public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

merge into: public/freeipa:ipa-4-10
public/freeipa:master public/freeipa:v4.12.5 public/freeipa:v4.12.2 public/freeipa:v4.11.0 public/freeipa:ipa-4-10 public/freeipa:ipa-4-9 public/freeipa:v4.10.0 public/freeipa:v4.9.10 public/freeipa:v4.9.8
...
pull from: public/freeipa:master
public/freeipa:v4.12.5 public/freeipa:v4.12.2 public/freeipa:v4.11.0 public/freeipa:master public/freeipa:ipa-4-10 public/freeipa:ipa-4-9 public/freeipa:v4.10.0 public/freeipa:v4.9.10 public/freeipa:v4.9.8
412 Commits
ipa-4-10 ... master
Author SHA1 Message Date
Viktor Ashirov fe005dd388 WebUI: update favicon.ico 
I noticed that FreeIPA favicon is a bit squished. I would like to unsquish it.
And resize it to 32x32 pixels as it would look a bit better on HiDPI screens.

Fixes: https://pagure.io/freeipa/issue/9449

Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Carla Martinez <carlmart@redhat.com>
 2023-10-05 07:38:05 +02:00
Florence Blanc-Renaud 430054db41 ipatests: fix test_ipactl_scenario_check 
The test is comparing the PID of services before and after
calling ipactl start, expecting to have the same value.
It should not compare the pid for ipa-dnskeysyncd as this service
is automatically restarted upon failure.

Fixes: https://pagure.io/freeipa/issue/9415

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-10-04 09:20:44 -04:00
Florence Blanc-Renaud e459e5b8bc ipatests: fix healthcheck test for --indent option 
ipa-healthcheck --indent option expects an integer. The error
message changed with ipa-healthcheck 0.13.
Recent versions also check that the value is in the range 0-32.

The test must be compatible with old and new versions.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-10-04 09:17:52 -04:00
Florence Blanc-Renaud f9075f9f77 ipatests: fix healthcheck test without DNS 
ipa-healthcheck has added a new check for ipa-ca record
missing. The test needs to be adapted to handle the new check.

Fixes: https://pagure.io/freeipa/issue/9459

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-10-04 09:15:29 -04:00
Alexander Bokovoy b22605ee54 Azure CI: increase memory for forced reenrollment test 
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-10-04 08:37:28 -04:00
Alexander Bokovoy 48cfe6848c Increase memory usage for Azure CI upgrade test 
The test often fails when running in parallel to other tests as very
little memory is left. 389-ds memory autotuning causes database backend
to refuse working in such cases. 389-ds team suggested more memory has
to be made available.

Increate RAM for this test to 2.5GB instead of 2.2GB.

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-10-04 08:37:28 -04:00
Antonio Torres fe223cde95 Update list of contributors 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2023-10-03 14:57:20 +02:00
Antonio Torres 843f4a7458 Update translations to FreeIPA master state 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2023-10-03 14:56:42 +02:00
Alexander Bokovoy 1a2cd7f408 Use datetime.timezone.utc instead of newer datetime.UTC alias 
datetime.UTC alias was added in Python 3.11:
https://docs.python.org/3/library/datetime.html#datetime.UTC

datetime.timezone.utc was present since Python 3.2.

Since RHEL 9 is using Python 3.9, use more compatible variant.

Fixes: https://pagure.io/freeipa/issue/9454

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-09-29 15:06:33 -04:00
Christian Heimes 6aebfe74fb Add context manager to ipalib.API 
`ipalib.API` instances like `ipalib.api` now provide a context manager
that connects and disconnects the API object. Users no longer have to
deal with different types of backends or finalize the API correctly.

```python
import ipalib

with ipalib.api as api:
    api.Commands.ping()
```

See: https://pagure.io/freeipa/issue/9443
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-09-29 12:57:06 +02:00
Florence Blanc-Renaud 8b70ee1ea8 Covscan issues: deadcode and Use after free 
Covscan detected an unused value in ipa_kdb_principals.c
and a use-after-free in ipa-print-pac.c.

Fixes: https://pagure.io/freeipa/issue/9431

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-09-29 12:05:48 +02:00
Francisco Trivino 4af05dde48 Workshop: fix broken Sphinx cross-references. 
Many of the workshop pages links are directing to URLs that end with
".rst" instead of ".html", as a result, these links are broken.

This commit introduces explicit targets and references to ensure that
the pages are correctly linked.

Signed-off-by: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-09-26 11:30:33 +02:00
Mohammad Rizwan 496e3ace85 ipatests: restart ipa services after moving date 
When system date is moved into future, it have unprecedented
behavior i.e CA becomes irresponsive or unexpected certificcate
state. Hence restart the ipa service after moving the date to
gracefully serve the request.

Fixes: https://pagure.io/freeipa/issue/9379

Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-09-18 17:51:30 +02:00
Christian Heimes 7ddf7711f3 Use find_spec() in meta importer 
The `find_module()` method of meta importers has been deprecated for a
long time. Python 3.12 no longer falls back to `find_module()`.

See: https://docs.python.org/3.12/whatsnew/3.12.html#removed
Related: https://pagure.io/freeipa/issue/9437
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
 2023-09-18 17:46:24 +02:00
Alexander Bokovoy 32721c4132 Allow ipa-otpd to access USB devices for passkeys 
Main SELinux policy will allow transition of passkey_child (SSSD) to
ipa_otpd_t context to perform FIDO2 operations with USB devices.
This means ipa-otpd will need to be able to read data from sysfs and
connect to USB devices.

Add required permissions to IPA subpolicy as well. See rhbz#2238224 for
discussion.

Related: https://pagure.io/freeipa/issue/9434

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-09-18 17:36:40 +02:00
Rob Crittenden f248b22ef4 Don't assume KRB5CCNAME is in the environment in replica install 
The replica install was unilaterally removing KRB5CCNAME from
os.environ in some cases. Instead check first to see if it is
present and only remove in that case.

Fixes: https://pagure.io/freeipa/issue/9446

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-09-14 07:59:44 +02:00
Alexandra Nikandrova dade02d5bb doc: typo in basic_usage.md 
Reviewed-By: Antonio Torres <antorres@redhat.com>
 2023-09-12 21:41:57 +02:00
Alexander Bokovoy 6aa3c3b628 Restore selinux states if they exist at uninstall time 
Related: https://pagure.io/freeipa/issue/9434

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-09-12 14:32:00 -04:00
Alexander Bokovoy f123b01d81 updates: add ACIs for RBCD self-management 
Fixes: https://pagure.io/freeipa/issue/9354

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
 2023-09-11 09:51:51 +02:00
Alexander Bokovoy d355761f23 ipa-client-install: enable SELinux for SSSD 
For passkeys (FIDO2) support, SSSD uses libfido2 library which needs
access to USB devices. Add SELinux booleans handling to ipa-client-install
so that correct SELinux booleans can be enabled and disabled during
install and uninstall. Ignore and record a warning when SELinux policy
does not support the boolean.

Fixes: https://pagure.io/freeipa/issue/9434

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-09-11 09:24:31 +02:00
Antonio Torres 2bc247d831 ipatests: rename 'ipatuura' directory to 'scim' in bridge tests 
A recent commit [1] in ipa-tuura project renamed the 'ipatuura' django app
to 'scim'. Change it in IPA side as well to fix tests.

[1]: https://github.com/freeipa/ipa-tuura/commit/f12592cea496818af782f953e0e9643c9ea440b5

Fixes: https://pagure.io/freeipa/issue/9447

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2023-09-11 09:12:51 +02:00
Viktor Ashirov 953c7cc076 BDB tuning should be applied only when BDB backend is used 
389DS supports BDB and LMDB backends. FreeIPA installation fails with
LMDB backend since it tries to apply tuning for BDB backend.

Instead, tuning for BDB should be applied only when 389DS uses BDB
backend.

Fixes: https://pagure.io/freeipa/issue/9435

Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-09-01 13:16:15 -04:00
Rob Crittenden 45fa43540f Configure affinity during server installation 
Write a new krb5.conf in case any values changed finding the
right server to configure against (e.g. for CA, KRA) and
ensure the API connection is to the remote server that
will be installed against.

When finding a CA or KRA during initial replica installation
set the remote master as well. The order is:

 - existing server value in /etc/ipa/default.conf
 - the chosen CA host if the server doesn't provide one
 - the chosen KRA host if the server doesn't provide one

This is more or less heirarchical. If a server is provided
then that is considered first. If it provides all the
optional services needed (CA and/or KRA) then it will
be used. Otherwise it will fall back to a server that provides
all the required services.

In short, providing --server either at client install or
with ipa-replica-install is no guarantee that it will
define all topology. This may be unexpected behavior.

For the case of adding a CA or KRA things are effectively
unchanged. This type of install does not appear to be
impacted by affinity issues.

Fixes: https://pagure.io/freeipa/issue/9289

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-09-01 13:13:02 -04:00
Christian Heimes 8f25b2a74a Refactor CA file handling in replica installer 
Clean up and remove obsolete code from ipa-replica-install. For several
versions replica installer first ensures that a host is an IPA client,
then promotes the client to a replica. The client installer code sets up
CA stores like IPA_CA_CRT already.

Related: https://pagure.io/freeipa/issue/9272
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
 2023-08-30 09:18:17 -04:00
Florence Blanc-Renaud 0654fb3737 idp: add the ipaidpuser objectclass when needed 
The ipaidpuser objectclass is required for the attribute ipaidpsub.
When a user is created or modified with --idp-user-id, the operation
must ensure that the objectclass is added if missing.

Add a test for user creation and user modification with --idp-user-id.
Fixes: https://pagure.io/freeipa/issue/9433

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-30 09:13:23 -04:00
Rob Crittenden 317e7061d0 Adjust test to handle revocation reason REMOVE_FROM_CRL 
The dogtag REST API has a change of behavior regarding
revocation reason 8, REMOVE_FROM_CRL. The XML interface
accepts it blindly and marks the certifiate as revoked.

This is complicated within RFC 5280 but the jist is that
it only affects a certificate on hold and only for delta
CRLs.

So this modifies the behavior of revocation 8 so that
the certificate is put on hold (6) first.

Fixes: https://pagure.io/freeipa/issue/9345

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-08-28 10:21:48 -04:00
Rob Crittenden ed52142c40 Use the PKI REST API wherever possible instead of XML 
The XML API is already deprecated and will be removed in some
future release.

All but the updateCRL API has an equivalent in REST. The upstream
dogtag project documents most of the API at
https://github.com/dogtagpki/pki/wiki/REST-API . I say most
because not every API includes sample input/output. The
pki ca-cert command is a good substitute for seeing how the API
is used by their own tooling.

This changes no pre-existing conventions. All serial numbers are
converted to decimal prior to transmission and are treated as
strings to avoid previous limitations with sizing (which would
have been exacerbated by random serial numbers).

Fixes: https://pagure.io/freeipa/issue/9345

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-08-28 10:21:48 -04:00
Mohammad Rizwan 8d081ce894 ipatests: accommodate DST in ACME cert expiry 
There is one hour time difference between expiry of ACME cert if
the certificate is issued while daylight saving is start and
expires after DST ends. For 2023 daylight saving time start at
Sunday 12 March and ends at Sunday 5 November. Every certificate
which is expiring after November 5th will have 1 hour difference in
expiry.

Fix is to use 90days+2hours to expire the cert.

Fixes: https://pagure.io/freeipa/issue/9428

Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-08-23 13:10:02 -04:00
Antonio Torres 1251c15fae Bump to IPA 4.12 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2023-08-21 16:39:16 +02:00
Alexander Bokovoy ef955c9015 support more DateTime attributes in LDAP searches in IPA API 
LDAPSearch class constructs a filter from a set of attributes and their
values passed in by the command. During this construction process a
limited set of attributes gets converted to a special form, the rest is
simply taken as a string and escaped according to LDAP rules.

This means DateTime class would simply be converted to string using
str(DateTime) and that uses default formatting method. For LDAP we need
to apply a specific formatting method instead.

Following LDAP attributes now handled as datetime.datetime:

 ( 1.3.6.1.4.1.5322.21.2.5 NAME 'krbLastAdminUnlock' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE)
 ( 2.16.840.1.113719.1.301.4.6.1 NAME 'krbPrincipalExpiration' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE)
 ( 2.16.840.1.113719.1.301.4.37.1 NAME 'krbPasswordExpiration' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE)
 ( 2.16.840.1.113719.1.301.4.45.1 NAME 'krbLastPwdChange' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE)
 ( 2.16.840.1.113719.1.301.4.48.1 NAME 'krbLastSuccessfulAuth' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE)
 ( 2.16.840.1.113719.1.301.4.49.1 NAME 'krbLastFailedAuth' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE)
 ( 2.16.840.1.113730.3.8.16.1.3  NAME 'ipatokenNotBefore' DESC 'Token validity date' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X-ORIGIN 'IPA OTP')
 ( 2.16.840.1.113730.3.8.16.1.4  NAME 'ipatokenNotAfter' DESC 'Token expiration date' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X-ORIGIN 'IPA OTP')

Fixes: https://pagure.io/freeipa/issue/9395

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
 2023-08-21 16:28:04 +02:00
Antonio Torres d5ae5e1884 Update list of contributors 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2023-08-21 14:57:34 +02:00
Antonio Torres 73c8aa4dc4 Update translations to FreeIPA master state 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2023-08-21 14:55:59 +02:00
Rob Crittenden d98d5e4751 Remove all references to deleted indirect map from parent map 
An attempt to do this was already coded but the wrong
argument was used. It was passing in the location name and
not the map name so the map wouldn't be completely removed.

Include a test to verify that the map is gone after removing
it by calling automountlocation-tofiles which will fail if the
map wasn't properly removed.

Fixes: https://pagure.io/freeipa/issue/9397

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-21 10:49:06 +02:00
Rafael Guterres Jeffman 82b129fe76 Fix typo in "Subordinate ID Selfservice User" role 
The description of "Subordinate ID Selfservice User" role had
'subordiante' instead of 'subordinate'.

This patch corrects the default value and adds a replace to fix
existing deployments.

Related: https://pagure.io/freeipa/issue/9418

Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-08-21 10:41:57 +02:00
Florence Blanc-Renaud 33549183ef ipa-server-guard: make the lock timezone aware 
ipa-server-guard reads a lock file in order to
check if the lock is still taken by comparing
the stored value, for instance:
expire = 20230810155452589311
with the current datetime.

The expire value needs to be timezone-aware in
order to be compared with "now" which is also tz aware.

Related: https://pagure.io/freeipa/issue/9425

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-17 14:28:26 +02:00
Florence Blanc-Renaud 0f16b72bcb ipa-cert-fix: use timezone-aware datetime 
ipa-cert-fix compares the current datetime with the
value obtained from a cert.not_valid_after.
With the fix for #9425, not_valid_after is timezone
aware and cannot be compared to a naive datetime.

Make the datetime "now" timezone aware.
Related: https://pagure.io/freeipa/issue/9425

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-17 14:28:26 +02:00
Florence Blanc-Renaud 59e68f79e4 ipa-epn: include timezone info 
ipa-epn is using timezone-aware timestamps for "now"
but converts krbpasswordexpiration attribute into
a naive datetime object that is missing the tzinfo.

It is not possible to substract timezone aware and
naive values. Convert krbpasswordexpiration attribute
into an UTC value before doing the substration.

Related: https://pagure.io/freeipa/issue/9425

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-17 14:28:26 +02:00
Florence Blanc-Renaud 7796b7b958 Installer: activate nss and pam services in sssd.conf 
If there is already a sssd.conf file before the installer is
executed, the nss and pam services may not be enabled by the
installer. This happens for instance if the machine is hardened
for STIG and sssd.conf does not define services=... in the
[sssd] section.

The consequence is that trust cannot be established with an AD
domain.

The installer must enable nss and pam services even if there is
a pre-existing sssd.conf file.

Fixes: https://pagure.io/freeipa/issue/9427

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-16 14:43:55 +02:00
Florence Blanc-Renaud a6f01115cf ipatests: fixture can produce IndexError 
The fixture issue_and_expire_acme_cert returns a function
that fills the hosts array. If the function is not called in
the test (for instance because a test is skipped, as in
TestACMEPrune::test_prune_cert_search_size_limit), hosts = []
and hosts[0] raises an IndexError.

Fix the fixture to check first that hosts is not empty.

Related: https://pagure.io/freeipa/issue/9348

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
 2023-08-16 11:33:32 +02:00
Endi S. Dewata 33c2740d82 Remove default values for pki_ca_signing_*_path 
In the future pkispawn will validate all path params so the
default values for pki_ca_signing_csr_path and
pki_ca_signing_cert_path need to be removed since they point
to non-existent files. When the params are actually used for
installing an external CA, CAInstance.__spawn_instance()
will initialize them with the correct paths.

Signed-off-by: Endi Sukma Dewata <edewata@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-08-15 12:00:09 -04:00
Florence Blanc-Renaud 6f5fe80de0 ipatests: fix test_topology 
The test TestTopologyOptions::test_add_remove_segment is
randomly failing downstream. Test scenario:
- create a line topology master <-> repl1 <-> repl2
- create user on master
- wait for repl success on master
- check that the user is seen on repl2

The test waits for replication to complete on the master but
it should also wait for the replication to complete on repl1
before checking the user presence on repl2.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
 2023-08-14 09:58:05 +02:00
Sudhir Menon 8e142bc1d4 ipatests: idm api related tests. 
IDM API related tests are automated in the
above PR
Ref: https://freeipa.readthedocs.io/en/latest/api/basic_usage.html

Signed-off-by: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-08-14 09:55:42 +02:00
Endi S. Dewata a9ee2adec3 Remove non-existent default pki_cert_chain_path 
In the future pkispawn will validate all path params so the
default value for pki_cert_chain_path needs to be removed
since it points to a non-existent file. When the param is
actually used (e.g. for installing with an external CA)
CAInstance.__spawn_instance() will configure the param to
point to the actual cert chain.

Signed-off-by: Endi Sukma Dewata <edewata@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-11 09:58:17 +02:00
Endi S. Dewata 7233944e74 Add pki_share_dbuser_dn for CA 
In the future the default value for pki_share_dbuser_dn might
change. To ensure that CA and KRA in IPA will use the same
database user, the pki_share_dbuser_dn needs to be defined
for CA to match the same param for KRA.

Signed-off-by: Endi Sukma Dewata <edewata@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-11 09:57:31 +02:00
Endi S. Dewata cfc4f47a10 Remove unused subsystem.count 
The subsystem.count param has actually been removed since
PKI 10.10 so it doesn't need to be set in renew_ca_cert.in.

Signed-off-by: Endi Sukma Dewata <edewata@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-11 09:56:33 +02:00
Alexander Bokovoy 8173e5df2d ipa-epn: don't use too general exception 
When modifying ipa-epn code, a warning was issued:

--------------
Python 3.11.4 (main, Jun  7 2023, 00:00:00) [GCC 13.1.1 20230511 (Red Hat 13.1.1-2)]
************* Module ipaclient.install.ipa_epn
ipaclient/install/ipa_epn.py:89: [W0719(broad-exception-raised), drop_privileges] Raising too general exception: Exception)
--------------

Use 'RequiresRoot' exception class and clarify the message:
    ipalib.errors.RequiresRoot: Cannot drop privileges!

Related: https://pagure.io/freeipa/issue/9425

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-08-09 18:31:03 +02:00
Alexander Bokovoy 09497d2df0 python 3.12: utcnow function is deprecated 
The following warning is displayed on a system running with Python 3.12:
-------------------
/usr/lib/python3.12/site-packages/ipalib/rpc.py:925: DeprecationWarning:
datetime.utcnow() is deprecated and scheduled for removal in a future
version. Use timezone-aware objects to represent datetimes in UTC:
datetime.now(datetime.UTC).

  timestamp=datetime.datetime.utcnow())
-------------------

Fixes: https://pagure.io/freeipa/issue/9425
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-08-09 18:31:03 +02:00
Mohammad Rizwan bbb53a1271 ipatests: remove fixture call and wait to get things settle 
system date moved in order to expire the certs. Sometime it
is observed that subsequent operation fails with 500 error for CA,
hence restart the services after moving date and wait for sometime
to get things settle.

Also the tests was calling fixture which is not required for it, hence
removed it as well.

Fixes: https://pagure.io/freeipa/issue/9348

Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-08-09 18:28:52 +02:00
Florence Blanc-Renaud e49ec1048d ipatests: update expected webui msg for admin deletion 
The deletion of the admin is now forbidden (even if it is
not the last member of the admins group) and the error
message has changed from "admin cannot be deleted or
disabled because it is the last member of group admins"
to " user admin cannot be deleted/modified: privileged user".

Update the expected message in the webui test.

Related: https://pagure.io/freeipa/issue/8878

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-08 12:53:09 +02:00
Rob Crittenden dea35922cd Prevent the admin user from being deleted 
admin is required for trust operations

Note that testing for removing the last member is now
irrelevant because admin must always exist so the test
for it was removed, but the code check remains. It is done
after the protected member check.

Fixes: https://pagure.io/freeipa/issue/8878

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-01 13:47:56 +02:00
Alexander Bokovoy 69e4397421 idp: when adding an IdP allow to override IdP options 
Use of 'ipa idp-add --provider' was supposed to allow override scope and
other IdP options. The defaults are provided by the IdP template and
were actually not overridden. Fix this.

Fixes: https://pagure.io/freeipa/issue/9421
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-08-01 13:41:59 +02:00
Julien Rische c84c59c66f ipa-kdb: fix error handling of is_master_host() 
Adding proper error handling to the is_master_host() function to allow
it to make the difference between the absence of a master host object
and a connection failure. This will keep the krb5kdc daemon from
continuing to run with a NULL LDAP context.

Fixes: https://pagure.io/freeipa/issue/9422

Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-08-01 13:31:09 +02:00
Rob Crittenden 089907b485 Fix memory leak in the OTP last token plugin 
Three memory leaks are addressed:

1. String values retrieved from the pblock need to be manually
freed.

2. The list of objectclasses retreived from the pblock need to be
freed.

3. Internal search results need to be freed.

Fixes: https://pagure.io/freeipa/issue/9403

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-07-31 18:04:40 +02:00
Florence Blanc-Renaud 7c5ee21a18 ipatests: update expected cksum for epn.conf 
The test test_epn.py::TestEPN::test_EPN_config_file ensures that
/etc/ipa/epn.conf is installed and compares its checksum with an
expected value.
Commit fcad9c9 has changed the content of the file and the cksum
must be updated to reflect the new content.

Fixes: https://pagure.io/freeipa/issue/9419

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-07-28 08:03:55 +02:00
Simon Nussbaum fcad9c9aa7 component: mail_from_realname config setting added to IPA-EPN 
Adding mail_from_realname setting to configuration so that the real name of the sender of the password expiration notification can be customized. This addition does not affect existing configurations.

Fixes: https://pagure.io/freeipa/issue/9336

Signed-off-by: Simon Nussbaum <simon.nussbaum@adfinis.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-07-26 09:01:37 -04:00
Rafael Guterres Jeffman a78c47b2d3 selinux: Update SELinux policy 
SELinux local policies updated due to AVCs found in upstream tests:

- ipa-dnskey_t: dev_read_sysfs
- ipa_ods_exporter_t: dev_read_sysfs
- ipa_helper_t: dev_read_sysfs
- ipa_custodia_t: allow setopt self:tcp_socket

Fixes: https://pagure.io/freeipa/issue/9386

Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-07-25 09:48:37 -04:00
Florence Blanc-Renaud 7517e2ce21 xmlrpc tests: add a test for user plugin with non-existing idp 
Add new tests checking the error returned for
ipa user-add ... --idp nonexistingidp
ipa user-mod ... --idp nonexistingidp
ipa stageuser-add ... --idp nonexistingidp
ipa stageuser-mod ... --idp nonexistingidp

The expected error message is:
ipa: ERROR: External IdP configuration nonexistingidp not found

Related: https://pagure.io/freeipa/issue/9416

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-07-19 16:59:25 -04:00
Florence Blanc-Renaud f57a7dbf50 User plugin: improve error related to non existing idp 
The user and stageuser commands return the following error
when the user is created/updated with a non existing idp:
$ ipa user-add testuser --first test --last user --idp dummy
ipa: ERROR: no such entry

The error is not descriptive enough and has been modified to
display instead:
$ ipa user-add testuser --first test --last user --idp dummy
ipa: ERROR: External IdP configuration dummy not found

Fixes: https://pagure.io/freeipa/issue/9416

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-07-19 16:59:25 -04:00
Miro Hrončok d2ed490ff4 Use ssl.match_hostname from urllib3 as it was removed from Python 3.12 
Based on upstream freeipa rawhide patch by Miro Hrončok

See https://github.com/python/cpython/pull/94224#issuecomment-1621097418

Fixes: https://pagure.io/freeipa/issue/9409

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Miro Hroncok <miro@hroncok.cz>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-07-19 08:27:30 +02:00
Mohammad Rizwan 00c0a62a6a ipatests: enable firewall rule for http service on acme client 
when system hardning done i.e in case of STIG, sometimes http challanges
can't be validated by CA if port 80 is not open. This fix enable it to facilitate
the communication.

Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-07-05 14:48:52 -04:00
Erik Belko 4a3e3efb84 test: add tests for descriptive error message in ipa user-add 
Add tests for renaming existing user and group with invalid name or only numeric name,
add numeric-only stage user, rename some functions and fix indentation
Related: https://pagure.io/freeipa/issue/9378

Signed-off-by: Erik Belko <ebelko@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2023-07-04 15:49:04 +02:00
Florence Blanc-Renaud 7060e3a031 OTP: fix data type to avoid endianness issue 
When 389-ds process an OTP authentication, the ipa-pwd-extop
plugin reads a buffer to extract the authentication type.
The type is stored in an int but the data is a ber_tag_t.

On big endian machines the type cast does not cause any issue
but on s390x the buffer that should return 128 is seen as 0.

As a consequence, the plugin considers that the method is not
LDAP_AUTH_SIMPLE and exits early, without processing the OTP.

The fix is simple and consists in using the right type
(ber_tag_t is an unsigned long).

Fixes: https://pagure.io/freeipa/issue/9402

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-28 17:28:41 +02:00
Florence Blanc-Renaud ce9346e74e ipatests: use dnf download to download pkgs 
The tasks.download_packages method is using
dnf install --downloaddir PATH --downloadonly
but the option --downloaddir does not exist any more with
dnf5 that is shipped in rawhide.

An alternative is to use
dnf download
which downloads to the current directory. This alternative
works for both dnf and dnf5.

Fixes: https://pagure.io/freeipa/issue/9399

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-28 09:28:19 +02:00
Florence Blanc-Renaud 8de6405b11 tests: fix backup-restore scenario with replica 
The test TestBackupAndRestoreWithReplica is simulating a
master crash in order to check the behavior after ipa-restore.

Since commit 67a33e5, the uninstaller restarts the services in
order to unregister the server from PKI security domain. An
indirect consequence is that master/replica communication is re-
established and operations removing entries (done by the uninstaller)
are replicated to the replica.
This means that the scenario does not really simulate a server crash.

To make sure that no replication happens during this "crash", stop
the replica first, then uninstall the master, and finally restart
the replica before calling the ipa-restore command on the master.

Fixes: https://pagure.io/freeipa/issue/9404

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-28 09:10:51 +02:00
Rob Crittenden f1ed46eb93 Differentiate location meaning between host and server 
A host uses Location (nshostlocation) as an optional hint where
a host may phsyically be located (e.g. Lab 2). This will result in
an attribute in the host entry like:
nshostlocation: Lab 2

A server uses location (ipalocation) to identify which DNS location
the server is part of (e.g. prague). This will result in an attribute
in the server entry like:
ipalocation: idnsname=prague,cn=locations,cn=etc,dc=example,dc=test

They are completely different animals.

https://pagure.io/freeipa/issue/9317

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
 2023-06-22 14:45:59 -04:00
Florence Blanc-Renaud 6c84ae5c30 Detection of PKI subsystem 
In order to know if ca/kra is installed locally, the code
is calling pki-server subsystem-show _subsystem_
and ensures that "Enabled: True" is in the output.

If a subsystem fails to start, the command returns
"Enabled: False" but it doesn't mean that the subsystem
is not installed, it just means that it is not active
right now.
Same output if the subsystem has been disabled with
pki-server subsystem-disable _subsystem_.

The correct way to check if a subsystem is installed is to
ensure that subsystem-show does not exit on error and
contains "Enabled: ", whatever the value.

Related: https://pagure.io/freeipa/issue/9330

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-21 21:08:17 +02:00
Florence Blanc-Renaud 67a33e5a30 Uninstaller: uninstall PKI before shutting down services 
The uninstaller is stopping all the services before
calling pkidestroy to uninstall the CA.
With PKI 11.4+ this sequence fails as pkidestroy tries
to connect to PKI server in order to unregister from the
security domain. The error interrupts the full completion
of pkidestroy, is logged but doesn't make ipa uninstallation
fail.
The issue is that trying to re-install later on would fail because
pkidestroy did not completely uninstall the CA.

To avoid this, call pkidestroy before shutting down the services.
Also add an uninstall_check method that restarts IPA if it is
not running, and use pkidestroy --force to make sure that PKI
is uninstalled even if restart failed.

Fixes: https://pagure.io/freeipa/issue/9330

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-21 21:08:17 +02:00
Florence Blanc-Renaud ac78a84fbe Integration tests: add a test to ipa-server-upgrade 
Add an integration test ensuring that the upgrade
properly updates the attributes to be excluded from
replication.

Related: https://pagure.io/freeipa/issue/9385
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-21 20:50:59 +02:00
Florence Blanc-Renaud 143c3eb161 Upgrade: fix replica agreement 
The upgrade checks the replication agreements to ensure that
some attributes are excluded from replication. The agreements
are stored in entries like
cn=serverToreplica,cn=replica,cn=_suffix_,cn=mapping tree,cn=config
but those entries are managed by the replication topology plugin
and should not be updated directly. The consequence is that the update
of the attributes fails and ipa-server-update prints an error message:

Error caught updating nsDS5ReplicatedAttributeList: Server is unwilling
to perform: Entry and attributes are managed by topology plugin.No direct
modifications allowed.
Error caught updating nsDS5ReplicatedAttributeListTotal: Server is
unwilling to perform: Entry and attributes are managed by topology
plugin.No direct modifications allowed.

