From 91245a57097e6b60663864cb944c0d3cf489c979 Mon Sep 17 00:00:00 2001
From: Jan Zeleny <jzeleny@redhat.com>
Date: Wed, 29 Sep 2010 12:50:20 +0200
Subject: [PATCH] Option krb5_server is now used to store a list of KDCs instead of krb5_kdcip.

For the time being, if krb5_server is not found, still falls back to
krb5_kdcip with a warning. If both options are present in config file,
krb5_server has a higher priority.

Fixes: #543
---
 src/config/SSSDConfig.py                 |    4 +-
 src/config/SSSDConfigTest.py             |    6 ++--
 src/config/etc/sssd.api.d/sssd-ipa.conf  |    2 +-
 src/config/etc/sssd.api.d/sssd-krb5.conf |    2 +-
 src/config/etc/sssd.api.d/sssd-ldap.conf |    2 +-
 src/config/upgrade_config.py             |    4 +-
 src/man/sssd-krb5.5.xml                  |   10 ++++++-
 src/man/sssd.conf.5.xml                  |    2 +-
 src/providers/ipa/ipa_common.c           |   10 ++++++-
 src/providers/krb5/krb5_common.c         |   41 +++++++++++++++++++++++++++++-
 src/providers/krb5/krb5_common.h         |    3 ++
 src/providers/krb5/krb5_init.c           |    2 +-
 12 files changed, 72 insertions(+), 16 deletions(-)

diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 22013ee..fc75ca7 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -92,7 +92,7 @@ option_strings = {
     'ipa_dyndns_iface' : _("The interface whose IP should be used for dynamic DNS updates"),
 
     # [provider/krb5]
-    'krb5_kdcip' : _('Kerberos server address'),
+    'krb5_server' : _('Kerberos server address'),
     'krb5_realm' : _('Kerberos realm'),
     'krb5_auth_timeout' : _('Authentication timeout'),
 
@@ -121,7 +121,7 @@ option_strings = {
     'ldap_tls_reqcert' : _('Require TLS certificate verification'),
     'ldap_sasl_mech' : _('Specify the sasl mechanism to use'),
     'ldap_sasl_authid' : _('Specify the sasl authorization id to use'),
-    'krb5_kdcip' : _('Kerberos server address'),
+    'krb5_server' : _('Kerberos server address'),
     'krb5_realm' : _('Kerberos realm'),
     'ldap_krb5_keytab' : _('Kerberos service keytab'),
     'ldap_krb5_init_creds' : _('Use Kerberos auth for LDAP connection'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index f0cfac8..3dd4e83 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -541,7 +541,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
 
         backup_list = control_list[:]
         control_list.extend(
-            ['krb5_kdcip',
+            ['krb5_server',
              'krb5_realm',
              'krb5_kpasswd',
              'krb5_ccachedir',
@@ -712,7 +712,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
         # Test looking up a specific provider type
         options = domain.list_provider_options('krb5', 'auth')
         control_list = [
-            'krb5_kdcip',
+            'krb5_server',
             'krb5_realm',
             'krb5_kpasswd',
             'krb5_ccachedir',
@@ -859,7 +859,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
 
         backup_list = control_list[:]
         control_list.extend(
-            ['krb5_kdcip',
+            ['krb5_server',
              'krb5_realm',
              'krb5_kpasswd',
              'krb5_ccachedir',
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index ac68171..352fd6f 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -18,7 +18,7 @@ ldap_tls_cacertdir = str, None, false
 ldap_tls_reqcert = str, None, false
 ldap_sasl_mech = str, None, false
 ldap_sasl_authid = str, None, false
-krb5_kdcip = str, None, false
+krb5_server = str, None, false
 krb5_realm = str, None, false
 krb5_auth_timeout = int, None, false
 krb5_kpasswd = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-krb5.conf b/src/config/etc/sssd.api.d/sssd-krb5.conf
index 76ef8b5..9c65436 100644
--- a/src/config/etc/sssd.api.d/sssd-krb5.conf
+++ b/src/config/etc/sssd.api.d/sssd-krb5.conf
@@ -1,5 +1,5 @@
 [provider/krb5]
-krb5_kdcip = str, None, false
+krb5_server = str, None, false
 krb5_realm = str, None, true
 krb5_auth_timeout = int, None, false
 krb5_kpasswd = str, None, false
diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf
index 7f0c360..3481b41 100644
--- a/src/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/src/config/etc/sssd.api.d/sssd-ldap.conf
@@ -13,7 +13,7 @@ ldap_tls_cacertdir = str, None, false
 ldap_tls_reqcert = str, None, false
 ldap_sasl_mech = str, None, false
 ldap_sasl_authid = str, None, false
-krb5_kdcip = str, None, false
+krb5_server = str, None, false
 krb5_realm = str, None, false
 ldap_krb5_keytab = str, None, false
 ldap_krb5_init_creds = bool, None, false
diff --git a/src/config/upgrade_config.py b/src/config/upgrade_config.py
index ff22b48..b5d5be6 100644
--- a/src/config/upgrade_config.py
+++ b/src/config/upgrade_config.py
@@ -77,7 +77,7 @@ class SSSDConfigFile(SSSDChangeConf):
 
