7f6164b
From eea6a8071b5e5df74808903bb15b30acf820ce3f Mon Sep 17 00:00:00 2001
7f6164b
From: Sumit Bose <sbose@redhat.com>
7f6164b
Date: Fri, 23 Oct 2020 16:55:11 +0200
7f6164b
Subject: [PATCH 06/10] enroll: use 'computer' or 'service' in debug messages
7f6164b
7f6164b
Use proper account type in debug messages.
7f6164b
7f6164b
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
7f6164b
---
7f6164b
 library/adenroll.c | 115 ++++++++++++++++++++++++++++-----------------
7f6164b
 1 file changed, 72 insertions(+), 43 deletions(-)
7f6164b
7f6164b
diff --git a/library/adenroll.c b/library/adenroll.c
7f6164b
index dbfda36..9cdc79b 100644
7f6164b
--- a/library/adenroll.c
7f6164b
+++ b/library/adenroll.c
7f6164b
@@ -155,6 +155,12 @@ struct _adcli_enroll {
7f6164b
 	char *description;
7f6164b
 };
7f6164b
 
7f6164b
+static const char *
7f6164b
+s_or_c (adcli_enroll *enroll)
7f6164b
+{
7f6164b
+	return enroll->is_service ? "service" : "computer";
7f6164b
+}
7f6164b
+
7f6164b
 static void
7f6164b
 check_if_service (adcli_enroll *enroll,
7f6164b
                   LDAP *ldap,
7f6164b
@@ -203,13 +209,15 @@ ensure_computer_name (adcli_result res,
7f6164b
 		return res;
7f6164b
 
7f6164b
 	if (enroll->computer_name) {
7f6164b
-		_adcli_info ("Enrolling computer name: %s",
7f6164b
+		_adcli_info ("Enrolling %s name: %s",
7f6164b
+		             s_or_c (enroll),
7f6164b
 		             enroll->computer_name);
7f6164b
 		return ADCLI_SUCCESS;
7f6164b
 	}
7f6164b
 
7f6164b
 	if (!enroll->host_fqdn) {
7f6164b
-		_adcli_err ("No host name from which to determine the computer name");
7f6164b
+		_adcli_err ("No host name from which to determine the %s name",
7f6164b
+		            s_or_c (enroll));
7f6164b
 		return ADCLI_ERR_CONFIG;
7f6164b
 	}
7f6164b
 
7f6164b
@@ -603,7 +611,8 @@ lookup_computer_container (adcli_enroll *enroll,
7f6164b
 
7f6164b
 	} else if (ret != LDAP_SUCCESS) {
7f6164b
 		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,
7f6164b
-		                                   "Couldn't lookup computer container: %s", base);
7f6164b
+		                                   "Couldn't lookup %s container: %s",
7f6164b
+		                                   s_or_c (enroll), base);
7f6164b
 	}
7f6164b
 
7f6164b
 	values = _adcli_ldap_parse_values (ldap, results, attrs[0]);
7f6164b
@@ -614,8 +623,8 @@ lookup_computer_container (adcli_enroll *enroll,
7f6164b
 		if (strncmp (values[i], prefix, prefix_len) == 0) {
7f6164b
 			enroll->computer_container = strdup (values[i] + prefix_len);
7f6164b
 			return_unexpected_if_fail (enroll->computer_container != NULL);
7f6164b
-			_adcli_info ("Found well known computer container at: %s",
7f6164b
-			             enroll->computer_container);
7f6164b
+			_adcli_info ("Found well known %s container at: %s",
7f6164b
+			             s_or_c (enroll), enroll->computer_container);
7f6164b
 			break;
7f6164b
 		}
7f6164b
 	}
7f6164b
@@ -629,8 +638,9 @@ lookup_computer_container (adcli_enroll *enroll,
7f6164b
 		if (ret == LDAP_SUCCESS) {
7f6164b
 			enroll->computer_container = _adcli_ldap_parse_dn (ldap, results);
7f6164b
 			if (enroll->computer_container) {
7f6164b
-				_adcli_info ("Well known computer container not "
7f6164b
+				_adcli_info ("Well known %s container not "
7f6164b
 				             "found, but found suitable one at: %s",
7f6164b
+				             s_or_c (enroll),
7f6164b
 				             enroll->computer_container);
7f6164b
 			}
7f6164b
 		}
7f6164b
@@ -646,7 +656,8 @@ lookup_computer_container (adcli_enroll *enroll,
7f6164b
 	}
7f6164b
 
