internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-07-31 20:04:45 +00:00
Code Issues Projects Releases Wiki Activity

ansible_freeipa_module: Set KRB5CCNAME for api_connect (non root)

Browse Source 
In the case that the admin password has been set and become was not set
the call to backend.connect in api_connect failed. The solution is simply
to set os.environ["KRB5CCNAME"] in temp_kinit after kinit_password has
been called using the temporary ccache. os.environ["KRB5CCNAME"] is not
used automatically by api.Backend.[ldap2,rpcclient].connect. Afterwards
os.environ["KRB5CCNAME"] is unset in temp_kdestroy if ccache_name is not
None.

Fixes: #249 (Kerberos errors while using the modules with a non-sudoer user)
This commit is contained in:
Thomas Woerner
2020-04-16 15:34:48 +02:00
parent e70944c325
commit 871cce5258
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
plugins/module_utils/ansible_freeipa_module.py
View File

@@ -108,6 +108,7 @@ def temp_kinit(principal, password):
except RuntimeError as e: except RuntimeError as e:
raise RuntimeError("Kerberos authentication failed: {}".format(e)) raise RuntimeError("Kerberos authentication failed: {}".format(e))
os.environ["KRB5CCNAME"] = ccache_name
return ccache_dir, ccache_name return ccache_dir, ccache_name
@@ -117,6 +118,7 @@ def temp_kdestroy(ccache_dir, ccache_name):
""" """
if ccache_name is not None: if ccache_name is not None:
run([paths.KDESTROY, '-c', ccache_name], raiseonerr=False) run([paths.KDESTROY, '-c', ccache_name], raiseonerr=False)
del os.environ['KRB5CCNAME']
if ccache_dir is not None: if ccache_dir is not None:
shutil.rmtree(ccache_dir, ignore_errors=True) shutil.rmtree(ccache_dir, ignore_errors=True)
@@ -142,7 +144,7 @@ def api_connect(context=None):
backend = api.Backend.rpcclient backend = api.Backend.rpcclient
if not backend.isconnected(): if not backend.isconnected():
backend.connect() backend.connect(ccache=os.environ.get('KRB5CCNAME', None))
def api_command(module, command, name, args): def api_command(module, command, name, args):