From d2fbcd121eaeb56ab36da6b2f84c780e3af14125 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Nov 13 2013 11:28:55 +0000
Subject: Map NT_STATUS_INVALID_PARAMETER to most likely error cause: clock skew


When we get NT_STATUS_INVALID_PARAMETER in response to establish
DCE RPC pipe with Kerberos, the most likely reason is clock skew.
Suggest that it is so in the error message.

https://fedorahosted.org/freeipa/ticket/4024

---

diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py
index 86bb428..0dde347 100644
--- a/ipaserver/dcerpc.py
+++ b/ipaserver/dcerpc.py
@@ -82,6 +82,9 @@ dcerpc_error_codes = {
     -1073741614: access_denied_error,
     -1073741603:
         errors.ValidationError(name=_('AD domain controller'), error=_('unsupported functional level')),
+    -1073741811: # NT_STATUS_INVALID_PARAMETER
+        errors.RemoteRetrieveError(
+            reason=_('AD domain controller complains about communication sequence. It may mean unsynchronized time on both sides, for example')),
 }
 
 dcerpc_error_messages = {