7f6164b
 	if (!enroll->computer_container) {
7f6164b
-		_adcli_err ("Couldn't find location to create computer accounts");
7f6164b
+		_adcli_err ("Couldn't find location to create %s accounts",
7f6164b
+		            s_or_c (enroll));
7f6164b
 		return ADCLI_ERR_DIRECTORY;
7f6164b
 	}
7f6164b
 
7f6164b
@@ -674,7 +685,8 @@ calculate_computer_account (adcli_enroll *enroll,
7f6164b
 	if (asprintf (&enroll->computer_dn, "CN=%s,%s", enroll->computer_name, enroll->computer_container) < 0)
7f6164b
 		return_unexpected_if_reached ();
7f6164b
 
7f6164b
-	_adcli_info ("Calculated computer account: %s", enroll->computer_dn);
7f6164b
+	_adcli_info ("Calculated %s account: %s",
7f6164b
+	             s_or_c (enroll), enroll->computer_dn);
7f6164b
 	return ADCLI_SUCCESS;
7f6164b
 }
7f6164b
 
7f6164b
@@ -861,7 +873,8 @@ create_computer_account (adcli_enroll *enroll,
7f6164b
 		                                   enroll->computer_dn);
7f6164b
 	}
7f6164b
 
7f6164b
-	_adcli_info ("Created computer account: %s", enroll->computer_dn);
7f6164b
+	_adcli_info ("Created %s account: %s", s_or_c (enroll),
7f6164b
+	                                       enroll->computer_dn);
7f6164b
 	return ADCLI_SUCCESS;
7f6164b
 }
7f6164b
 
7f6164b
@@ -908,17 +921,17 @@ validate_computer_account (adcli_enroll *enroll,
7f6164b
 	assert (enroll->computer_dn != NULL);
7f6164b
 
7f6164b
 	if (already_exists && !allow_overwrite) {
7f6164b
-		_adcli_err ("The computer account %s already exists",
7f6164b
-		            enroll->computer_name);
7f6164b
+		_adcli_err ("The %s account %s already exists",
7f6164b
+		            s_or_c (enroll), enroll->computer_name);
7f6164b
 		return ADCLI_ERR_CONFIG;
7f6164b
 	}
7f6164b
 
7f6164b
 	/* Do we have an explicitly requested ou? */
7f6164b
 	if (enroll->domain_ou && enroll->domain_ou_explicit && already_exists) {
7f6164b
 		if (!_adcli_ldap_dn_has_ancestor (enroll->computer_dn, enroll->domain_ou)) {
7f6164b
-			_adcli_err ("The computer account %s already exists, "
7f6164b
+			_adcli_err ("The %s account %s already exists, "
7f6164b
 			            "but is not in the desired organizational unit.",
7f6164b
-			            enroll->computer_name);
7f6164b
+			            s_or_c (enroll), enroll->computer_name);
7f6164b
 			return ADCLI_ERR_CONFIG;
7f6164b
 		}
7f6164b
 	}
7f6164b
@@ -943,7 +956,8 @@ delete_computer_account (adcli_enroll *enroll,
7f6164b
 		                                   "Couldn't delete computer account: %s",
7f6164b
 		                                   enroll->computer_dn);
7f6164b
 	} else {
7f6164b
-		_adcli_info ("Deleted computer account at: %s", enroll->computer_dn);
7f6164b
+		_adcli_info ("Deleted %s account at: %s", s_or_c (enroll),
7f6164b
+		                                          enroll->computer_dn);
7f6164b
 	}
7f6164b
 
7f6164b
 	return ADCLI_SUCCESS;
7f6164b
@@ -992,20 +1006,21 @@ locate_computer_account (adcli_enroll *enroll,
7f6164b
 			free (enroll->computer_dn);
7f6164b
 			enroll->computer_dn = strdup (dn);
7f6164b
 			return_unexpected_if_fail (enroll->computer_dn != NULL);
7f6164b
-			_adcli_info ("Found computer account for %s at: %s",
7f6164b
-			             enroll->computer_sam, dn);
7f6164b
+			_adcli_info ("Found %s account for %s at: %s",
7f6164b
+			             s_or_c (enroll), enroll->computer_sam, dn);
7f6164b
 			ldap_memfree (dn);
7f6164b
 