         auth_provider = self.findOpts(domain['value'], 'option', 'auth_provider')[1]
         if auth_provider and auth_provider['value'] == 'krb5':
-            server = self.findOpts(domain['value'], 'option', 'krb5_kdcip')[1]
+            server = self.findOpts(domain['value'], 'option', 'krb5_server')[1]
             if not server or "__srv__" in server['value']:
                 domain['value'].insert(0, dns_domain_name)
 
@@ -194,7 +194,7 @@ class SSSDConfigFile(SSSDChangeConf):
                     'ldap_opt_timeout' : 'opt_timeout',
                     'ldap_tls_reqcert' : 'tls_reqcert',
                    }
-        krb5_kw = { 'krb5_kdcip' : 'krb5KDCIP',
+        krb5_kw = { 'krb5_server' : 'krb5KDCIP',
                     'krb5_realm'  : 'krb5REALM',
                     'krb5_try_simple_upn' : 'krb5try_simple_upn',
                     'krb5_changepw_principal' : 'krb5changepw_principle',
diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
index 489a507..24f6b20 100644
--- a/src/man/sssd-krb5.5.xml
+++ b/src/man/sssd-krb5.5.xml
@@ -62,7 +62,7 @@
             for details on the configuration of a SSSD domain.
             <variablelist>
                 <varlistentry>
-                    <term>krb5_kdcip (string)</term>
+                    <term>krb5_server (string)</term>
                     <listitem>
                         <para>
                             Specifies the list of IP addresses or hostnames
@@ -76,6 +76,12 @@
                             for more information, refer to the
                             <quote>SERVICE DISCOVERY</quote> section.
                         </para>
+                        <para>
+                            This option was named <quote>krb5_kdcip</quote> in
+                            earlier releases of SSSD. While the legacy name is recognized
+                            for the time being, users are advised to migrate their config
+                            files to use <quote>krb5_server</quote> instead.
+                        </para>
                     </listitem>
                 </varlistentry>
 
@@ -269,7 +275,7 @@
 <programlisting>
     [domain/FOO]
     auth_provider = krb5
-    krb5_kdcip = 192.168.1.1
+    krb5_server = 192.168.1.1
     krb5_realm = EXAMPLE.COM
 </programlisting>
         </para>
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 850dfdd..3aa5d29 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -909,7 +909,7 @@ ldap_uri = ldap://ldap.example.com
 ldap_search_base = dc=example,dc=com
 
 auth_provider = krb5
-krb5_kdcip = kerberos.example.com
+krb5_server = kerberos.example.com
 krb5_realm = EXAMPLE.COM
 cache_credentials = true
 
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 99b1508..ac6588e 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -117,7 +117,7 @@ struct sdap_attr_map ipa_group_map[] = {
 };
 
 struct dp_option ipa_def_krb5_opts[] = {
-    { "krb5_kdcip", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_ccachedir", DP_OPT_STRING, { "/tmp" }, NULL_STRING },
     { "krb5_ccname_template", DP_OPT_STRING, { "FILE:%d/krb5cc_%U_XXXXXX" }, NULL_STRING},
@@ -402,6 +402,14 @@ int ipa_get_auth_options(struct ipa_options *ipa_opts,
         goto done;
     }
 
