Bug 1172598
| Summary: | Access is not rejected for disabled domain | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Martin Kosek <mkosek> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.1 | CC: | abokovoy, grajaiya, jcholast, jgalipea, jhrozek, kbanerje, lslebodn, mkosek, mzidek, pbrezina, preichl, rcritten, sbose, sgoveas, sssd-maint |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.1.0-13.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1170300 | Environment: | |
| Last Closed: | 2015-03-05 10:18:55 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1170300 | ||
| Bug Blocks: | |||
|
Description
Martin Kosek
2014-12-10 12:54:29 UTC
This Bugzilla is to provide better error code in this scenario (and return POLICY error to be precise) How to test:
- disable a domain from a trusted forest
- call kinit with a principal of a user from the disabled domain (this will work because kinit will talk to the DC of the domain directly)
- try to get a Kerberos service ticket for an IPA server, e.g.
kvno ldap/ipaserver.ipa.domain
Older version of IPA should just show an unspecific error, while versions with the patch should show a policy error.
Verified in version ipa-server-4.1.0-13.el7.x86_64 sssd-ipa-1.12.2-39.el7.x86_64 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: trustdomain_cli_bz1172598: Policy error expected when access is rejected for disabled domain :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ BEGIN ] :: Running 'ipa trustdomain-disable adtest.qe pune.adtest.qe > /tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out 2>&1' :: [ PASS ] :: Command 'ipa trustdomain-disable adtest.qe pune.adtest.qe > /tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out 2>&1' (Expected 0, got 0) -------------------------------------- Disabled trust domain "pune.adtest.qe" -------------------------------------- :: [ BEGIN ] :: Running 'kdestroy -A' :: [ PASS ] :: Command 'kdestroy -A' (Expected 0, got 0) :: [ BEGIN ] :: Running 'echo Secret123 | kinit testu1.QE' Password for testu1.QE: :: [ PASS ] :: Command 'echo Secret123 | kinit testu1.QE' (Expected 0, got 0) :: [ BEGIN ] :: Running 'kvno ldap/vm-idm-010.steeve2411.test > /tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out 2>&1' :: [ PASS ] :: Command 'kvno ldap/vm-idm-010.steeve2411.test > /tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out 2>&1' (Expected 1, got 1) :: [ BEGIN ] :: Running 'cat /tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out' kvno: KDC policy rejects request while getting credentials for ldap/vm-idm-010.steeve2411.test :: [ PASS ] :: Command 'cat /tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out' (Expected 0, got 0) :: [ PASS ] :: File '/tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out' should contain 'kvno: KDC policy rejects request while getting credentials for ldap/vm-idm-010.steeve2411.test' :: [ BEGIN ] :: Running 'kdestroy -A' :: [ PASS ] :: Command 'kdestroy -A' (Expected 0, got 0) :: [ BEGIN ] :: Running 'echo Secret123 | kinit admin' Password for admin: :: [ PASS ] :: Command 'echo Secret123 | kinit admin' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ipa trustdomain-enable adtest.qe pune.adtest.qe > /tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out 2>&1' :: [ PASS ] :: Command 'ipa trustdomain-enable adtest.qe pune.adtest.qe > /tmp/tmp.9Bf6w4t88R/tmpout.trustdomain_cli_bz1172598.out 2>&1' (Expected 0, got 0) :: [ BEGIN ] :: Running 'sleep 65' :: [ PASS ] :: Command 'sleep 65' (Expected 0, got 0) Fixed upstream master: https://fedorahosted.org/freeipa/changeset/373a04870d6ecc99145a6267c008702ed3e24171 ipa-4-1: https://fedorahosted.org/freeipa/changeset/6d6e924b1fe154812d66277f55c485f210e9c32d Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0442.html |