7f6164b
 		} else {
7f6164b
 			ldap_msgfree (results);
7f6164b
 			results = NULL;
7f6164b
-			_adcli_info ("Computer account for %s does not exist",
7f6164b
-			             enroll->computer_sam);
7f6164b
+			_adcli_info ("A %s account for %s does not exist",
7f6164b
+			             s_or_c (enroll), enroll->computer_sam);
7f6164b
 		}
7f6164b
 
7f6164b
 	} else {
7f6164b
 		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,
7f6164b
-		                                   "Couldn't lookup computer account: %s",
7f6164b
+		                                   "Couldn't lookup %s account: %s",
7f6164b
+		                                   s_or_c (enroll),
7f6164b
 		                                   enroll->computer_sam);
7f6164b
 	}
7f6164b
 
7f6164b
@@ -1039,7 +1054,9 @@ load_computer_account (adcli_enroll *enroll,
7f6164b
 	if (ret == LDAP_SUCCESS) {
7f6164b
 		entry = ldap_first_entry (ldap, results);
7f6164b
 		if (entry) {
7f6164b
-			_adcli_info ("Found computer account for %s at: %s",
7f6164b
+			check_if_service (enroll, ldap, results);
7f6164b
+			_adcli_info ("Found %s account for %s at: %s",
7f6164b
+			             s_or_c (enroll),
7f6164b
 			             enroll->computer_sam, enroll->computer_dn);
7f6164b
 		}
7f6164b
 
7f6164b
@@ -1146,7 +1163,8 @@ set_password_with_user_creds (adcli_enroll *enroll)
7f6164b
 	                                       &result_code_string, &result_string);
7f6164b
 
7f6164b
 	if (code != 0) {
7f6164b
-		_adcli_err ("Couldn't set password for computer account: %s: %s",
7f6164b
+		_adcli_err ("Couldn't set password for %s account: %s: %s",
7f6164b
+		            s_or_c (enroll),
7f6164b
 		            enroll->computer_sam, krb5_get_error_message (k5, code));
7f6164b
 		/* TODO: Parse out these values */
7f6164b
 		res = ADCLI_ERR_DIRECTORY;
7f6164b
@@ -1160,7 +1178,8 @@ set_password_with_user_creds (adcli_enroll *enroll)
7f6164b
 		if (result_string.length)
7f6164b
 			message = _adcli_str_dupn (result_string.data, result_string.length);
7f6164b
 #endif
7f6164b
-		_adcli_err ("Cannot set computer password: %.*s%s%s",
7f6164b
+		_adcli_err ("Cannot set %s password: %.*s%s%s",
7f6164b
+		            s_or_c (enroll),
7f6164b
 		            (int)result_code_string.length, result_code_string.data,
7f6164b
 		            message ? ": " : "", message ? message : "");
7f6164b
 		res = ADCLI_ERR_CREDENTIALS;
7f6164b
@@ -1170,7 +1189,7 @@ set_password_with_user_creds (adcli_enroll *enroll)
7f6164b
 		free (message);
7f6164b
 #endif
7f6164b
 	} else {
7f6164b
-		_adcli_info ("Set computer password");
7f6164b
+		_adcli_info ("Set %s password", s_or_c (enroll));
7f6164b
 		if (enroll->kvno > 0) {
7f6164b
 			enroll->kvno++;
7f6164b
 			_adcli_info ("kvno incremented to %d", enroll->kvno);
7f6164b
@@ -1203,7 +1222,8 @@ set_password_with_computer_creds (adcli_enroll *enroll)
7f6164b
 
7f6164b
 	code = _adcli_kinit_computer_creds (enroll->conn, "kadmin/changepw", NULL, &creds);
7f6164b
 	if (code != 0) {
7f6164b
-		_adcli_err ("Couldn't get change password ticket for computer account: %s: %s",
7f6164b
+		_adcli_err ("Couldn't get change password ticket for %s account: %s: %s",
7f6164b
+		            s_or_c (enroll),
7f6164b
 		            enroll->computer_sam, krb5_get_error_message (k5, code));
7f6164b
 		return ADCLI_ERR_DIRECTORY;
7f6164b
 	}
7f6164b
@@ -1214,7 +1234,8 @@ set_password_with_computer_creds (adcli_enroll *enroll)
7f6164b
 	krb5_free_cred_contents (k5, &creds);
7f6164b
 
