Blame 0004-library-make-sure-server-side-SPNs-are-preserved.patch

8fc58f6
From 972f1a2f35829ed89f5353bd204683aa9ad6a2d2 Mon Sep 17 00:00:00 2001
8fc58f6
From: Sumit Bose <sbose@redhat.com>
8fc58f6
Date: Fri, 22 Mar 2019 10:37:57 +0100
8fc58f6
Subject: [PATCH 4/4] library: make sure server side SPNs are preserved
8fc58f6
8fc58f6
adcli should not delete service principal names (SPNs) unexpectedly. If
8fc58f6
a SPN was added on the server while presetting a host or updating an
8fc58f6
existing entry and upcoming adcli join or update should preserver this
8fc58f6
change.
8fc58f6
8fc58f6
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1630187
8fc58f6
---
8fc58f6
 library/adenroll.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
8fc58f6
 1 file changed, 46 insertions(+)
8fc58f6
8fc58f6
diff --git a/library/adenroll.c b/library/adenroll.c
8fc58f6
index 48cb4cf..1cce86a 100644
8fc58f6
--- a/library/adenroll.c
8fc58f6
+++ b/library/adenroll.c
8fc58f6
@@ -1961,6 +1961,47 @@ adcli_enroll_prepare (adcli_enroll *enroll,
8fc58f6
 	return res;
8fc58f6
 }
8fc58f6
 
8fc58f6
+static adcli_result
8fc58f6
+add_server_side_service_principals (adcli_enroll *enroll)
8fc58f6
+{
8fc58f6
+	char **spn_list;
8fc58f6
+	LDAP *ldap;
8fc58f6
+	size_t c;
8fc58f6
+	int length = 0;
8fc58f6
+	adcli_result res;
8fc58f6
+
8fc58f6
+	ldap = adcli_conn_get_ldap_connection (enroll->conn);
8fc58f6
+	assert (ldap != NULL);
8fc58f6
+
8fc58f6
+	spn_list = _adcli_ldap_parse_values (ldap, enroll->computer_attributes,
8fc58f6
+	                                     "servicePrincipalName");
8fc58f6
+	if (spn_list == NULL) {
8fc58f6
+		return ADCLI_SUCCESS;
8fc58f6
+	}
8fc58f6
+
8fc58f6
+	if (enroll->service_principals != NULL) {
8fc58f6
+		length = seq_count (enroll->service_principals);
8fc58f6
+	}
8fc58f6
+
8fc58f6
+	for (c = 0; spn_list[c] != NULL; c++) {
8fc58f6
+		_adcli_info ("Checking %s", spn_list[c]);
8fc58f6
+		if (!_adcli_strv_has_ex (enroll->service_principals_to_remove, spn_list[c], strcasecmp)) {
8fc58f6
+			enroll->service_principals = _adcli_strv_add_unique (enroll->service_principals,
8fc58f6
+		                                                             spn_list[c], &length, false);
8fc58f6
+			assert (enroll->service_principals != NULL);
8fc58f6
+			_adcli_info ("   Added %s", spn_list[c]);
8fc58f6
+		}
8fc58f6
+	}
8fc58f6
+	_adcli_strv_free (spn_list);
8fc58f6
+
8fc58f6
+	res = ensure_keytab_principals (ADCLI_SUCCESS, enroll);
8fc58f6
+	if (res != ADCLI_SUCCESS) {
8fc58f6
+		return res;
8fc58f6
+	}
8fc58f6
+
8fc58f6
+	return ADCLI_SUCCESS;
8fc58f6
+}
8fc58f6
+
8fc58f6
 static adcli_result
8fc58f6
 enroll_join_or_update_tasks (adcli_enroll *enroll,
8fc58f6
 		             adcli_enroll_flags flags)
8fc58f6
@@ -2019,6 +2060,11 @@ enroll_join_or_update_tasks (adcli_enroll *enroll,
8fc58f6
 	update_and_calculate_enctypes (enroll);
8fc58f6
 	update_computer_account (enroll);
8fc58f6
 
8fc58f6
+	res = add_server_side_service_principals (enroll);
8fc58f6
+	if (res != ADCLI_SUCCESS) {
8fc58f6
+		return res;
8fc58f6
+	}
8fc58f6
+
8fc58f6
 	/* service_names is only set from input on the command line, so no
8fc58f6
 	 * additional check for explicit is needed here */
8fc58f6
 	if (enroll->service_names != NULL) {
8fc58f6
-- 
8fc58f6
2.20.1
8fc58f6