Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adtrust: remove FILE: prefix from 'dedicated keytab file' in smb.conf #326

Closed
wants to merge 1 commit into from

Conversation

abbra
Copy link
Contributor

@abbra abbra commented Dec 12, 2016

Samba 4.5 does not allow to specify access mode for the keytab (FILE: or
WRFILE:) from external sources. Thus, change the defaults to a path
(implies FILE: prefix) while Samba Team fixes the code to allow the
access mode prefix for keytabs.

On upgrade we need to replace 'dedicated keytab file' value with the
path to the Samba keytab that FreeIPA maintains. Since the configuration
is stored in the Samba registry, we use net utility to manipulate the
configuration:

net conf setparm global 'dedicated keytab file' /etc/samba/samba.keytab

Fixes https://fedorahosted.org/freeipa/ticket/6551

@@ -1653,6 +1674,7 @@ def upgrade_configuration():

cleanup_kdc(fstore)
cleanup_adtrust(fstore)
upgrade_atrust_config()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo here, should be upgrade_adtrust_config

@martbab
Copy link
Contributor

martbab commented Dec 12, 2016

Pylint complaints about undefined function because you made a typo.

@abbra
Copy link
Contributor Author

abbra commented Dec 12, 2016

Thanks, fixed it.

@martbab
Copy link
Contributor

martbab commented Dec 12, 2016

The branch needs a rebase. Otherwise works as expected and has no PEP8 errors despite what crazy Travis CI claims.

Samba 4.5 does not allow to specify access mode for the keytab (FILE: or
WRFILE:) from external sources. Thus, change the defaults to a path
(implies FILE: prefix) while Samba Team fixes the code to allow the
access mode prefix for keytabs.

On upgrade we need to replace 'dedicated keytab file' value with the
path to the Samba keytab that FreeIPA maintains. Since the configuration
is stored in the Samba registry, we use net utility to manipulate the
configuration:

    net conf setparm global 'dedicated keytab file' /etc/samba/samba.keytab

Fixes https://fedorahosted.org/freeipa/ticket/6551
@abbra
Copy link
Contributor Author

abbra commented Dec 12, 2016

Rebased to git master.

@martbab martbab added the ack Pull Request approved, can be merged label Dec 12, 2016
@martbab
Copy link
Contributor

martbab commented Dec 12, 2016

@martbab martbab added the pushed Pull Request has already been pushed label Dec 12, 2016
@martbab martbab closed this Dec 12, 2016
@martbab
Copy link
Contributor

martbab commented Dec 12, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ack Pull Request approved, can be merged pushed Pull Request has already been pushed
Projects
None yet
2 participants