The upgrade continues but the replication is not excluding
passwordgraceusertime.

Instead of editing the agreements, perform the modifications on
the topology segments.

Fixes: https://pagure.io/freeipa/issue/9385
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-21 20:50:59 +02:00
Florence Blanc-Renaud d76f8fceda Integration test: add a test for upgrade and PKI drop-in file 
Add an upgrade test with the following scenario:
- remove PKI drop-in file (to simulate an upgrade from an old
version)
- remove caECServerCertWithSCT profile from LDAP
- launch the ipa-server-upgrade command
- check that the upgrade added the file

Related: https://pagure.io/freeipa/issue/9381

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-21 08:48:07 +02:00
Florence Blanc-Renaud 0472067ca6 Upgrade: add PKI drop-in file if missing 
During the installation of IPA server, the installer adds a drop-in
file in /etc/systemd/system/pki-tomcatd@pki-tomcat.service.d/ipa.conf
that ensures the CA is reachable before the start command returns.
If the file is missing (for instance because the server was installed
with an old version before this drop-in was created), the upgrade
should add the file.

Fixes: https://pagure.io/freeipa/issue/9381

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-21 08:48:07 +02:00
Florence Blanc-Renaud ae6549ffae xmlrpc tests: add test renaming user or group with setattr 
Add a new test renaming user or group using --setattr.
The new name must be validated and invalid names must be
refused.

Related: https://pagure.io/freeipa/issue/9396

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-16 15:19:10 -04:00
Florence Blanc-Renaud 794b2c32f6 User and groups: rename with --setattr must check format 
There are 2 possible methods to rename users and groups:
- either use ipa user|group-mod oldname --rename newname
- or use settattr:
   ipa user-mod oldname --setattr uid=newname
   ipa group-mod oldname --setattr cn=newname

The first method validates the new name but the second method
doesn't. Add a validation to make both methods consistent

Fixes: https://pagure.io/freeipa/issue/9396

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-06-16 15:19:10 -04:00
Rob Crittenden fa3a69f91f Use the python-cryptography parser directly in cert-find 
cert-find is a rather complex beast because it not only
looks for certificates in the optional CA but within the
IPA LDAP database as well. It has a process to deduplicate
the certificates since any PKI issued certificates will
also be associated with an IPA record.

In order to obtain the data to deduplicate the certificates
the cert from LDAP must be parser for issuer and serial number.
ipaldap has automation to determine the datatype of an
attribute and will use the ipalib.x509 IPACertificate class to
decode a certificate automatically if you access
entry['usercertificate'].

The downside is that this is comparatively slow. Here is the
parse time in microseconds:

cryptography 0.0081
OpenSSL.crypto 0.2271
ipalib.x509 2.6814

Since only issuer and subject are required there is no need to
make the expensive IPACertificate call.

The IPACertificate parsing time is fine if you're parsing one
certificate but if the LDAP search returns a lot of certificates,
say in the thousands, then those microseconds add up quickly.
In testing it took ~17 seconds to parse 5k certificates (excluding
transmission overhead, etc).

cert-find when there are a lot of certificates has been
historically slow. It isn't related to the CA which returns
large sets (well, 5k anyway) in a second or two. It was the
LDAP comparision adding tens of seconds to the runtime.

When searching with the default sizelimit of 100 the time is
~10s without this patch. With it the time is 1.5s.

CLI times from before and after searching for all certs:

original:

-------------------------------
Number of entries returned 5038
-------------------------------
real    0m15.507s
user    0m0.828s
sys     0m0.241s

using cryptography:

real    0m4.037s
user    0m0.816s
sys     0m0.193s

Fixes: https://pagure.io/freeipa/issue/9331

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-06-16 11:15:48 -04:00
Rob Crittenden 8a25020149 Revert "cert_find: fix call with --all" 
This reverts commit 1f30cc6527.

The problem isn't with python-cryptography, it is with the
IPACertificate class which does way more work on a certificate
than is necessary in cert-find.

Related: https://pagure.io/freeipa/issue/9331
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-06-16 11:15:48 -04:00
Rob Crittenden 2a605c5d07 Revert "Use the OpenSSL certificate parser in cert-find" 
This reverts commit 191880bc9f.

The problem isn't with python-cryptography, it is with the
IPACertificate class which does way more work on a certificate
than is necessary in cert-find.

Related: https://pagure.io/freeipa/issue/9331
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-06-16 11:15:48 -04:00
Anuja More d7a27a24b9 ipatests: Check that SSSD_PUBCONF_KRB5_INCLUDE_D_DIR is not included in krb5.conf 
SSSD already provides a config snippet which includes
SSSD_PUBCONF_KRB5_INCLUDE_D_DIR, and having both breaks Java.
Test checks that krb5.conf does not include
SSSD_PUBCONF_KRB5_INCLUDE_D_DIR.

Related: https://pagure.io/freeipa/issue/9267

Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-06-09 10:04:20 +02:00
Rob Crittenden c2bce952d8 Don't allow the FQDN to match the domain on server installs 
Without this the installation is successful but the DNS
records will not work. With --setup-dns there will be no
A record for the host (only an NS record) and the PTR record
will point to the domain name.

Fixes: https://pagure.io/freeipa/issue/9003

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-06-08 16:04:24 -04:00
Florence Blanc-Renaud 1aea1cc29e webuitests: close notification which hides Add button 
The webui test test_service.py::test_service::test_arbitrary_certificates
randomly fails.
The test is creating a new service then navigates to the Service page
and clicks on the Add Certificate button.
The notification area may still be present and hide the button, with
the message "Service successfully added".
Close all notifications before navigating to the Service page.

Fixes: https://pagure.io/freeipa/issue/9389
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2023-06-07 09:53:07 +02:00
Florence Blanc-Renaud 107f5f2d81 ipatest: remove xfail from test_smb 
test_smb is now successful because the windows server version
has been updated to windows-server-2022 with
- KB5012170
- KB5025230
- KB5022507
- servicing stack 10.0.20348.1663
in freeipa-pr-ci commit 3ba4151.

Remove the xfail.

Fixes: https://pagure.io/freeipa/issue/9124
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mohammad Rizwan <myusuf@redhat.com>
 2023-06-05 09:41:14 +02:00
Alexander Bokovoy 3a706e8620 ipa-kdb: be compatible with krb5 1.19 when checking for server referral 
Related: https://pagure.io/freeipa/issue/9164

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-06-02 13:04:14 +02:00
Alexander Bokovoy 18bf495ce8 ipalib/x509.py: Add signature_algorithm_parameters 
Python-cryptography 41.0.0 new abstract method.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
 2023-06-01 11:10:21 +02:00
Alexander Bokovoy 9cdf010ca6 ipa-kdb: skip verification of PAC full checksum 
MIT Kerberos KDC code will do verification of the PAC full checksum
buffers, we don't need to process them. This change only applies to
newer MIT Kerberos version which have this buffer type defined, hence
using #ifdef to protect the use of the define.

This should have no functional difference.

Related: https://pagure.io/freeipa/issue/9371

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
 2023-06-01 11:10:21 +02:00
Alexander Bokovoy d551e853fc ipa-kdb: process out of realm server lookup during S4U 
Kerberos principal aliases lookup had a long-standing TODO item to
support server referrals for host-based aliases. This commit implements
server referrals for hosts belonging to trusted domains. The use-case is
a part of S4U processing in a two-way trust when an IPA service requests
a ticket to a host in a trusted domain (e.g. service on AD DC). In such
situation, the server principal in TGS request will be a normal principal
in our domain and KDC needs to respond with a server referral. This
referral can be issued by a KDB driver or by the KDC itself, using
'domain_realms' section of krb5.conf. Since KDB knows all suffixes
associated with the trusted domains, implement the logic there.

Fixes: https://pagure.io/freeipa/issue/9164

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
 2023-06-01 11:10:21 +02:00
Alexander Bokovoy 03897d8a68 ipa-kdb: postpone ticket checksum configuration 
Postpone ticket checksum configuration after KDB module was initialized.
This, in practice, should now happen when a master key is retrieved.

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
 2023-06-01 11:10:21 +02:00
Alexander Bokovoy 4ef8258d58 ipa-kdb: protect against context corruption 
Early in startup LDAP server might not respond well yet and
should_support_pac_tkt_sign() will bail out with
KRB5_KDB_SERVER_INTERNAL_ERR. We should postpone this call but for time
being we should prevent a crash.

Crash happens because init_module() returns with an error and KDC then
calls fini_module() which will free the DB context which is already
corrupted for some reason.

Do not call any free() call because the whole context is corrupted as
tests do show.

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
 2023-06-01 11:10:21 +02:00
Alexander Bokovoy e00f457f75 ipa-kdb: hint KDC to use aes256-sha1 for forest trust TGT 
From https://krbdev.mit.edu/rt/Ticket/Display.html?id=9089
--------
The KDC uses the first local TGT key for the privsvr and full PAC
checksums.  If this key is of an aes-sha2 enctype in a cross-realm
TGT, a Microsoft KDC in the target realm may reject the ticket because
it has an unexpectedly large privsvr checksum buffer.  This behavior
is unnecessarily picky as the target realm KDC cannot and does not
need to very the privsvr checksum, but [MS-PAC] 2.8.2 does limit the
checksum key to three specific enctypes.
--------

Use MIT Kerberos 1.21+ facility to hint about proper enctype for
cross-realm TGT.

Fixes: https://pagure.io/freeipa/issue/9124

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
 2023-06-01 11:10:21 +02:00
Iker Pedrosa 105b03370c Passkey design: add second sssd design page 
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Iker Pedrosa 957d67aca5 Passkey design: user verification clarification 
User verification clarification regarding PIN prompt.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Iker Pedrosa e0acc51ff5 Passkey design: fix user verification 
User verification is a boolean attribute.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 665227e437 Spec file: bump SSSD version for passkey support 
SSSD 2.9.0 provides support for passkey in rawhide.
Note that f37 and f38 ship 2.9.0 without the passkey feature
but this is not an issue as IPA has a "Recommends: sssd-passkey"
definition, not a "Requires:"

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Alexander Bokovoy e5c292cdad doc/designs: update link to SSSD passkey design page 
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Sumit Bose 8d12d497f6 ipa-otpd: add passkey_child_debug_level option 
By setting passkey_child_debug_level in default.conf the debug level for
the passkey_child helper utility can be set.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Sumit Bose b252988da6 ipa-otpd: add support for passkey authentication 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Sumit Bose a02fd5305e ipa-otpd: make get_krad_attr_from_packet() public 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Sumit Bose 62e28e4247 ipa-otpd: make auth_type_is(), get_string() and get_string_array() public 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Sumit Bose e7a69b3d9f ipa-otpd: make add_krad_attr_to_set() public 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Sumit Bose 9caea3205c ipa-otpd: suppress "function declaration isn't a prototype" warning 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 31b70ee324 Passkey: add a weak dependency on sssd-passkey 
The package sssd-passkey provides the executable
/usr/libexec/sssd/passkey_child
which is not mandatory but recommended.

Add a weak dependency from ipa client package on sssd-passkey.

TBD: when a new version of sssd is released with passkey
support, bump the SSSD version.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 14526c50bb Webui tests: fix test failure 
Fix translation issues in webui unit tests

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud c0f71b0525 passkey: adjust selinux security context for passkey_child 
SSSD ships passkey_child binary in /usr/libexec/sssd and
it needs the same security context as /usr/libexec/sssd/oidc_child
(ipa_otpd_exec_t type).

Add the context in the SELinux policy provided by IPA.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2169438

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 0075c8b8f6 passkeyconfig: require-user-verification is a boolean 
ipa passkeyconfig-mod now accepts Boolean values for
--require-user-verification

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 9963dcdd5b Passkey: update the API doc 
Include changes related to passkey auth indicators.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud b650783a18 Passkey: extract the passkey from stdout 
SSSD's command passkey_child was previously using stderr to
print the following messages:
PIN required.
Please touch the device.
but switched to stdout instead in the commit
https://github.com/SSSD/sssd/commit/6b0d175f8fad63c9c41e0b990c4a5632e96cc3f7

Stdout was used only for displaying the generated passkey.

This means that ipa user-add-passkey --register now must read
stdout line by line and print only the messages that the user
needs to see (all lines except the one containing the passkey).

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud c016e271b2 Passkey: add "passkey configuration" to webui 
Add a "Passkey configuration" subtab in the "Policy" tab,
showing the settings for passkeyconfig.

Related: https://pagure.io/freeipa/issue/9261

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 510f806a9f WebUI: improve passkey display 
The passkey is a long string and not user-friendly.
Instead of showing the whole passkey in the webui, only show
the id part and a string for discoverable or server-side passkey.

Related: https://pagure.io/freeipa/issue/9261
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud c58e483095 Passkey support: show the passkey in webui 
Display the passkey value for user or stageuser
in the user details page
Allow addition/removal of a passkey

Related: https://pagure.io/freeipa/issue/9261
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 6f0da62f5a Passkey: add support for discoverable credentials 
Apart from server-side credentials passkey should also register
discoverable credentials.
ipa user-add-passkey --register now supports an additional option,
--cred-type server-side|discoverable
that is propagated to passkey_child command.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Alexander Bokovoy 56e179748b ipa-kdb: initial support for passkeys 
- added passkey detection based on the presence of ipaPassKey attribute
  in the LDAP entry of the principal
- added 'passkey' authentication indicator
- added support for enforcing KDC policy based on the 'passkey'
  indicator

Fixes: https://pagure.io/freeipa/issue/9263
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud d207f6bf32 WebUI tests: add test for krbtpolicy passkey maxlife/maxrenew 
Add a new test ensuring that it is possible to modify
the krbt policy settings related to passkey authentication
(max life and max renew)

Related: https://pagure.io/freeipa/issue/9262
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud f8580cae4b WebUI: add support for passkey auth type and auth indicator 
Add new checkbox value "Passkey" for authentication type
(user page, config page)
Add new checkbox value "Passkey" for authentication indicator
(service page, host page)
Add new fields for Passkey krbptpolicy (max life, max renew)

Related: https://pagure.io/freeipa/issue/9262
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud a7d90c1ef5 XMLRPC tests: add new tests for passkey auth type 
Add tests for the new passkey authentication type
(ipa user-*, ipa config-mod)
Add tests for the new passkey authentication indicator
(ipa service-*, ipa host-*)
Add tests for the new krbtpolicy parameters
(ipa krbtpolicy-mod --passkey-maxlife=INT --passkeymaxrenew=INT)

Related: ipatests/test_xmlrpc/test_user_plugin.py
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 7911b2466d CLI: add support for passkey authentication type 
Add a new authentication type for Passkey in the following commands:

ipa user-add --user-auth-type=AUTHTYPE
ipa user-mod --user-auth-type=AUTHTYPE
ipa config-mod --user-auth-type=AUTHTYPE
ipa service-add --auth-ind=AUTHTYPE
ipa service-mod --auth-ind=AUTHTYPE
ipa host-add --auth-ind=AUTHTYPE
ipa host-mod --auth-ind=AUTHTYPE
ipa krbtpolicy-mod --passkey-maxlife=INT --passkey-maxrenew=INT

Fixes: https://pagure.io/freeipa/issue/9262
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud ae3c281a64 XMLRPC tests: test new passkey commands 
Add tests for:
 ipa passkeyconfig-show
 ipa passkeyconfig-mod
 ipa user-add-passkey LOGIN PASSKEY
 ipa user-remove-passkey LOGIN PASSKEY
 ipa stageuser-add-passkey LOGIN PASSKEY
 ipa stageuser-remove-passkey LOGIN PASSKEY

Related: https://pagure.io/freeipa/issue/9261
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud a21214cb9e API: add new commands for passkey mappings 
- ipa user-add-passkey
- ipa user-remove-passkey
- ipa stageuser-add-passkey
- ipa stageuser-remove-passkey

Fixes: https://pagure.io/freeipa/issue/9261
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 4bd1be9e90 API: add new commands for ipa passkeyconfig-show | mod 
Currently supports a single parameter:
--require-user-verification [ 'on', 'off', 'default']

Related: https://pagure.io/freeipa/issue/9261
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud af569508c1 New schema for Passkey mappings 
Add attributetypes and objectclasses for Passkey config object
and Passkey mappings.

Related: https://pagure.io/freeipa/issue/9261
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Florence Blanc-Renaud 574517cb16 Design for passkey support 
Related: https://pagure.io/freeipa/issue/9261
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-06-01 08:20:37 +02:00
Rob Crittenden a213253bb1 Don't allow a group to be converted to POSIX and external 
This condition was checked in group-add but not in group-mod.
This evaluation is done later in the pre_callback so that all
the other machinations about posix are already done to make
it easier to tell whether this condition is true or not.

Fixes: https://pagure.io/freeipa/issue/8990

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-05-31 09:24:55 +02:00
Rob Crittenden a1ed0ff77e Replace usage of #!/usr/bin/env python3 with #!/usr/bin/python3 
Only three remaining scripts used this form, two of which are
for developers only and not shipped.

The shebang in ipa-ccache-sweeper will be converted to
"#!$(PYTHON) -I" in the build process.

Fixes: https://pagure.io/freeipa/issue/8941

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
 2023-05-31 09:21:48 +02:00
Florence Blanc-Renaud 2be07242b7 PRCI: update rawhide box 
Update the rawhide Vagrant box to 0.8.3
(built May 26 2023 using fedora-39)

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-05-31 09:17:25 +02:00
Florence Blanc-Renaud 359e1a3d95 ACME tests: fix issue_and_expire_acme_cert method 
The fixture issue_and_expire_acme_cert is changing the date
on master and client. It also resets the admin password as
it gets expired after the date change.
Currently the code is resetting the password by performing
kinit on the client, which leaves the master with an expired
ticket in its cache. Reset the password on the master instead
in order to have a valid ticket for the next operations.

Fixes: https://pagure.io/freeipa/issue/9383

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mohammad Rizwan <myusuf@redhat.com>
 2023-05-24 15:50:56 -04:00
Rob Crittenden 8eeba00c4f Mention in ipa-client-install that nscd is disabled 
Also warn that similar services may also need to be disabled.
An example is an nscd replacement named unscd.

Fixes: https://pagure.io/freeipa/issue/9086

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-05-24 13:29:35 +02:00
Julien Rische 545a363dd2 Filter out constrained delegation ACL from KDB entry 
Commit f78dc0b163 was missing an exception for the constrained
delegation ACL TL data type during the principal entry update operation.
This ACL is not meant to be stored as encoded data in krbExtraData.

Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-05-24 13:20:38 +02:00
Julien Rische 3f1b373cb2 Tolerate absence of PAC ticket signature depending of server capabilities 
Since November 2020, Active Directory KDC generates a new type of
signature as part of the PAC. It is called "ticket signature", and is
generated based on the encrypted part of the ticket. The presence of
this signature is not mandatory in order for the PAC to be accepted for
S4U requests.

However, the behavior is different for MIT krb5. Support was added as
part of the 1.20 release, and this signature is required in order to
process S4U requests. Contrary to the PAC extended KDC signature, the
code generating this signature cannot be isolated and backported to
older krb5 versions because this version of the KDB API does not allow
passing the content of the ticket's encrypted part to IPA.

This is an issue in gradual upgrade scenarios where some IPA servers
rely on 1.19 and older versions of MIT krb5, while others use version
1.20 or newer. A service ticket that was provided by 1.19- IPA KDC will
be rejected when used by a service against a 1.20+ IPA KDC for S4U
requests.

On Fedora, CentOS 9 Stream, and RHEL 9, when the krb5 version is 1.20 or
newer, it will include a downstream-only update adding the
"optional_pac_tkt_chksum" KDB string attribute allowing to tolerate the
absence of PAC ticket signatures, if necessary.

This commit adds an extra step during the installation and update
processes where it adds a "pacTktSignSupported" ipaConfigString
attribute in "cn=KDC,cn=[server],cn=masters,cn=ipa,cn=etc,[basedn]" if
the MIT krb5 version IPA what built with was 1.20 or newer.

This commit also set "optional_pac_tkt_chksum" as a virtual KDB entry
attribute. This means the value of the attribute is not actually stored
in the database (to avoid race conditions), but its value is determined
at the KDC starting time by search the "pacTktSignSupported"
ipaConfigString in the server list. If this value is missing for at
least of them is missing, enforcement of the PAC ticket signature is
disabled by setting "optional_pac_tkt_chksum" to true for the local
realm TGS KDB entry.

For foreign realm TGS KDB entries, the "optional_pac_tkt_chksum" virtual
string attribute is set to true systematically, because, at least for
now, trusted AD domains can still have PAC ticket signature support
disabled.

Given the fact the "pacTktSignSupported" ipaConfigString for a single
server is added when this server is updated, and that the value of
"optional_pac_tkt_chksum" is determined at KDC starting time based on
the ipaConfigString attributes of all the KDCs in the domain, this
requires to restart all the KDCs in the domain after all IPA servers
were updated in order for PAC ticket signature enforcement to actually
take effect.

Fixes: https://pagure.io/freeipa/issue/9371
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-05-24 13:20:38 +02:00
Julien Rische 9cd5f49c74 kdb: Use krb5_pac_full_sign_compat() when available 
In November 2022, Microsoft introduced a new PAC signature type called
"extended KDC signature" (or "full PAC checksum"). This new PAC
signature will be required by default by Active Directory in July 2023
for S4U requests, and opt-out will no longer be possible after October
2023.

Support for this new signature type was added to MIT krb5, but it relies
on the new KDB API introduced in krb5 1.20. For older MIT krb5 versions,
the code generating extended KDC signatures cannot be backported as it
is without backporting the full new KDB API code too. This would have
too much impact to be done.

As a consequence, krb5 packages for Fedora 37, CentOS 8 Stream, and RHEL
8 will include a downstream-only update adding the
krb5_pac_full_sign_compat() function, which can be used in combination
with the prior to 1.20 KDB API to generate PAC extended KDC signatures.

Fixes: https://pagure.io/freeipa/issue/9373
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-05-24 13:20:38 +02:00
Jerry James da65cc35bd Change fontawesome-fonts requires to match fontawesome 4.x 
fontawesome 6.x is not entirely compatible with 4.x version but in
Fedora the change was made to make 4.x bits FreeIPA depends on to be
forward-ported to 6.x build. This also allows to have common dependency
for all versions.

This patch switches to the common dependency using 'fonts(fontawesome)'.
This works on all Fedora and RHEL versions.

Signed-off-by: Jerry James <loganjerry@gmail.com>
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-05-23 09:26:58 -04:00
Florence Blanc-Renaud 7b0ad59fea user or group name: explain the supported format 
The commands ipa user-add or ipa group-add validate the
format of the user/group name and display the following
message when it does not conform to the expectations:
invalid 'login': may only include letters, numbers, _, -, . and $

The format is more complex, for instance '1234567' is an invalid
user name but the failure is inconsistent with the error message.
Modify the error message to point to ipa help user/group and add
more details in the help message.

Same change for idoverrideuser and idoverridegroup:
The user/group name must follow these rules:
- cannot contain only numbers
- must start with a letter, a number, _ or .
- may contain letters, numbers, _, ., or -
- may end with a letter, a number, _, ., - or $

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2150217

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-05-22 20:22:59 +02:00
Antonio Torres 479a24f285 Update contributors list 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2023-05-19 10:03:15 +02:00
Antonio Torres eec46800d5 Update translations to FreeIPA master state 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2023-05-19 09:58:02 +02:00
Mohammad Rizwan 2eb4cdb641 ipatests: wait for sssd-kcm to settle after date change 
In order to expire the ACME cert, system is moved and while
issuing the kinit command, results into failure.

Hence run kinit command repeatedly untill things get settle.

This patch removes the sleep and adds tasks.run_repeatedly()
method instead.

Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-05-17 18:12:27 +02:00
Florence Blanc-Renaud 72dccd8244 azure tests: move to fedora 38 
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-05-16 13:12:12 +02:00
Rob Crittenden 9e80616401 Return the <Message> value cert-find failures from the CA 
If a cert-find fails on the CA side we get a Message tag
containing a string describing the failure plus the java stack
trace. Pull out the first part of the message as defined by the
first colon and include that in the error message returned to
the user.

The new message will appear as:

$ ipa cert-find
ipa: ERROR: Certificate operation cannot be completed: Unable to search for certificates (500)

vs the old generic message:

ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (500)

This can be reproduced by setting nssizelimit to 100 on the
pkidbuser. The internal PKI search returns err=4 but the CA
tries to convert all values into certificates and it fails. The
value needs to be high enough that the CA can start but low
enough that you don't have to create hundreds of certificates
to demonstrate the issue.

https://pagure.io/freeipa/issue/9369

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-05-16 13:09:56 +02:00
Michal Polovka abf1dc557e ipatests: commands: Wait for the SSSD to become available 
Previous test to test_ssh_key_connection is calling ipa-server-upgrade command,
which restarts all the associated services.
Especially on slower machine, SSSD is not yet online when the SSH connection is attempted.
This results to only cached users being available.
Wait for SSSD to become available before the SSH connection is attempted.

Fixes: https://pagure.io/freeipa/issue/9377

Signed-off-by: Michal Polovka <mpolovka@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
 2023-05-16 13:00:57 +02:00
Florence Blanc-Renaud 72cc53a22e Tests: test on f37 and f38 
Fedora 38 is now available, move the testing pipelines to
- fedora 38 for the _latest definitions
- fedora 37 for the _previous definitions

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-05-09 18:05:24 +02:00
Florence Blanc-Renaud c8c05289f8 idview: improve performance of idview-show 
The command ipa idview-show NAME has a post callback
method that replaces the ID override anchor with the corresponding
user name.
For instance the anchor
ipaanchoruuid=:SID:S-1-5-21-3951964782-819614989-3867706637-1114
is replaced with the name of the ad user aduser@ad.test.

The method loops on all the anchors and for each one performs the
resolution, which can be a costly operation if the anchor is for
a trusted user. Instead of doing a search for each anchor, it is
possible to read the 'ipaOriginalUid' value from the ID override
entry.

Fixes: https://pagure.io/freeipa/issue/9372

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-05-05 14:17:18 -04:00
s1341 f66160fdc9 ipaplatform: add initial nixos support 
Fixes: https://pagure.io/freeipa/issue/9299
Signed-off-by: Shmarya Rubenstein <github@shmarya.net>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-05-04 14:58:15 +02:00
Florence Blanc-Renaud 2c41b49bfc spec file: force nodejs < 20 on fedora < 39 
On fedora < 39, nodejs 20 is not the default version. As
a consequence, the installation of nodejs20 adds the command
/usr/bin/node-20 instead of /usr/bin/node.
FreeIPA build is using the node command and fails if the
command is missing.

Force nodejs < 20 on fedora < 39 to make sure the node
command is installed.

Fixes: https://pagure.io/freeipa/issue/9374

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-05-04 13:37:58 +02:00
Florence Blanc-Renaud c7ef94c62f Nightly test: add +15min for test_ipahealthcheck 
The test test_ipahealthcheck.py::TestIpaHealthcheck frequently
hits its 90min timeout. Extend by 15min to allow completion.

Fixes: https://pagure.io/freeipa/issue/9362
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
 2023-05-04 08:33:53 +02:00
Alexander Bokovoy e0c4f83abd Change doc theme to 'book' 
RTD theam is not compatible with Sphinx 7.0+
https://github.com/readthedocs/readthedocs.org/issues/10279

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-05-03 18:21:12 +02:00
mbhalodi ef0ae496b7 ipatests: add remove automember condition tests 
Related: https://pagure.io/freeipa/issue/9332

Signed-off-by: mbhalodi <mbhalodi@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-05-02 20:40:01 +02:00
Stanislav Levin cfc0233369 ipasphinx: Correct import of progress_message for Sphinx 6.1.0+ 
Pylint reports false-negative result for Sphinx 6.1.0+:

```
************* Module ipasphinx.ipabase
ipasphinx/ipabase.py:10: [E0611(no-name-in-module), ] No name 'progress_message' in module 'sphinx.util')
```

Actually `sphinx.util.progress_message` is still available in Sphinx 6.1
but it's deprecated and will be removed in 8.0:
https://www.sphinx-doc.org/en/master/extdev/deprecated.html#deprecated-apis

Related change:
https://github.com/sphinx-doc/sphinx/commit/8c5e7013ea5f6a50e3cc3130b22205a85ba87fab

Fixes: https://pagure.io/freeipa/issue/9361
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-28 13:20:30 -04:00
Florence Blanc-Renaud 1f30cc6527 cert_find: fix call with --all 
When ipa cert-find --all is called, the function prints the
certificate public bytes. The code recently switched to OpenSSL.crypto
and the objects OpenSSL.crypto.X509 do not have the method
public_bytes(). Use to_cryptography() to transform into a
cryptography.x509.Certificate before calling public_bytes().

Related: https://pagure.io/freeipa/issue/9331

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-28 10:12:46 -04:00
Rafael Guterres Jeffman fd0fd487df Fix "no entry" condition when searching PAC info 
Fix Covscan-discovered DEADCODE block when searching for PAC info,
caused by a wrong condition being evaluated when entry is a trusted
domain object.

Fixes: https://pagure.io/freeipa/issue/9368

Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-04-28 10:11:30 -04:00
Sudhir Menon dd22bd2528 ipatests: ipa-adtrust-install command test scenarios 
This patch includes additional testcase that can be run
against ipa-adtrust-install CLI tool.

test_adtrust_install_with_incorrect_netbios_name
test_adtrust_install_as_regular_ipa_user
test_adtrust_install_with_incorrect_admin_password
test_adtrust_install_with_invalid_rid_base_value
test_adtrust_install_with_invalid_secondary_rid_base
test_adtrust_reinstall_updates_ipaNTFlatName_attribute
test_adtrust_install_without_ipa_installed
test_samba_credential_cache_is_removed_post_uninstall
test_adtrust_install_without_integrated_dns
test_adtrust_install_with_debug_option
test_adtrust_install_cli_without_smbpasswd_file
test_adtrust_install_enable_compat
test_adtrust_install_invalid_ipaddress_option
test_syntax_error_in_ipachangeconf
test_unattended_adtrust_install_uses_default_netbios_name
test_smb_not_starting_post_adtrust_install

Signed-off-by: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-04-28 16:08:56 +02:00
Timo Aaltonen a83ae63578 Drop duplicate includedir from krb5.conf 
SSSD already provides a config snippet which includes
SSSD_PUBCONF_KRB5_INCLUDE_D_DIR, and having both breaks Java.