+    /* If there is no KDC, try the deprecated krb5_kdcip option, too */
+    /* FIXME - this can be removed in a future version */
+    ret = krb5_try_kdcip(ipa_opts, cdb, conf_path, ipa_opts->auth);
+    if (ret != EOK) {
+        DEBUG(1, ("sss_krb5_try_kdcip failed.\n"));
+        goto done;
+    }
+
     /* set krb realm */
     if (NULL == dp_opt_get_string(ipa_opts->auth, KRB5_REALM)) {
         value = dp_opt_get_string(ipa_opts->basic, IPA_DOMAIN);
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index e5471e3..3b9e0c1 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -32,7 +32,7 @@
 #include "providers/krb5/krb5_common.h"
 
 struct dp_option default_krb5_opts[] = {
-    { "krb5_kdcip", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_ccachedir", DP_OPT_STRING, { "/tmp" }, NULL_STRING },
     { "krb5_ccname_template", DP_OPT_STRING, { "FILE:%d/krb5cc_%U_XXXXXX" }, NULL_STRING},
@@ -91,6 +91,37 @@ errno_t check_and_export_options(struct dp_option *opts,
     return EOK;
 }
 
+errno_t krb5_try_kdcip(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
+                              const char *conf_path, struct dp_option *opts)
+{
+    char *krb5_servers = NULL;
+    errno_t ret;
+
+    krb5_servers = dp_opt_get_string(opts, KRB5_KDC);
+    if (!krb5_servers) {
+        DEBUG(4, ("No KDC found in configuration, trying legacy option\n"));
+        ret = confdb_get_string(cdb, memctx, conf_path,
+                                "krb5_kdcip", NULL, &krb5_servers);
+        if (ret != EOK) {
+            DEBUG(1, ("confdb_get_string failed.\n"));
+            return ret;
+        }
+
+        ret = dp_opt_set_string(opts, KRB5_KDC, krb5_servers);
+        if (ret != EOK) {
+            DEBUG(1, ("dp_opt_set_string failed.\n"));
+            talloc_free(krb5_servers);
+            return ret;
+        }
+        DEBUG(9, ("Set krb5 server [%s] based on legacy krb5_kdcip option\n"));
+        DEBUG(0, ("Your configuration uses the deprecated option 'krb5_kdcip' "
+                  "to specify the KDC. Please change the configuration to use "
+                  "the 'krb5_server' option instead."));
+    }
+
+    return EOK;
+}
+
 errno_t krb5_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
                          const char *conf_path, struct dp_option **_opts)
 {
@@ -110,6 +141,14 @@ errno_t krb5_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
         goto done;
     }
 
+    /* If there is no KDC, try the deprecated krb5_kdcip option, too */
+    /* FIXME - this can be removed in a future version */
+    ret = krb5_try_kdcip(memctx, cdb, conf_path, opts);
+    if (ret != EOK) {
+        DEBUG(1, ("sss_krb5_try_kdcip failed.\n"));
+        goto done;
+    }
+
     *_opts = opts;
     ret = EOK;
 
diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h
index f3bbbb8..c953901 100644
--- a/src/providers/krb5/krb5_common.h
+++ b/src/providers/krb5/krb5_common.h
@@ -112,6 +112,9 @@ struct remove_info_files_ctx {
 errno_t check_and_export_options(struct dp_option *opts,
                                  struct sss_domain_info *dom);
 
+errno_t krb5_try_kdcip(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
+                       const char *conf_path, struct dp_option *opts);
+
 errno_t krb5_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
                          const char *conf_path, struct dp_option **_opts);
 
diff --git a/src/providers/krb5/krb5_init.c b/src/providers/krb5/krb5_init.c
index c457dc5..7facdce 100644
--- a/src/providers/krb5/krb5_init.c
+++ b/src/providers/krb5/krb5_init.c
@@ -88,7 +88,7 @@ int sssm_krb5_auth_init(struct be_ctx *bectx,
 
     krb5_servers = dp_opt_get_string(ctx->opts, KRB5_KDC);
     if (krb5_servers == NULL) {
-        DEBUG(1, ("Missing krb5_kdcip option, using service discovery!\n"));
+        DEBUG(1, ("Missing krb5_server option, using service discovery!\n"));
     }
 
     krb5_realm = dp_opt_get_string(ctx->opts, KRB5_REALM);
-- 
1.7.2.3

