyncResult *result,
|
||||
+ gpointer user_data)
|
||||
+{
|
||||
+ on_join_leave_process (source, result, user_data, FALSE);
|
||||
+}
|
||||
+
|
||||
void
|
||||
realm_adcli_enroll_join_async (RealmDisco *disco,
|
||||
RealmCredential *cred,
|
||||
@@ -290,7 +310,7 @@ realm_adcli_enroll_delete_async (RealmDisco *disco,
|
||||
g_ptr_array_add (args, NULL);
|
||||
|
||||
realm_command_runv_async ((gchar **)args->pdata, environ, input,
|
||||
- invocation, on_join_process,
|
||||
+ invocation, on_leave_process,
|
||||
g_object_ref (task));
|
||||
|
||||
g_ptr_array_free (args, TRUE);
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -0,0 +1,26 @@
|
||||
From 56aedbceec3e6ff0d6142a16ca0c343c523b6d7a Mon Sep 17 00:00:00 2001
|
||||
From: Sumit Bose <sbose@redhat.com>
|
||||
Date: Fri, 1 Dec 2023 13:07:10 +0100
|
||||
Subject: [PATCH 3/3] doc: fix reference in realmd.conf man page
|
||||
|
||||
---
|
||||
doc/manual/realmd.conf.xml | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/doc/manual/realmd.conf.xml b/doc/manual/realmd.conf.xml
|
||||
index 72b706c..ad17639 100644
|
||||
--- a/doc/manual/realmd.conf.xml
|
||||
+++ b/doc/manual/realmd.conf.xml
|
||||
@@ -110,7 +110,8 @@ default-client = sssd
|
||||
</para>
|
||||
|
||||
<para>Some callers of <command>realmd</command> such as the
|
||||
- <link linkend="realm"><command>realm</command></link>
|
||||
+ <citerefentry><refentrytitle>realm</refentrytitle>
|
||||
+ <manvolnum>8</manvolnum></citerefentry>
|
||||
command line tool allow specifying which client software should
|
||||
be used. Others, such as GNOME Control Center, simplify choose
|
||||
the default.</para>
|
||||
--
|
||||
2.43.0
|
||||
|
||||
Loading…
Reference in new issue