Add also a dependency on sssd-krb5 for freeipa-client.

https://pagure.io/freeipa/issue/9267

Signed-off-by: Timo Aaltonen <tjaalton@debian.org>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-27 08:52:51 +02:00
Rob Crittenden 191880bc9f Use the OpenSSL certificate parser in cert-find 
cert-find is a rather complex beast because it not only
looks for certificates in the optional CA but within the
IPA LDAP database as well. It has a process to deduplicate
the certificates since any PKI issued certificates will
also be associated with an IPA record.

In order to obtain the data to deduplicate the certificates
the cert from LDAP must be parser for issuer and serial number.
ipaldap has automation to determine the datatype of an
attribute and will use the python-cryptography engine to
decode a certificate automatically if you access
entry['usercertificate'].

The downside is that this is comparatively slow. Here is the
parse time in microseconds:

OpenSSL.crypto 175
pyasn1 1010
python-cryptography 3136

The python-cryptography time is fine if you're parsing one
certificate but if the LDAP search returns a lot of certificates,
say in the thousands, then those microseconds add up quickly.
In testing it took ~17 seconds to parse 5k certificates.

It's hard to overstate just how much better the cryptography
Python interface is. In the case of OpenSSL really the only
certificate fields easily available are serial number, subject
and issuer. And the subject/issuer are in the OpenSSL reverse
format which doesn't compare nicely to the cryptography format.
The DN module can correct this.

Fortunately for cert-find we only need serial number and issuer,
so the OpenSSL module fine. It takes ~2 seconds.

pyasn1 is also relatively faster but switch to it would require
subtantially more effort for less payback.

cert-find when there are a lot of certificates has been
historically slow. It isn't related to the CA which returns
large sets (well, 5k anyway) in a second or two. It was the
LDAP comparision adding tens of seconds to the runtime.

CLI times from before and after:

original:

-------------------------------
Number of entries returned 5011
-------------------------------
real    0m21.155s
user    0m0.835s
sys     0m0.159s

using OpenSSL:

real    0m5.747s
user    0m0.864s
sys     0m0.148s

OpenSSL is forcibly lazy-loaded so it doesn't conflict with
python-requests.  See ipaserver/wsgi.py for the gory details.

Fixes: https://pagure.io/freeipa/issue/9331

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
 2023-04-26 14:21:33 -04:00
Rob Crittenden 2b2f10c2eb Enforce sizelimit in cert-find 
The sizelimit option was not being passed into the dogtag
ra_find() command so it always returned all available certificates.

A value of 0 will retain old behavior and return all certificates.

The default value is the LDAP searchsizelimit.

Related: https://pagure.io/freeipa/issue/9331

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
 2023-04-26 14:21:33 -04:00
Michal Polovka ba845b237f ipatest: loginscreen: do not use hardcoded password 
Use admin password obtained from local config instead of hardcoded
value, as the password may differ in different testing environments.

https://pagure.io/freeipa/issue/9226

Signed-off-by: Michal Polovka <mpolovka@redhat.com>
Reviewed-By: Erik Belko <ebelko@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-04-19 21:46:14 +02:00
Todd Zullinger 4f9e6b1bed spec: silence krb5 pkgconf errors in %krb5_base_version 
Send stderr of pkgconf to /dev/null rather than printing the following
error text while parsing the spec file:

    Package krb5 was not found in the pkg-config search path.
    Perhaps you should add the directory containing `krb5.pc'
    to the PKG_CONFIG_PATH environment variable
    Package 'krb5', required by 'virtual:world', not found

`BuildRequires: pkgconfig(krb5)` ensures this won't happen when running
a real build.  It simply avoids 4 lines of needless error output when
running something like `fedpkg prep`.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-04-18 08:32:54 +02:00
Todd Zullinger 0d72a6cf5c spec: verify upstream source signature 
Per the Fedora packaging guidelines¹.

The GPG key was generated using details found on the wiki².  The
following commands can be used to fetch the signing key via fingerprint
and extract it:

    fpr=0E63D716D76AC080A4A33513F40800B6298EB963
    gpg --keyserver keys.openpgp.org --receive-keys $fpr
    gpg --armor --export-options export-minimal --export $fpr >gpgkey-$fpr.asc

¹ https://docs.fedoraproject.org/en-US/packaging-guidelines/#_verifying_signatures
² https://www.freeipa.org/page/Verify_Release_Signature

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-04-18 08:32:54 +02:00
Christian Heimes 903c8f9dcf Speed up installer by restarting DS after DNA plugin 
DS does not enable plugins unless nsslapd-dynamic-plugins is enabled or
DS is restarted. The DNA plugin creates its configuration entries with
some delay after the plugin is enabled.

DS is now restarted after the DNA plugin is enabled so it can create the
entries while Dogtag and the rest of the system is installing. The
updater `update_dna_shared_config` no longer blocks and waits for two
times 60 seconds for `posix-ids` and `subordinate-ids`.

Fixes: https://pagure.io/freeipa/issue/9358
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-17 15:15:09 -04:00
Florence Blanc-Renaud 3bba254ccd ipatests: mark known failures for autoprivategroup 
Two tests have known issues in test_trust.py with sssd 2.8.2+:
- TestNonPosixAutoPrivateGroup::test_idoverride_with_auto_private_group
(when called with the "hybrid" parameter)
- TestPosixAutoPrivateGroup::test_only_uid_number_auto_private_group_default
(when called with the "true" parameter)

Related: https://pagure.io/freeipa/issue/9295
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-04-17 16:44:57 +02:00
mbhalodi dc8590ef66 ipatests: Test for sequence processing failures with server context 
1 : Test to verify that groups have correct userclass when
external is set to true or false with group-add.
2 : After creating a nonposix group verify that all
following group_add calls to add posix groups calls are
not failing with missing attribute.

Related: https://pagure.io/freeipa/issue/9349

Signed-off-by: mbhalodi <mbhalodi@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
 2023-04-12 15:10:04 +02:00
Antonio Torres 88d8534e49 Extend API documentation 
This includes:

* Section about command/param info in usage guide
* Section about metadata retrieval in usage guide
* Guide about differences between CLI and API
* Access control guide (management of roles, privileges and
  permissions).
* Guide about API contexts
* JSON-RPC usage guide and JSON-to-Python conversion
* Notes about types in API Reference

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-06 08:56:35 +02:00
Alexander Bokovoy 0bf0b2d251 doc/designs/rbcd.md: document use of S-1-18-* SIDs 
Fixes: https://pagure.io/freeipa/issue/9354

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
Alexander Bokovoy 667b82a870 doc/designs/rbcd.md: add usage examples 
Fixes: https://pagure.io/freeipa/issue/9354

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
Alexander Bokovoy dd5b189a09 RBCD: add basic test for RBCD handling 
Add a test that uses IPA API to allow delegation of RBCD configuration
to a host and then use it to set up RBCD rule for a service.

Run RBCD check when the rule exists and when the rule is removed.

Since we only provide RBCD support on KDC side with Kerberos 1.20, skip
the test on Fedora versions prior to Fedora 38 and on RHEL versions
prior to RHEL 9.2.

Fixes: https://pagure.io/freeipa/issue/9354

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
Alexander Bokovoy f78dc0b163 kdb: implement RBCD handling in KDB driver 
Resource-based constrained delegation (RBCD) is implemented with a new
callback used by the KDC. This callback is called when a server asks for
S4U2Proxy TGS request and passes a ticket that contains RBCD PAC
options.

The callback is supposed to take a client and a server principals, a PAC and a target
service database entry. Using the target service database entry it then
needs to decide whether a server principal is allowed to delegate the
client credentials to the target service.

The callback can also cross-check whether the client principal can be
limited in delegating own tickets but this is not implemented in the
current version.

Fixes: https://pagure.io/freeipa/issue/9354

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
Alexander Bokovoy 4239b77a6d IPA API changes to support RBCD 
IPA API commands to manage RBCD access controls.

Fixes: https://pagure.io/freeipa/issue/9354

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
Alexander Bokovoy b035ac8eb9 doc: add design document for Kerberos constrained delegation 
FreeIPA Kerberos implementation already supports delegation of
credentails, both unconstrained and constrained. Constrained delegation
is an extension developed by Microsoft and documented in MS-SFU
specification. MS-SFU specification also includes resource-based
constrained delegation (RBCD) which FreeIPA did not support.

Microsoft has decided to force use of RBCD for forest trust. This means
that certain use-cases will not be possible anymore.

This design document outlines approaches used by FreeIPA for constrained
delegation implementation, including RBCD.

Fixes: https://pagure.io/freeipa/issue/9354

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
Alexander Bokovoy adc9609ff3 ipa-kdb: search S4U2Proxy ACLs in cn=s4u2proxy,cn=etc,$BASEDN subtree only 
Confine search for S4U2Proxy access control lists to the subtree where
they created. This will allow to use a similar method to describe RBCD
access controls.

Related: https://pagure.io/freeipa/issue/5444

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
Alexander Bokovoy 9b777390fb test_xmlrpc: adopt to automember plugin message changes in 389-ds 
Another change in automember plugin messaging that breaks FreeIPA tests.
Use common substring to match.

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
Alexander Bokovoy 68c113f02b Ignore empty modification error in case cifs/.. principal already added 
Constrained delegation target may already be configured by default.

Related: https://pagure.io/freeipa/issue/9354

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-05 14:55:22 -04:00
mbhalodi 4119e4e799 ipatests: add missing automember-cli tests 
Revisit the bash tests and port the valid
tests to upstream.

Related: https://pagure.io/freeipa/issue/9332

Signed-off-by: mbhalodi <mbhalodi@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2023-04-04 16:11:32 +02:00
Jarl Gullberg 5a0eed0b1a ipaplatform/debian: fix path to ldap.so 
bind-dyndb-ldap on Debian installs ldap.so in a subdirectory of
/usr/lib to prevent unintentional usage of an unversioned .so.
The default settings for FreeIPA on Debian used an incomplete
path, resulting in a failure to find ldap.so when bind attempts to
start with bind-dyndb-ldap configured.

This fixes the default path to use the appropriate location in its
multiarch-qualified path.

Signed-off-by: Jarl Gullberg <jarl.gullberg@gmail.com>
Reviewed-By: Timo Aaltonen <tjaalton@ubuntu.com>
 2023-04-04 09:35:49 -04:00
Jarl Gullberg a59f6e00d9 install: Fix missing dyndb keytab directive 
bind-dyndb-ldap uses the krb5_keytab directive to set the path to
the keytab to use. This directive was not being used in the
configuration template, resulting in a failure to start named if
the keytab path differed from the defaults.

This issue was discovered when packaging FreeIPA for Debian,
which is one of the platforms where the path is customized.

Signed-off-by: Jarl Gullberg <jarl.gullberg@gmail.com>
Fixes: https://pagure.io/freeipa/issue/9344
Reviewed-By: Timo Aaltonen <tjaalton@ubuntu.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-04-03 16:58:27 -04:00
Antonio Torres c553e3ceb2 doc: allow notes on Param API Reference pages 
The notes that Param pages will contain after #6733 are added manually,
and because of it we need to add markers to differentiate between
automated and manual content, equal to what we do for class pages.

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-03-29 10:53:25 +02:00
Alexander Bokovoy 3721bca657 ipalib/x509: Implement abstract method Certificate.verify_directly_issued_by 
Added in Python Cryptography 40.0
Thanks to @tiran for the code

Fixes: https://pagure.io/freeipa/issue/9355

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-03-29 10:45:07 +02:00
Stanislav Levin d32c640df0 fastlint: Correct concatenation of file lists 
`printf` ignores excessive arguments unused in formatting.
This resulted in only the first file from two file lists was
linted/ stylechecked if both Python template files and Python
modules were changed.

Make use of formatting instead:
> The format is reused as necessary to consume all of the arguments

Fixes: https://pagure.io/freeipa/issue/9318
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-03-24 11:49:23 +01:00
Florence Blanc-Renaud 07fe877525 ipatests: increase timeout for test_trust 
The timeout for test_trust is too short (6000s) and
the nightly tests often fail. Increase to 7200s.

Fixes: https://pagure.io/freeipa/issue/9326

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
 2023-03-24 09:28:43 +01:00
Antonio Torres 05279ef447 ipaserver: deepcopy objectclasses list from IPA config 
We need to deepcopy the list of default objectlasses from IPA config
before assigning it to an entry, in order to avoid further modifications of the
entry affect the cached IPA config.

Fixes: https://pagure.io/freeipa/issue/9349
Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
 2023-03-23 10:12:44 +01:00
Anuja More 1cca609857 ipatests: Test that non admin user can search hbac rule. 
Related : https://pagure.io/freeipa/issue/5130

Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-03-22 16:52:49 +01:00
Alexander Bokovoy 3f9d9b2626 Fix tox in Azure CI 
Fixes: https://pagure.io/freeipa/issue/9347

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2023-03-21 16:54:28 +01:00
Alexander Bokovoy ebac8f6f9b Use system-wide chromium for webui tests 
Fixes: https://pagure.io/freeipa/issue/9347

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2023-03-21 16:54:28 +01:00
Alexander Bokovoy 779aa6bc11 Don't fail if optional RPM macros file is missing 
With fix for https://pagure.io/freeipa/issue/7951 we started to modify
RPM macros in Azure CI environment. Don't fail if the file does not
exist anymore like it happens now in Fedora.

Fixes: https://pagure.io/freeipa/issue/9347

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2023-03-21 16:54:28 +01:00
Erik Belko 4acd9fe9f7 ipatests: Test MemberManager ACI to allow managers from a specified group after upgrade scenario 
Testing if manager whose rights defined by the group membership
is able to add group members, after upgrade of ipa server.
Using ACI modification to demonstrate unability before upgrading
ipa server.
Related: https://pagure.io/freeipa/issue/9286

Also added some generally helpful functions to tasks.py

Signed-off-by: Erik Belko <ebelko@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2023-03-15 09:45:08 +01:00
Anuja More 35c36f9b4e ipatests: Test ipa-advise is not failing with error. 
The ipa-advise command should not fail
with error in command.

Related: https://pagure.io/freeipa/issue/6044

Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Sudhir Menon <sumenon@redhat.com>
 2023-03-14 13:49:09 +01:00
Florence Blanc-Renaud 5dba2aa466 ipatests: adapt for new automembership fixup behavior 
The automembership fixup task now needs to be called
with --cleanup argument when the user expects automember
to remove user/hosts from automember groups.
Update the test to call create a cleanup task equivalent to
dsconf plugin automember fixup --cleanup
when it is needed.

Fixes: https://pagure.io/freeipa/issue/9313
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-03-14 09:39:17 +01:00
Thorsten Scherf 2aeb963fc9 external-idp: change idp server name to reference name 
When you  run "ipa idp-show <idp reference>" the IdP reference is shown
as "Identity Provider server name". This is confusing as we are pointing
to the earlier created IdP reference rather than a server.  Other files
are updated as well to reflect this change.

Additionally some typos are fixed with this patch too.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-03-03 05:08:02 +01:00
Carla Martinez 16b3977119 Update 'Auth indicators' doc string 
The doc string located in the 'Authentication
indicators' ('Services' settings page) was
missing the usage explanation for the 'ipd'
checkbox option.

Fixes: https://pagure.io/freeipa/issue/9338
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-03-02 15:25:44 -05:00
Stanislav Levin 1420599165 dns: Fix support for dnspython 1.1x 
`nameservers` was transformed into the property in dnspython 2:
https://github.com/rthalley/dnspython/commit/bbf0cfd239ffa6deeb67a4787bd292e9a972af74

This causes
> AttributeError: type object 'Resolver' has no attribute 'nameservers'
on the previous dnspython 1.1x.

Fixes: https://pagure.io/freeipa/issue/9339
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-03-02 10:06:04 -05:00
Rafael Guterres Jeffman 02b0e46b7f Migrated to SPDX license. 
According to [1] all Fedora packages need to be updated to use a SPDX
expression. This patch updates the freeipa spec template to comply with
this change.

[1] https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1

Fixes: https://pagure.io/freeipa/issue/9342

Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-03-02 05:03:41 +01:00
Christian Heimes 074c2f5421 Don't block when kinit_pkinit() fails 
Installation of ipa-client with PKINIT authentication can block when
there is a problem with PKINIT, e.g. KDC does not accept the cert or the
anchor chain is incomplete. `kinit` falls back to password
authentication and asks the user to enter a password.

`kinit` does not have an option to force non-interactive mode. Sending
`\n` to stdin seems to be the only solution here.

Fixes: https://pagure.io/freeipa/issue/9333
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-02-28 17:23:02 -05:00
Florence Blanc-Renaud 9ee16e8acc ipatests: increase timeout for test_acme 
The test test_integration/test_acme.py times out frequently
and has a current timeout set to 2h, which is roughly
the average time for a successful run.

Increase by 15 minutes, so that even the tests requiring
packages update have enough time (for instance rawhide
run needs to update all the packages to the latest version).

Also create a separate job for the new test TestACMEPrune.

Fixes: https://pagure.io/freeipa/issue/9324

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-02-22 15:47:26 +01:00
mbhalodi 14a3d85a15 ipatests: WebUI - ensure that ipa automember-rebuild prints a warning 
ipa automember-rebuild now prints a warning about CPU usage
in the WebUI. Ensure that the warning is properly displayed.

Related: https://pagure.io/freeipa/issue/9320

Signed-off-by: mbhalodi <mbhalodi@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2023-02-22 09:16:30 +01:00
Mohammad Rizwan e76b219c21 ipatests: fix tests in TestACMEPrune 
When cron_minute + 5 > 59, cron job throwing error for it.
i.e 58 + 5 = 63 which is not acceptable value for cron minute.

Second fix is related to mismatch of confing setting and corresponding
assert.

Third fix is related to extending time by 60 minutes to properly
expire the certs.

related: https://pagure.io/freeipa/issue/9294

Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-21 15:19:02 +01:00
Rob Crittenden 50d40b5a9f doc: Update pruning design with implement enable/disable options 
Instead of passing TRUE/FALSE to a single --enable option
use two flags instead, which IMHO is clearer.

So --enable=TRUE to --enable and --enable=FALSE to --disable

Fixes: https://pagure.io/freeipa/issue/9323

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-20 10:43:17 +01:00
mbhalodi 6a809ff58f ipatests: ensure that ipa automember-rebuild prints a warning 
ipa automember-rebuild now prints a warning about CPU usage.
Ensure that the warning is properly displayed.

Related: https://pagure.io/freeipa/issue/9320

Signed-off-by: mbhalodi <mbhalodi@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-18 09:04:20 +01:00
David Pascual b0636c5408 doc: Use case examples for PR-CI checker tool 
This document showcases common usecases for the user to
interact with the PR-CI checker tool.

Signed-off-by: David Pascual <davherna@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-02-18 09:02:27 +01:00
Stanislav Levin 64fa6b7241 tests: webui: Update vendored qunit 
Updated qunit to latest supported version from
https://code.jquery.com/qunit.

See https://qunitjs.com/intro/#release-channels for details.

Related: https://pagure.io/freeipa/issue/9329
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-17 09:44:53 +01:00
Stanislav Levin 8d634d8abf AP: webui: List installed nodejs packages 
It's helpful for debugging regressions.

Related: https://pagure.io/freeipa/issue/9329
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-17 09:44:53 +01:00
Stanislav Levin a7e13f9719 tests: webui: Load qunit only once 
webui unit tests fail with grunt-contrib-qunit:
```
Testing test/all_tests.html

>> Error: Error: QUnit has already been defined.
>>     at exportQUnit (file:///home/test/freeipa/install/ui/js/qunit.js:2475:12)
>>     at file:///home/test/freeipa/install/ui/js/qunit.js:2946:3
>>     at file:///home/test/freeipa/install/ui/js/qunit.js:5061:2

>> Error: TypeError: Cannot set properties of undefined (setting 'reorder')
>>     at <anonymous>:175:24
>>     at runFactory (file:///home/test/freeipa/install/ui/js/dojo/dojo.js:1:17157)
>>     at execModule (file:///home/test/freeipa/install/ui/js/dojo/dojo.js:1:19541)
>>     at file:///home/test/freeipa/install/ui/js/dojo/dojo.js:1:20002
>>     at guardCheckComplete (file:///home/test/freeipa/install/ui/js/dojo/dojo.js:1:19707)
>>     at checkComplete (file:///home/test/freeipa/install/ui/js/dojo/dojo.js:1:19854)
>>     at onLoadCallback (file:///home/test/freeipa/install/ui/js/dojo/dojo.js:1:22296)
>>     at HTMLScriptElement.onLoad (file:///home/test/freeipa/install/ui/js/dojo/dojo.js:1:26209)
```

Load `qunit` with `dojo.require` that among other useful things helps
> Preventing loading Dojo packages twice.
  dojo.require will simply return if the package is already loaded.

See also https://github.com/gruntjs/grunt-contrib-qunit#loading-qunit-with-amd

Related: https://pagure.io/freeipa/issue/9329
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-17 09:44:53 +01:00
Stanislav Levin 5c35405e78 tests: webui: Allow file access from files in tests 
https://peter.sh/experiments/chromium-command-line-switches/#allow-file-access-from-files
> By default, file:// URIs cannot read other file:// URIs. This is an
  override for developers who need the old behavior for testing.

Fixes webui tests on CI:
```
Testing test/all_tests.html
Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help, check https://xhr.spec.whatwg.org/.
Access to XMLHttpRequest at 'file:///__w/freeipa/freeipa/install/ui/test/qunit.js' from origin 'null' has been blocked by CORS policy: Cross origin requests are only supported for protocol schemes: http, data, chrome, chrome-untrusted, https.
Failed to load resource: net::ERR_FAILED
Access to XMLHttpRequest at 'file:///__w/freeipa/freeipa/install/ui/test/data/i18n_messages.json' from origin 'null' has been blocked by CORS policy: Cross origin requests are only supported for protocol schemes: http, data, chrome, chrome-untrusted, https.
Failed to load resource: net::ERR_FAILED
>> Error: Error: Couldn't receive translations
```

Related: https://pagure.io/freeipa/issue/9329
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-17 09:44:53 +01:00
Anuja More 8d92546447 PRCI: update test_trust.py for nightly pipelines. 
test_integration/test_trust.py is divided into two parts.
1: class TestTrust
2: class TestNonPosixAutoPrivateGroup, class TestPosixAutoPrivateGroup

Fixes: https://pagure.io/freeipa/issue/9326

Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-15 08:26:44 +01:00
Mohammad Rizwan 828f6e7c92 ipatests: tests for certificate pruning 
1. Test to prune the expired certificate by manual run
2. Test to prune expired certificate by cron job
3. Test to prune expired certificate with retention unit option
4. Test to prune expired certificate with search size limit option
5. Test to check config-show command shows set param
6. Test prune command shows proper status after disabling the pruning

related: https://pagure.io/freeipa/issue/9294

Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-02-13 14:30:05 -05:00
Anuja More 0b762d2b2a Add test for SSH with GSSAPI auth. 
Added test for aduser with GSSAPI authentication.

Related : https://pagure.io/freeipa/issue/9316

Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-02-09 14:29:38 -05:00
Alexander Bokovoy 0c32ebf858 ipa-kdb: PAC consistency checker needs to handle child domains as well 
When PAC check is performed, we might get a signing TGT instead of the
client DB entry. This means it is a principal from a trusted domain but
we don't know which one exactly because we only have a krbtgt for the
forest root. This happens in MIT Kerberos 1.20 or later where KDB's
issue_pac() callback never gets the original client principal directly.

Look into known child domains as well and make pass the check if both
NetBIOS name and SID correspond to one of the trusted domains under this
forest root. Move check for the SID before NetBIOS name check because we
can use SID of the domain in PAC to find out the right child domain in
our trusted domains' topology list.

Fixes: https://pagure.io/freeipa/issue/9316

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-02-09 14:29:38 -05:00
Rob Crittenden c38546d085 Wipe the ipa-ca DNS record when updating system records 
If a server with a CA has been marked as hidden and
contains the last A or AAAA address then that address
would remain in the ipa-ca entry.

This is because update-dns-system-records did not delete
values, it just re-computed them. So if no A or AAAA
records were found then the existing value was left.

Fixes: https://pagure.io/freeipa/issue/9195

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-02-09 14:24:14 -05:00
Rob Crittenden 724c8314b5 Fix setting values of 0 in ACME pruning 
Replace comparisons of "if value" with "if value is not None"
in order to handle 0.

Add a short reference to the man page to indicat that a cert
or request retention time of 0 means remove at the next
execution.

Also indicate that the search time limit is in seconds.

Fixes: https://pagure.io/freeipa/issue/9325

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2023-02-09 13:28:23 -05:00
Chris Kelley 614d3bd9c0 Check that CADogtagCertsConfigCheck can handle cert renewal 
Renewal causes two certs to have the same nickname. Dogtag is
patched to allow for N certs with the same nickname, and this test
is to verify that CADogtagCertsConfigCheck still passes.

Related: https://github.com/dogtagpki/pki/pull/4285
Signed-off-by: Chris Kelley <ckelley@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-02-09 10:22:07 -05:00
Antonio Torres a2667b249e API doc: add usage guides for groups, HBAC and sudo rules 
Include guides with examples for groups, HBAC and sudo rules management.
These cover most of available commands related to these topics.

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-02-08 14:20:38 -05:00
Antonio Torres 53f7a44c5c API doc: add note about ipa show-mappings to usage guide 
As discussed in PR #6664, `ipa show-mappings` can be used as a handy way to list
command arguments and options directly through the CLI.

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-02-07 13:37:20 -05:00
Rob Crittenden 414b5fe352 tests: add wrapper around ACME RSNv3 test 
This test is located outside of the TestACMEPrune because
it enables RSNv3 while the server installed by TestACME doesn't.

It still needs a wrapper to enforce a version of PKI that
supports pruning because that is checked first in the tool.
Re-ordering that wouldn't be a good user experience.

https://pagure.io/freeipa/issue/9322

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-04 17:10:51 +01:00
David Pascual 07927b21ba ipatests: fix (prci_checker) duplicated check & error return code 
Fix 1: timeout field was being checked twice and did not return fail code on error

Fix 2: Tool did not return error code on single file check unsuccessful run

Signed-off-by: David Pascual <davherna@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-02-03 08:29:46 -05:00
Rob Crittenden 7d1d91fc86 doc: add the --run command for manual job execution 
A manual method was mentioned with no specificity. Include
the --run command. Also update the troubleshooting section
to show what failure to restart the CA after configuration
looks like.

Import the IPA CA chain for manual execution.

Also fix up some $ -> # to indicate root is needed.

Related: https://pagure.io/freeipa/issue/9294

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-02 07:36:16 +01:00
Rob Crittenden 78298fd4e1 ipa-acme-manage: add certificate/request pruning management 
Configures PKI to remove expired certificates and non-resolved
requests on a schedule.

This is geared towards ACME which can generate a lot of certificates
over a short period of time but is general purpose. It lives in
ipa-acme-manage because that is the primary reason for including it.

Random Serial Numbers v3 must be enabled for this to work.

Enabling pruning enables the job scheduler within CS and sets the
job user as the IPA RA user which has full rights to certificates
and requests.

Disabling pruning does not disable the job scheduler because the
tool is stateless. Having the scheduler enabled should not be a
problem.

A restart of PKI is required to apply any changes. This tool forks
out to pki-server which does direct writes to CS.cfg. It might
be easier to use our own tooling for this but this makes the
integration tighter so we pick up any improvements in PKI.

The "cron" setting is quite limited, taking only integer values
and *. It does not accept ranges, either - or /.

No error checking is done in PKI when setting a value, only when
attempting to use it, so some rudimentary validation is done.

Fixes: https://pagure.io/freeipa/issue/9294

Signed-off-by: Rob Crittenden rcritten@redhat.com
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-02 07:36:16 +01:00
Florence Blanc-Renaud 5154f8e639 automember-rebuild: add a notice about high CPU usage 
The automember-rebuild task may require high CPU usage
if many users/hosts/groups are processed.
Add a note in the ipa automember-rebuild CLI output
and in the WebUI confirmation message.

Fixes: https://pagure.io/freeipa/issue/9320
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2023-02-02 07:33:36 +01:00
Stanislav Levin 2996cc8eae tests: Configure DNSResolver as platform agnostic resolver 
Avoid reading platform specific `/etc/resolv.conf` in `TestDNSResolver`
unit tests. Systems (e.g. sandboxes) may not have `/etc/resolv.conf`
or this file may not contain any configured name servers.

`TestDNSResolver` unit tests check only customized `nameservers`
property and should not depend on existence of `/etc/resolv.conf`.

Resolver accepts `configure` option.
https://dnspython.readthedocs.io/en/latest/resolver-class.html :
> configure, a bool. If True (the default), the resolver instance is
  configured in the normal fashion for the operating system the resolver
  is running on. (I.e. by reading a /etc/resolv.conf file on POSIX
  systems and from the registry on Windows systems.)

Fixes: https://pagure.io/freeipa/issue/9319
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-01 17:49:43 +01:00
Rob Crittenden 6897ad9972 tests: Add new ipa-ca error messages to IPADNSSystemRecordsCheck 
freeipa-healthcheck changed some messages related to ipa-ca
DNS record validation in IPADNSSystemRecordsCheck. Include support
for it and retain backwards compatibility.

Fixes: https://pagure.io/freeipa/issue/9291

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-01 11:00:57 +01:00
Rob Crittenden bf9797f27b tests: Add ipa_ca_name checking to DNS system records 
freeipa-healthcheck 0.12 includes a SUCCESS message if the
ipa-ca records are as expected so a user will know they
were checked. For that version and beyond test that it
is included.

