From b93cf2d751e9c6078ee15d30a66d939bbe2f3b9f Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 7 May 2014 09:45:32 -0400 Subject: [PATCH] Give more user feedback around keytab issues Signed-off-by: Simo Sorce --- README | 2 ++ ipsilon/helpers/ipa.py | 16 ++++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/README b/README index 78f8ee2..ae0c46f 100644 --- a/README +++ b/README @@ -62,6 +62,8 @@ Instances are configured to be available at https://hostname/instance So for a server called ipsilon.example.com, using the default installation options the IdP will be available at https://ipsilon.example.com/idp/ +The install script expects to find the keytab in /etc/httpd/conf/http.keytab + NOTE: If you are installing Ipsilon in a FreeIPA[4] environment you can use the --ipa switch to simplify the deployment. Using the --ipa switch will allow the use of your IPA Kerberos administrative credentials to automatically provision diff --git a/ipsilon/helpers/ipa.py b/ipsilon/helpers/ipa.py index df6717f..4948624 100755 --- a/ipsilon/helpers/ipa.py +++ b/ipsilon/helpers/ipa.py @@ -93,12 +93,22 @@ class Installer(object): # Check if we already have a keytab for HTTP if 'krb_httpd_keytab' in opts: + msg = "Searching for keytab in: %s" % opts['krb_httpd_keytab'] + print >> sys.stdout, msg, if os.path.exists(opts['krb_httpd_keytab']): + print >> sys.stdout, "... Found!" return + else: + print >> sys.stdout, "... Not found!" + msg = "Searching for keytab in: %s" % HTTPD_IPA_KEYTAB + print >> sys.stdout, msg, if os.path.exists(HTTPD_IPA_KEYTAB): opts['krb_httpd_keytab'] = HTTPD_IPA_KEYTAB + print >> sys.stdout, "... Found!" return + else: + print >> sys.stdout, "... Not found!" us = socket.gethostname() princ = 'HTTP/%s@%s' % (us, self.realm) @@ -108,11 +118,14 @@ class Installer(object): from ipalib import errors as ipaerrors for srv in self.server: + msg = "Testing access to server: %s" % srv + print >> sys.stdout, msg, try: server = srv c = ipaldap.IPAdmin(host=server) c.do_sasl_gssapi_bind() del c + print >> sys.stdout, "... Succeeded!" break except ipaerrors.ACIError, e: # usually this error is returned when we have no @@ -134,6 +147,9 @@ class Installer(object): logger.info('Cmd> %s\n%s', e.cmd, e.output) try: + msg = "Trying to fetch keytab[%s] for %s" % ( + opts['krb_httpd_keytab'], princ) + print >> sys.stdout, msg, subprocess.check_output([IPA_GETKEYTAB, '-s', server, '-p', princ, '-k', opts['krb_httpd_keytab']], -- 2.20.1