Bug 973764

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3689

I did run

{{{
ipa-getkeytab -s server.example.com -p HTTP/broker.example.net -k /var/www/openshift/broker/httpd/conf.d/http.keytab
}}}

and the call failed with exit status 11 and message

{{{
Failed to add key to the keytab
}}}

I took me some time (this being a scripted operation) that the directory to which I wanted to put the keytab did not exist.

Looking at the code, it does

{{{
                krberr = krb5_kt_add_entry(krbctx, kt, &kt_entry);
                if (krberr) {
                        fprintf(stderr,
                                _("Failed to add key to the keytab\n"));
                        exit (11);
                }
}}}

Alexander suggests that it should be possible to get some more detailed error message about the cause of the problem from the krb5* library using krb5_get_error_message. I tried to apply the following patch

{{{
--- ipa-getkeytab.c.orig	2012-10-12 10:05:55.000000000 -0400
+++ ipa-getkeytab.c	2013-06-05 06:53:15.378200294 -0400
@@ -604,8 +604,10 @@
 
 		krberr = krb5_kt_add_entry(krbctx, kt, &kt_entry);
 		if (krberr) {
+                        const char * krberr_str = krb5_get_error_message(krbctx, krberr);
 			fprintf(stderr,
-                                _("Failed to add key to the keytab\n"));
+                                _("Failed to add key to the keytab: %s\n"), krberr_str);
+			krb5_free_error_message(krbctx, krberr_str);
 			exit (11);
 		}
 	}
}}}

(noto sure how critical it is to call the free if we are about to exit) and the error message is

{{{
Failed to add key to the keytab: Key table file '/var/www/openshift/broker/httpd/conf.dx/http.keytab' not found
}}}

It might not be exactly the 'Directory does not exist' but at least it points to the existence of the file as the source of the problem.

Could all ocurences of

{{{
if (error_code_that_ve_got_from_kr5_call) {
  fprintf(stderr, _("some fixed string\n"));
  exit(somevalue);
}
}}}

be replaced with code which would also call krb5_get_error_message and printed it out?