Related: https://pagure.io/freeipa/issue/9291

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2023-02-01 11:00:57 +01:00
Stanislav Levin a5c99a6b04 spec: Drop no longer used build dependency on paste 
With ff6e701b00 it was replaced
with `werkzeug`.

https://pypi.org/project/Paste/
> Paste is in maintenance mode and recently moved from bitbucket to
  github. Patches are accepted to keep it on life support, but for the
  most part, please consider using other options.

Fixes: https://pagure.io/freeipa/issue/9314
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-01-31 09:57:24 -05:00
Stanislav Levin 203b7d1cb5 ipatests: healthcheck: Handle missing fips-mode-setup 
freeipa-healthcheck prechecks existance of `fips-mode-setup` and
reports if it's missing:
> "fips": "missing /bin/fips-mode-setup"

Fixes: https://pagure.io/freeipa/issue/9315
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-01-30 15:26:24 -05:00
Rob Crittenden 5d9f59038d doc: Design for certificate pruning 
This describes how the certificate pruning capability of PKI
introduced in v11.3.0 will be integrated into IPA, primarily for
ACME.

Related: https://pagure.io/freeipa/issue/9294

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2023-01-26 17:31:26 -05:00
Florence Blanc-Renaud 07975b52c3 trust-add: handle missing msSFU30MaxGidNumber 
When ipa trust-add is executed with --range-type ad-trust-posix,
the server tries to find the max uidnumber and max gidnumber
from AD domain controller.
The values are extracted from the entry
CN=<domain>,CN=ypservers,CN=ypServ30,CN=RpcServices,CN=System,<AD suffix>
in the msSFU30MaxUidNumber and msSFU30MaxGidNumber attributes.

msSFU30MaxUidNumber is required but not msSFU30MaxGidNumber.
In case msSFU30MaxGidNumber is missing, the code is currently assigning
a "None" value and later on evaluates the max between this value and
msSFU30MaxUidNumber. The max function cannot compare None and a list
of string and triggers an exception.

To avoid the exception, assign [b'0'] to max gid if msSFU30MaxGidNumber
is missing. This way, the comparison succeeds and max returns the
value from msSFU30MaxUidNumber.

Fixes: https://pagure.io/freeipa/issue/9310
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-01-25 15:23:29 +01:00
Florence Blanc-Renaud 295b4e23b4 Spec file: use %autosetup instead of %setup 
This change fixes rpminspect issues reported when building
for RHEL, like the following one:

Patch number 1001 (1001-Change-branding-to-IPA-and-Identity-Management.patch)
is missing a corresponding %patch1001 macro, usually in %prep.

Waiver Authorization: Anyone

Suggested Remedy:
The named patch is defined in the source RPM header (this means it has a
PatchN: definition in the spec file) but is not applied anywhere in the
spec file.  It is missing a corresponding %patch macro and the spec file
lacks the %autosetup or %autopatch macros.  You can fix this by adding
the appropriate %patch macro in the spec file (usually in the %prep
section).  The number specified with the %patch macro corresponds to the
number used to define the patch at the top of the spec file.  So Patch47
is applied with a %patch47 macro.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2023-01-24 16:50:31 +01:00
Florence Blanc-Renaud 6ab93f8be3 Spec file: unify with RHEL9 spec 
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2023-01-24 16:50:31 +01:00
Antonio Torres f44bde9e26 API doc: validate generated reference 
Extend 'makeapi --validate' to validate API Reference files too. If
differences are found between the generated and stored docs the
validation fails. This command is executed in our Azure pipelines, so
every time a developer opens a PR but forgets to update the API
Reference, the CI will fail.

Fixes: https://pagure.io/freeipa/issue/9287
Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-01-24 09:54:54 +01:00
Lenz Grimmer 4eba0481ec doc: Fix incorrect URL format 
Replaced URL in Markdown Format with the proper reStructuredText markup
in file doc/workshop/12-external-idp-support.rst

Signed-off-by: Lenz Grimmer <lenz.grimmer@percona.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-01-22 11:39:12 +01:00
Filip Dvorak 1611d54549 ipa tests: Add LANG before kinit command to fix issue with locale settings 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2023-01-19 16:15:11 +01:00
Florence Blanc-Renaud ad05218450 Installer: create RID base before domain object 
The installer is currently creating the samba domain object
before it adds the RID base and secondary RID base. As a consequence,
there is a window during which the sidgen plugin is active but
unable to generate SIDs (it requires the samba domain object to
find the domain SID and RID base to know where to start from).
There is no direct impact except the error log of 389ds that reports
ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct.

This fix configures the RID base and secondary RID base before the
domain object is created, thus removing this window.

Fixes: https://pagure.io/freeipa/issue/9309
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-01-17 15:51:25 +01:00
Florence Blanc-Renaud 36cba23f3f Tests: force key type in ACME tests 
PKI can issue ACME certs only when the key type is rsa.

With version 2.0.0, certbot defaults to ecdsa key type,
and this causes test failures.
For now, force rsa when requesting an ACME certificate.
This change can be reverted when PKI fixes the issue
on their side (https://github.com/dogtagpki/pki/issues/4273)

Related: https://pagure.io/freeipa/issue/9298
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-01-17 08:21:56 +01:00
Florence Blanc-Renaud 97330785ad server install: remove error log about missing bkup file 
The client installer code can be called in 3 different ways:
- from ipa-client-install CLI
- from ipa-replica-install CLI if the client is not already installed
- from ipa-server-install

In the last case, the client installer is called with
options.on_master=True
As a result, it's skipping the part that is creating the krb5
configuration:
    if not options.on_master:
        nolog = tuple()
        configure_krb5_conf(...)

The configure_krb5_conf method is the place where the krb5.conf file is
backup'ed with the extention ".ipabkp". For a master installation, this
code is not called and the ipabkp file does not exist => delete raises
an error.

When delete fails because the file does not exist, no need to log an
error message.

Fixes: https://pagure.io/freeipa/issue/9306
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2023-01-13 18:06:21 -05:00
Florence Blanc-Renaud 5419864c7e ipatests: mark test_smb as xfail 
Mark the test test_smb.py::TestSMB::test_smb_service_s4u2self as xfail.

Related: https://pagure.io/freeipa/issue/9124
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2023-01-11 09:13:48 +01:00
Stanislav Levin 691b5d21af pylint: Replace deprecated cgi module 
https://docs.python.org/3/library/cgi.html#module-cgi:
> Deprecated since version 3.11, will be removed in version 3.13: The
cgi module is deprecated (see PEP 594 for details and alternatives).

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin b8480549c6 pylint: Fix useless-object-inheritance 
https://pylint.pycqa.org/en/latest/user_guide/messages/refactor/useless-object-inheritance.html:
> Used when a class inherit from object, which under python3 is
implicit, hence can be safely removed from bases.

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin c523e85835 pylint: Fix unhashable-member 
https://pylint.pycqa.org/en/latest/user_guide/messages/error/unhashable-member.html:
> Emitted when a dict key or set member is not hashable (i.e. doesn't
define __hash__ method).

https://docs.python.org/3/library/stdtypes.html#dict.update:
> Update the dictionary with the key/value pairs from other, overwriting
existing keys. Return None.
update() accepts either another dictionary object or an iterable of
key/value pairs (as tuples or other iterables of length two). If keyword
arguments are specified, the dictionary is then updated with those
key/value pairs: d.update(red=1, blue=2).

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin bf3083c376 pylint: Fix unnecessary-lambda-assignment 
https://pylint.pycqa.org/en/latest/user_guide/messages/convention/unnecessary-lambda-assignment.html:
> Used when a lambda expression is assigned to variable rather than
defining a standard function with the "def" keyword.

https://peps.python.org/pep-0008/#programming-recommendations:
> Always use a def statement instead of an assignment statement that
binds a lambda expression directly to an identifier:
def f(x): return 2*x
f = lambda x: 2*x
The first form means that the name of the resulting function object is
specifically ‘f’ instead of the generic ‘<lambda>’. This is more useful
for tracebacks and string representations in general. The use of the
assignment statement eliminates the sole benefit a lambda expression can
offer over an explicit def statement (i.e. that it can be embedded
inside a larger expression)

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin 24db4dc876 pylint: Fix modified-iterating-list 
https://pylint.pycqa.org/en/latest/user_guide/messages/warning/modified-iterating-list.html:
> Emitted when items are added or removed to a list being iterated
through. Doing so can result in unexpected behaviour, that is why it is
preferred to use a copy of the list.

https://docs.python.org/3/tutorial/controlflow.html#for-statements:
> Code that modifies a collection while iterating over that same
collection can be tricky to get right. Instead, it is usually more
straight-forward to loop over a copy of the collection or to create a
new collection

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin 0e03315299 pylint: Fix used-before-assignment 
> Emitted when a local variable is accessed before its assignment took
place. Assignments in try blocks are assumed not to have occurred when
evaluating associated except/finally blocks. Assignments in except
blocks are assumed not to have occurred when evaluating statements
outside the block, except when the associated try block contains a
return statement.

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin a8dd070992 pylint: Replace deprecated pipes 
`pipes` module is deprecated as of Python 3.11.
https://docs.python.org/3/library/pipes.html#module-pipes:
> Deprecated since version 3.11, will be removed in version 3.13: The
  pipes module is deprecated (see PEP 594 for details).

IPA code used only `quote` function from `pipes` that in turn is
the alias for `shlex.quote` since Python 3.3:
https://github.com/python/cpython/commit/9bce311ea4f58ec04cab356a748e173ecfea381c

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin 4352bd5a50 pylint: Fix cyclic-import 
Most of `cyclic-import` issues reported by Pylint are false-positive
and they are already handled in the code, but several ones are the
actual errors.

Fixes: https://pagure.io/freeipa/issue/9232
Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin ccdc94b0e1 pylint: Replace deprecated extension-pkg-whitelist 
`extension-pkg-whitelist` is deprecated in favour of
`extension-pkg-allow-list` since Pylint 2.7.3:
https://pylint.pycqa.org/en/latest/whatsnew/2/2.7/full.html#what-s-new-in-pylint-2-7-3

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin deaec9b31a pylint: More allowed C extensions 
Fixes:
```
[E0611(no-name-in-module), ] No name 'parse' in module 'lxml.etree'
[E0611(no-name-in-module), ] No name 'murmurhash3' in module 'pysss_murmur'
```

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Stanislav Levin a1a3b90c48 pylint: Lint in single process mode 
There are several known problems with multiprocess mode.
For example, https://github.com/PyCQA/pylint/issues/3232.

In other words the lint result depends on the number of jobs.
The most correct report is expected for single process.

Fixes: https://pagure.io/freeipa/issue/9278
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud fa4b054056 pylint: disable deprecated-module message 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud a4102b9960 pylint: fix comparison-of-constants 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 416c210fc3 pylint: disable comparison-of-constants 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud fdd3dd29b7 pylint: fix consider-iterating-dictionary 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 8fad897ee7 pylint: globally disable useless-object-inheritance 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 79153655d7 pylint: disable unhashable-member 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 372a5dc6b8 pylint: disable invalid-sequence-index 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 6518855c34 pylint: fix deprecated-class SafeConfigParser 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 8e7e48dc78 pylint: fix duplicate-value 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 2268ef4e3c pylint: fix implicit-str-concat 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 139038c58b pylint: disable missing-timeout message 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 18fd448156 pylint: globally disable unnecessary-lambda-assignment message 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 0268857483 pylint: disable unnecessary-dunder-call message 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud d6d8319ece pylint: disable using-constant-test 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 8cd9ddfdeb pylint: remove arguments-renamed warnings 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud be7f0a6e5e pylint: disable modified-iterating-list 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud d1f1612088 pylint: replace deprecated distutils module 
PEP 632 deprecates the distutils module. Replace
- distutils.spawn.find_executable with shutil.which
- distutils.log with logging

Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 2011d1a36a pylint: disable used-before-assignment 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud a9c1c81a46 pylint: disable redefined-slots-in-subclass 
Related: https://pagure.io/freeipa/issue/9278

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 12067297d8 pylint: remove useless suppression 
The newer version of pylint has fixed false positives and
does not need anymore these suppressions:
- global-variable-not-assigned
- invalid-sequence-index
- no-name-in-module
- not-callable
- unsupported-assignment-operation

Related: https://pagure.io/freeipa/issue/9278
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud cad06382a2 pylint: remove unneeded disable=unused-private-member 
pylint fixed issue https://github.com/PyCQA/pylint/issues/4756
and we don't need anymore to disable this check.

Related: https://pagure.io/freeipa/issue/9278
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 232b5a9dde azure tests: move to fedora 37 
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2023-01-10 08:30:58 +01:00
Florence Blanc-Renaud 25c00d0d40 ipatests: update the xfail annotation for test_number_of_zones 
The test is failing on fedora 36+, update and simplify the
xfail condition.

Related: https://pagure.io/freeipa/issue/9135

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
 2022-12-20 14:54:28 +01:00
Florence Blanc-Renaud be21cabad4 Spec file: bump krb5_kdb_version on rawhide 
fedora 38 now uses krb5 1.20.1 which provides
krb5_kdb_version 9.0 instead of 8.0

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-12-19 15:38:05 +01:00
Florence Blanc-Renaud 17a5d5bff1 FIPS setup: fix typo filtering camellia encryption 
The config file /var/kerberos/krb5kdc/kdc.conf is customized
during IPA server installation with a list of supported
encryption types.
In FIPS mode, camellia encryption is not supported and should
be filtered out. Because of a typo in the filtering method,
the camellia encryptions are appended while they should not.

Fix the typo (camelia vs camellia) in order to filter properly.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-12-19 15:38:05 +01:00
Florence Blanc-Renaud 6bd9d156e0 cert utilities: MAC verification is incompatible with FIPS mode 
The PKCS12 MAC requires PKCS12KDF which is not an approved FIPS
algorithm and cannot be supported by the FIPS provider.
Do not require mac verification in FIPS mode: append the option
--nomacver to the command openssl pkcs12 used to extract a pem file
or a key from a p12 file.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-12-19 15:38:05 +01:00
Florence Blanc-Renaud b8947b829b ipatests: update the fake fips mode expected message 
The test ipatests/test_integration/test_fips.py is faking
FIPS mode and calls "openssl md5" to ensure the algo is
not available in the fake FIPS mode.

The error message has been updated with openssl-3.0.5-5.
In the past the command used to return:
$ openssl md5 /dev/null
Error setting digest
140640350118336:error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS:crypto/evp/digest.c:147:

And now it returns:
$ openssl md5 /dev/null
Error setting digest
00C224822E7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (MD5 : 97), Properties ()
00C224822E7F0000:error:03000086:digital envelope routines:evp_md_init_internal:initialization error:crypto/evp/digest.c:252:

To be compatible with all versions, only check the common part:
Error setting digest

Mark the test as xfail since installation is currently not working.

Related: https://pagure.io/freeipa/issue/9002
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-12-19 15:38:05 +01:00
Sudhir Menon b0ba520860 Fixes: ipa-otpd@.service: deprecated syslog setting 
This patch updates the deprecated syslog setting i.e
StandardError=syslog with StandardError=journal

Pagure: https://pagure.io/freeipa/issue/9279
Ref: https://github.com/systemd/systemd/pull/15812

Signed-off-by: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Peter Keresztes Schmidt <carbenium@outlook.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-12-19 08:06:52 +01:00
Florence Blanc-Renaud 6f3721a885 ipatests: xfail on all fedora for test_ipa_login_with_sso_user 
With the new fedora36 vagrant image, the test is also failing.
Mark xfail for all fedora versions.
Related: https://pagure.io/freeipa/issue/9264

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Scott Poore <spoore@redhat.com>
 2022-12-14 11:26:17 +01:00
Florence Blanc-Renaud 827dc9afc9 Spec file: ipa-client depends on krb5-pkinit-openssl 
Now that ipa-client-installs supports pkinit, the package
depends on krb5-pkinit-openssl.
Update the spec file, move the dependency from ipa-server
to ipa-client subpackage.

Fixes: https://pagure.io/freeipa/issue/9290

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-12-02 11:32:51 +01:00
Antonio Torres 0a4506ba1b API doc: add basic user management guide 
Add basic user management guide that includes various examples on
performing common tasks related to the user module, such as adding an
user, modifying it, adding certificates for it, etc.

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-12-02 10:28:58 +01:00
Florence Blanc-Renaud ab8b1fa6f5 PRCI: update memory reqs for each topology 
The memory requirements are defined in the vagrant templates in
https://github.com/freeipa/freeipa-pr-ci/tree/master/templates/vagrantfiles

They have been updated and the corresponding values must be
kept consistent in the topologies for PRCI.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Armando Neto <abiagion@redhat.com>
 2022-12-02 10:17:04 +01:00
Christian Heimes bb74832f31 ipa-certupdate: Update client certs before KDC/HTTPd restart 
Apache HTTPd uses `/etc/ipa/ca.crt` to validate client certs.
`ipa-certupdate` now updates the file before it restarts HTTPd.

Fixes: https://pagure.io/freeipa/issue/9285
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-12-01 18:05:28 -05:00
Florence Blanc-Renaud f43dab3b78 webui tests: fix assertion in test_subid.py 
The test wants to check the error related to an
exception obtained inside a "with pytest.raises" instruction.
The object is an ExceptionInfo and offers a match method
to check the content of the string representation.
Use this match() method instead of str(excinfo) which now
returns
'<ExceptionInfo NoSuchElementException() tblen=10>'

Fixes: https://pagure.io/freeipa/issue/9282

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
 2022-12-01 11:06:41 +01:00
Alexander Bokovoy e1fd9ebb73 updates: fix memberManager ACI to allow managers from a specified group 
The original implementation of the member manager added support for both
user and group managers but left out upgrade scenario. This means when
upgrading existing installation a manager whose rights defined by the
group membership would not be able to add group members until the ACI is
fixed.

Remove old ACI and add a full one during upgrade step.

Fixes: https://pagure.io/freeipa/issue/9286
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-11-28 10:29:03 +01:00
Florence Blanc-Renaud 04aae0eecc API reference: update dnszone_add generated doc 
Update doc/api/dnszone_add.md after commit c74c701
(Set 'idnssoaserial' to deprecated)

Related: https://pagure.io/freeipa/issue/9249

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-25 10:38:56 +01:00
Florence Blanc-Renaud 35876b4e11 API reference: update vault doc 
Update doc/api/vault_archive_internal.md and
doc/api/vault_retrieve_internal.md
after the change from commit 93548f2
(default wrapping algo is now des-ede3-cbc instead of aes-128-cbc).

Related: https://pagure.io/freeipa/issue/9259

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-25 10:38:56 +01:00
Antonio Torres b39d8b9375 Update contributors list 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2022-11-24 16:30:09 +01:00
Antonio Torres b928e5da5d Update translations to FreeIPA master state 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2022-11-24 16:26:42 +01:00
Julien Rische 673d2b82d0 Generate CNAMEs for TXT+URI location krb records 
The IPA location system relies on DNS record priorities in order to give
higher precedence to servers from the same location. For Kerberos, this
is done by redirecting generic SRV records (e.g.
_kerberos._udp.[domain].) to location-aware records (e.g.
_kerberos._udp.[location]._locations.[domain].) using CNAMEs.

This commit applies the same logic for URI records. URI location-aware
record were created, but there were no redirection from generic URI
records. It was causing them to be ignored in practice.

Kerberos URI and TXT records have the same name: "_kerberos". However,
CNAME records cannot coexist with any other record type. To avoid this
conflict, the generic TXT realm record was replaced by location-aware
records, even if the content of these records is the same for all
locations.

Fixes: https://pagure.io/freeipa/issue/9257
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-23 20:00:17 +01:00
Florence Blanc-Renaud 3d6d7e9fdf ipatests: update vagrant boxes 
Use new versions of vagrant boxes:
ci-master-f36 0.0.8
ci-master-f37 0.0.2
ci-master-frawhide 0.8.2

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Armando Neto <abiagion@redhat.com>
 2022-11-22 11:45:27 +01:00
Florence Blanc-Renaud 29012bb374 ipatests: remove xfail for tests using sssctl domain-status 
The tests calling sssctl domain-status were marked xfail
because of SSSD issue #6331. Now that the issue is fixed
and freeipa bumped sssd required version, remove the xfail
annotation.

Related: https://pagure.io/freeipa/issue/9234
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-22 08:49:09 +01:00
Florence Blanc-Renaud 5a23d8ec3f spec file: bump sssd version 
Bump sssd version to 2.8.0 on fedora37+ and RHEL
to ensure the fix for SSSD #6631 is present.

No need to bump the version on fedora 36 as the issue
is not seen on versions < 37.

Fixes: https://pagure.io/freeipa/issue/9234
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-22 08:49:09 +01:00
Francisco Trivino 93548f2569 Vault: fix interoperability issues with older RHEL systems 
AES-128-CBC was recently enabled as default wrapping algorithm for transport of secrets.
This change was done in favor of FIPS as crypto-policies disabled 3DES in RHEL9, but
setting AES as default ended-up breaking backwards compatibility with older RHEL systems.

This commit is tuning some defaults so that interoperability with older RHEL systems
works again. The new logic reflects:

- when an old client is calling a new server, it doesn't send any value for wrapping_algo
  and the old value is used (3DES), so that the client can decrypt using 3DES.

- when a new client is calling a new server, it sends wrapping_algo = AES128_CBC

- when a new client is calling an old server, it doesn't send any value and the default is
  to use 3DES.

Finally, as this logic is able to handle overlapping wrapping algorithm between server and
client, the Option "--wrapping-algo" is hidden from "ipa vault-archive --help" and "ipa
vault-retrieve --help" commands.

Fixes: https://pagure.io/freeipa/issue/9259
Signed-off-by: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-21 10:41:10 -05:00
Florence Blanc-Renaud d9ecb12d57 ipatests: re-enable dnssec tests 
On fedora 37+ the dnssec tests were broken. The tests
launched for each pull request were disabled or marked
as xfail.
With the bump of bind version, they should now succeed
and can be re-enabled.

Related: https://pagure.io/freeipa/issue/9216

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-21 14:24:17 +01:00
Florence Blanc-Renaud dface55b1f Spec file: bump bind version on f37+ 
On fedora37+, require at least bind 9.18.7-1 to avoid
dnssec regression (see BZ#2117342) related to bind and
OpenSSL 3.0 engine support.

Fixes: https://pagure.io/freeipa/issue/9216

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-21 14:24:17 +01:00
Rob Crittenden a7b58b3c07 doc: Design for HSM support 
Purpose is to add support for HSM installation of CA and KRA
on both initial server and replicas.

Related: https://pagure.io/freeipa/issue/9273

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-11-18 16:05:31 -05:00
Rob Crittenden 4a2c7b311b Pass the curl write callback by name instead of address 
This was reported by Coverity as a potential issue. Passing
by name is the example that curl uses so switch to that to
quiet the warning.

Also change to a static function and pre-declare it to quiet a
compile-time warning.

https://pagure.io/freeipa/issue/9274

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-16 14:50:22 -05:00
Rob Crittenden 83161913fb Support tokens and optional password files when opening an NSS db 
Each token in an NSS database is likely to have its own
password/PIN. This allows the password to be set per token
available in the PKI password file.

This is necessary for HSM devices where the password is necessary
to access information about the private key (e.g. presence)

This may mean that to see all certificates in a given NSS database
one will need multiple instances of the NSSDatabase class, one for
each desired token (include None for the native token).

https://pagure.io/freeipa/issue/9273

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-16 14:47:53 -05:00
Antonio Torres 4caa5ca577 Add basic API usage guide 
Add a guide explaining how to use the IPA API through Python. This
includes initializing the API, launching commands and retrieving
results, including batch operations.

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-16 14:46:17 -05:00
Antonio Torres 988cb5a535 doc: generate API Reference 
Extend the 'make api' target so that we also build an API Reference in
Markdown format. One template for each command gets generated. These
templates include all of the command details (arguments, options and
outputs), and then a section for manually-added notes such as semantics
or version differences. Every time the docs are regenerated, these notes
will be added if they exist.

Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-16 14:46:17 -05:00
Pavel Březina c6a16a7e53 docs: add security section to idp 
Related: https://pagure.io/freeipa/issue/8805
Related: https://pagure.io/freeipa/issue/8804
Related: https://pagure.io/freeipa/issue/8803
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-16 14:44:13 -05:00
Christian Heimes dbebed2e3a Add PKINIT support to ipa-client-install 
The ``ipa-client-install`` command now supports PKINIT for client
enrollment. Existing X.509 client certificates can be used to
authenticate a host.

Also restart KRB5 KDC during ``ipa-certupdate`` so KDC picks up new CA
certificates for PKINIT.

*Requirements*

- The KDC must trust the CA chain of the client certificate.
- The client must be able to verify the KDC's PKINIT cert.
- The host entry must exist. This limitation may be removed in the
  future.
- A certmap rule must match the host certificate and map it to a single
  host entry.

*Example*

```
ipa-client-install \
    --pkinit-identity=FILE:/path/to/cert.pem,/path/to/key.pem \
    --pkinit-anchor=/path/to/kdc-ca-bundle.pem
```

Fixes: https://pagure.io/freeipa/issue/9271
Fixes: https://pagure.io/freeipa/issue/9269
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-11-16 14:32:05 +02:00
Carla Martinez f15da10454 webui: Add name to 'Certificates' table 
For testing purposes and uniformity, the 'Certificates'
table generated after a new certificate is added should
also have the 'name' attribute to be able to access its
value.

Fixes: https://pagure.io/freeipa/issue/8946
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
 2022-11-15 13:04:22 +01:00
Mohammad Rizwan 746a036c7e ipatests: Test newly added certificate lable 
Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
 2022-11-15 13:04:22 +01:00
Carla Martinez b76bb195a5 webui: Add label name to 'Certificates' section 
For testing purposes and uniformity, the
'Certificates' label (located under
'Active users' settings ) should also have
'name' attribute, like seen in other parts of the WebUI.

Fixes: https://pagure.io/freeipa/issue/8946
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
 2022-11-15 13:04:22 +01:00
Alexander Bokovoy 21d99b457d ipa-kdb: for delegation check, use different error codes before and after krb5 1.20 
With MIT krb5 1.20, a call to krb5_db_check_allowed_to_delegate()
and krb5_db_check_allowed_to_delegate_from() expects to return either
KRB5KDC_ERR_BADOPTION for a policy denial or KRB5_PLUGIN_OP_NOTSUPP in
case plugin does not handle the policy case. This is part of the MIT
krb5 commit a441fbe329ebbd7775eb5d4ccc4a05eef370f08b which added a
minimal MS-PAC generator.

Prior to MIT krb5 1.20, the same call was expected to return either
KRB5KDC_ERR_POLICY or KRB5_PLUGIN_OP_NOTSUPP errors.

Related: https://pagure.io/freeipa/issue/9083
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-14 10:12:42 -05:00
Erik Belko d6a643b798 ipatests: Add test for grace login limit 
Test user and pwpolicy entity for grace login limit setting.

Related: https://pagure.io/freeipa/issue/9211

Signed-off-by: Erik Belko <ebelko@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2022-11-10 09:30:15 +01:00
Erik Belko 815f18396c ipatests: test for root using admin password in webUI 
Check if there is no infinite loop caused by this
combination of user and password

Related: https://pagure.io/freeipa/issue/9226

Signed-off-by: Erik Belko <ebelko@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2022-11-09 14:53:16 +01:00
Endi S. Dewata 38728dd518 Explicitly use legacy ID generators by default 
The default ID generators used by PKI might change in the
future, so to preserve the current behavior the installation
code has been updated to explicitly use the legacy ID
generators by default.

Signed-off-by: Endi S. Dewata <edewata@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-03 15:18:30 -04:00
Scott Poore c62e5d7a18 ipatests: xfail test_ipa_login_with_sso_user 
There is a crash occurring that causes Keycloak to be unable to
communicate with ipa-tuura on the bridge server (replica0).  This is
much more prevalent in Fedora 37 so we need to xfail that test case
until the crash is resolved.

Related: https://pagure.io/freeipa/issue/9264

Signed-off-by: Scott Poore <spoore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-11-03 10:55:32 +01:00
Alexander Bokovoy ce05e5fd40 ipa-kdb: fix comment to make sure we talk about krb5 1.20 or later 
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-02 11:03:04 +02:00
Alexander Bokovoy 0c67f0e607 ipa-kdb: fix PAC requester check 
PAC requester check was incorrect for in-realm S4U operations. It casted
too wide check which denied some legitimate requests. Fix that by only
applying rejection to non-S4U unknown SIDs, otherwise S4U2Self request
issued by the in-realm service against a trusted domain's user would not
work.

Related: https://pagure.io/freeipa/issue/9083
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-02 11:03:04 +02:00
Alexander Bokovoy e86807b58c ipa-kdb: handle empty S4U proxy in allowed_to_delegate 
With krb5 1.20, S4U processing code uses a special case of passing an
empty S4U proxy to allowed_to_delegate() callback to identify if the
server cannot get forwardable S4U2Self tickets according to [MS-PAC]
3.2.5.1.2.

This means we need to ensure NULL proxy is a valid one and return an
appropriate response to that.

Fixes: https://pagure.io/freeipa/issue/9083
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-02 11:03:04 +02:00
Alexander Bokovoy a9018da90d ipa-kdb: handle cross-realm TGT entries when generating PAC 
For generating PAC we need to know SID of the object and a number of
required attributes. However, trusted domain objects do not have these
attributes. Luckily, IPA LDAP schema puts them under actual trust
objects which have all the additional (POSIX) attributes.

Refactor PAC generator to accept secondary LDAP entry and use that one
to pull up required attributes. We only use this for trusted domain
objects.

Fixes: https://pagure.io/freeipa/issue/9083
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-02 11:03:04 +02:00
Alexander Bokovoy c1582bd322 ipa-kdb: add krb5 1.20 support 
Add basic krb5 1.20 integration without RBCD support. RBCD will come in
a separate series.

Fixes: https://pagure.io/freeipa/issue/9083
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-02 11:03:04 +02:00
Alexander Bokovoy 5e7590981b ipa-kdb: refactor MS-PAC processing to prepare for krb5 1.20 
Make sure both krb5 pre 1.20 and 1.20 or later would call into the same
PAC generation code while driven by different API callbacks from the
krb5 KDB interface.

