From: Tim Beale Date: Tue, 30 Oct 2018 01:11:46 +0000 (+1300) Subject: dnsupdate: Skip kerberos step if use-file specified X-Git-Tag: tdb-1.3.17~991 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=018ff496e4be6ed536e56b2e6b1940c048f09762;p=thirdparty%2Fsamba.git dnsupdate: Skip kerberos step if use-file specified If there's a problem in get_credentials() (getting the machine account Kerberos credentials), then we fallback to use_samba_tool (essentially ignoring use-file). However, there's no need to do this, as use-file shouldn't require Kerberos credentials. This was making bootstrapping issues starting a testenv harder to debug. Obviously, Kerberos is dependent on DNS functioning correctly, but running dnsupdate was also dependent on having a working Kerberos KDC. In my case, the testenv had a bad krb5.conf file, but the problem appeared as resolv-wrapper errors (due to a missing RESOLV_WRAPPER_HOSTS file, which should've been generated by dnsupdate). Signed-off-by: Tim Beale Reviewed-by: Andrew Bartlett Pair-Programmed-With: Garming Sam --- diff --git a/source4/scripting/bin/samba_dnsupdate b/source4/scripting/bin/samba_dnsupdate index 18b61977dff..37c8c684b24 100755 --- a/source4/scripting/bin/samba_dnsupdate +++ b/source4/scripting/bin/samba_dnsupdate @@ -196,11 +196,11 @@ def get_credentials(lp): creds.set_krb_forwardable(credentials.NO_KRB_FORWARDABLE) (tmp_fd, ccachename) = tempfile.mkstemp() try: - creds.get_named_ccache(lp, ccachename) - if opts.use_file is not None: return + creds.get_named_ccache(lp, ccachename) + # Now confirm we can get a ticket to the DNS server get_krb5_rw_dns_server(creds, sub_vars['DNSDOMAIN'] + '.') return creds