7f6164b
 	if (code != 0) {
7f6164b
-		_adcli_err ("Couldn't change password for computer account: %s: %s",
7f6164b
+		_adcli_err ("Couldn't change password for %s account: %s: %s",
7f6164b
+		            s_or_c (enroll),
7f6164b
 		            enroll->computer_sam, krb5_get_error_message (k5, code));
7f6164b
 		/* TODO: Parse out these values */
7f6164b
 		res = ADCLI_ERR_DIRECTORY;
7f6164b
@@ -1284,7 +1305,8 @@ retrieve_computer_account (adcli_enroll *enroll)
7f6164b
 
7f6164b
 	if (ret != LDAP_SUCCESS) {
7f6164b
 		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,
7f6164b
-		                                   "Couldn't retrieve computer account info: %s",
7f6164b
+		                                   "Couldn't retrieve %s account info: %s",
7f6164b
+		                                   s_or_c (enroll),
7f6164b
 		                                   enroll->computer_dn);
7f6164b
 	}
7f6164b
 
7f6164b
@@ -1294,15 +1316,15 @@ retrieve_computer_account (adcli_enroll *enroll)
7f6164b
 		if (value != NULL) {
7f6164b
 			kvno = strtoul (value, &end, 10);
7f6164b
 			if (end == NULL || *end != '\0') {
7f6164b
-				_adcli_err ("Invalid kvno '%s' for computer account in directory: %s",
7f6164b
-				            value, enroll->computer_dn);
7f6164b
+				_adcli_err ("Invalid kvno '%s' for %s account in directory: %s",
7f6164b
+				            value, s_or_c (enroll), enroll->computer_dn);
7f6164b
 				res = ADCLI_ERR_DIRECTORY;
7f6164b
 
7f6164b
 			} else {
7f6164b
 				enroll->kvno = kvno;
7f6164b
 
7f6164b
-				_adcli_info ("Retrieved kvno '%s' for computer account in directory: %s",
7f6164b
-				             value, enroll->computer_dn);
7f6164b
+				_adcli_info ("Retrieved kvno '%s' for %s account in directory: %s",
7f6164b
+				             value, s_or_c (enroll), enroll->computer_dn);
7f6164b
 			}
7f6164b
 
7f6164b
 			free (value);
7f6164b
@@ -1311,8 +1333,8 @@ retrieve_computer_account (adcli_enroll *enroll)
7f6164b
 			/* Apparently old AD didn't have this attribute, use zero */
7f6164b
 			enroll->kvno = 0;
7f6164b
 
7f6164b
-			_adcli_info ("No kvno found for computer account in directory: %s",
7f6164b
-			             enroll->computer_dn);
7f6164b
+			_adcli_info ("No kvno found for %s account in directory: %s",
7f6164b
+			             s_or_c (enroll), enroll->computer_dn);
7f6164b
 		}
7f6164b
 	}
7f6164b
 
7f6164b
@@ -1353,12 +1375,14 @@ update_and_calculate_enctypes (adcli_enroll *enroll)
7f6164b
 
7f6164b
 	if (ret == LDAP_INSUFFICIENT_ACCESS) {
7f6164b
 		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_CREDENTIALS,
7f6164b
-		                                   "Insufficient permissions to set encryption types on computer account: %s",
7f6164b
+		                                   "Insufficient permissions to set encryption types on %s account: %s",
7f6164b
+		                                   s_or_c (enroll),
7f6164b
 		                                   enroll->computer_dn);
7f6164b
 
7f6164b
 	} else if (ret != LDAP_SUCCESS) {
7f6164b
 		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,
7f6164b
-		                                   "Couldn't set encryption types on computer account: %s",
7f6164b
+		                                   "Couldn't set encryption types on %s account: %s",
7f6164b
+		                                   s_or_c (enroll),
7f6164b
 		                                   enroll->computer_dn);
7f6164b
 	}
7f6164b
 
7f6164b
@@ -1381,13 +1405,14 @@ update_computer_attribute (adcli_enroll *enroll,
7f6164b
 	string = _adcli_ldap_mods_to_string (mods);
7f6164b
 	return_unexpected_if_fail (string != NULL);
7f6164b
 