Fixes: https://pagure.io/freeipa/issue/9083
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-11-02 11:03:04 +02:00
Florence Blanc-Renaud fbda6ea4d3 Spec file: bump the selinux-policy version 
selinux-policy introduced a regression in fedora 36, rhel 8
and rhel 9. After a call to ipa trust-add, the credential cache
contains cifs/master.ipa.test@IPA.TEST instead of admin principal.

The fix is available in
- fedora 36: selinux-policy-36.16-1
- rhel 8: 3.14.3-107

Bump the selinux-policy version to install the fix.

Fixes: https://pagure.io/freeipa/issue/9198
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-10-20 15:42:05 -04:00
Scott Poore 899530bd40 ipatests: add keycloak user login to ipa test 
Adding test case to test_sso.py to cover login to IPA client as Keycloak
user without relying on external IdP.

create_bridge.py:
- getkeytab in setup_scim_server to allow bridge to use IPA API.
- fix unintstall to remove plugin by version instead of main

test_sso.py:
- add keycloak_add_user function
- add test_ipa_login_with_sso_user

tasks.py:
- add set_user_password to only set password for ipa users

Fixes: https://pagure.io/freeipa/issue/9250
Signed-off-by: Scott Poore <spoore@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-10-20 08:48:53 -04:00
Florence Blanc-Renaud 06780f4d90 webui tests: fix test_subid suite 
The webui test test_subid_range_deletion_not_allowed is
adding a new subid for the admin user but a previous
test already took care of that step.
Remove the call adding the subid.

2nd issue: a given record has to be selected in
order to check that there is no "delete" button.

Fixes: https://pagure.io/freeipa/issue/9214

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-10-19 09:49:04 -04:00
Anuja More 715ee82e3c ipatests : Test query to AD specific attributes is successful. 
Test scenario:
configure sssd with ldap_group_name = info for the trusted domain,
so that the group name is read from the "info" attribute
of the AD group entry.
With this setting, it is possible to have a group and a user
that appear on IdM side with the same name.
Ensure that the conflict does not break IdM and that the id,
getent group and getent passwd commands work on an IdM client.

Related : https://pagure.io/freeipa/issue/9127

Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-10-18 07:03:29 +02:00
Nikola Knazekova 7b855c602e Exclude installed policy module file from RPM verification 
selinux: Update based on latest packaging guide
https://fedoraproject.org/wiki/SELinux/IndependentPolicy

Fixes: https://pagure.io/freeipa/issue/9254

Signed-off-by: Nikola Knazekova <nknazeko@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-10-17 15:57:10 +02:00
Sumedh Sidhaye 42f73ea655 With the commit #99a74d7, 389-ds changed the message returned in ipa-healthcheck. 
Previously the message was:

"\n\nIn Directory Server, we offer one hash suitable for this "
"(PBKDF2_SHA256) and one hash\nfor \"legacy\" support (SSHA512)."
"\n\nYour configuration does not use these for password storage "
"or the root password storage\nscheme.\n"

but now the message is:

\n\nIn Directory Server, we offer one hash suitable for this "
"(PBKDF2-SHA512) and one hash\nfor \"legacy\" support (SSHA512)."
"\n\nYour configuration does not use these for password storage "
"or the root password storage\nscheme.\n"

PBKDF2_SHA256 has been replaced with PBKDF2-SHA512

Pagure: https://pagure.io/freeipa/issue/9238

Signed-off-by: Sumedh Sidhaye <ssidhaye@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2022-10-12 12:01:27 +02:00
Alexander Bokovoy 22022ae2ff ipaclient: do not set TLS CA options in ldap.conf anymore 
OpenLDAP has made it explicit to use default CA store as provided by
OpenSSL in 2016:

	branches 2.5 and later:
	commit 4962dd6083ae0fe722eb23a618ad39e47611429b
	Author: Howard Guo <hguo@suse.com>
	Date:   Thu Nov 10 15:39:03 2016 +0100

	branch 2.4:
	commit e3affc71e05b33bfac43833c7b95fd7b7c3188f8
	Author: Howard Guo <hguo@suse.com>
	Date:   Thu Nov 10 15:39:03 2016 +0100

This means starting with OpenLDAP 2.4.45 we can drop the explicit CA
configuration in ldap.conf.

There are several use cases where an explicit IPA CA should be specified
in the configuration. These mostly concern situations where a higher
security level must be maintained. For these configurations an
administrator would need to add an explicit CA configuration to
ldap.conf if we wouldn't add it during the ipa-client-install setup.

RN: FreeIPA client installer does not add explicit TLS CA configuration
RN: to OpenLDAP's ldap.conf anymore. Since OpenLDAP 2.4.45, explicit CA
RN: configuration is not required as OpenLDAP uses the default CA store
RN: provided by OpenSSL and IPA CA is installed in the default store
RN: by the installer already.

Fixes: https://pagure.io/freeipa/issue/9258

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-10-10 09:50:39 +02:00
Viacheslav Sychov d33a2523ee fix: Handle /proc/1/sched missing error 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-10 09:48:55 +02:00
Sumit Bose 0ce3ab36b4 ipa-kdb: do not fail if certmap rule cannot be added 
Currently if a certificate mapping and matching rule has a typo or is of
an unsupported type the whole rule processing is aborted and the IPA
certmap plugin works without any rules effectively disabling PKINIT for
users. Since each rule would only allow more certificates for PKINIT it
would be more user/admin friendly to just ignore the failed rules with a
log message and continue with what is left or use the default rule if
nothing is left.

This change is done to add more flexibility to define new mapping and
matching templates which are e.g. needed to cover changes planned by
Microsoft as explained in
https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-07 17:02:43 +02:00
Stanislav Levin d4fa80b224 ipapython: Support openldap 2.6 
While python-ldap is strict dependency of IPA in downstreams, it
is optional for IPA packages published on PyPI.

Openldap 2.6 no longer ships ldap_r-2, that makes
ipapython.dn_ctypes not working against such environments.

Thanks @abbra!

Fixes: https://pagure.io/freeipa/issue/9255
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-10-06 10:22:26 +02:00
Alexey Tikhonov 147123e6b9 extdom: avoid sss_nss_getorigby*() calls when get*_r_wrapper() returns object from a wrong domain (performance optimization) 
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
 2022-10-04 14:01:56 +02:00
Alexey Tikhonov b381acb3d0 extdom: make sure result doesn't miss domain part 
This is required to ensure that only objects from requested domain
are returned.

Resolves: https://pagure.io/freeipa/issue/9245
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
 2022-10-04 14:01:56 +02:00
Alexey Tikhonov f0c26fe094 extdom: internal functions should be static 
Fixes following compilation warnings:
```
ipa_extdom_common.c:109:5: warning: no previous prototype for ‘__nss_to_err’ [-Wmissing-prototypes]
  109 | int __nss_to_err(enum nss_status errcode)
      |     ^~~~~~~~~~~~
ipa_extdom_common.c:738:5: warning: no previous prototype for ‘pack_ber_name_list’ [-Wmissing-prototypes]
  738 | int pack_ber_name_list(struct extdom_req *req, char **fq_name_list,
      |     ^~~~~~~~~~~~~~~~~~
```

Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
 2022-10-04 14:01:56 +02:00
Florence Blanc-Renaud 96cf293f1f ipatests: mark xfail tests using dnssec 
In fedora 37+, the signing of DNS zones is failing.
Mark xfail the gating tests impacted by this issue, to avoid
breaking the CI gating when we move to f37.

Related: https://pagure.io/freeipa/issue/9216
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2022-10-04 13:47:48 +02:00
Florence Blanc-Renaud 4a4f7e76da ipatests: mark xfail tests using sssctl domain-status 
In fedora 37+, sssctl domain-status is failing.
Mark xfail the gating tests impacted by this issue, to avoid
breaking the CI gating when we move to f37.

Related: https://pagure.io/freeipa/issue/9234
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2022-10-04 13:47:48 +02:00
Florence Blanc-Renaud 43fcfe45f1 Tests: test on f37 and f36 
Fedora 37 beta is now available, move the testing pipelines to
- fedora 37 for the _latest definitions
- fedora 36 for the _previous definition

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2022-10-04 13:47:48 +02:00
Alexander Bokovoy 76152e0335 Remove empty translation for 'si' which breaks linter 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
김인수 6e6a07188b Translated using Weblate (Korean) 
Currently translated at 2.9% (140 of 4818 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ko/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
김인수 a2a70ab7ac Translated using Weblate (Korean) 
Currently translated at 2.2% (108 of 4818 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ko/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
김인수 526b5165fe Translated using Weblate (Korean) 
Currently translated at 2.0% (99 of 4818 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ko/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
김인수 e9d5908851 Added translation using Weblate (Korean) 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Temuri Doghonadze 2ee7fcdfba Translated using Weblate (Georgian) 
Currently translated at 8.3% (401 of 4818 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ka/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Temuri Doghonadze d12908ffce Translated using Weblate (Georgian) 
Currently translated at 7.6% (368 of 4818 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ka/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Temuri Doghonadze 097615c34c Translated using Weblate (Georgian) 
Currently translated at 6.9% (333 of 4818 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ka/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen e20e1a446c Translated using Weblate (Finnish) 
Currently translated at 17.6% (848 of 4818 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Yuri Chornoivan 7a82bc090e Translated using Weblate (Ukrainian) 
Currently translated at 100.0% (4818 of 4818 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/uk/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Weblate 1d1b31a2f4 Update translation files 
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Temuri Doghonadze b2cdddeaea Added translation using Weblate (Georgian) 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen ea95f0dda0 Translated using Weblate (Finnish) 
Currently translated at 17.8% (845 of 4741 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Yuri Chornoivan 0f2d2d36ee Translated using Weblate (Ukrainian) 
Currently translated at 100.0% (4741 of 4741 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/uk/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Weblate 6f3c9a2533 Update translation files 
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen e92b847850 Translated using Weblate (Finnish) 
Currently translated at 17.7% (842 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen cd702b5421 Translated using Weblate (Finnish) 
Currently translated at 17.7% (840 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Ricky Tigg ab652aa11a Translated using Weblate (Finnish) 
Currently translated at 17.5% (833 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Piotr Drąg 35f58c9af4 Translated using Weblate (Polish) 
Currently translated at 9.5% (453 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/pl/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen f680614b5c Translated using Weblate (Finnish) 
Currently translated at 17.5% (832 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen 581dfddcf7 Translated using Weblate (Finnish) 
Currently translated at 17.2% (816 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Andika Triwidada c7ba8f5f28 Translated using Weblate (Indonesian) 
Currently translated at 6.8% (323 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/id/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen 7fc89bc0ba Translated using Weblate (Finnish) 
Currently translated at 16.9% (804 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Yuri Chornoivan cf338b5b35 Translated using Weblate (Ukrainian) 
Currently translated at 100.0% (4739 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/uk/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Weblate 8b1eb488bd Update translation files 
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen 386e51168a Translated using Weblate (Finnish) 
Currently translated at 16.7% (794 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen feb94b3aa5 Translated using Weblate (Finnish) 
Currently translated at 16.1% (764 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Ricky Tigg e7623b4f5a Translated using Weblate (Finnish) 
Currently translated at 16.0% (762 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen e39ccf5988 Translated using Weblate (Finnish) 
Currently translated at 15.9% (754 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Piotr Drąg fd985ae43a Translated using Weblate (Polish) 
Currently translated at 9.5% (452 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/pl/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Ricky Tigg 0ab3870229 Translated using Weblate (Finnish) 
Currently translated at 15.6% (743 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen 706faddf24 Translated using Weblate (Finnish) 
Currently translated at 15.6% (742 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen dd345aaca8 Translated using Weblate (Finnish) 
Currently translated at 15.5% (736 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen 31ba6aa500 Translated using Weblate (Finnish) 
Currently translated at 10.9% (520 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Yuri Chornoivan b9f9462055 Translated using Weblate (Ukrainian) 
Currently translated at 100.0% (4739 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/uk/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Yuri Chornoivan 5cc8e5b869 Translated using Weblate (Ukrainian) 
Currently translated at 99.4% (4713 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/uk/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Yuri Chornoivan a0e0d57a42 Translated using Weblate (Ukrainian) 
Currently translated at 98.5% (4671 of 4739 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/uk/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Weblate 3c7fe6c49d Update translation files 
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Jan Kuparinen 4185578705 Translated using Weblate (Finnish) 
Currently translated at 7.7% (362 of 4672 strings)

Translation: freeipa/master
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/fi/
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Weblate ac2c3de889 Update translation files 
Updated by "Update LINGUAS file" hook in Weblate.

Update translation files

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Co-authored-by: Weblate <noreply@weblate.org>
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/
Translation: freeipa/master
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-10-02 12:07:20 +03:00
Florence Blanc-Renaud cca7a7cd77 ipa man page: format the EXAMPLES section 
The EXAMPLES section is missing .TP macros before some of
the provided examples, and they are displayed in the same paragraph.

Add .TP (tagged, indented paragraph) before each example.

Fixes: https://pagure.io/freeipa/issue/9252
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-09-30 15:15:50 +02:00
Rob Crittenden dbec885cb0 Move client certificate request after krb5.conf is created 
The creation of krb5.conf was moved to the end of the script
as part of maintaining server affinity during ipa-client-install.
If the installation is faster than replication then requests
against some IPA servers may fail because the client entry is
not yet present.

This is more difficult with certmonger as it will only use
/etc/krb5.conf. There is no way of knowing, even at the end
of the client installation, that replication has finished.

Certificate issuance may fail during ipa-client-install but
certmonger will re-try the request.

Fixes: https://pagure.io/freeipa/issue/9246

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2022-09-29 16:40:19 -04:00
Carla Martinez 55ef0008b8 Update API and VERSION 
The API and VERSION files need to be updated
to hold the changes made in the 'idnssoaserial'
parameter.

Fixes: https://pagure.io/freeipa/issue/9249
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
 2022-09-29 14:23:44 +02:00
Carla Martinez a3b4b476b9 webui: Set 'SOA serial' field as read-only 
On the WebUI, the SOA serial textbox must be disabled (non-editable)
to prevent the 'ValidationError' message to be shown when this
specific field is manually set.

Fixes: https://pagure.io/freeipa/issue/9249
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
 2022-09-29 14:23:44 +02:00
Carla Martinez b326b4afae ipatest: Remove warning message for 'idnssoaserial' 
The tests must be updated to not expect the
deprecation warning messages for the 'idnssoaserial'
parameter. Those should (successfully) fail when
'dnszone_add' and 'dnszone_mod' commands are
executed with the SOA serial parameter provided.

Also, due to this SOA serial deprecation, an
expected-to-fail test should be defined when a
DNS zone is added (dnszone_add) and the SOA serial
is passed as a parameter.

Fixes: https://pagure.io/freeipa/issue/9249
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
 2022-09-29 14:23:44 +02:00
Carla Martinez c74c701cac Set 'idnssoaserial' to deprecated 
A warning message (regarding the SOA serial deprecation) is shown
on the webui and CLI every time a new DNS zone is added (even if the
'--serial' option is not being explicitly set) or the SOA serial is modified.

This should be managed by setting the 'idnssoaserial' as deprecated and
not required parameter.

Fixes: https://pagure.io/freeipa/issue/9249
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
 2022-09-29 14:23:44 +02:00
Florence Blanc-Renaud 59db0faf21 ipatests: add negative test for otptoken-sync 
Scenario:  call ipa otptoken-sync with
- an invalid password
- an invalid first token (containing non-digits)
- an invalid sequence of tokens

The test expects a return code = 1.

Related: https://pagure.io/freeipa/issue/9248
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-09-29 07:58:44 -04:00
Florence Blanc-Renaud f1b2d8ab36 ipa otptoken-sync: return error when sync fails 
The command ipa otptoken-sync does not properly handle
errors happening during the synchronization step.

- Even if an error is detected (such as invalid password
provided), the command exits with return code = 0. An
error message is displayed but the exit code should be 1.

- When an invalid token is provided, the token is not
synchronized but the error is not reported back to the
ipa otptoken-sync command.

The first issue can be fixed by raising an exception when
the HTTP response contains an header with an error.
The second issue is fixed by returning LDAP_INVALID_CREDENTIALS
to ldap bind with the sync control if synchronization fails.

Fixes: https://pagure.io/freeipa/issue/9248

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-09-29 07:58:44 -04:00
Rob Crittenden 9d9d925b14 Defer creating the final krb5.conf on clients 
A temporary krb5.conf is created early during client enrollment
and was previously used only during the initial ipa-join call.
The final krb5.conf was written soon afterward.

If there are multiple servers it is possible that the client
may then choose a different KDC to connect. If the client
is faster than replication then the client may not exist
on all servers and therefore enrollment will fail.

This was seen in performance testing of how many simultaneous
client enrollments are possible.

Use a decorator to wrap the _install() method to ensure the
temporary files created during installation are cleaned up.

https://pagure.io/freeipa/issue/9228

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-09-26 08:48:42 +02:00
Florence Blanc-Renaud 7aeb9e5860 ipa-cacert-manage prune: remove all expired certs 
ipa-cacert-manage prune is removing the expired certs one
at a time and this may result in verifying that one of
the expired certs is still valid.
As a consequence, ipa-cacert-manage prune always fails
when more than 1 cert are expired.

To avoid the issue, remove all the expired certs in a single
pass, and validate only the ones that would remain after full
pruning.

Fixes: https://pagure.io/freeipa/issue/9244
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-09-23 09:49:06 +02:00
Carla Martinez 926680ffb2 webui: Show 'Sudo order' column 
In the 'Sudo rules' page, the 'Sudo order' column should be visible in the
list so the users can easily see which rules override other rules based on
their order.

Fixes: https://pagure.io/freeipa/issue/9237
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-09-21 10:45:32 +02:00
Scott Poore 04c2b06984 ipatests: add prci definitions for test_sso jobs 
Signed-off-by: Scott Poore <spoore@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-09-20 14:54:04 -04:00
Scott Poore a4da017272 ipatests: add Keycloak Bridge test 
Add test code for new bridge server (ipa-tuura) and Keycloak plugin.

Add uninstall functions for create_keycloak.py so that the tests can
be run repeatedly.

Fixes: https://pagure.io/freeipa/issue/9227
Signed-off-by: Scott Poore <spoore@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-09-20 14:54:04 -04:00
Rob Crittenden 36591995ac Fix upper bound of password policy grace limit 
It was defined as an unsigned value (2**32) because it
originally was. During the review an additional setting of
disabled (-1) was added so the value needed to be signed.
The upper bound needs to be 2**31 which is provided by
the xmlrpc client MAXINT import.

Fixes: https://pagure.io/freeipa/issue/9243

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2022-09-20 14:51:56 -04:00
Stanislav Levin 94835d19b5 x509: Replace removed register_interface with subclassing 
python-cryptography 38.0 removed `register_interface` decorator:
pyca/cryptography@f70e334a52

Backward compatibility:
Cryptography haven't changed the interface of `Certificate` since it was
first used by IPA (4.6.0) till cryptography 38.0.

cryptography 38.0 (pyca/cryptography@c1b7307a3e)
added `tbs_precertificate_bytes` attribute.

Fixes: https://pagure.io/freeipa/issue/9160
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-09-19 14:15:36 -04:00
Carla Martinez 090d4f9e9d Set pkeys in test_selinuxusermap.py::test_misc::delete_record 
The test_selinuxusermap.py::test_selinuxusermap::test_misc is failing
because the 'delete_record' function (located in the same file) is passing
incorrect parameters: it should take the 'pkeys' instead of the full
data.

The changes will take the right 'pkeys' parameters in the 'test_misc()'
function.

Fixes: https://pagure.io/freeipa/issue/9161

Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-08-30 16:07:42 +02:00
Jesse Sandberg fa85301895 Fix ipa-ccache-sweeper activation timer and clean up service file 
Added OnActiveSec=12h to start the timer cycle because OnUnitActiveSec setting alone never triggers the timer after boot as there has not been transition between active and inactive state.
Removed [Install] section from sweeper.service as it is not needed

Fixes: https://pagure.io/freeipa/issue/9231
Signed-off-by: Jesse Sandberg <jesse.sandberg@netcode.fi>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-08-29 18:28:42 +02:00
Alexander Bokovoy ad8f90f816 ipa-otpd: initialize local pointers and handle gcc 10 
oauth2_on_child_readable() does not use the main verto context and used
to drop the argument name to signify that. This is a feature of C2X
standard by default and is not enabled in gcc before 11 by default (it
is enabled in RHEL 8's gcc 8.5).

Add a simple 'if the context is missing, get out' code to use 'ctx'.
This allows to avoid enabling C2X features.

Initialize local pointers to prevent use before initialization on exit
paths in abnormal situations as well.

Fixes: https://pagure.io/freeipa/issue/9230

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2022-08-29 17:34:20 +02:00
Alexander Bokovoy 2ae316d430 fix canonicalization issue in Web UI 
When Kerberos principal alias is used to login to a Web UI, we end up
with a request that is authenticated by a ticket issued in the alias
name but metadata processed for the canonical user name. This confuses
RPC layer of Web UI code and causes infinite loop to reload the page.

Fix it by doing two things:

 - force use of canonicalization of an enterprise principal on server
   side, not just specifying that the principal is an enterprise one;

 - recognize that a principal in the whoami()-returned object can have
   aliases and the principal returned by the server in the JSON response
   may be one of those aliases.

Fixes: https://pagure.io/freeipa/issue/9226

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Armando Neto <abiagion@redhat.com>
 2022-08-29 17:30:22 +02:00
Endi S. Dewata 06183a061a Remove pki_restart_configured_instance 
The pki_restart_configured_instance param is no longer used
by pkispawn so it has been removed.

https://github.com/dogtagpki/pki/blob/master/docs/changes/v11.3.0/Server-Changes.adoc

Signed-off-by: Endi S. Dewata <edewata@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-08-19 10:19:10 +02:00
Scott Poore 5a225deaa0 ipatests: Rename create_quarkus to create_keycloak 
The module installs and configures a Keycloak server and
not just the Quarkus Java framework.  So, renaming to better
reflect what the module is used for.

Fixes: https://pagure.io/freeipa/issue/9225
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-08-19 09:47:41 +02:00
Rob Crittenden 0468cc6085 Set default on group pwpolicy with no grace limit in upgrade 
If an existing group policy lacks a password grace limit
update it to -1 on upgrade.

Fixes: https://pagure.io/freeipa/issue/9212

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-08-18 17:51:20 -04:00
Rob Crittenden c8955a4d0a Set default gracelimit on group password policies to -1 
This will retain previous behavior of unlimited LDAP BIND
post-expiration.

Fixes: https://pagure.io/freeipa/issue/9212

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-08-18 17:51:20 -04:00
Rob Crittenden b6587d3361 doc: Update LDAP grace period design with default values 
New group password policies will get -1 (unlimited) on creation
by default.

Existing group password policies will remain untouched and
those created prior will be treated as no BIND allowed.

Fixes: https://pagure.io/freeipa/issue/9212

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-08-18 17:51:20 -04:00
Thomas Woerner 77803587d6 DNSResolver: Fix use of nameservers with ports 
IPA DNS zone and forwardzone commands allow to use nameservers with ports
as "SERVER_IP port PORT_NUMBER". bind is supporting this syntax, but the
Resolver in dnspython that is used to verify the list of forwarders
(nameservers) is only allowing to have IP addresses in this list. With
dnspython version 2.20 there is a new validator in dns.resolver.BaseResolver
that ensures this.

Refs:
- https://bind9.readthedocs.io/en/v9_18_4/reference.html#zone-statement-grammar
- https://github.com/rthalley/dnspython/blob/master/dns/resolver.py#L1094

ipapython/dnsutil.DNSResolver derives from dns.resolver.Resolver. The setter
for nameservers has been overloaded in the DNSResolver class to split out
the port numbers into the nameserver_ports dict { SERVER_IP: PORT_NUMBER }.
After the setter for nameservers succeeded, nameserver_ports is set.
nameserver_ports is used in the resolve() method of dns.resolver.Resolver.

Additional tests have been added to verify that nameservers and also
nameserver_ports are properly set and also valid.

Fixes: https://pagure.io/freeipa/issue/9158

Signed-off-by: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-08-16 13:49:40 +02:00
Florence Blanc-Renaud 21091c2bc7 gitignore: add install/oddjob/org.freeipa.server.config-enable-sid 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-08-16 13:07:03 +02:00
Florence Blanc-Renaud 54d32fcd76 ipatests: Fix expected object classes 
Because the sidgen plugin is a postop plugin, it is not
always triggered before the result of an ADD is returned
and the objectclasses of the user may / may not contain
ipantuserattrs.
Fix the expected object classes.

Related: https://pagure.io/freeipa/issue/9062
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-08-16 13:07:03 +02:00
Rob Crittenden 45b351f8c5 upgrades: Don't restart the CA on ACME and profile schema change 
There are currently three sets of CA schema changes applied
in ipa-server-upgrade:

* addition of ACME schema
* addition of certificate profile schema
* addition of lightweight CA schema

None of these require a restart of the CA to be supported.

There is an issue in schema parsing such that it doesn't handle
X-ORIGIN properly. A difference is detected and a change applied
but no change is recorded in LDAP so every time upgrade is
run it thinks a CA restart is needed. The CA is not quick to
restart so avoiding one is best, particularly when the update is
run as part of an rpm transaction where a user with an itchy finger
may think things have hung and break out of it.

https://github.com/389ds/389-ds-base/issues/5366 was
filed to track this.

Related: https://pagure.io/freeipa/issue/9204

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-08-16 08:51:31 +02:00
Florence Blanc-Renaud 8a415ff985 check_repl_update: in progress is a boolean 
With the fix for https://pagure.io/freeipa/issue/9171,
nsds5replicaUpdateInProgress is now handled as a boolean.
One remaining occurrence was still handling it as a string
and calling lower() on its value.

Replace with direct boolean comparison.

Fixes: https://pagure.io/freeipa/issue/9218
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2022-08-16 08:39:06 +02:00
Florence Blanc-Renaud 4ae9c78f59 azure tests: disable TestInstallDNSSECFirst 
The test TestInstallDNSSECFirst is failing because of one of its
dependencies (the most likely suspect is the update of openssl-pkcs11).
Disable the test from azure gating until the issue is solved.

Related: https://pagure.io/freeipa/issue/9216
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2022-08-08 09:53:25 +02:00
Florence Blanc-Renaud ccb012b402 ipatests: fix the topology for rawhide/test_subids 
The test test_integration/test_subids.py::TestSubordinateId
needs a master and a client but the yaml definition for rawhide
and sssd is currently using master_1repl. Replace with
master_1repl_1client to fulfill the requirement.

Fixes: https://pagure.io/freeipa/issue/9217
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2022-08-08 09:53:25 +02:00
Carla Martinez 42b2607a6f webui: Allow grace login limit 
There was no support for setting the grace login limit on the WebUI. The
only way to so was only via CLI:

   `ipa pwpolicy-mod --gracelimit=2 global_policy`

Thus, the grace login limit must be updated from the policy section and
this will reflect also on the user settings (under the 'Password Policy'
section)

Fixes: https://pagure.io/freeipa/issue/9211

Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-08-05 16:30:18 +02:00
Sumedh Sidhaye 6033d495d1 Additional tests for RSN v3 
New Tests include
TestRSNPKIConfig
TestRSNVault

The new tests are just extending existing classes to be run
with random serial numbers enabled

The tests also include a new method to check params set in CS.cfg for both CA and
KRA, and another test to check Random Serial Number version while
running `ipa ca-find`

Added nightly definitions

Related Ticket: https://pagure.io/freeipa/issue/2016

Signed-off-by: Sumedh Sidhaye <ssidhaye@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-08-04 13:26:00 -04:00
Sudhir Menon bf4c51266c ipatests: WebUI: do not allow subid range deletion 
This testcase checks that subid added by user admin
cannot be deleted.

Related: https://pagure.io/freeipa/issue/9150

Signed-off-by: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
 2022-08-03 09:33:42 +02:00
David Pascual 8297b74974 ipatest: fix prci checker target masked return code & add pylint 
In the yamllint target of makefile, prci_checker result was being masked by echo statement.
Aditionally, prci_checker script has been added to the list of Python sources to be Pylinted.

Addressing comments of recently merged PR:
https://github.com/freeipa/freeipa/pull/6301#discussion_r923163970
https://github.com/freeipa/freeipa/pull/6301#issuecomment-1187037261

Signed-off-by: David Pascual <davherna@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2022-08-01 09:34:42 -04:00
Sudhir Menon e3e7c98ac5 ipatests: ipa-client-install --subid adds entry in nsswitch.conf 
This testcase checks that when ipa-client-install command
is run with --subid option, /etc/nsswitch.conf file is updated
with the below entry

subid: nss
Related: https://pagure.io/freeipa/issue/9159

Since the newly added testsuite required client
system, hence modified the below yaml files to change the topology
from *master_1repl to *master_1repl_1client in the below files

gating.yaml
nightly_latest.yaml
nightly_latest_selinux.yaml
nightly_latest_testing.yaml
nightly_previous.yaml
nightly_rawhide.yaml

Signed-off-by: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-08-01 09:28:30 -04:00
Rob Crittenden 4105fee2cf Disabling gracelimit does not prevent LDAP binds 
Originally the code treated 0 as disabled. This was
changed during the review process to -1 but one remnant
was missed effetively allowing gracelimit 0 to also mean
disabled.

Add explicit tests for testing with gracelimit = 0 and
gracelimit = -1.

Also remove some extranous "str(self.master.domain.basedn)"
lines from some of the tests.

Fixes: https://pagure.io/freeipa/issue/9206

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
 2022-08-01 09:24:40 -04:00
Erik fc5de8216d ipatests: healthcheck: test if system is FIPS enabled 
Test if FIPS is enabled and the check exists.

Related: https://pagure.io/freeipa/issue/8951

Signed-off-by: Erik Belko <ebelko@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-07-27 13:34:07 +02:00
Stanislav Levin e9b232fcf4 ap: Constrain supported docutils 
New Sphinx 5.1.0 (Released: Jul 24, 2022) bumped supported docutils
to 0.19:
https://github.com/sphinx-doc/sphinx/pull/10656

But m2r2 doesn't support it yet:
https://github.com/CrossNox/m2r2/issues/52

Thereby, docutils must be constrained to < 0.19.

