[Freeipa-devel] [PATCH] 0078 ipa-client-install: Obtain host TGT from one specific KDC

[Petr Viktorin]

When installing the client, we need to take extra case to only contact 
the one server we're installing against. Otherwise, in the real world, 
we might hit a server that hasn't replicated info about the client yet.

This patch fixes a bug where kinit attempted to contact a KDC that 
didn't have the host principal yet.


To reproduce:

- Install a "master" and "replica"
- Change the Kerberos DNS entries to only point to the replica:
     for REC_NAME in '_kerberos-master._tcp' '_kerberos-master._udp' 
'_kerberos._tcp' '_kerberos._udp' '_kpasswd._tcp' '_kpasswd._udp'; do
         ipa dnsrecord-mod $DOMAIN $REC_NAME --srv-rec="0 100 88 
$REPLICA_HOSTNAME"
     done
     ipa dnsrecord-mod $DOMAIN _ldap._tcp --srv-rec="0 100 389 
$MASTER_HOSTNAME"
     ipa dnsrecord-find $DOMAIN  # check
- Sever communication between the hosts to disable replication:
     (on master)
     iptables -A INPUT -j DROP -p all --source $REPLICA_IP
- On client machine, put master as nameserver in /etc/resolv.conf & 
install client

This will fail without the patch.


Thanks to Petr Spacek, Simo, and Scott for helping to reproduce and 
explain the bug. I learned a lot.

https://fedorahosted.org/freeipa/ticket/2982

-- 
Petr³
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-pviktori-0078-ipa-client-install-Obtain-host-TGT-from-one-specific.patch
Type: text/x-patch
Size: 5473 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20120906/2ee23f7a/attachment.bin>