From 50c383aeedeca63fbcd54963d8378214a6c13559 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 6 Nov 2007 10:22:47 -0500 Subject: [PATCH 1/3] Update text to reflect new CSS code (sidebar now on right) --- ipa-server/ipa-gui/ipagui/templates/welcome.kid | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipa-server/ipa-gui/ipagui/templates/welcome.kid b/ipa-server/ipa-gui/ipagui/templates/welcome.kid index 732b3d6d3..eb568851f 100644 --- a/ipa-server/ipa-gui/ipagui/templates/welcome.kid +++ b/ipa-server/ipa-gui/ipagui/templates/welcome.kid @@ -28,7 +28,7 @@ IPA is used to manage Identity, Policy, and Auditing for your organization. "joe finance" into the search box.

- Alternatively, select a task from the left sidebar. + Alternatively, select a task from the right sidebar.

From 22493d9b9fbc0b6a2e35397ab7b6a62740fcfe7a Mon Sep 17 00:00:00 2001 From: John Dennis Date: Tue, 6 Nov 2007 16:26:10 -0500 Subject: [PATCH 2/3] remove offensive use of rpm add the radiusprofile to the list of objectclasses used when creating a user --- ipa-python/ipautil.py | 36 -------------------------- ipa-server/freeipa-server.spec | 2 +- ipa-server/ipaserver/radiusinstance.py | 30 ++++++++++++++++----- ipa-server/xmlrpc-server/funcs.py | 2 +- 4 files changed, 25 insertions(+), 45 deletions(-) diff --git a/ipa-python/ipautil.py b/ipa-python/ipautil.py index 96a74d757..e7f594191 100644 --- a/ipa-python/ipautil.py +++ b/ipa-python/ipautil.py @@ -30,7 +30,6 @@ from string import lower import re import xmlrpclib import datetime -import rpm def realm_to_suffix(realm_name): s = realm_name.split(".") @@ -332,38 +331,3 @@ def parse_generalized_time(timestr): except ValueError: return None -#------------------------------------------------------------------------------- - -def get_rpm_nvr_from_header(hdr): - 'Given an RPM header return the package NVR as a string' - name = hdr['name'] - version = hdr['version'] - release = hdr['release'] - - return '%s-%s-%s' % (name, version, release) - -def get_rpm_nvr_by_name(name): - if name is None: - return None - - nvr = None - try: - ts = rpm.ts() - mi = ts.dbMatch(rpm.RPMTAG_NAME, name) - for h in mi: - nvr = get_rpm_nvr_from_header(h) - break - except: - logging.exception('failed to retrieve rpm info for %s', name) - return nvr - -def split_rpm_nvr(nvr): - components = nvr.split('-') - release = components[-1] - version = components[-2] - name = '-'.join(components[:-2]) - return (name, version, release) - - - - diff --git a/ipa-server/freeipa-server.spec b/ipa-server/freeipa-server.spec index 7606acf03..918e17c3b 100755 --- a/ipa-server/freeipa-server.spec +++ b/ipa-server/freeipa-server.spec @@ -11,7 +11,7 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: fedora-ds-base-devel openldap-devel krb5-devel nss-devel mozldap-devel openssl-devel -Requires: python fedora-ds-base krb5-server krb5-server-ldap nss-tools openldap-clients httpd mod_python mod_auth_kerb python-ldap freeipa-python ntp cyrus-sasl-gssapi nss TurboGears python-krbV acl freeipa-admintools rpm +Requires: python fedora-ds-base krb5-server krb5-server-ldap nss-tools openldap-clients httpd mod_python mod_auth_kerb python-ldap freeipa-python ntp cyrus-sasl-gssapi nss TurboGears python-krbV acl freeipa-admintools Requires: mod_nss >= 1.0.7-2 Requires: freeradius >= 1.1.7 diff --git a/ipa-server/ipaserver/radiusinstance.py b/ipa-server/ipaserver/radiusinstance.py index 27e7527e0..2aee09b33 100644 --- a/ipa-server/ipaserver/radiusinstance.py +++ b/ipa-server/ipaserver/radiusinstance.py @@ -44,9 +44,30 @@ LDAP_ATTR_MAP_FILEPATH = os.path.join(PKG_CONFIG_DIR, 'ldap.attrmap') RADIUSD_CONF_FILEPATH = os.path.join(PKG_CONFIG_DIR, 'radiusd.conf') RADIUSD_CONF_TEMPLATE_FILEPATH = os.path.join(SHARE_DIR, 'radius.radiusd.conf.template') +RADIUSD = '/usr/sbin/radiusd' + # FIXME there should a utility to get the user base dn from ipaserver.funcs import DefaultUserContainer, DefaultGroupContainer +#------------------------------------------------------------------------------- + +def get_radius_version(): + version = None + try: + p = subprocess.Popen([RADIUSD, '-v'], stdout=subprocess.PIPE, + stderr=subprocess.PIPE) + stdout, stderr = p.communicate() + status = p.returncode + + if status == 0: + match = re.search("radiusd: FreeRADIUS Version (.+), for host", stdout) + if match: + version = match.group(1) + except Exception, e: + pass + return version + + #------------------------------------------------------------------------------- class RadiusInstance(service.Service): @@ -63,12 +84,7 @@ class RadiusInstance(service.Service): self.principal = "%s/%s@%s" % (RADIUS_SERVICE_NAME, self.fqdn, self.realm) self.basedn = realm_to_suffix(self.realm) self.user_basedn = "%s,%s" % (DefaultUserContainer, self.basedn) # FIXME, should be utility to get this - self.rpm_nvr = get_rpm_nvr_by_name(PKG_NAME) - if self.rpm_nvr is not None: - self.rpm_name, self.rpm_version, self.rpm_release = split_rpm_nvr(self.rpm_nvr) - else: - self.rpm_name = self.rpm_version = self.rpm_release = None - + self.radius_version = get_radius_version() self.start_creation(4, "Configuring radiusd") try: @@ -93,7 +109,7 @@ class RadiusInstance(service.Service): def __radiusd_conf(self): self.step('configuring radiusd.conf for radius instance') - version = 'IPA_RADIUS_VERSION=%s RADIUS_PACKAGE_VERSION=%s' % (IPA_RADIUS_VERSION, self.rpm_nvr) + version = 'IPA_RADIUS_VERSION=%s FREE_RADIUS_VERSION=%s' % (IPA_RADIUS_VERSION, self.radius_version) sub_dict = {'CONFIG_FILE_VERSION_INFO' : version, 'LDAP_SERVER' : self.ldap_server, 'RADIUS_KEYTAB' : IPA_KEYTAB_FILEPATH, diff --git a/ipa-server/xmlrpc-server/funcs.py b/ipa-server/xmlrpc-server/funcs.py index 17a578c26..6fdaaca51 100644 --- a/ipa-server/xmlrpc-server/funcs.py +++ b/ipa-server/xmlrpc-server/funcs.py @@ -443,7 +443,7 @@ class IPAServer: # some required objectclasses entry.setValues('objectClass', 'top', 'person', 'organizationalPerson', - 'inetOrgPerson', 'inetUser', 'posixAccount', 'krbPrincipalAux') + 'inetOrgPerson', 'inetUser', 'posixAccount', 'krbPrincipalAux', 'radiusprofile') # fill in our new entry with everything sent by the user for u in user: From 24d5777bd682636b36b96193c2ec2c8bcb6f684f Mon Sep 17 00:00:00 2001 From: Pete Rowley Date: Tue, 6 Nov 2007 15:57:15 -0800 Subject: [PATCH 3/3] Add posix auto gen for single master case --- ipa-server/ipa-install/share/Makefile.am | 2 + .../ipa-install/share/bootstrap-template.ldif | 14 ++++++- ipa-server/ipa-install/share/dna-posix.ldif | 37 +++++++++++++++++++ .../ipa-install/share/master-entry.ldif | 7 ++++ .../ipa-slapi-plugins/dna/dna-conf.ldif | 7 ++-- ipa-server/ipa-slapi-plugins/dna/dna.c | 18 ++++----- ipa-server/ipaserver/dsinstance.py | 34 +++++++++++++++++ 7 files changed, 106 insertions(+), 13 deletions(-) create mode 100644 ipa-server/ipa-install/share/dna-posix.ldif create mode 100644 ipa-server/ipa-install/share/master-entry.ldif diff --git a/ipa-server/ipa-install/share/Makefile.am b/ipa-server/ipa-install/share/Makefile.am index cbb2e149a..b103d5670 100644 --- a/ipa-server/ipa-install/share/Makefile.am +++ b/ipa-server/ipa-install/share/Makefile.am @@ -20,6 +20,8 @@ app_DATA = \ ntp.conf.server.template \ radius.radiusd.conf.template \ referint-conf.ldif \ + dna-posix.ldif \ + master-entry.ldif \ $(NULL) EXTRA_DIST = \ diff --git a/ipa-server/ipa-install/share/bootstrap-template.ldif b/ipa-server/ipa-install/share/bootstrap-template.ldif