diff options
| author | Alexander Bokovoy <[email protected]> | 2014-11-24 15:07:49 +0200 |
|---|---|---|
| committer | Tomas Babej <[email protected]> | 2014-11-25 12:23:17 +0100 |
| commit | 538e023107ed307142ca7302ff34106c53afa932 (patch) | |
| tree | c7e231cb0c2767a89ad594f6b18f5b99fdedef21 /ipaserver | |
| parent | 94bc7a9431c3e44c4e0dcf84fbb0f0613ec86600 (diff) | |
| download | freeipa-538e023107ed307142ca7302ff34106c53afa932.tar.gz freeipa-538e023107ed307142ca7302ff34106c53afa932.tar.xz freeipa-538e023107ed307142ca7302ff34106c53afa932.zip | |
AD trust: improve trust validation
Trust validation requires AD DC to contact IPA server to verify that trust account
actually works. It can fail due to DNS or firewall issue or if AD DC was able to
resolve IPA master(s) via SRV records, it still may contact a replica that has
no trust data replicated yet.
In case AD DC still returns 'access denied', wait 5 seconds and try validation again.
Repeat validation until we hit a limit of 10 attempts, at which point raise
exception telling what's happening.
https://fedorahosted.org/freeipa/ticket/4764
Reviewed-By: Tomas Babej <[email protected]>
Diffstat (limited to 'ipaserver')
| -rw-r--r-- | ipaserver/dcerpc.py | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py index caeca3c4a..e342c4973 100644 --- a/ipaserver/dcerpc.py +++ b/ipaserver/dcerpc.py @@ -58,6 +58,7 @@ import pysss from ipaplatform.paths import paths from ldap.filter import escape_filter_chars +from time import sleep __doc__ = _(""" Classes to manage trust joins using DCE-RPC calls @@ -93,6 +94,8 @@ dcerpc_error_codes = { dcerpc_error_messages = { "NT_STATUS_OBJECT_NAME_NOT_FOUND": errors.NotFound(reason=_('Cannot find specified domain or server name')), + "WERR_NO_LOGON_SERVERS": + errors.RemoteRetrieveError(reason=_('AD DC was unable to reach any IPA domain controller. Most likely it is a DNS or firewall issue')), "NT_STATUS_INVALID_PARAMETER_MIX": errors.RequirementError(name=_('At least the domain or IP address should be specified')), } @@ -699,6 +702,7 @@ class TrustDomainInstance(object): self._policy_handle = None self.read_only = False self.ftinfo_records = None + self.validation_attempts = 0 def __gen_lsa_connection(self, binding): if self.creds is None: @@ -1011,9 +1015,18 @@ class TrustDomainInstance(object): netlogon.NETLOGON_CONTROL_TC_VERIFY, another_domain.info['dns_domain']) if (result and (result.flags and netlogon.NETLOGON_VERIFY_STATUS_RETURNED)): - # netr_LogonControl2Ex() returns non-None result only if overall call - # result was WERR_OK which means verification was correct. - # We only check that it was indeed status for verification process + if (result.pdc_connection_status[0] != 0) and (result.tc_connection_status[0] != 0): + if result.pdc_connection_status[1] == "WERR_ACCESS_DENIED": + # Most likely AD DC hit another IPA replica which yet has no trust secret replicated + # Sleep and repeat again + self.validation_attempts += 1 + if self.validation_attempts < 10: + sleep(5) + return self.verify_trust(another_domain) + raise errors.ACIError(reason=_('IPA master denied trust validation requests from AD DC ' + '%(count)d times. Most likely AD DC contacted a replica ' + 'that has no trust information replicated yet.' % (self.validation_attempts))) + raise assess_dcerpc_exception(*result.pdc_connection_status) return True return False |