27391890643
79%
master: 79%

Ran 12 Jun 2026 03:08AM UTC

Jobs 1

Files 36

Run time 1min

Badge

Embed ▾

Committed 12 Jun 2026 03:07AM UTC coverage: 78.996%. Remained the same

Build # 27391890643

Build Type

push

github

Committed by

web-flow

Commit Message

CA-428436: validate DC LDAPS certificate before joining domain (#7121)

When LDAPS is enabled, pool.enable_external_auth could intermittently
fail with POOL_AUTH_ENABLE_FAILED_SETUP_TLS_CONNECTION: "net ads join"
auto-selects a domain controller via DsGetDcName without considering its
TLS certificate, so if the chosen DC presents a certificate that does
not chain to a trusted CA the LDAPS bind fails (GnuTLS
signer_not_found).

When ldaps is enabled, probe the candidate DCs in on_enable and join via
the first one whose LDAPS certificate validates against the trusted CAs:
enumerate the KDCs (kdcs_of_domain) and run Ldap.query_sid over LDAPS
for each, then pin the join with "net ads join -S <dc>". The probe uses
the supplied join credentials rather than the machine account, which
does not exist yet during the join.

For this, query_sid takes optional ?duser/?dpass arguments: when both
are given it authenticates via the USER/PASSWD environment variables
instead of --machine-pass.

When ldaps is disabled the behaviour is unchanged.

Coverage Stats

3667 of 4642 relevant lines covered (79.0%)

0.79 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	python3.11 - 27391890643.1	12 Jun 2026 03:08AM UTC	36	79.0	GitHub Action Run

xapi-project / xen-api / 27391890643
79%
master: 79%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 27391890643

xapi-project / xen-api / 27391890643 79% master: 79%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 27391890643

xapi-project / xen-api / 27391890643
79%
master: 79%

README BADGES
x