This should be fixed by m2r2 and after they do it the restriction
can be removed.

Fixes: https://pagure.io/freeipa/issue/9208
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-07-26 12:36:41 -04:00
Stanislav Levin 8542fd3012 ap: Rearrange overloaded jobs 
With some recent changes the Azure Agent has decreased performance.
For example, `InstallDNSSECFirst_1_to_5` (5 subjobs) job took ~33min
and now it takes ~40min. In the same time there are jobs having only
1 or 2 subjobs and they should be used more.

Fixes: https://pagure.io/freeipa/issue/9207
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-07-26 12:36:41 -04:00
Stanislav Levin dd094e3889 ap: Disable azure's security daemon 
This daemon run clamav which is resource aggressive.
No point to run Windows virus scanner on Ubuntu in Linux-only
environment.

Fixes: https://pagure.io/freeipa/issue/9207
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-07-26 12:36:41 -04:00
Stanislav Levin 0e8bde3175 ap: Raise dbus timeout 
With some recent changes on Azure Agent the default DBus call
timeout is not good enough. For example, in case of
`InstallDNSSECFirst_1_to_5` job hostnamectl received reply in ~20sec,
but later it increased to ~30sec (more subjobs - more time to reply).
It's good to raise this timeout to be more protected against minimum
performance times.

https://www.freedesktop.org/software/systemd/man/sd_bus_set_method_call_timeout.html#Description

Fixes: https://pagure.io/freeipa/issue/9207
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-07-26 12:36:41 -04:00
David Pascual 3237ade3d2 ipatests: Checker script for prci definitions 
This script allows developers to check if prci definition jobs have the correct format,
which is defined in prci_jobs_spec.yaml
Useful when adding new jobs to the definitions.

Signed-off-by: David Pascual <davherna@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
 2022-07-15 17:09:17 +02:00
Rob Crittenden dc73813b8a Warn for permissions with read/write/search/compare and no attrs 
An ACI with rights of read, write, search and/or compare without
attributes to apply the rights to is effectively a no-op. Allow
the ACI to be created but include a warning. Ignore the add
and delete rights. While they make no sense in the context of
the other rights we should still warn that they are a no-op
with no attributes.

Use the existing make_aci() object method to create the
message and update the add/mod callers to capture and add the
message to the result if one is provided.

When updating an existing ACI the effective attributes will
not be included so fall back to the attributes in the resulting
permission.

Prior to checking for rights and attributes convert any deprecated
names for older clients into the newer values needed by make_aci

This is exercised by existing xmlrpc permission tests that
create such permissions without attributes.

https://pagure.io/freeipa/issue/9188

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-07-15 16:59:15 +02:00
Armando Neto 436c9d85ee webui: Do not allow empty pagination size 
Pagination size must be required, the current validators are triggered after
form is submitted, thus the only way for check if data is not empty is by making
the field required.

Fixes: https://pagure.io/freeipa/issue/9192

Signed-off-by: Armando Neto <abiagion@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-07-12 11:38:17 -03:00
Florence Blanc-Renaud e8d34361c7 ipatests: fix SSSD nightly definition 
The nightly test test_external_idp requires a topology
with 2 replicas. Fix the definition in nightly_latest_sssd.

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-07-12 10:15:21 +02:00
Fraser Tweedale f8da5bfbea install: suggest --skip-mem-check when mem check fails 
In the memory check failure message, add a hint to the administrator
that they can use the --skip-mem-check flag to skip the check.

Related: https://pagure.io/freeipa/issue/8404

Signed-off-by: Fraser Tweedale <frase@frase.id.au>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-07-05 14:29:27 +02:00
Fraser Tweedale cb0ce1bd8b man: add --skip-mem-check to man pages 
Document the --skip-mem-check flag in the ipa-server-install(1) and
ipa-replica-install(1) man pages.

Related: https://pagure.io/freeipa/issue/8404

Signed-off-by: Fraser Tweedale <frase@frase.id.au>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-07-05 14:29:27 +02:00
Fraser Tweedale 7a40948d6e BUILD.txt: remove redundant dnf-builddep option 
-b and --best are the same option (see dnf(8)).  Remove -b and keep
--best, because --best is more descriptive.

Signed-off-by: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-07-05 14:26:52 +02:00
Iker Pedrosa 03e9139504 ipatests: definitions for SSSD COPR nightly 
Defined the tests that will be executed for SSSD's COPR nightly.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2022-07-05 09:46:17 +02:00
Sumedh Sidhaye 2e11247cde Added a check while removing 'cert_dir'. The teardown method is called even if all the tests are skipped since the required PKI version is not present. The teardown is trying to remove a non-existent directory. 
Currently the cert_dir attribute is only present if IPA installation was
done. If IPA was not installed the attribute does not exist.
In order that the uninstall code finds the attribute a class attribute
is added.

Pagure Issue: https://pagure.io/freeipa/issue/9179

Signed-off-by: Sumedh Sidhaye <ssidhaye@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2022-07-02 18:34:16 +02:00
Rob Crittenden 22d1392a8a Only calculate LDAP password grace when the password is expired 
The user's pwd expiration was retrieved but inadvertently was never
compared to current time. So any LDAP bind, including from the
IPA API, counted against the grace period. There is no need to go
through the graceperiod code for non-expired passwords.

https://pagure.io/freeipa/issue/1539

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-06-30 08:34:28 -04:00
Armando Neto 52782b55f5 ipatests: update rawhide template 
Python packages updated to include latest `pytest-html`.

Issue: https://github.com/freeipa/freeipa-pr-ci/issues/467

Signed-off-by: Armando Neto <abiagion@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2022-06-29 21:24:04 -03:00
Antonio Torres 9819058d73 Bump to IPA 4.11 
Signed-off-by: Antonio Torres <antorres@redhat.com>
 2022-06-29 17:07:59 +02:00
962 changed files with 56750 additions and 40329 deletions
Expand all files Collapse all files

