>From 5d8f4a4fdd63798e361b96fac5b53f2e5734a5a6 Mon Sep 17 00:00:00 2001
From: Abhishek Koneru <akoneru@redhat.com>
Date: Mon, 9 Dec 2013 12:38:42 -0500
Subject: [PATCH] Cannot connect to ds when anon. access is off

The connection to ds is checked during installation.
But the current method of checking the ds connection before
binding with the ds throws an Inappropriate Authentication error
when Anonymous access is off. This patch uses the following method to
check the connection to a DS server.
1. Initialize the connection
2. Bind with the DS.
3. Perform the ldap search.

Ticket #811
---
 .../python/pki/server/deployment/pkiparser.py      | 51 +++++++++++++++-------
 base/server/sbin/pkispawn                          | 23 ++--------
 2 files changed, 40 insertions(+), 34 deletions(-)

diff --git a/base/server/python/pki/server/deployment/pkiparser.py b/base/server/python/pki/server/deployment/pkiparser.py
index b7cece722110a2f8a1ac1c7e03111854f71339a2..864be721dfb1c578041f8ef4584a4ed956599652 100644
--- a/base/server/python/pki/server/deployment/pkiparser.py
+++ b/base/server/python/pki/server/deployment/pkiparser.py
@@ -405,30 +405,51 @@ class PKIConfigParser:
             port = self.pki_master_dict['pki_ds_ldap_port']
 
         self.ds_connection = ldap.initialize(protocol + '://' + hostname + ':' + port)
-        self.ds_connection.search_s('', ldap.SCOPE_BASE)
 
     def ds_bind(self):
         self.ds_connection.simple_bind_s(
             self.pki_master_dict['pki_ds_bind_dn'],
             self.pki_master_dict['pki_ds_password'])
-
-    def ds_base_dn_exists(self):
-        try:
-            results = self.ds_connection.search_s(
-                self.pki_master_dict['pki_ds_base_dn'],
-                ldap.SCOPE_BASE)
-
-            if results is None or len(results) == 0:
-                return False
-
-            return True
-
-        except ldap.NO_SUCH_OBJECT:
-            return False
+            
+    def ds_search(self, key=None):
+        if key is None:
+            key = ''
+        self.ds_connection.search_s(key, ldap.SCOPE_BASE)
 
     def ds_close(self):
         self.ds_connection.unbind_s()
 
+    def ds_verify_configuration(self):
+        
+        try:
+            self.ds_connect()
+            self.ds_bind()
+            self.ds_search()
+        except:
+            raise
+        finally:
+            self.ds_close()
+
+    def ds_base_dn_exists(self):
+        base_dn_exists = True
+        try:
+            self.ds_connect()
+            self.ds_bind()
+            self.ds_search()
+            try:
+                results = self.ds_search(self.pki_master_dict['pki_ds_base_dn'])
+
+                if results is None or len(results) == 0:
+                    base_dn_exists = False
+
+            except ldap.NO_SUCH_OBJECT:
+                base_dn_exists = False
+        except:
+            raise
+        finally:
+            self.ds_close()
+        return base_dn_exists
+
     def sd_connect(self):
         self.sd_connection = pki.client.PKIConnection(
             protocol='https',
diff --git a/base/server/sbin/pkispawn b/base/server/sbin/pkispawn
index d048147e39a7e7ebe922eef0242c6ab3180938e0..583f91fcc8e9165e2b657ac5856fe0eb8ed241f1 100755
--- a/base/server/sbin/pkispawn
+++ b/base/server/sbin/pkispawn
@@ -182,26 +182,16 @@ def main(argv):
             while True:
                 parser.read_text('Hostname', config.pki_subsystem, 'pki_ds_hostname')
                 parser.read_text('Port', config.pki_subsystem, 'pki_ds_ldap_port')
-
-                try:
-                    parser.ds_connect()
-                    break
-
-                except ldap.LDAPError as e:
-                    parser.print_text('ERROR: ' + e.message['desc'])
-
-            while True:
                 parser.read_text('Bind DN', config.pki_subsystem, 'pki_ds_bind_dn')
                 parser.read_password('Password', config.pki_subsystem, 'pki_ds_password')
 
                 try:
-                    parser.ds_bind()
-                    break
+                    parser.ds_verify_configuration()
 
                 except ldap.LDAPError as e:
                     parser.print_text('ERROR: ' + e.message['desc'])
+                    continue
 
-            while True:
                 parser.read_text('Base DN', config.pki_subsystem, 'pki_ds_base_dn')
                 try:
                     if not parser.ds_base_dn_exists():
@@ -222,8 +212,6 @@ def main(argv):
                 if remove == 'y' or remove == 'yes':
                     break
 
-            parser.ds_close()
-
             print
 
             print "Security Domain:"
@@ -402,16 +390,13 @@ def main(argv):
                     extra=config.PKI_INDENTATION_LEVEL_0)
                 sys.exit(1)
 
-            parser.ds_connect()
-            parser.ds_bind()
-
+            parser.ds_verify_configuration()
+ 
             if parser.ds_base_dn_exists() and\
                 not config.str2bool(parser.pki_master_dict['pki_ds_remove_data']):
                 print 'ERROR:  Base DN already exists.'
                 sys.exit(1)
 
-            parser.ds_close()
-
         except ldap.LDAPError as e:
             print 'ERROR:  Unable to access directory server: ' + e.message['desc']
             sys.exit(1)
-- 
1.8.3.1

