From e2d69380fbae6dab244fce3fd5afe5fdc28a2663 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Thu, 9 Jan 2020 14:20:53 +0100 Subject: [PATCH] AD user without override receive InternalServerError with API When ipa commands are used by an Active Directory user that does not have any idoverride-user set, they return the following error message which can be misleading: $ kinit aduser@ADDOMAIN.COM $ ipa ping ipa: ERROR: cannot connect to 'https://master.ipa.com/ipa/json': Internal Server Error The fix properly handles ACIError exception received when creating the context, and now the following message can be seen: $ kinit aduser@ADDOMAIN.COM $ ipa ping ipa: ERROR: cannot connect to 'https://master.ipa.com/ipa/json': Unauthorized with the following log in /var/log/httpd/error_log: ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials Fixes: https://pagure.io/freeipa/issue/8163 Reviewed-By: Alexander Bokovoy --- ipaserver/rpcserver.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py index 0495557cd..194cbbcb1 100644 --- a/ipaserver/rpcserver.py +++ b/ipaserver/rpcserver.py @@ -694,7 +694,7 @@ class KerberosWSGIExecutioner(WSGIExecutioner, KerberosSession): status = HTTP_STATUS_SUCCESS response = status.encode('utf-8') start_response(status, self.headers) - return self.marshal(None, e) + return [self.marshal(None, e)] finally: destroy_context() return response