Changeset 2575 for trunk/server/common/oursrc

Timestamp:

Aug 24, 2014, 11:29:04 PM (10 years ago)

Author:

glasgall

Message:

Make signup use GSSAPI auth for LDAP now that ldap master is remote,
and pick which server to use at random because we can't use
scripts-ldap yet.

Committed on trunk because achernya asked me to put it on trunk.

File:

• trunk/server/common/oursrc/accountadm/signup-scripts-backend.in (modified) (3 diffs)

trunk/server/common/oursrc/accountadm/signup-scripts-backend.in

@@ -1 +1 @@
 #!/usr/bin/perl
 use strict;
+use File::Temp qw/ :POSIX /;
 
 # signup-scripts-backend
@@ -102 +103 @@
 }
 
+# Get credentials
+my $ccache = tmpnam();
+$ENV{'KRB5CCNAME'} = $ccache;
+my $exit_status = system("/usr/bin/kinit", "-k", "-t", "/etc/signup.keytab", "daemon/scripts-signup.mit.edu");
+if (($exit_status >> 8) != 0) {
+    die "Couldn't get Kerberos credentials for account creation!";
+}
 my $pid;
+my @ldap_servers = ('doppelganger', 'alter-ego', 'body-double');
+my $selected_server = $ldap_servers[int(rand(3))];
 defined ($pid = open LDAP, '|-') or complain("internal error");
 if (!$pid) {
         close STDOUT;
         open STDOUT, '>/dev/null';
-        exec '@ldapadd_path@', '-c', '-x', '-D', 'cn=Directory Manager', '-y', '/etc/signup-ldap-pw';
+        exec '@ldapadd_path@', '-c', '-Y', 'gssapi', '-H', "ldap://$selected_server.mit.edu";
         exit 1;
 }
@@ -145 +155 @@
 #system('@sudo_path@', '-u', 'root', '/usr/sbin/setquota', $username, '0', '25000', '0', '10000', '-a');
 
+system("kdestroy");
+
 printexit("done", 0);