[Freeipa-devel] [freeipa PR#629][opened] adtrust: make sure that runtime hostname result is consistent with the configuration

[abbra]

URL: https://github.com/freeipa/freeipa/pull/629
Author: abbra
Title: #629: adtrust: make sure that runtime hostname result is consistent with the configuration
Action: opened

PR body:
"""

FreeIPA's `ipasam` module to Samba uses gethostname() call to identify
own server's host name. This value is then used in multiple places,
including construction of cifs/host.name principal. `ipasam` module
always uses GSSAPI authentication when talking to LDAP, so Kerberos
keys must be available in the /etc/samba/samba.keytab. However, if
the principal was created using non-FQDN name but system reports
FQDN name, `ipasam` will fail to acquire Kerberos credentials.
Same with FQDN principal and non-FQDN hostname.

Also host name and principal name must have the same case.

Report an error when configuring ADTrust instance with inconsistent
runtime hostname and configuration. This prevents errors like this:

[20/21]: starting CIFS services
ipa : CRITICAL CIFS services failed to start

where samba logs have this:

[2017/03/20 06:34:27.385307, 0] ipa_sam.c:4193(bind_callback_cleanup)
kerberos error: code=-1765328203, message=Keytab contains no suitable keys for cifs/***@EXAMPLE.COM
[2017/03/20 06:34:27.385476, 1] ../source3/lib/smbldap.c:1206(get_cached_ldap_connect)
Connection to LDAP server failed for the 16 try!

Fixes https://pagure.io/freeipa/issue/6786
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/629/head:pr629
git checkout pr629

[abbra]

URL: https://github.com/freeipa/freeipa/pull/629
Author: abbra
Title: #629: adtrust: make sure that runtime hostname result is consistent with the configuration
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/629/head:pr629
git checkout pr629

[abbra]

URL: https://github.com/freeipa/freeipa/pull/629
Title: #629: adtrust: make sure that runtime hostname result is consistent with the configuration

abbra commented:
"""
Removed backslashes and also moved the check to be the first step when creating an instance.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/629#issuecomment-290086797

[abbra]

URL: https://github.com/freeipa/freeipa/pull/629
Author: abbra
Title: #629: adtrust: make sure that runtime hostname result is consistent with the configuration
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/629/head:pr629
git checkout pr629

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/629
Title: #629: adtrust: make sure that runtime hostname result is consistent with the configuration

Label: +ack

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/629
Title: #629: adtrust: make sure that runtime hostname result is consistent with the configuration

Label: +pushed

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/629
Author: abbra
Title: #629: adtrust: make sure that runtime hostname result is consistent with the configuration
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/629/head:pr629
git checkout pr629

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/629
Title: #629: adtrust: make sure that runtime hostname result is consistent with the configuration

MartinBasti commented:
"""
master:

* 0d817ae63a4ad8ba7a29910a9342a78e15e89593 adtrust: make sure that runtime hostname result is consistent with the configuration


ipa-4-5:

* e430699024df06e1e6f819824548986eb0fa5fd2 adtrust: make sure that runtime hostname result is consistent with the configuration


"""

See the full comment at https://github.com/freeipa/freeipa/pull/629#issuecomment-290381044