From 352f2beeb77b3a08fabc94ccb08d0b561b457408 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= Date: Tue, 15 Dec 2020 09:50:57 +0100 Subject: [PATCH] ipa-client-install: unilaterally set dns_lookup_kdc to True MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, dns_lookup_kdc was only set to True if DNS discovery worked or if the KDC was not specified on the command-line. Setting dns_lookup_kdc to False would result in a hardcoded configuration which is less reliable in the long run. For instance, adding a trust to an Active Directory forest after clients are enrolled would result in clients not being able to authenticate AD users. Recycling FreeIPA servers could prove problematic if the original hostnames are not reused too. Change summary: Always set dns_lookup_kdc to True on client enrollment. With this change, DNS SRV search will always be performed before looking into /etc/krb5.conf realm entries. Fixes: https://pagure.io/freeipa/issue/6523 Signed-off-by: François Cami Reviewed-By: Alexander Bokovoy --- ipaclient/install/client.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py index abb6bd304..37d623f70 100644 --- a/ipaclient/install/client.py +++ b/ipaclient/install/client.py @@ -693,16 +693,15 @@ def configure_krb5_conf( if not dnsok or not cli_kdc or force: libopts.extend([ krbconf.setOption('dns_lookup_realm', 'false'), - krbconf.setOption('dns_lookup_kdc', 'false') ]) else: libopts.extend([ krbconf.setOption('dns_lookup_realm', 'true'), - krbconf.setOption('dns_lookup_kdc', 'true') ]) libopts.extend([ krbconf.setOption('rdns', 'false'), krbconf.setOption('dns_canonicalize_hostname', 'false'), + krbconf.setOption('dns_lookup_kdc', 'true'), krbconf.setOption('ticket_lifetime', '24h'), krbconf.setOption('forwardable', 'true'), krbconf.setOption('udp_preference_limit', '0')