Report better error when enabling or disabling unknown principals

Check the existence of the principal before enabling or disabling it
in the Heimdal backend so that nonexistent principals report a clearer
error message instead of an internal error about getAttributes
failure.

diff --git a/NEWS b/NEWS
index c59b678081f3d5a5dfaaa0ce1774a35400584f29..d0931987690a6dd016ff38401c56b2ebbe6abb1a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,11 @@ kadmin-remctl 3.5 (unreleased)
     In the Heimdal backend, recognize the new form of the Heimdal kpasswd
     prompt to repeat the new password.
 
+    Check the existence of the principal before enabling or disabling it
+    in the Heimdal backend so that nonexistent principals report a clearer
+    error message instead of an internal error about getAttributes
+    failure.
+
 kadmin-remctl 3.4 (2013-07-09)
 
     Set the disallow-svr flag on all newly-created principals.  This

diff --git a/kadmin-backend-heim b/kadmin-backend-heim
index 957254bb289c7512484f498fa0fee03631b8f1dd..f4503fc5e5ce126e27ff7b0a1f15cb67c1c23cdd 100755 (executable)
--- a/kadmin-backend-heim
+++ b/kadmin-backend-heim
@@ -332,6 +332,15 @@ sub kadmin_disable {
     $principal = "$principal/$instance" if $instance;
 
     my $kadmin = kadmin_handle ($instance);
+    my $data = eval { $kadmin->getPrincipal ($principal) };
+    if ($@) {
+        my $error = $@ || "unknown error\n";
+        warn "error: cannot retrieve $principal: $error\n";
+        exit 1;
+    } elsif (!defined $data) {
+        warn "error: principal $principal does not exist\n";
+        exit 1;
+    }
     if (!eval { $kadmin->disablePrincipal ($principal) }) {
         my $error = $@ || "unknown error\n";
         warn "error: cannot disable $principal: $error";
@@ -354,10 +363,19 @@ sub kadmin_enable {
         }
     }
     my $kadmin = kadmin_handle ($instance);
+    my $data = eval { $kadmin->getPrincipal ($principal) };
+    if ($@) {
+        my $error = $@ || "unknown error\n";
+        warn "error: cannot retrieve $principal: $error\n";
+        exit 1;
+    } elsif (!defined $data) {
+        warn "error: principal $principal does not exist\n";
+        exit 1;
+    }
     eval { $kadmin->enablePrincipal ($principal) };
     if ($@) {
         my $error = $@ || "unknown error\n";
-        warn "error: cannot enable $principal: $error\n";
+        warn "error: cannot enable $principal: $error";
         exit 1;
     }
 }