index d793dd9ee..ca8bdcb6b 100644 --- a/ipa-server/ipa-install/share/bootstrap-template.ldif +++ b/ipa-server/ipa-install/share/bootstrap-template.ldif @@ -39,6 +39,18 @@ objectClass: nsContainer objectClass: top cn: sysaccounts +dn: cn=ipa,cn=etc,$SUFFIX +changetype: add +objectClass: nsContainer +objectClass: top +cn: ipa + +dn: cn=masters,cn=ipa,cn=etc,$SUFFIX +changetype: add +objectClass: nsContainer +objectClass: top +cn: masters + dn: uid=admin,cn=sysaccounts,cn=etc,$SUFFIX changetype: add objectClass: top @@ -50,7 +62,7 @@ uid: admin krbPrincipalName: admin@$REALM cn: Administrator sn: Administrator -uidNumber: 1000 +uidNumber: 999 gidNumber: 1001 homeDirectory: /home/admin loginShell: /bin/bash diff --git a/ipa-server/ipa-install/share/dna-posix.ldif b/ipa-server/ipa-install/share/dna-posix.ldif new file mode 100644 index 000000000..e999b209b --- /dev/null +++ b/ipa-server/ipa-install/share/dna-posix.ldif @@ -0,0 +1,37 @@ +# add container for posix configuration + +dn: cn=Posix,cn=ipa-dna,cn=plugins,cn=config +changetype: add +objectclass: top +objectclass: nsContainer +objectclass: extensibleObject +cn: Posix + +# add plugin configuration for posix users + +dn: cn=Accounts,cn=Posix,cn=ipa-dna,cn=plugins,cn=config +changetype: add +objectclass: top +objectclass: extensibleObject +cn: Accounts +dnaType: uidNumber +dnaNextValue: 1100 +dnaInterval: 4 +dnaMagicRegen: 999 +dnaFilter: (objectclass=posixAccount) +dnaScope: $SUFFIX + +# add plugin configuration for posix groups + +dn: cn=Groups,cn=Posix,cn=ipa-dna,cn=plugins,cn=config +changetype: add +objectclass: top +objectclass: extensibleObject +cn: Groups +dnaType: gidNumber +dnaNextValue: 1100 +dnaInterval: 4 +dnaMagicRegen: 999 +dnaFilter: (objectclass=posixGroup) +dnaScope: $SUFFIX + diff --git a/ipa-server/ipa-install/share/master-entry.ldif b/ipa-server/ipa-install/share/master-entry.ldif new file mode 100644 index 000000000..09c1d44fd --- /dev/null +++ b/ipa-server/ipa-install/share/master-entry.ldif @@ -0,0 +1,7 @@ +dn: cn=$FQHN,cn=masters,cn=ipa,cn=etc,$SUFFIX +changetype: add +objectclass: top +objectclass: extensibleObject +cn: $FQHN +dnabase: 1100 +dnainterval: 4 diff --git a/ipa-server/ipa-slapi-plugins/dna/dna-conf.ldif b/ipa-server/ipa-slapi-plugins/dna/dna-conf.ldif index a133fcf46..02532b4e4 100644 --- a/ipa-server/ipa-slapi-plugins/dna/dna-conf.ldif +++ b/ipa-server/ipa-slapi-plugins/dna/dna-conf.ldif @@ -1,13 +1,14 @@ dn: cn=ipa-dna,cn=plugins,cn=config +changetype: add objectclass: top objectclass: nsSlapdPlugin objectclass: extensibleObject cn: ipa-dna nsslapd-pluginpath: libipa-dna-plugin -nsslapd-plugininitfunc: dna_init -nsslapd-plugintype: postoperation +nsslapd-plugininitfunc: ipa_dna_init +nsslapd-plugintype: preoperation nsslapd-pluginenabled: on nsslapd-pluginid: ipa-dna nsslapd-pluginversion: 1.0 nsslapd-pluginvendor: Red Hat -nsslapd-plugindescription: Distributed numeric assignment plugin +nsslapd-plugindescription: IPA Distributed numeric assignment plugin diff --git a/ipa-server/ipa-slapi-plugins/dna/dna.c b/ipa-server/ipa-slapi-plugins/dna/dna.c index 7c8dad1aa..bafe44107 100644 --- a/ipa-server/ipa-slapi-plugins/dna/dna.c +++ b/ipa-server/ipa-slapi-plugins/dna/dna.c @@ -65,7 +65,7 @@ #include #endif -#define DNA_PLUGIN_SUBSYSTEM "dna-plugin" +#define DNA_PLUGIN_SUBSYSTEM "ipa-dna-plugin" #define DNA_PLUGIN_VERSION 0x00010000 #define DNA_DN "cn=ipa-dna,cn=plugins,cn=config" /* temporary */ @@ -84,8 +84,8 @@ #define DNA_FILTER "dnaFilter" #define DNA_SCOPE "dnaScope" -#define FEATURE_DESC "Distributed Numeric Assignment" -#define PLUGIN_DESC "Distributed Numeric Assignment plugin" +#define FEATURE_DESC "IPA Distributed Numeric Assignment" +#define PLUGIN_DESC "IPA