From d7f3c1ff4cbfc7840ca7c3015ca13eaeceee18ca Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 3 Jun 2021 10:30:02 +0300 Subject: [PATCH] service: enforce keytab user when retrieving the keytab HTTP service uses different user for keytab ownership than the service user. On Fedora this leads to http.keytab being owned by 'apache' user after IPA deployment while it should be owned by 'root' to allow GSSPROXY configuration to work correctly. The situation is fixed during upgrade (ipa-server-upgrade) but it means for new deployments there might be a period of unexplained Web UI authentication failures. Fixes: https://pagure.io/freeipa/issue/8872 Signed-off-by: Alexander Bokovoy Signed-off-by: Christian Heimes Reviewed-By: Christian Heimes --- ipaserver/install/service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipaserver/install/service.py b/ipaserver/install/service.py index 3603ad393..13ae346bc 100644 --- a/ipaserver/install/service.py +++ b/ipaserver/install/service.py @@ -768,7 +768,7 @@ class Service: if keytab is None: keytab = self.keytab if owner is None: - owner = self.service_user + owner = self.keytab_user owner.chown(keytab) def run_getkeytab(self, ldap_uri, keytab, principal, retrieve=False):