No files matched your search

.gitignore
+1
View File
@@ -155,6 +155,7 @@ install/custodia/ipa-custodia-dmldap
install/custodia/ipa-custodia-pki-tomcat install/custodia/ipa-custodia-pki-tomcat
install/custodia/ipa-custodia-pki-tomcat-wrapped install/custodia/ipa-custodia-pki-tomcat-wrapped
install/custodia/ipa-custodia-ra-agent install/custodia/ipa-custodia-ra-agent
install/oddjob/org.freeipa.server.config-enable-sid
install/oddjob/org.freeipa.server.trust-enable-agent install/oddjob/org.freeipa.server.trust-enable-agent
install/oddjob/com.redhat.idm.trust-fetch-domains install/oddjob/com.redhat.idm.trust-fetch-domains
install/oddjob/etc/oddjobd.conf.d/ipa-server.conf install/oddjob/etc/oddjobd.conf.d/ipa-server.conf
.wheelconstraints.in
+2 -3
View File
@@ -10,6 +10,5 @@ ipaserver == @VERSION@
ipatests == @VERSION@ ipatests == @VERSION@
# keep pylint version in sync with current Fedora release # keep pylint version in sync with current Fedora release
# F36 has 2.12.2 # F37 has 2.15.5
# https://pagure.io/freeipa/issue/8818 added pylint 2.8 support pylint ~= 2.15.5
pylint ~= 2.12.2
ACI.txt
+15 -3
View File
@@ -153,6 +153,8 @@ aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys
dn: cn=computers,cn=accounts,dc=ipa,dc=example dn: cn=computers,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=computers,cn=accounts,dc=ipa,dc=example dn: cn=computers,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "memberprincipal || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Resource Delegation";allow (delete,write) groupdn = "ldap:///cn=System: Manage Host Resource Delegation,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=computers,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=computers,cn=accounts,dc=ipa,dc=example dn: cn=computers,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
@@ -161,7 +163,7 @@ aci: (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytim
dn: cn=computers,cn=accounts,dc=ipa,dc=example dn: cn=computers,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";) aci: (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=computers,cn=accounts,dc=ipa,dc=example dn: cn=computers,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";) aci: (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || memberprincipal || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=computers,cn=accounts,dc=ipa,dc=example dn: cn=computers,cn=accounts,dc=ipa,dc=example
aci: (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
@@ -222,6 +224,10 @@ dn: cn=ng,cn=alt,dc=ipa,dc=example
aci: (targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Remove Netgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetfilter = "(objectclass=ipanisnetgroup)")(version 3.0;acl "permission:System: Remove Netgroups";allow (delete) groupdn = "ldap:///cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=otp,cn=etc,dc=ipa,dc=example dn: cn=otp,cn=etc,dc=ipa,dc=example
aci: (targetattr = "cn || ipatokenhotpauthwindow || ipatokenhotpsyncwindow || ipatokentotpauthwindow || ipatokentotpsyncwindow")(targetfilter = "(objectclass=ipatokenotpconfig)")(version 3.0;acl "permission:System: Read OTP Configuration";allow (compare,read,search) userdn = "ldap:///all";) aci: (targetattr = "cn || ipatokenhotpauthwindow || ipatokenhotpsyncwindow || ipatokentotpauthwindow || ipatokentotpsyncwindow")(targetfilter = "(objectclass=ipatokenotpconfig)")(version 3.0;acl "permission:System: Read OTP Configuration";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=passkeyconfig,cn=etc,dc=ipa,dc=example
aci: (targetattr = "iparequireuserverification")(targetfilter = "(objectclass=ipapasskeyconfigobject)")(version 3.0;acl "permission:System: Modify Passkey Configuration";allow (write) groupdn = "ldap:///cn=System: Modify Passkey Configuration,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=passkeyconfig,cn=etc,dc=ipa,dc=example
aci: (targetattr = "cn || iparequireuserverification")(targetfilter = "(objectclass=ipapasskeyconfigobject)")(version 3.0;acl "permission:System: Read Passkey Configuration";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=permissions,cn=pbac,dc=ipa,dc=example dn: cn=permissions,cn=pbac,dc=ipa,dc=example
aci: (targetattr = "member")(targetfilter = "(objectclass=ipapermission)")(version 3.0;acl "permission:System: Modify Privilege Membership";allow (write) groupdn = "ldap:///cn=System: Modify Privilege Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "member")(targetfilter = "(objectclass=ipapermission)")(version 3.0;acl "permission:System: Modify Privilege Membership";allow (write) groupdn = "ldap:///cn=System: Modify Privilege Membership,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: dc=ipa,dc=example dn: dc=ipa,dc=example
@@ -281,11 +287,15 @@ aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys
dn: cn=services,cn=accounts,dc=ipa,dc=example dn: cn=services,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=services,cn=accounts,dc=ipa,dc=example dn: cn=services,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "memberprincipal || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Resource Delegation";allow (delete,write) groupdn = "ldap:///cn=System: Manage Service Resource Delegation,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=services,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;write_delegation || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Resource Delegation Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Resource Delegation Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=services,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=services,cn=accounts,dc=ipa,dc=example dn: cn=services,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";) aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=services,cn=accounts,dc=ipa,dc=example dn: cn=services,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";) aci: (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || memberprincipal || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=services,cn=accounts,dc=ipa,dc=example dn: cn=services,cn=accounts,dc=ipa,dc=example
aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=s4u2proxy,cn=etc,dc=ipa,dc=example dn: cn=s4u2proxy,cn=etc,dc=ipa,dc=example
@@ -377,6 +387,8 @@ aci: (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory
dn: cn=users,cn=accounts,dc=ipa,dc=example dn: cn=users,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "krbpasswordexpiration || krbprincipalkey || passwordhistory || sambalmpassword || sambantpassword || userpassword")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Change User password";allow (write) groupdn = "ldap:///cn=System: Change User password,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=users,cn=accounts,dc=ipa,dc=example dn: cn=users,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "ipapasskey || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage Passkey Mappings";allow (write) groupdn = "ldap:///cn=System: Manage Passkey Mappings,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=users,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "ipacertmapdata || objectclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Manage User Certificate Mappings";allow (write) groupdn = "ldap:///cn=System: Manage User Certificate Mappings,cn=permissions,cn=pbac,dc=ipa,dc=example";)
dn: cn=users,cn=accounts,dc=ipa,dc=example dn: cn=users,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=ipa,dc=example";) aci: (targetattr = "usercertificate")(targetfilter = "(&(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipa,dc=example))(objectclass=posixaccount))")(version 3.0;acl "permission:System: Manage User Certificates";allow (write) groupdn = "ldap:///cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=ipa,dc=example";)
@@ -393,7 +405,7 @@ aci: (targetattr = "audio || businesscategory || carlicense || departmentnumber
dn: dc=ipa,dc=example dn: dc=ipa,dc=example
aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";) aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)
dn: cn=users,cn=accounts,dc=ipa,dc=example dn: cn=users,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";) aci: (targetattr = "ipapasskey || ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=users,cn=accounts,dc=ipa,dc=example dn: cn=users,cn=accounts,dc=ipa,dc=example
aci: (targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";) aci: (targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";)
dn: cn=users,cn=accounts,dc=ipa,dc=example dn: cn=users,cn=accounts,dc=ipa,dc=example
API.txt
+203 -20
View File
@@ -1099,7 +1099,7 @@ option: Int('ipasearchrecordslimit?', autofill=False, cli_name='searchrecordslim
option: Int('ipasearchtimelimit?', autofill=False, cli_name='searchtimelimit') option: Int('ipasearchtimelimit?', autofill=False, cli_name='searchtimelimit')
option: Str('ipaselinuxusermapdefault?', autofill=False) option: Str('ipaselinuxusermapdefault?', autofill=False)
option: Str('ipaselinuxusermaporder?', autofill=False) option: Str('ipaselinuxusermaporder?', autofill=False)
option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'disabled']) option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey', u'disabled'])
option: Bool('ipauserdefaultsubordinateid?', autofill=False, cli_name='user_default_subid') option: Bool('ipauserdefaultsubordinateid?', autofill=False, cli_name='user_default_subid')
option: Str('ipauserobjectclasses*', autofill=False, cli_name='userobjectclasses') option: Str('ipauserobjectclasses*', autofill=False, cli_name='userobjectclasses')
option: IA5Str('ipausersearchfields?', autofill=False, cli_name='usersearch') option: IA5Str('ipausersearchfields?', autofill=False, cli_name='usersearch')
@@ -1798,7 +1798,7 @@ option: DNSNameParam('idnssoamname?', cli_name='name_server')
option: Int('idnssoarefresh', autofill=True, cli_name='refresh', default=3600) option: Int('idnssoarefresh', autofill=True, cli_name='refresh', default=3600)
option: Int('idnssoaretry', autofill=True, cli_name='retry', default=900) option: Int('idnssoaretry', autofill=True, cli_name='retry', default=900)
option: DNSNameParam('idnssoarname', autofill=True, cli_name='admin_email', default=<DNS name hostmaster>) option: DNSNameParam('idnssoarname', autofill=True, cli_name='admin_email', default=<DNS name hostmaster>)
option: Int('idnssoaserial', autofill=True, cli_name='serial') option: Int('idnssoaserial?', cli_name='serial', deprecated=True)
option: Str('idnsupdatepolicy?', autofill=True, cli_name='update_policy') option: Str('idnsupdatepolicy?', autofill=True, cli_name='update_policy')
option: Str('ip_address?') option: Str('ip_address?')
option: Str('name_from_ip?') option: Str('name_from_ip?')
@@ -1862,7 +1862,7 @@ option: DNSNameParam('idnssoamname?', autofill=False, cli_name='name_server')
option: Int('idnssoarefresh?', autofill=False, cli_name='refresh', default=3600) option: Int('idnssoarefresh?', autofill=False, cli_name='refresh', default=3600)
option: Int('idnssoaretry?', autofill=False, cli_name='retry', default=900) option: Int('idnssoaretry?', autofill=False, cli_name='retry', default=900)
option: DNSNameParam('idnssoarname?', autofill=False, cli_name='admin_email', default=<DNS name hostmaster>) option: DNSNameParam('idnssoarname?', autofill=False, cli_name='admin_email', default=<DNS name hostmaster>)
option: Int('idnssoaserial?', autofill=False, cli_name='serial') option: Int('idnssoaserial?', autofill=False, cli_name='serial', deprecated=True)
option: Str('idnsupdatepolicy?', autofill=False, cli_name='update_policy') option: Str('idnsupdatepolicy?', autofill=False, cli_name='update_policy')
option: Bool('idnszoneactive?', autofill=False, cli_name='zone_active') option: Bool('idnszoneactive?', autofill=False, cli_name='zone_active')
option: Str('name_from_ip?', autofill=False) option: Str('name_from_ip?', autofill=False)
@@ -1899,7 +1899,7 @@ option: DNSNameParam('idnssoamname?', autofill=False, cli_name='name_server')
option: Int('idnssoarefresh?', autofill=False, cli_name='refresh', default=3600) option: Int('idnssoarefresh?', autofill=False, cli_name='refresh', default=3600)
option: Int('idnssoaretry?', autofill=False, cli_name='retry', default=900) option: Int('idnssoaretry?', autofill=False, cli_name='retry', default=900)
option: DNSNameParam('idnssoarname?', autofill=False, cli_name='admin_email', default=<DNS name hostmaster>) option: DNSNameParam('idnssoarname?', autofill=False, cli_name='admin_email', default=<DNS name hostmaster>)
option: Int('idnssoaserial?', autofill=False, cli_name='serial') option: Int('idnssoaserial?', autofill=False, cli_name='serial', deprecated=True)
option: Str('idnsupdatepolicy?', autofill=False, cli_name='update_policy') option: Str('idnsupdatepolicy?', autofill=False, cli_name='update_policy')
option: Str('name_from_ip?', autofill=False) option: Str('name_from_ip?', autofill=False)
option: Str('nsec3paramrecord?', autofill=False, cli_name='nsec3param_rec') option: Str('nsec3paramrecord?', autofill=False, cli_name='nsec3param_rec')
@@ -2478,7 +2478,7 @@ option: Bool('ipakrbokasdelegate?', cli_name='ok_as_delegate')
option: Bool('ipakrboktoauthasdelegate?', cli_name='ok_to_auth_as_delegate') option: Bool('ipakrboktoauthasdelegate?', cli_name='ok_to_auth_as_delegate')
option: Bool('ipakrbrequirespreauth?', cli_name='requires_pre_auth') option: Bool('ipakrbrequirespreauth?', cli_name='requires_pre_auth')
option: Str('ipasshpubkey*', cli_name='sshpubkey') option: Str('ipasshpubkey*', cli_name='sshpubkey')
option: StrEnum('krbprincipalauthind*', cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('krbprincipalauthind*', cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: Str('l?', cli_name='locality') option: Str('l?', cli_name='locality')
option: Str('macaddress*') option: Str('macaddress*')
option: Flag('no_members', autofill=True, default=False) option: Flag('no_members', autofill=True, default=False)
@@ -2507,6 +2507,17 @@ option: Str('version?')
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: host_add_delegation/1
args: 2,4,3
arg: Str('fqdn', cli_name='hostname')
arg: Str('memberprincipal+', alwaysask=True, cli_name='principal')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: host_add_managedby/1 command: host_add_managedby/1
args: 1,5,3 args: 1,5,3
arg: Str('fqdn', cli_name='hostname') arg: Str('fqdn', cli_name='hostname')
@@ -2529,6 +2540,20 @@ option: Str('version?')
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: host_allow_add_delegation/1
args: 1,8,3
arg: Str('fqdn', cli_name='hostname')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Str('group*', alwaysask=True, cli_name='groups')
option: Str('host*', alwaysask=True, cli_name='hosts')
option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('user*', alwaysask=True, cli_name='users')
option: Str('version?')
output: Output('completed', type=[<type 'int'>])
output: Output('failed', type=[<type 'dict'>])
output: Entry('result')
command: host_allow_create_keytab/1 command: host_allow_create_keytab/1
args: 1,8,3 args: 1,8,3
arg: Str('fqdn', cli_name='hostname') arg: Str('fqdn', cli_name='hostname')
@@ -2573,6 +2598,20 @@ option: Str('version?')
output: Output('result', type=[<type 'bool'>]) output: Output('result', type=[<type 'bool'>])
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: host_disallow_add_delegation/1
args: 1,8,3
arg: Str('fqdn', cli_name='hostname')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Str('group*', alwaysask=True, cli_name='groups')
option: Str('host*', alwaysask=True, cli_name='hosts')
option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('user*', alwaysask=True, cli_name='users')
option: Str('version?')
output: Output('completed', type=[<type 'int'>])
output: Output('failed', type=[<type 'dict'>])
output: Entry('result')
command: host_disallow_create_keytab/1 command: host_disallow_create_keytab/1
args: 1,8,3 args: 1,8,3
arg: Str('fqdn', cli_name='hostname') arg: Str('fqdn', cli_name='hostname')
@@ -2614,7 +2653,7 @@ option: Str('in_netgroup*', cli_name='in_netgroups')
option: Str('in_role*', cli_name='in_roles') option: Str('in_role*', cli_name='in_roles')
option: Str('in_sudorule*', cli_name='in_sudorules') option: Str('in_sudorule*', cli_name='in_sudorules')
option: Str('ipaassignedidview?', autofill=False) option: Str('ipaassignedidview?', autofill=False)
option: StrEnum('krbprincipalauthind*', autofill=False, cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('krbprincipalauthind*', autofill=False, cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: Str('l?', autofill=False, cli_name='locality') option: Str('l?', autofill=False, cli_name='locality')
option: Str('macaddress*', autofill=False) option: Str('macaddress*', autofill=False)
option: Str('man_by_host*', cli_name='man_by_hosts') option: Str('man_by_host*', cli_name='man_by_hosts')
@@ -2654,7 +2693,7 @@ option: Bool('ipakrbokasdelegate?', autofill=False, cli_name='ok_as_delegate')
option: Bool('ipakrboktoauthasdelegate?', autofill=False, cli_name='ok_to_auth_as_delegate') option: Bool('ipakrboktoauthasdelegate?', autofill=False, cli_name='ok_to_auth_as_delegate')
option: Bool('ipakrbrequirespreauth?', autofill=False, cli_name='requires_pre_auth') option: Bool('ipakrbrequirespreauth?', autofill=False, cli_name='requires_pre_auth')
option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey') option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey')
option: StrEnum('krbprincipalauthind*', autofill=False, cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('krbprincipalauthind*', autofill=False, cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: Principal('krbprincipalname*', autofill=False) option: Principal('krbprincipalname*', autofill=False)
option: Str('l?', autofill=False, cli_name='locality') option: Str('l?', autofill=False, cli_name='locality')
option: Str('macaddress*', autofill=False) option: Str('macaddress*', autofill=False)
@@ -2685,6 +2724,17 @@ option: Str('version?')
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: host_remove_delegation/1
args: 2,4,3
arg: Str('fqdn', cli_name='hostname')
arg: Str('memberprincipal+', alwaysask=True, cli_name='principal')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: host_remove_managedby/1 command: host_remove_managedby/1
args: 1,5,3 args: 1,5,3
arg: Str('fqdn', cli_name='hostname') arg: Str('fqdn', cli_name='hostname')
@@ -3327,7 +3377,7 @@ output: Output('result', type=[<type 'bool'>])
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: krbtpolicy_mod/1 command: krbtpolicy_mod/1
args: 1,19,3 args: 1,21,3
arg: Str('uid?', cli_name='user') arg: Str('uid?', cli_name='user')
option: Str('addattr*', cli_name='addattr') option: Str('addattr*', cli_name='addattr')
option: Flag('all', autofill=True, cli_name='all', default=False) option: Flag('all', autofill=True, cli_name='all', default=False)
@@ -3335,11 +3385,13 @@ option: Str('delattr*', cli_name='delattr')
option: Int('krbauthindmaxrenewableage_hardened?', autofill=False, cli_name='hardened_maxrenew') option: Int('krbauthindmaxrenewableage_hardened?', autofill=False, cli_name='hardened_maxrenew')
option: Int('krbauthindmaxrenewableage_idp?', autofill=False, cli_name='idp_maxrenew') option: Int('krbauthindmaxrenewableage_idp?', autofill=False, cli_name='idp_maxrenew')
option: Int('krbauthindmaxrenewableage_otp?', autofill=False, cli_name='otp_maxrenew') option: Int('krbauthindmaxrenewableage_otp?', autofill=False, cli_name='otp_maxrenew')
option: Int('krbauthindmaxrenewableage_passkey?', autofill=False, cli_name='passkey_maxrenew')
option: Int('krbauthindmaxrenewableage_pkinit?', autofill=False, cli_name='pkinit_maxrenew') option: Int('krbauthindmaxrenewableage_pkinit?', autofill=False, cli_name='pkinit_maxrenew')
option: Int('krbauthindmaxrenewableage_radius?', autofill=False, cli_name='radius_maxrenew') option: Int('krbauthindmaxrenewableage_radius?', autofill=False, cli_name='radius_maxrenew')
option: Int('krbauthindmaxticketlife_hardened?', autofill=False, cli_name='hardened_maxlife') option: Int('krbauthindmaxticketlife_hardened?', autofill=False, cli_name='hardened_maxlife')
option: Int('krbauthindmaxticketlife_idp?', autofill=False, cli_name='idp_maxlife') option: Int('krbauthindmaxticketlife_idp?', autofill=False, cli_name='idp_maxlife')
option: Int('krbauthindmaxticketlife_otp?', autofill=False, cli_name='otp_maxlife') option: Int('krbauthindmaxticketlife_otp?', autofill=False, cli_name='otp_maxlife')
option: Int('krbauthindmaxticketlife_passkey?', autofill=False, cli_name='passkey_maxlife')
option: Int('krbauthindmaxticketlife_pkinit?', autofill=False, cli_name='pkinit_maxlife') option: Int('krbauthindmaxticketlife_pkinit?', autofill=False, cli_name='pkinit_maxlife')
option: Int('krbauthindmaxticketlife_radius?', autofill=False, cli_name='radius_maxlife') option: Int('krbauthindmaxticketlife_radius?', autofill=False, cli_name='radius_maxlife')
option: Int('krbmaxrenewableage?', autofill=False, cli_name='maxrenew') option: Int('krbmaxrenewableage?', autofill=False, cli_name='maxrenew')
@@ -3769,6 +3821,28 @@ option: Str('version?')
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: passkeyconfig_mod/1
args: 0,8,3
option: Str('addattr*', cli_name='addattr')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Str('delattr*', cli_name='delattr')
option: Bool('iparequireuserverification?', autofill=False, cli_name='require_user_verification')
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Flag('rights', autofill=True, default=False)
option: Str('setattr*', cli_name='setattr')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: passkeyconfig_show/1
args: 0,4,3
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Flag('rights', autofill=True, default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: passwd/1 command: passwd/1
args: 3,2,3 args: 3,2,3
arg: Principal('principal', autofill=True, cli_name='user') arg: Principal('principal', autofill=True, cli_name='user')
@@ -4076,7 +4150,7 @@ option: Int('krbpwdlockoutduration?', cli_name='lockouttime')
option: Int('krbpwdmaxfailure?', cli_name='maxfail') option: Int('krbpwdmaxfailure?', cli_name='maxfail')
option: Int('krbpwdmindiffchars?', cli_name='minclasses') option: Int('krbpwdmindiffchars?', cli_name='minclasses')
option: Int('krbpwdminlength?', cli_name='minlength') option: Int('krbpwdminlength?', cli_name='minlength')
option: Int('passwordgracelimit?', cli_name='gracelimit', default=-1) option: Int('passwordgracelimit?', autofill=True, cli_name='gracelimit', default=-1)
option: Flag('raw', autofill=True, cli_name='raw', default=False) option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('setattr*', cli_name='setattr') option: Str('setattr*', cli_name='setattr')
option: Str('version?') option: Str('version?')
@@ -4684,7 +4758,7 @@ option: StrEnum('ipakrbauthzdata*', cli_name='pac_type', values=[u'MS-PAC', u'PA
option: Bool('ipakrbokasdelegate?', cli_name='ok_as_delegate') option: Bool('ipakrbokasdelegate?', cli_name='ok_as_delegate')
option: Bool('ipakrboktoauthasdelegate?', cli_name='ok_to_auth_as_delegate') option: Bool('ipakrboktoauthasdelegate?', cli_name='ok_to_auth_as_delegate')
option: Bool('ipakrbrequirespreauth?', cli_name='requires_pre_auth') option: Bool('ipakrbrequirespreauth?', cli_name='requires_pre_auth')
option: StrEnum('krbprincipalauthind*', cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('krbprincipalauthind*', cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: Flag('no_members', autofill=True, default=False) option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False) option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('setattr*', cli_name='setattr') option: Str('setattr*', cli_name='setattr')
@@ -4705,6 +4779,17 @@ option: Str('version?')
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: service_add_delegation/1
args: 2,4,3
arg: Principal('krbcanonicalname', cli_name='canonical_principal')
arg: Str('memberprincipal+', alwaysask=True, cli_name='principal')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: service_add_host/1 command: service_add_host/1
args: 1,5,3 args: 1,5,3
arg: Principal('krbcanonicalname', cli_name='canonical_principal') arg: Principal('krbcanonicalname', cli_name='canonical_principal')
@@ -4743,6 +4828,20 @@ option: Str('version?')
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: service_allow_add_delegation/1
args: 1,8,3
arg: Principal('krbcanonicalname', cli_name='canonical_principal')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Str('group*', alwaysask=True, cli_name='groups')
option: Str('host*', alwaysask=True, cli_name='hosts')
option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('user*', alwaysask=True, cli_name='users')
option: Str('version?')
output: Output('completed', type=[<type 'int'>])
output: Output('failed', type=[<type 'dict'>])
output: Entry('result')
command: service_allow_create_keytab/1 command: service_allow_create_keytab/1
args: 1,8,3 args: 1,8,3
arg: Principal('krbcanonicalname', cli_name='canonical_principal') arg: Principal('krbcanonicalname', cli_name='canonical_principal')
@@ -4786,6 +4885,20 @@ option: Str('version?')
output: Output('result', type=[<type 'bool'>]) output: Output('result', type=[<type 'bool'>])
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: service_disallow_add_delegation/1
args: 1,8,3
arg: Principal('krbcanonicalname', cli_name='canonical_principal')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Str('group*', alwaysask=True, cli_name='groups')
option: Str('host*', alwaysask=True, cli_name='hosts')
option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('user*', alwaysask=True, cli_name='users')
option: Str('version?')
output: Output('completed', type=[<type 'int'>])
output: Output('failed', type=[<type 'dict'>])
output: Entry('result')
command: service_disallow_create_keytab/1 command: service_disallow_create_keytab/1
args: 1,8,3 args: 1,8,3
arg: Principal('krbcanonicalname', cli_name='canonical_principal') arg: Principal('krbcanonicalname', cli_name='canonical_principal')
@@ -4820,7 +4933,7 @@ arg: Str('criteria?')
option: Flag('all', autofill=True, cli_name='all', default=False) option: Flag('all', autofill=True, cli_name='all', default=False)
option: StrEnum('ipakrbauthzdata*', autofill=False, cli_name='pac_type', values=[u'MS-PAC', u'PAD', u'NONE']) option: StrEnum('ipakrbauthzdata*', autofill=False, cli_name='pac_type', values=[u'MS-PAC', u'PAD', u'NONE'])
option: Principal('krbcanonicalname?', autofill=False, cli_name='canonical_principal') option: Principal('krbcanonicalname?', autofill=False, cli_name='canonical_principal')
option: StrEnum('krbprincipalauthind*', autofill=False, cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('krbprincipalauthind*', autofill=False, cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: Principal('krbprincipalname*', autofill=False, cli_name='principal') option: Principal('krbprincipalname*', autofill=False, cli_name='principal')
option: Str('man_by_host*', cli_name='man_by_hosts') option: Str('man_by_host*', cli_name='man_by_hosts')
option: Flag('no_members', autofill=True, default=True) option: Flag('no_members', autofill=True, default=True)
@@ -4844,7 +4957,7 @@ option: StrEnum('ipakrbauthzdata*', autofill=False, cli_name='pac_type', values=
option: Bool('ipakrbokasdelegate?', autofill=False, cli_name='ok_as_delegate') option: Bool('ipakrbokasdelegate?', autofill=False, cli_name='ok_as_delegate')
option: Bool('ipakrboktoauthasdelegate?', autofill=False, cli_name='ok_to_auth_as_delegate') option: Bool('ipakrboktoauthasdelegate?', autofill=False, cli_name='ok_to_auth_as_delegate')
option: Bool('ipakrbrequirespreauth?', autofill=False, cli_name='requires_pre_auth') option: Bool('ipakrbrequirespreauth?', autofill=False, cli_name='requires_pre_auth')
option: StrEnum('krbprincipalauthind*', autofill=False, cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('krbprincipalauthind*', autofill=False, cli_name='auth_ind', values=[u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: Principal('krbprincipalname*', autofill=False, cli_name='principal') option: Principal('krbprincipalname*', autofill=False, cli_name='principal')
option: Flag('no_members', autofill=True, default=False) option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False) option: Flag('raw', autofill=True, cli_name='raw', default=False)
@@ -4866,6 +4979,17 @@ option: Str('version?')
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
command: service_remove_delegation/1
args: 2,4,3
arg: Principal('krbcanonicalname', cli_name='canonical_principal')
arg: Str('memberprincipal+', alwaysask=True, cli_name='principal')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: service_remove_host/1 command: service_remove_host/1
args: 1,5,3 args: 1,5,3
arg: Principal('krbcanonicalname', cli_name='canonical_principal') arg: Principal('krbcanonicalname', cli_name='canonical_principal')
@@ -5094,7 +5218,7 @@ option: Str('ipaidpsub?', cli_name='idp_user_id')
option: Str('ipasshpubkey*', cli_name='sshpubkey') option: Str('ipasshpubkey*', cli_name='sshpubkey')
option: Str('ipatokenradiusconfiglink?', cli_name='radius') option: Str('ipatokenradiusconfiglink?', cli_name='radius')
option: Str('ipatokenradiususername?', cli_name='radius_username') option: Str('ipatokenradiususername?', cli_name='radius_username')
option: StrEnum('ipauserauthtype*', cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('ipauserauthtype*', cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: DateTime('krbpasswordexpiration?', cli_name='password_expiration') option: DateTime('krbpasswordexpiration?', cli_name='password_expiration')
option: DateTime('krbprincipalexpiration?', cli_name='principal_expiration') option: DateTime('krbprincipalexpiration?', cli_name='principal_expiration')
option: Principal('krbprincipalname*', autofill=True, cli_name='principal') option: Principal('krbprincipalname*', autofill=True, cli_name='principal')
@@ -5160,6 +5284,17 @@ option: Str('version?')
output: Output('completed', type=[<type 'int'>]) output: Output('completed', type=[<type 'int'>])
output: Output('failed', type=[<type 'dict'>]) output: Output('failed', type=[<type 'dict'>])
output: Entry('result') output: Entry('result')
command: stageuser_add_passkey/1
args: 2,4,3
arg: Str('uid', cli_name='login')
arg: Str('ipapasskey+', alwaysask=True, cli_name='passkey')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: stageuser_add_principal/1 command: stageuser_add_principal/1
args: 2,4,3 args: 2,4,3
arg: Str('uid', cli_name='login') arg: Str('uid', cli_name='login')
@@ -5209,7 +5344,7 @@ option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')
option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path') option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')
option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius') option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')
option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username') option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username')
option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: DateTime('krbpasswordexpiration?', autofill=False, cli_name='password_expiration') option: DateTime('krbpasswordexpiration?', autofill=False, cli_name='password_expiration')
option: DateTime('krbprincipalexpiration?', autofill=False, cli_name='principal_expiration') option: DateTime('krbprincipalexpiration?', autofill=False, cli_name='principal_expiration')
option: Principal('krbprincipalname*', autofill=False, cli_name='principal') option: Principal('krbprincipalname*', autofill=False, cli_name='principal')
@@ -5275,7 +5410,7 @@ option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')
option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey') option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey')
option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius') option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')
option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username') option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username')
option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: DateTime('krbpasswordexpiration?', autofill=False, cli_name='password_expiration') option: DateTime('krbpasswordexpiration?', autofill=False, cli_name='password_expiration')
option: DateTime('krbprincipalexpiration?', autofill=False, cli_name='principal_expiration') option: DateTime('krbprincipalexpiration?', autofill=False, cli_name='principal_expiration')
option: Principal('krbprincipalname*', autofill=False, cli_name='principal') option: Principal('krbprincipalname*', autofill=False, cli_name='principal')
@@ -5343,6 +5478,17 @@ option: Str('version?')
output: Output('completed', type=[<type 'int'>]) output: Output('completed', type=[<type 'int'>])
output: Output('failed', type=[<type 'dict'>]) output: Output('failed', type=[<type 'dict'>])
output: Entry('result') output: Entry('result')
command: stageuser_remove_passkey/1
args: 2,4,3
arg: Str('uid', cli_name='login')
arg: Str('ipapasskey+', alwaysask=True, cli_name='passkey')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: stageuser_remove_principal/1 command: stageuser_remove_principal/1
args: 2,4,3 args: 2,4,3
arg: Str('uid', cli_name='login') arg: Str('uid', cli_name='login')
@@ -6279,7 +6425,7 @@ option: Str('ipaidpsub?', cli_name='idp_user_id')
option: Str('ipasshpubkey*', cli_name='sshpubkey') option: Str('ipasshpubkey*', cli_name='sshpubkey')
option: Str('ipatokenradiusconfiglink?', cli_name='radius') option: Str('ipatokenradiusconfiglink?', cli_name='radius')
option: Str('ipatokenradiususername?', cli_name='radius_username') option: Str('ipatokenradiususername?', cli_name='radius_username')
option: StrEnum('ipauserauthtype*', cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('ipauserauthtype*', cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: DateTime('krbpasswordexpiration?', cli_name='password_expiration') option: DateTime('krbpasswordexpiration?', cli_name='password_expiration')
option: DateTime('krbprincipalexpiration?', cli_name='principal_expiration') option: DateTime('krbprincipalexpiration?', cli_name='principal_expiration')
option: Principal('krbprincipalname*', autofill=True, cli_name='principal') option: Principal('krbprincipalname*', autofill=True, cli_name='principal')
@@ -6347,6 +6493,17 @@ option: Str('version?')
output: Output('completed', type=[<type 'int'>]) output: Output('completed', type=[<type 'int'>])
output: Output('failed', type=[<type 'dict'>]) output: Output('failed', type=[<type 'dict'>])
output: Entry('result') output: Entry('result')
command: user_add_passkey/1
args: 2,4,3
arg: Str('uid', cli_name='login')
arg: Str('ipapasskey+', alwaysask=True, cli_name='passkey')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: user_add_principal/1 command: user_add_principal/1
args: 2,4,3 args: 2,4,3
arg: Str('uid', cli_name='login') arg: Str('uid', cli_name='login')
@@ -6411,7 +6568,7 @@ option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')
option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path') option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')
option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius') option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')
option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username') option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username')
option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: DateTime('krbpasswordexpiration?', autofill=False, cli_name='password_expiration') option: DateTime('krbpasswordexpiration?', autofill=False, cli_name='password_expiration')
option: DateTime('krbprincipalexpiration?', autofill=False, cli_name='principal_expiration') option: DateTime('krbprincipalexpiration?', autofill=False, cli_name='principal_expiration')
option: Principal('krbprincipalname*', autofill=False, cli_name='principal') option: Principal('krbprincipalname*', autofill=False, cli_name='principal')
@@ -6480,7 +6637,7 @@ option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')
option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey') option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey')
option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius') option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')
option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username') option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username')
option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp']) option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey'])
option: DateTime('krbpasswordexpiration?', autofill=False, cli_name='password_expiration') option: DateTime('krbpasswordexpiration?', autofill=False, cli_name='password_expiration')
option: DateTime('krbprincipalexpiration?', autofill=False, cli_name='principal_expiration') option: DateTime('krbprincipalexpiration?', autofill=False, cli_name='principal_expiration')
option: Principal('krbprincipalname*', autofill=False, cli_name='principal') option: Principal('krbprincipalname*', autofill=False, cli_name='principal')
@@ -6549,6 +6706,17 @@ option: Str('version?')
output: Output('completed', type=[<type 'int'>]) output: Output('completed', type=[<type 'int'>])
output: Output('failed', type=[<type 'dict'>]) output: Output('failed', type=[<type 'dict'>])
output: Entry('result') output: Entry('result')
command: user_remove_passkey/1
args: 2,4,3
arg: Str('uid', cli_name='login')
arg: Str('ipapasskey+', alwaysask=True, cli_name='passkey')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: user_remove_principal/1 command: user_remove_principal/1
args: 2,4,3 args: 2,4,3
arg: Str('uid', cli_name='login') arg: Str('uid', cli_name='login')
@@ -6667,7 +6835,7 @@ option: Flag('shared?', autofill=True, default=False)
option: Str('username?', cli_name='user') option: Str('username?', cli_name='user')
option: Bytes('vault_data') option: Bytes('vault_data')
option: Str('version?') option: Str('version?')
option: StrEnum('wrapping_algo?', autofill=True, default=u'aes-128-cbc', values=[u'aes-128-cbc', u'des-ede3-cbc']) option: StrEnum('wrapping_algo?', autofill=True, default=u'des-ede3-cbc', values=[u'aes-128-cbc', u'des-ede3-cbc'])
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
@@ -6767,7 +6935,7 @@ option: Bytes('session_key')
option: Flag('shared?', autofill=True, default=False) option: Flag('shared?', autofill=True, default=False)
option: Str('username?', cli_name='user') option: Str('username?', cli_name='user')
option: Str('version?') option: Str('version?')
option: StrEnum('wrapping_algo?', autofill=True, default=u'aes-128-cbc', values=[u'aes-128-cbc', u'des-ede3-cbc']) option: StrEnum('wrapping_algo?', autofill=True, default=u'des-ede3-cbc', values=[u'aes-128-cbc', u'des-ede3-cbc'])
output: Entry('result') output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>]) output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value') output: PrimaryKey('value')
@@ -7092,17 +7260,21 @@ default: hbactest/1
default: host/1 default: host/1
default: host_add/1 default: host_add/1
default: host_add_cert/1 default: host_add_cert/1
default: host_add_delegation/1
default: host_add_managedby/1 default: host_add_managedby/1
default: host_add_principal/1 default: host_add_principal/1
default: host_allow_add_delegation/1
