[freeipa PR#3328][opened] trust-fetch-domains: make sure we use right KDC when --server is spec…

[abbra]

   URL: https://github.com/freeipa/freeipa/pull/3328
Author: abbra
 Title: #3328: trust-fetch-domains: make sure we use right KDC when --server is spec…
Action: opened

PR body:
"""
…ified

Since we are authenticating against AD DC before talking to it (by using
trusted domain object's credentials), we need to override krb5.conf
configuration in case --server option is specified.

The context is a helper which is launched out of process with the help
of oddjobd. The helper takes existing trusted domain object, uses its
credentials to authenticate and then runs LSA RPC calls against that
trusted domain's domain controller. Previous code directed Samba
bindings to use the correct domain controller. However, if a DC visible
to MIT Kerberos is not reachable, we would not be able to obtain TGT and
the whole process will fail.

Also we need to make errors in the oddjob helper more visible to
error_log. Thus, move error reporting for a normal communication up from
the exception catching.

Resolves: https://pagure.io/freeipa/issue/7895
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3328/head:pr3328
git checkout pr3328

[freeipa PR#3328][closed] trust-fetch-domains: make sure we use right KDC when --server is spec…

[flo-renaud]

   URL: https://github.com/freeipa/freeipa/pull/3328
Author: abbra
 Title: #3328: trust-fetch-domains: make sure we use right KDC when --server is spec…
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3328/head:pr3328
git checkout pr3328