7f6164b
-	_adcli_info ("Modifying computer account: %s", string);
7f6164b
+	_adcli_info ("Modifying %s account: %s", s_or_c (enroll), string);
7f6164b
 
7f6164b
 	ret = ldap_modify_ext_s (ldap, enroll->computer_dn, mods, NULL, NULL);
7f6164b
 
7f6164b
 	if (ret != LDAP_SUCCESS) {
7f6164b
-		_adcli_warn ("Couldn't set %s on computer account: %s: %s",
7f6164b
-		             string, enroll->computer_dn, ldap_err2string (ret));
7f6164b
+		_adcli_warn ("Couldn't set %s on %s account: %s: %s",
7f6164b
+		             string, s_or_c (enroll), enroll->computer_dn,
7f6164b
+		             ldap_err2string (ret));
7f6164b
 		res = ADCLI_ERR_DIRECTORY;
7f6164b
 	}
7f6164b
 
7f6164b
@@ -1411,8 +1436,8 @@ static char *get_user_account_control (adcli_enroll *enroll)
7f6164b
 
7f6164b
 		attr_val = strtoul (uac_str, &end, 10);
7f6164b
 		if (*end != '\0' || attr_val > UINT32_MAX) {
7f6164b
-			_adcli_warn ("Invalid userAccountControl '%s' for computer account in directory: %s, assuming 0",
7f6164b
-			            uac_str, enroll->computer_dn);
7f6164b
+			_adcli_warn ("Invalid userAccountControl '%s' for %s account in directory: %s, assuming 0",
7f6164b
+			            uac_str, s_or_c (enroll), enroll->computer_dn);
7f6164b
 		} else {
7f6164b
 			uac = attr_val;
7f6164b
 		}
7f6164b
@@ -1653,7 +1678,8 @@ load_keytab_entry (krb5_context k5,
7f6164b
 		    _adcli_str_has_suffix (name, "$") && !strchr (name, '/')) {
7f6164b
 			enroll->computer_name = name;
7f6164b
 			name[len - 1] = '\0';
7f6164b
-			_adcli_info ("Found computer name in keytab: %s", name);
7f6164b
+			_adcli_info ("Found %s name in keytab: %s",
7f6164b
+			             s_or_c (enroll), name);
7f6164b
 			adcli_conn_set_computer_name (enroll->conn,
7f6164b
 			                              enroll->computer_name);
7f6164b
 			name = NULL;
7f6164b
@@ -2348,7 +2374,8 @@ adcli_enroll_read_computer_account (adcli_enroll *enroll,
7f6164b
 		if (res != ADCLI_SUCCESS)
7f6164b
 			return res;
7f6164b
 		if (!enroll->computer_dn) {
7f6164b
-			_adcli_err ("No computer account for %s exists", enroll->computer_sam);
7f6164b
+			_adcli_err ("No %s account for %s exists",
7f6164b
+			            s_or_c (enroll), enroll->computer_sam);
7f6164b
 			return ADCLI_ERR_CONFIG;
7f6164b
 		}
7f6164b
 	}
7f6164b
@@ -2460,7 +2487,8 @@ adcli_enroll_delete (adcli_enroll *enroll,
7f6164b
 		if (res != ADCLI_SUCCESS)
7f6164b
 			return res;
7f6164b
 		if (!enroll->computer_dn) {
7f6164b
-			_adcli_err ("No computer account for %s exists",
7f6164b
+			_adcli_err ("No %s account for %s exists",
7f6164b
+			            s_or_c (enroll),
7f6164b
 			            enroll->computer_sam);
7f6164b
 			return ADCLI_ERR_CONFIG;
7f6164b
 		}
7f6164b
@@ -2503,7 +2531,8 @@ adcli_enroll_password (adcli_enroll *enroll,
7f6164b
 		if (res != ADCLI_SUCCESS)
7f6164b
 			return res;
7f6164b
 		if (!enroll->computer_dn) {
7f6164b
-			_adcli_err ("No computer account for %s exists",
7f6164b
+			_adcli_err ("No %s account for %s exists",
7f6164b
+			            s_or_c (enroll),
7f6164b
 			            enroll->computer_sam);
7f6164b
 			return ADCLI_ERR_CONFIG;
7f6164b
 		}
7f6164b
-- 
7f6164b
2.28.0
7f6164b