Distributed Numeric Assignment plugin" static Slapi_PluginDesc pdesc = { FEATURE_DESC, "FreeIPA project", "FreeIPA/1.0", @@ -125,7 +125,7 @@ static Slapi_Mutex *g_new_value_lock; * DNA plug-in management functions * */ -int dna_init(Slapi_PBlock *pb); +int ipa_dna_init(Slapi_PBlock *pb); static int dna_start(Slapi_PBlock *pb); static int dna_close(Slapi_PBlock *pb); static int dna_postop_init(Slapi_PBlock *pb); @@ -235,12 +235,12 @@ char * getPluginDN() ------------- adds our callbacks to the list */ -int dna_init( Slapi_PBlock *pb ) +int ipa_dna_init( Slapi_PBlock *pb ) { int status = DNA_SUCCESS; char * plugin_identity=NULL; - slapi_log_error( SLAPI_LOG_TRACE, DNA_PLUGIN_SUBSYSTEM , "--> dna_init\n"); + slapi_log_error( SLAPI_LOG_TRACE, DNA_PLUGIN_SUBSYSTEM , "--> ipa_dna_init\n"); /** * Store the plugin identity for later use. @@ -267,7 +267,7 @@ int dna_init( Slapi_PBlock *pb ) slapi_register_plugin( "postoperation", /* op type */ 1, /* Enabled */ - "dna_init", /* this function desc */ + "ipa_dna_init", /* this function desc */ dna_postop_init, /* init func for post op */ PLUGIN_DESC, /* plugin desc */ NULL, /* ? */ @@ -276,11 +276,11 @@ int dna_init( Slapi_PBlock *pb ) ) { slapi_log_error( SLAPI_LOG_FATAL, DNA_PLUGIN_SUBSYSTEM, - "dna_init: failed to register plugin\n" ); + "ipa_dna_init: failed to register plugin\n" ); status = DNA_FAILURE; } - slapi_log_error( SLAPI_LOG_TRACE, DNA_PLUGIN_SUBSYSTEM , "<-- dna_init\n"); + slapi_log_error( SLAPI_LOG_TRACE, DNA_PLUGIN_SUBSYSTEM , "<-- ipa_dna_init\n"); return status; } diff --git a/ipa-server/ipaserver/dsinstance.py b/ipa-server/ipaserver/dsinstance.py index 284ad3a6d..9a539470e 100644 --- a/ipa-server/ipaserver/dsinstance.py +++ b/ipa-server/ipaserver/dsinstance.py @@ -84,6 +84,7 @@ class DsInstance(service.Service): self.__add_default_schemas() self.__add_memberof_module() self.__add_referint_module() + self.__add_dna_module() self.__create_indeces() self.__enable_ssl() self.__certmap_conf() @@ -93,7 +94,10 @@ class DsInstance(service.Service): except: # TODO: roll back here? logging.critical("Failed to restart the ds instance") + self.__config_uidgid_gen_first_master() self.__add_default_layout() + self.__add_master_entry_first_master() + self.step("configuring directoy to start on boot") self.chkconfig_on() @@ -183,6 +187,36 @@ class DsInstance(service.Service): print "Failed to load referint-conf.ldif", e referint_fd.close() + def __add_dna_module(self): + self.step("enabling distributed numeric assignment plugin") + dna_txt = template_file(SHARE_DIR + "dna-conf.ldif", self.sub_dict) + dna_fd = write_tmp_file(dna_txt) + try: + ldap_mod(dna_fd, "cn=Directory Manager", self.dm_password) + except subprocess.CalledProcessError, e: + print "Failed to load dna-conf.ldif", e + dna_fd.close() + + def __config_uidgid_gen_first_master(self): + self.step("configuring Posix uid/gid generation as first master") + dna_txt = template_file(SHARE_DIR + "dna-posix.ldif", self.sub_dict) + dna_fd = write_tmp_file(dna_txt) + try: + ldap_mod(dna_fd, "cn=Directory Manager", self.dm_password) + except subprocess.CalledProcessError, e: + print "Failed to configure Posix uid/gid generation with dna-posix.ldif", e + dna_fd.close() + + def __add_master_entry_first_master(self): + self.step("adding master entry as first master") + master_txt = template_file(SHARE_DIR + "master-entry.ldif", self.sub_dict) + master_fd = write_tmp_file(master_txt) + try: + ldap_mod(master_fd, "cn=Directory Manager", self.dm_password) + except subprocess.CalledProcessError, e: + print "Failed to add master-entry.ldif", e + master_fd.close() + def __enable_ssl(self): self.step("configuring ssl for ds instance") dirname = self.config_dirname()