default: host_allow_create_keytab/1 default: host_allow_create_keytab/1
default: host_allow_retrieve_keytab/1 default: host_allow_retrieve_keytab/1
default: host_del/1 default: host_del/1
default: host_disable/1 default: host_disable/1
default: host_disallow_add_delegation/1
default: host_disallow_create_keytab/1 default: host_disallow_create_keytab/1
default: host_disallow_retrieve_keytab/1 default: host_disallow_retrieve_keytab/1
default: host_find/1 default: host_find/1
default: host_mod/1 default: host_mod/1
default: host_remove_cert/1 default: host_remove_cert/1
default: host_remove_delegation/1
default: host_remove_managedby/1 default: host_remove_managedby/1
default: host_remove_principal/1 default: host_remove_principal/1
default: host_show/1 default: host_show/1
@@ -7191,6 +7363,9 @@ default: output_show/1
default: param/1 default: param/1
default: param_find/1 default: param_find/1
default: param_show/1 default: param_show/1
default: passkeyconfig/1
default: passkeyconfig_mod/1
default: passkeyconfig_show/1
default: passwd/1 default: passwd/1
default: permission/1 default: permission/1
default: permission_add/1 default: permission_add/1
@@ -7272,18 +7447,22 @@ default: server_state/1
default: service/1 default: service/1
default: service_add/1 default: service_add/1
default: service_add_cert/1 default: service_add_cert/1
default: service_add_delegation/1
default: service_add_host/1 default: service_add_host/1
default: service_add_principal/1 default: service_add_principal/1
default: service_add_smb/1 default: service_add_smb/1
default: service_allow_add_delegation/1
default: service_allow_create_keytab/1 default: service_allow_create_keytab/1
default: service_allow_retrieve_keytab/1 default: service_allow_retrieve_keytab/1
default: service_del/1 default: service_del/1
default: service_disable/1 default: service_disable/1
default: service_disallow_add_delegation/1
default: service_disallow_create_keytab/1 default: service_disallow_create_keytab/1
default: service_disallow_retrieve_keytab/1 default: service_disallow_retrieve_keytab/1
default: service_find/1 default: service_find/1
default: service_mod/1 default: service_mod/1
default: service_remove_cert/1 default: service_remove_cert/1
default: service_remove_delegation/1
default: service_remove_host/1 default: service_remove_host/1
default: service_remove_principal/1 default: service_remove_principal/1
default: service_show/1 default: service_show/1
@@ -7312,6 +7491,7 @@ default: stageuser_add/1
default: stageuser_add_cert/1 default: stageuser_add_cert/1
default: stageuser_add_certmapdata/1 default: stageuser_add_certmapdata/1
default: stageuser_add_manager/1 default: stageuser_add_manager/1
default: stageuser_add_passkey/1
default: stageuser_add_principal/1 default: stageuser_add_principal/1
default: stageuser_del/1 default: stageuser_del/1
default: stageuser_find/1 default: stageuser_find/1
@@ -7319,6 +7499,7 @@ default: stageuser_mod/1
default: stageuser_remove_cert/1 default: stageuser_remove_cert/1
default: stageuser_remove_certmapdata/1 default: stageuser_remove_certmapdata/1
default: stageuser_remove_manager/1 default: stageuser_remove_manager/1
default: stageuser_remove_passkey/1
default: stageuser_remove_principal/1 default: stageuser_remove_principal/1
default: stageuser_show/1 default: stageuser_show/1
default: subid/1 default: subid/1
@@ -7407,6 +7588,7 @@ default: user_add/1
default: user_add_cert/1 default: user_add_cert/1
default: user_add_certmapdata/1 default: user_add_certmapdata/1
default: user_add_manager/1 default: user_add_manager/1
default: user_add_passkey/1
default: user_add_principal/1 default: user_add_principal/1
default: user_del/1 default: user_del/1
default: user_disable/1 default: user_disable/1
@@ -7416,6 +7598,7 @@ default: user_mod/1
default: user_remove_cert/1 default: user_remove_cert/1
default: user_remove_certmapdata/1 default: user_remove_certmapdata/1
default: user_remove_manager/1 default: user_remove_manager/1
default: user_remove_passkey/1
default: user_remove_principal/1 default: user_remove_principal/1
default: user_show/1 default: user_show/1
default: user_stage/1 default: user_stage/1
BUILD.txt
+1 -1
View File
@@ -7,7 +7,7 @@ For more information, see http://www.freeipa.org/page/Build
The quickest way to get the dependencies needed for building is: The quickest way to get the dependencies needed for building is:
# dnf builddep -b -D "with_wheels 1" -D "with_lint 1" -D "with_doc 1" --spec freeipa.spec.in --best --allowerasing --setopt=install_weak_deps=False # dnf builddep -D "with_wheels 1" -D "with_lint 1" -D "with_doc 1" --spec freeipa.spec.in --best --allowerasing --setopt=install_weak_deps=False
TIP: For building with latest dependencies for freeipa master enable copr repo: TIP: For building with latest dependencies for freeipa master enable copr repo:
Contributors.txt
+22
View File
@@ -16,8 +16,10 @@ Developers:
Alexander Bokovoy Alexander Bokovoy
Alexander Koksharov Alexander Koksharov
Alexander Scheel Alexander Scheel
Alexandra Nikandrova
Alexandre Mulatinho Alexandre Mulatinho
Alexey Slaykovsky Alexey Slaykovsky
Alexey Tikhonov
Amit Kumar Amit Kumar
Ana Krivokapić Ana Krivokapić
Andika Triwidada Andika Triwidada
@@ -33,6 +35,7 @@ Developers:
Brian J. Murrell Brian J. Murrell
Brian Turek Brian Turek
Carl George Carl George
Carla Martinez
Cédric Jeanneret Cédric Jeanneret
Changmin Teng Changmin Teng
Chris Kelley Chris Kelley
@@ -42,6 +45,7 @@ Developers:
David Kreitschmann David Kreitschmann
David Kupka David Kupka
David O'Brien David O'Brien
David Pascual
David Spångberg David Spångberg
Diane Trout Diane Trout
Dinesh Prasanth M K Dinesh Prasanth M K
@@ -51,8 +55,11 @@ Developers:
Drew Erny Drew Erny
Emilio Herrera Emilio Herrera
Endi Sukma Dewata Endi Sukma Dewata
Erik
Erik Belko
Fabiano Fidêncio Fabiano Fidêncio
Felipe Volpone Felipe Volpone
Filip Dvorak
Filip Skola Filip Skola
Florence Blanc-Renaud Florence Blanc-Renaud
Francesco Marella Francesco Marella
@@ -69,6 +76,7 @@ Developers:
Hela Basa Hela Basa
Ian Kumlien Ian Kumlien
Ian Pilcher Ian Pilcher
Iker Pedrosa
Isaac Boukris Isaac Boukris
Jakub Hrozek Jakub Hrozek
James Groffen James Groffen
@@ -77,12 +85,15 @@ Developers:
Jan Kuparinen Jan Kuparinen
Jan Pazdziora Jan Pazdziora
Jan Zelený Jan Zelený
Jarl Gullberg
Jason Gerard DeRose Jason Gerard DeRose
Jason Woods Jason Woods
Jayesh Jayesh
Jayesh Garg Jayesh Garg
Jeremy Frasier Jeremy Frasier
Jérôme Fenal Jérôme Fenal
Jerry James
Jesse Sandberg
jh23453 jh23453
Jim Meyering Jim Meyering
Jochen Kellner Jochen Kellner
@@ -102,6 +113,7 @@ Developers:
Lars Sjostrom Lars Sjostrom
Lenka Doudova Lenka Doudova
Lenka Ryznarova Lenka Ryznarova
Lenz Grimmer
Lewis Eason Lewis Eason
Lubomír Rintel Lubomír Rintel
Ludwig Krispenz Ludwig Krispenz
@@ -117,6 +129,7 @@ Developers:
Martin Nagy Martin Nagy
Matt Rogers Matt Rogers
Matthew Davis Matthew Davis
mbhalodi
Michael Simacek Michael Simacek
Michal Polovka Michal Polovka
Michal Reznik Michal Reznik
@@ -132,6 +145,7 @@ Developers:
ndehadra ndehadra
Nick Hatch Nick Hatch
Nikhil Dehadrai Nikhil Dehadrai
Nikola Knazekova
Nikolai Kondrashov Nikolai Kondrashov
Niranjan Mallapadi Niranjan Mallapadi
Niranjan MR Niranjan MR
@@ -159,18 +173,22 @@ Developers:
realsobek realsobek
René Genz René Genz
Rich Megginson Rich Megginson
Ricky Tigg
Rishabh Dave Rishabh Dave
Rob Crittenden Rob Crittenden
Robbie Harwood Robbie Harwood
Robert Collins Robert Collins
Robert Kuska Robert Kuska
s1341
Sam Bristow Sam Bristow
Sam Morris Sam Morris
Scott Poore
Sergey Orlov Sergey Orlov
Sergio Oliveira Campos Sergio Oliveira Campos
Serhii Tsymbaliuk Serhii Tsymbaliuk
shanyin shanyin
Simo Sorce Simo Sorce
Simon Nussbaum
Slava Aseev Slava Aseev
Spencer E. Olson Spencer E. Olson
Stanislav Laznicka Stanislav Laznicka
@@ -184,17 +202,20 @@ Developers:
Sumit Bose Sumit Bose
Sylvain Baubeau Sylvain Baubeau
Takeshi MIZUTA Takeshi MIZUTA
Temuri Doghonadze
Theodor van Nahl Theodor van Nahl
Thierry Bordaz Thierry Bordaz
Thomas Woerner Thomas Woerner
Thorsten Scherf Thorsten Scherf
Tibor Dudlák Tibor Dudlák
Timo Aaltonen Timo Aaltonen
Todd Zullinger
Tomáš Babej Tomáš Babej
Tomas Halman Tomas Halman
Tomáš Křížek Tomáš Křížek
Troy Dawson Troy Dawson
Varun Mylaraiah Varun Mylaraiah
Viacheslav Sychov
Viktor Ashirov Viktor Ashirov
Vit Mojzis Vit Mojzis
W. Michael Petullo W. Michael Petullo
@@ -205,6 +226,7 @@ Developers:
Yuri Chornoivan Yuri Chornoivan
Zdenek Pytela Zdenek Pytela
zdover zdover
김인수
Documentation: Documentation:
Gabe Alford Gabe Alford
Makefile.am
+11 -4
View File
@@ -23,6 +23,8 @@ PYTHON_SCRIPT_SUBDIRS = \
$(top_builddir)/install/tools \ $(top_builddir)/install/tools \
$(NULL) $(NULL)
PRCI_DEFINITIONS_DIR = $(top_srcdir)/ipatests/prci_definitions
AZURE_PYTHON_SCRIPT_SUBDIR = $(top_builddir)/ipatests/azure AZURE_PYTHON_SCRIPT_SUBDIR = $(top_builddir)/ipatests/azure
IPA_PLACEHOLDERS = freeipa ipa ipaserver ipatests IPA_PLACEHOLDERS = freeipa ipa ipaserver ipatests
@@ -242,7 +244,7 @@ fastcodestyle: $(GENERATED_PYTHON_FILES) ipasetup.py
| xargs -n1 file 2>/dev/null | grep Python \ | xargs -n1 file 2>/dev/null | grep Python \
| cut -d':' -f1; ); \ | cut -d':' -f1; ); \
if [ -n "$${PYFILES}" ] && [ -n "$${INFILES}" ]; then \ if [ -n "$${PYFILES}" ] && [ -n "$${INFILES}" ]; then \
FILES="$$( printf $${PYFILES}\\n$${INFILES} )" ; \ FILES="$$( printf '%s\n' "$${PYFILES}" "$${INFILES}" )" ; \
elif [ -n "$${PYFILES}" ]; then \ elif [ -n "$${PYFILES}" ]; then \
FILES="$${PYFILES}" ; \ FILES="$${PYFILES}" ; \
else \ else \
@@ -272,7 +274,7 @@ endif
| xargs -n1 file 2>/dev/null | grep Python \ | xargs -n1 file 2>/dev/null | grep Python \
| cut -d':' -f1; ); \ | cut -d':' -f1; ); \
if [ -n "$${PYFILES}" ] && [ -n "$${INFILES}" ]; then \ if [ -n "$${PYFILES}" ] && [ -n "$${INFILES}" ]; then \
FILES="$$( printf $${PYFILES}\\n$${INFILES} )" ; \ FILES="$$( printf '%s\n' "$${PYFILES}" "$${INFILES}" )" ; \
elif [ -n "$${PYFILES}" ]; then \ elif [ -n "$${PYFILES}" ]; then \
FILES="$${PYFILES}" ; \ FILES="$${PYFILES}" ; \
else \ else \
@@ -336,6 +338,8 @@ endif # WITH_RPMLINT
# There are Jinja yaml templates, which differ from reqular ones. These # There are Jinja yaml templates, which differ from reqular ones. These
# files should be placed on skip list (YAML_TEMPLATE_FILES), otherwise # files should be placed on skip list (YAML_TEMPLATE_FILES), otherwise
# safe_load fails. # safe_load fails.
# Also check PRCI definitions yaml files jobs format and content with
# prci_checker script
.PHONY: yamllint .PHONY: yamllint
yamllint: yamllint:
YAML_TEMPLATE_FILES="\ YAML_TEMPLATE_FILES="\
@@ -357,7 +361,10 @@ yamllint:
echo $${YAML}; \ echo $${YAML}; \
$(PYTHON) -c "import yaml; f = open('$${YAML}'); yaml.safe_load(f); f.close()" || { echo Your YAML file: $${YAML} has a wrong syntax or this is a Jinja template. In the latter clause, consider to add your YAML file to the YAML_TEMPLATE_FILES list in Makefile.am.; exit 1; } \ $(PYTHON) -c "import yaml; f = open('$${YAML}'); yaml.safe_load(f); f.close()" || { echo Your YAML file: $${YAML} has a wrong syntax or this is a Jinja template. In the latter clause, consider to add your YAML file to the YAML_TEMPLATE_FILES list in Makefile.am.; exit 1; } \
done; \ done; \
echo "-----------" echo -e "\nCheck PRCI definitions";
@echo "-----------"
$(PYTHON) $(PRCI_DEFINITIONS_DIR)/prci_checker.py -d $(PRCI_DEFINITIONS_DIR) -s $(PRCI_DEFINITIONS_DIR)/prci_jobs_spec.yaml;
@echo "-----------"
# Build & lint documentation. # Build & lint documentation.
# #
@@ -389,7 +396,7 @@ pylint: $(GENERATED_PYTHON_FILES) ipasetup.py python_scripts
-name '*~' -o \ -name '*~' -o \
-name '*.py' -print -o \ -name '*.py' -print -o \
-type f -exec grep -qsm1 '^#!.*\bpython' '{}' \; -print`; \ -type f -exec grep -qsm1 '^#!.*\bpython' '{}' \; -print`; \
FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)"`; \ FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)\n$(PRCI_DEFINITIONS_DIR)"`; \
echo -e "Pylint on $(PYTHON) is running over files:\n$${FILES}\nPlease wait ...\n"; \ echo -e "Pylint on $(PYTHON) is running over files:\n$${FILES}\nPlease wait ...\n"; \
$(PYTHON) -m pylint --version; \ $(PYTHON) -m pylint --version; \
PYTHONPATH=$(top_srcdir) $(PYTHON) -m pylint \ PYTHONPATH=$(top_srcdir) $(PYTHON) -m pylint \
VERSION.m4
+9 -3
View File
@@ -20,7 +20,7 @@
# -> "1.0.0" # # -> "1.0.0" #
######################################################## ########################################################
define(IPA_VERSION_MAJOR, 4) define(IPA_VERSION_MAJOR, 4)
define(IPA_VERSION_MINOR, 10) define(IPA_VERSION_MINOR, 12)
define(IPA_VERSION_RELEASE, 0) define(IPA_VERSION_RELEASE, 0)
######################################################## ########################################################
@@ -86,8 +86,8 @@ define(IPA_DATA_VERSION, 20100614120000)
# # # #
######################################################## ########################################################
define(IPA_API_VERSION_MAJOR, 2) define(IPA_API_VERSION_MAJOR, 2)
# Last change: add Random Serial Numbers v3 # Last change: add passkey support
define(IPA_API_VERSION_MINOR, 249) define(IPA_API_VERSION_MINOR, 253)
######################################################## ########################################################
# Following values are auto-generated from values above # Following values are auto-generated from values above
@@ -137,6 +137,11 @@ ifelse(IPA_VERSION_IS_GIT_SNAPSHOT, yes,
IPA_GIT_VERSION), IPA_GIT_VERSION),
NEWLINE)) dnl IPA_VERSION end NEWLINE)) dnl IPA_VERSION end
########################################################
# Version of MIT krb5 used to build IPA
########################################################
define(IPA_KRB5_BUILD_VERSION, translit(esyscmd(krb5-config --version | awk '{ print $NF }'), NEWLINE))
dnl DEBUG: uncomment following lines and run command m4 VERSION.m4 dnl DEBUG: uncomment following lines and run command m4 VERSION.m4
dnl `IPA_VERSION: ''IPA_VERSION' dnl `IPA_VERSION: ''IPA_VERSION'
dnl `IPA_GIT_VERSION: ''IPA_GIT_VERSION' dnl `IPA_GIT_VERSION: ''IPA_GIT_VERSION'
@@ -144,3 +149,4 @@ dnl `IPA_GIT_BRANCH: ''IPA_GIT_BRANCH'
dnl `IPA_API_VERSION: ''IPA_API_VERSION' dnl `IPA_API_VERSION: ''IPA_API_VERSION'
dnl `IPA_DATA_VERSION: ''IPA_DATA_VERSION' dnl `IPA_DATA_VERSION: ''IPA_DATA_VERSION'
dnl `IPA_NUM_VERSION: ''IPA_NUM_VERSION' dnl `IPA_NUM_VERSION: ''IPA_NUM_VERSION'
dnl `IPA_KRB5_BUILD_VERSION: ''IPA_KRB5_BUILD_VERSION'
client/ipa-join.c
+4 -2
View File
@@ -57,6 +57,8 @@
char * read_config_file(const char *filename); char * read_config_file(const char *filename);
char * get_config_entry(char * data, const char *section, const char *key); char * get_config_entry(char * data, const char *section, const char *key);
static size_t
jsonrpc_handle_response(char *ptr, size_t size, size_t nmemb, void *userdata);
static int debug = 0; static int debug = 0;
@@ -642,7 +644,7 @@ curl_slist_append_log(struct curl_slist *list, char *string, bool quiet) {
goto cleanup; \ goto cleanup; \
} }
size_t static size_t
jsonrpc_handle_response(char *ptr, size_t size, size_t nmemb, void *userdata) { jsonrpc_handle_response(char *ptr, size_t size, size_t nmemb, void *userdata) {
size_t realsize = size * nmemb; size_t realsize = size * nmemb;
curl_buffer *cb = (curl_buffer *) userdata; curl_buffer *cb = (curl_buffer *) userdata;
@@ -722,7 +724,7 @@ jsonrpc_request(const char *ipaserver, const json_t *json, curl_buffer *response
CURL_SETOPT(curl, CURLOPT_CAINFO, DEFAULT_CA_CERT_FILE); CURL_SETOPT(curl, CURLOPT_CAINFO, DEFAULT_CA_CERT_FILE);
CURL_SETOPT(curl, CURLOPT_WRITEFUNCTION, &jsonrpc_handle_response); CURL_SETOPT(curl, CURLOPT_WRITEFUNCTION, jsonrpc_handle_response);
CURL_SETOPT(curl, CURLOPT_WRITEDATA, response); CURL_SETOPT(curl, CURLOPT_WRITEDATA, response);
CURL_SETOPT(curl, CURLOPT_HTTPAUTH, CURLAUTH_NEGOTIATE); CURL_SETOPT(curl, CURLOPT_HTTPAUTH, CURLAUTH_NEGOTIATE);
client/man/default.conf.5
+3
View File
@@ -166,6 +166,9 @@ Specifies the mount point that the development server will register. The default
.B oidc_child_debug_level <debuglevel> .B oidc_child_debug_level <debuglevel>
Specifies the debug level of \fBoidc_child\fR, a helper process used by \fBipa-otpd\fR for OIDC/OAuth2 authentication. Level can be between 0 and 10, the higher the more details. If the level is 6 or higher HTTP debug output is added as well. Specifies the debug level of \fBoidc_child\fR, a helper process used by \fBipa-otpd\fR for OIDC/OAuth2 authentication. Level can be between 0 and 10, the higher the more details. If the level is 6 or higher HTTP debug output is added as well.
.TP .TP
.B passkey_child_debug_level <debuglevel>
Specifies the debug level of \fBpasskey_child\fR, a helper process used by \fBipa-otpd\fR for passkey authentication. Level can be between 0 and 10, the higher the more details. If the level is 6 or higher libfido2 debug output is added as well.
.TP
.B prompt_all <boolean> .B prompt_all <boolean>
Specifies that all options should be prompted for in the IPA client, even optional values. Default is False. Specifies that all options should be prompted for in the IPA client, even optional values. Default is False.
.TP .TP
client/man/epn.conf.5
+3
View File
@@ -86,6 +86,9 @@ Time to wait, in milliseconds, between each e-mail sent to try to avoid overload
Specifies the From: e-mail address value in the e-mails sent. The default is noreply@ipadefaultemaildomain. This value can be found by running Specifies the From: e-mail address value in the e-mails sent. The default is noreply@ipadefaultemaildomain. This value can be found by running
.I ipa config-show .I ipa config-show
.TP .TP
.B mail_from_name <name>
Specifies the From: name value in the e-mails sent. The default is IPA-EPN.
.TP
.B notify_ttls <list of days> .B notify_ttls <list of days>
This is the list of days before a password expiration when ipa-epn should notify a user that their password will soon require a reset. If this value is not specified then the default list will be used: 28, 14, 7, 3, 1. This is the list of days before a password expiration when ipa-epn should notify a user that their password will soon require a reset. If this value is not specified then the default list will be used: 28, 14, 7, 3, 1.
.TP .TP
client/man/ipa-client-install.1
+23 -1
View File
@@ -11,7 +11,7 @@ Configures a client machine to use IPA for authentication and identity services.
By default this configures SSSD to connect to an IPA server for authentication and authorization. Optionally one can instead configure PAM and NSS (Name Switching Service) to work with an IPA server over Kerberos and LDAP. By default this configures SSSD to connect to an IPA server for authentication and authorization. Optionally one can instead configure PAM and NSS (Name Switching Service) to work with an IPA server over Kerberos and LDAP.
An authorized user is required to join a client machine to IPA. This can take the form of a kerberos principal or a one\-time password associated with the machine. An authorized account is required to join a client machine to IPA. This can take the form of a kerberos principal, a one\-time password associated with the machine, or PKINIT identity associated with the machine.
This same tool is used to unconfigure IPA and attempts to return the machine to its previous state. Part of this process is to unenroll the host from the IPA server. Unenrollment consists of disabling the principal key on the IPA server so that it may be re\-enrolled. The machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to authenticate to the IPA server to unenroll itself. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host\-disable <fqdn>). This same tool is used to unconfigure IPA and attempts to return the machine to its previous state. Part of this process is to unenroll the host from the IPA server. Unenrollment consists of disabling the principal key on the IPA server so that it may be re\-enrolled. The machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to authenticate to the IPA server to unenroll itself. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host\-disable <fqdn>).
@@ -229,6 +229,22 @@ first. When this option is not specified, \fBipa\-client\-install\fR will back
up SSSD config and create new one. The back up version will be restored during up SSSD config and create new one. The back up version will be restored during
uninstall. uninstall.
.SS "PKINIT OPTIONS"
.TP
\fB\-\-pkinit\-identity=\fIDENTITY\fR
Identity string for PKINIT authentication to use to join the IPA realm,
for example 'FILE:/path/to/cert.pem,/path/to/key.pem'. See krb5.conf(5)
for more information. The option is mutually exclusive with
\fB\-\-password\fR and \fB\-\-keytab\fR.
.TP
\fB\-\-pkinit\-anchor\fR=\fIFILEDIR\fR
Trust anchors (root and intermediate CA certs) for PKINIT. \fIFILEDIR\fR is
either the absolute path to a PEM bundle (for example
'FILE:/etc/pki/tls/cert.pem') or to an OpenSSL hash directory (for example
'DIR:/etc/ssl/certs/'). The option can be used multiple times. PKINIT
requires the full trust chain of the Kerberos KDC server as well as the full
trust chain of the identity certificate.
.SS "UNINSTALL OPTIONS" .SS "UNINSTALL OPTIONS"
.TP .TP
\fB\-\-uninstall\fR \fB\-\-uninstall\fR
@@ -237,6 +253,12 @@ Remove the IPA client software and restore the configuration to the pre\-IPA sta
\fB\-U\fR, \fB\-\-unattended\fR \fB\-U\fR, \fB\-\-unattended\fR
Unattended uninstallation. The user will not be prompted. Unattended uninstallation. The user will not be prompted.
.SH "DISABLED SERVICES"
.TP
ipa-client-install will automatically disable the Name Service Caching Daemon (nscd) when configuring the SSSD client. These are competing services and cannot co-exist.
.TP
If there are other similar services providing nss capabilities they will need to be manually disabled by the user. An example is unscd, a complete replacement for nscd.
.SH "FILES" .SH "FILES"
.TP .TP
Files that will be replaced if SSSD is configured (default): Files that will be replaced if SSSD is configured (default):
client/man/ipa.1
+2
View File
@@ -136,8 +136,10 @@ O \- self\-obliterate
.TP .TP
\fBipa help commands\fR \fBipa help commands\fR
Display a list of available commands Display a list of available commands
.TP
\fBipa help topics\fR \fBipa help topics\fR
Display a high\-level list of help topics Display a high\-level list of help topics
.TP
\fBipa help user\fR \fBipa help user\fR
Display documentation and list of commands in the "user" topic. Display documentation and list of commands in the "user" topic.
.TP .TP
client/share/epn.conf
+4
View File
@@ -60,6 +60,10 @@ smtp_delay = 0
# This value can be found by running ipa config-show. # This value can be found by running ipa config-show.
# mail_from = # mail_from =
# Specifies the From: name value in the e-mails-sent.
# The default when unset is IPA-EPN.
# mail_from_name =
# The list of days before a password expiration when ipa-epn should notify # The list of days before a password expiration when ipa-epn should notify
# a user that their password will soon require a reset. # a user that their password will soon require a reset.
notify_ttls = 28, 14, 7, 3, 1 notify_ttls = 28, 14, 7, 3, 1
configure.ac
+1
View File
@@ -460,6 +460,7 @@ AC_SUBST(VENDOR_SUFFIX)
AC_SUBST([VERSION], [IPA_VERSION]) AC_SUBST([VERSION], [IPA_VERSION])
AC_SUBST([GIT_VERSION], [IPA_GIT_VERSION]) AC_SUBST([GIT_VERSION], [IPA_GIT_VERSION])
AC_SUBST([GIT_BRANCH], [IPA_GIT_BRANCH]) AC_SUBST([GIT_BRANCH], [IPA_GIT_BRANCH])
AC_SUBST([KRB5_BUILD_VERSION], [IPA_KRB5_BUILD_VERSION])
# used by Makefile.am for files depending on templates # used by Makefile.am for files depending on templates
AC_SUBST([CONFIG_STATUS]) AC_SUBST([CONFIG_STATUS])
contrib/lite-server.py
+1 -1
View File
@@ -1,4 +1,4 @@
#!/usr/bin/env python3 #!/usr/bin/python3
# #
# Copyright (C) 2017 FreeIPA Contributors see COPYING for license # Copyright (C) 2017 FreeIPA Contributors see COPYING for license
# #
contrib/lite-setup.py
+1 -1
View File
@@ -1,4 +1,4 @@
#!/usr/bin/env python3 #!/usr/bin/python3
# #
# Copyright (C) 2020 FreeIPA Contributors see COPYING for license # Copyright (C) 2020 FreeIPA Contributors see COPYING for license
# #
daemons/dnssec/ipa-dnskeysyncd.in
+1 -1
View File
@@ -57,7 +57,7 @@ KEYTAB_FB = paths.IPA_DNSKEYSYNCD_KEYTAB
def commenceShutdown(signum, stack): def commenceShutdown(signum, stack):
# Declare the needed global variables # Declare the needed global variables
global watcher_running global watcher_running
global ldap_connection # pylint: disable=global-variable-not-assigned global ldap_connection
logger.info('Signal %s received: Shutting down!', signum) logger.info('Signal %s received: Shutting down!', signum)
daemons/ipa-kdb/ipa-print-pac.c
+1 -1
View File
@@ -494,7 +494,7 @@ init_with_password(const char *name, const char *password)
done: done:
if (service_creds != GSS_C_NO_CREDENTIAL) if (service_creds != GSS_C_NO_CREDENTIAL)
gss_release_cred(&min, &client_creds); gss_release_cred(&min, &service_creds);
if (client_creds != GSS_C_NO_CREDENTIAL) if (client_creds != GSS_C_NO_CREDENTIAL)
gss_release_cred(&min, &client_creds); gss_release_cred(&min, &client_creds);
daemons/ipa-kdb/ipa_kdb.c
+21 -3
View File
@@ -49,6 +49,11 @@ static void ipadb_context_free(krb5_context kcontext,
size_t c; size_t c;
if (*ctx != NULL) { if (*ctx != NULL) {
if ((*ctx)->magic != IPA_CONTEXT_MAGIC) {
krb5_klog_syslog(LOG_ERR, "IPA context is corrupted");
*ctx = NULL;
return;
}
free((*ctx)->uri); free((*ctx)->uri);
free((*ctx)->base); free((*ctx)->base);
free((*ctx)->realm_base); free((*ctx)->realm_base);
@@ -200,6 +205,7 @@ static const struct {
{ "pkinit", IPADB_USER_AUTH_PKINIT }, { "pkinit", IPADB_USER_AUTH_PKINIT },
{ "hardened", IPADB_USER_AUTH_HARDENED }, { "hardened", IPADB_USER_AUTH_HARDENED },
{ "idp", IPADB_USER_AUTH_IDP }, { "idp", IPADB_USER_AUTH_IDP },
{ "passkey", IPADB_USER_AUTH_PASSKEY },
{ } { }
}; };
@@ -615,6 +621,8 @@ static krb5_error_code ipadb_init_module(krb5_context kcontext,
goto fail; goto fail;
} }
ipactx->optional_pac_tkt_chksum = IPADB_TRISTATE_UNDEFINED;
ret = ipadb_get_connection(ipactx); ret = ipadb_get_connection(ipactx);
if (ret != 0) { if (ret != 0) {
/* Not a fatal failure, as the LDAP server may be temporarily down. */ /* Not a fatal failure, as the LDAP server may be temporarily down. */
@@ -628,6 +636,7 @@ static krb5_error_code ipadb_init_module(krb5_context kcontext,
goto fail; goto fail;
} }
return 0; return 0;
fail: fail:
@@ -798,11 +807,20 @@ kdb_vftabl kdb_function_table = {
#endif #endif
#if (KRB5_KDB_DAL_MAJOR_VERSION == 9) #if (KRB5_KDB_DAL_MAJOR_VERSION == 9)
#error DAL version 9 is not supported yet
/* Version 9 removes sign_authdata and adds issue_pac method. It is a complete /* Version 9 removes sign_authdata and adds issue_pac method. It is a complete
* revamp of how PAC is issued, so we need to implement it differently to previous * revamp of how PAC is issued, so we need to implement it differently to previous
* versions. */ * versions. */
krb5_error_code
ipadb_v9_issue_pac(krb5_context context, unsigned int flags,
krb5_db_entry *client,
krb5_keyblock *replaced_reply_key,
krb5_db_entry *server,
krb5_db_entry *signing_krbtgt,
krb5_timestamp authtime, krb5_pac old_pac,
krb5_pac new_pac,
krb5_data ***auth_indicators);
kdb_vftabl kdb_function_table = { kdb_vftabl kdb_function_table = {
.maj_ver = KRB5_KDB_DAL_MAJOR_VERSION, .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION,
.min_ver = 0, .min_ver = 0,
@@ -830,8 +848,8 @@ kdb_vftabl kdb_function_table = {
.check_allowed_to_delegate = ipadb_check_allowed_to_delegate, .check_allowed_to_delegate = ipadb_check_allowed_to_delegate,
.free_principal_e_data = ipadb_free_principal_e_data, .free_principal_e_data = ipadb_free_principal_e_data,
.get_s4u_x509_principal = NULL, .get_s4u_x509_principal = NULL,
.allowed_to_delegate_from = NULL, .allowed_to_delegate_from = ipadb_allowed_to_delegate_from,
.issue_pac = NULL, .issue_pac = ipadb_v9_issue_pac,
}; };
#endif #endif
daemons/ipa-kdb/ipa_kdb.h
+54
View File
@@ -49,6 +49,22 @@
#include "ipa_krb5.h" #include "ipa_krb5.h"
#include "ipa_pwd.h" #include "ipa_pwd.h"
/* Difference between krb5 1.20 and previous versions. From
* krb5 commit a441fbe329ebbd7775eb5d4ccc4a05eef370f08b:
* Combine the KRB5_KDB_FLAG_ISSUE_PAC and
* KRB5_FLAG_CLIENT_REFERRALS_ONLY flags into KRB5_KDB_FLAG_CLIENT.
*
* Rename the KRB5_KDB_FLAG_CANONICALIZE flag to
* KRB5_KDB_FLAG_REFERRAL_OK, and only pass it to get_principal() for
* lookup operations that can use a realm referral.
* */
#if defined(KRB5_KDB_FLAG_CLIENT)
#define CLIENT_REFERRALS_FLAGS (KRB5_KDB_FLAG_REFERRAL_OK)
#else
#define CLIENT_REFERRALS_FLAGS (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)
#endif
/* easier to copy the defines here than to mess with kadm5/admin.h /* easier to copy the defines here than to mess with kadm5/admin.h
* for now */ * for now */
#define KMASK_PRINCIPAL 0x000001 #define KMASK_PRINCIPAL 0x000001
@@ -90,6 +106,7 @@ enum ipadb_user_auth {
IPADB_USER_AUTH_PKINIT = 1 << 4, IPADB_USER_AUTH_PKINIT = 1 << 4,
IPADB_USER_AUTH_HARDENED = 1 << 5, IPADB_USER_AUTH_HARDENED = 1 << 5,
IPADB_USER_AUTH_IDP = 1 << 6, IPADB_USER_AUTH_IDP = 1 << 6,
IPADB_USER_AUTH_PASSKEY = 1 << 7,
}; };
enum ipadb_user_auth_idx { enum ipadb_user_auth_idx {
@@ -98,6 +115,7 @@ enum ipadb_user_auth_idx {
IPADB_USER_AUTH_IDX_PKINIT, IPADB_USER_AUTH_IDX_PKINIT,
IPADB_USER_AUTH_IDX_HARDENED, IPADB_USER_AUTH_IDX_HARDENED,
IPADB_USER_AUTH_IDX_IDP, IPADB_USER_AUTH_IDX_IDP,
IPADB_USER_AUTH_IDX_PASSKEY,
IPADB_USER_AUTH_IDX_MAX, IPADB_USER_AUTH_IDX_MAX,
}; };
@@ -110,6 +128,12 @@ struct ipadb_global_config {
bool disable_preauth_for_spns; bool disable_preauth_for_spns;
}; };
enum ipadb_tristate_option {
IPADB_TRISTATE_FALSE = FALSE,
IPADB_TRISTATE_TRUE = TRUE,
IPADB_TRISTATE_UNDEFINED,
};
#define IPA_CONTEXT_MAGIC 0x0c027ea7 #define IPA_CONTEXT_MAGIC 0x0c027ea7
struct ipadb_context { struct ipadb_context {
int magic; int magic;
@@ -127,6 +151,7 @@ struct ipadb_context {
krb5_key_salt_tuple *def_encs; krb5_key_salt_tuple *def_encs;
int n_def_encs; int n_def_encs;
struct ipadb_mspac *mspac; struct ipadb_mspac *mspac;
enum ipadb_tristate_option optional_pac_tkt_chksum;
#ifdef HAVE_KRB5_CERTAUTH_PLUGIN #ifdef HAVE_KRB5_CERTAUTH_PLUGIN
krb5_certauth_moddata certauth_moddata; krb5_certauth_moddata certauth_moddata;
#endif #endif
@@ -206,6 +231,16 @@ int ipadb_ldap_attr_has_value(LDAP *lcontext, LDAPMessage *le,
int ipadb_ldap_deref_results(LDAP *lcontext, LDAPMessage *le, int ipadb_ldap_deref_results(LDAP *lcontext, LDAPMessage *le,
LDAPDerefRes **results); LDAPDerefRes **results);
krb5_error_code ipadb_get_tl_data(krb5_db_entry *entry,
krb5_int16 type,
krb5_ui_2 length,
krb5_octet *data);
krb5_error_code ipadb_set_tl_data(krb5_db_entry *entry,
krb5_int16 type,
krb5_ui_2 length,
const krb5_octet *data);
struct ipadb_multires; struct ipadb_multires;
krb5_error_code ipadb_multires_init(LDAP *lcontext, struct ipadb_multires **r); krb5_error_code ipadb_multires_init(LDAP *lcontext, struct ipadb_multires **r);
void ipadb_multires_free(struct ipadb_multires *r); void ipadb_multires_free(struct ipadb_multires *r);
@@ -309,6 +344,7 @@ krb5_error_code ipadb_get_pwd_expiration(krb5_context context,
/* MS-PAC FUNCTIONS */ /* MS-PAC FUNCTIONS */
#if (KRB5_KDB_DAL_MAJOR_VERSION < 9)
krb5_error_code ipadb_sign_authdata(krb5_context context, krb5_error_code ipadb_sign_authdata(krb5_context context,
unsigned int flags, unsigned int flags,
krb5_const_principal client_princ, krb5_const_principal client_princ,
@@ -323,6 +359,18 @@ krb5_error_code ipadb_sign_authdata(krb5_context context,
krb5_authdata **tgt_auth_data, krb5_authdata **tgt_auth_data,
krb5_authdata ***signed_auth_data); krb5_authdata ***signed_auth_data);
#else
/* DAL 9 or later uses issue_pac */
krb5_error_code ipadb_v9_issue_pac(krb5_context context, unsigned int flags,
krb5_db_entry *client,
krb5_keyblock *replaced_reply_key,
krb5_db_entry *server,
krb5_db_entry *signing_krbtgt,
krb5_timestamp authtime, krb5_pac old_pac,
krb5_pac new_pac,
krb5_data ***auth_indicators);
#endif
krb5_error_code ipadb_reinit_mspac(struct ipadb_context *ipactx, bool force_reinit); krb5_error_code ipadb_reinit_mspac(struct ipadb_context *ipactx, bool force_reinit);
void ipadb_mspac_struct_free(struct ipadb_mspac **mspac); void ipadb_mspac_struct_free(struct ipadb_mspac **mspac);
@@ -345,6 +393,12 @@ krb5_error_code ipadb_check_allowed_to_delegate(krb5_context kcontext,
const krb5_db_entry *server, const krb5_db_entry *server,
krb5_const_principal proxy); krb5_const_principal proxy);
krb5_error_code ipadb_allowed_to_delegate_from(krb5_context context,
krb5_const_principal client,
krb5_const_principal server,
krb5_pac server_pac,
const krb5_db_entry *proxy);
/* AS AUDIT */ /* AS AUDIT */
void ipadb_audit_as_req(krb5_context kcontext, void ipadb_audit_as_req(krb5_context kcontext,
daemons/ipa-kdb/ipa_kdb_certauth.c
+28 -8
View File
@@ -120,6 +120,7 @@ static krb5_error_code ipa_get_init_data(krb5_context kcontext,
char *map_rule = NULL; char *map_rule = NULL;
char *match_rule = NULL; char *match_rule = NULL;
char **domains = NULL; char **domains = NULL;
bool rule_added = false;
const char *certmap_attrs[] = { OBJECTCLASS, const char *certmap_attrs[] = { OBJECTCLASS,
IPA_CERTMAP_PRIORITY, IPA_CERTMAP_PRIORITY,
@@ -171,13 +172,7 @@ static krb5_error_code ipa_get_init_data(krb5_context kcontext,
return ret; return ret;
} }
if (kerr == KRB5_KDB_NOENTRY) { if (kerr != KRB5_KDB_NOENTRY) {
ret = sss_certmap_add_rule(ctx, SSS_CERTMAP_MIN_PRIO,
NULL, NULL, NULL);
if (ret != 0) {
goto done;
}
} else {
lc = ipactx->lcontext; lc = ipactx->lcontext;
for (le = ldap_first_entry(lc, result); le; for (le = ldap_first_entry(lc, result); le;
@@ -221,8 +216,33 @@ static krb5_error_code ipa_get_init_data(krb5_context kcontext,
ret = sss_certmap_add_rule(ctx, prio, match_rule, map_rule, ret = sss_certmap_add_rule(ctx, prio, match_rule, map_rule,
(const char **) domains); (const char **) domains);
if (ret != 0) { if (ret != 0) {
goto done; krb5_klog_syslog(LOG_ERR,
"Failed to add certificate mapping [%s] and "
"matching [%s] rule with error [%d][%s], "
"skipping. Please check for typos and if rule "
"syntax is supported.", map_rule, match_rule,
ret, strerror(ret));
continue;
} }
rule_added = true;
}
}
if (!rule_added) {
if (kerr == KRB5_KDB_NOENTRY) {
krb5_klog_syslog(LOG_INFO,
"No certificate mapping and matching rule "
"defined, trying to use the default rule.");
} else {
krb5_klog_syslog(LOG_INFO,
"No valid certificate mapping and matching rule "
"found, trying to use the default rule.");
}
ret = sss_certmap_add_rule(ctx, SSS_CERTMAP_MIN_PRIO,
NULL, NULL, NULL);
if (ret != 0) {
goto done;
} }
} }
daemons/ipa-kdb/ipa_kdb_common.c
+65 -2
View File
@@ -158,12 +158,75 @@ static bool ipadb_need_retry(struct ipadb_context *ipactx, int error)
return false; return false;
} }
static char *no_attrs[] = {
LDAP_NO_ATTRS,
NULL
};
static int
should_support_pac_tkt_sign(struct ipadb_context *ipactx, bool *result)
{
int ret;
LDAPMessage *res = NULL;
char *masters_dn = NULL;
int count;
char *kdc_filter = "(&(cn=KDC)(objectClass=ipaConfigObject)"
"(!(ipaConfigString=pacTktSignSupported)))";
if (!ipactx) {
ret = KRB5_KDB_DBNOTINITED;
goto done;
}
count = asprintf(&masters_dn, "cn=masters,cn=ipa,cn=etc,%s", ipactx->base);
if (count < 0) {
ret = ENOMEM;
goto done;
}
ret = ipadb_simple_search(ipactx, masters_dn, LDAP_SCOPE_SUBTREE,
kdc_filter, no_attrs, &res);
if (ret)
goto done;
count = ldap_count_entries(ipactx->lcontext, res);
if (result)
*result = (count == 0);
done:
free(masters_dn);
ldap_msgfree(res);
return ret;
}
static int ipadb_check_connection(struct ipadb_context *ipactx) static int ipadb_check_connection(struct ipadb_context *ipactx)
{ {
int ret = 0;
if (ipactx->lcontext == NULL) { if (ipactx->lcontext == NULL) {
return ipadb_get_connection(ipactx); ret = ipadb_get_connection(ipactx);
} }
return 0; if ((ret == 0) && (ipactx->optional_pac_tkt_chksum == IPADB_TRISTATE_UNDEFINED)) {
bool pac_tkt_sign_supported;
/* Enforce PAC ticket signature verification if supported by all KDCs
* To avoid loops as all search functions call into
* ipadb_check_connection(), mark that the init is complete at this
* point. Default to not issuing PAC to be safe.
*/
ipactx->optional_pac_tkt_chksum = IPADB_TRISTATE_FALSE;
ret = should_support_pac_tkt_sign(ipactx,
&pac_tkt_sign_supported);
if (ret == 0) {
ipactx->optional_pac_tkt_chksum = !pac_tkt_sign_supported;
} else {
ipactx->optional_pac_tkt_chksum = IPADB_TRISTATE_UNDEFINED;
}
}
return ret;
} }
krb5_error_code ipadb_simple_search(struct ipadb_context *ipactx, krb5_error_code ipadb_simple_search(struct ipadb_context *ipactx,
daemons/ipa-kdb/ipa_kdb_delegation.c
+120 -33
View File
@@ -42,7 +42,7 @@ static krb5_error_code ipadb_get_delegation_acl(krb5_context kcontext,
{ {
struct ipadb_context *ipactx; struct ipadb_context *ipactx;
krb5_error_code kerr; krb5_error_code kerr;
char *filter = NULL; char *filter = NULL, *basedn = NULL;
int ret; int ret;
ipactx = ipadb_get_context(kcontext); ipactx = ipadb_get_context(kcontext);
@@ -58,12 +58,20 @@ static krb5_error_code ipadb_get_delegation_acl(krb5_context kcontext,
goto done; goto done;
} }
ret = asprintf(&basedn,
"cn=s4u2proxy,cn=etc,%s", ipactx->base);
if (ret == -1) {
kerr = ENOMEM;
goto done;
}
/* == Search ACL info == */ /* == Search ACL info == */
kerr = ipadb_deref_search(ipactx, ipactx->base, kerr = ipadb_deref_search(ipactx, basedn,
LDAP_SCOPE_SUBTREE, filter, acl_attrs, LDAP_SCOPE_SUBTREE, filter, acl_attrs,
search_attrs, acl_attrs, results); search_attrs, acl_attrs, results);
done: done:
free(basedn);
free(filter); free(filter);
return kerr; return kerr;
} }
@@ -106,6 +114,8 @@ static krb5_error_code ipadb_match_acl(krb5_context kcontext,
bool client_missing; bool client_missing;
bool client_found; bool client_found;
bool target_found; bool target_found;
bool is_constraint_delegation = false;
size_t nrules = 0;
int ret; int ret;
ipactx = ipadb_get_context(kcontext); ipactx = ipadb_get_context(kcontext);
@@ -113,13 +123,17 @@ static krb5_error_code ipadb_match_acl(krb5_context kcontext,
return KRB5_KDB_DBNOTINITED; return KRB5_KDB_DBNOTINITED;
} }
kerr = krb5_unparse_name(kcontext, client, &client_princ); if ((client != NULL) && (target != NULL)) {
if (kerr != 0) { kerr = krb5_unparse_name(kcontext, client, &client_princ);
goto done; if (kerr != 0) {
} goto done;
kerr = krb5_unparse_name(kcontext, target, &target_princ); }
if (kerr != 0) { kerr = krb5_unparse_name(kcontext, target, &target_princ);
goto done; if (kerr != 0) {
goto done;
}
} else {
is_constraint_delegation = true;
} }
lentry = ldap_first_entry(ipactx->lcontext, results); lentry = ldap_first_entry(ipactx->lcontext, results);
@@ -142,6 +156,25 @@ static krb5_error_code ipadb_match_acl(krb5_context kcontext,
switch (ret) { switch (ret) {
case 0: case 0:
for (dres = deref_results; dres; dres = dres->next) { for (dres = deref_results; dres; dres = dres->next) {
nrules++;
if (is_constraint_delegation) {
/*
Microsoft revised the S4U2Proxy rules for forwardable
tickets. All S4U2Proxy operations require forwardable
evidence tickets, but S4U2Self should issue a
forwardable ticket if the requesting service has no
ok-to-auth-as-delegate bit but also no constrained
delegation privileges for traditional S4U2Proxy.
Implement these rules, extending the
check_allowed_to_delegate() DAL method so that the KDC
can ask if a principal has any delegation privileges.
Since target principal is NULL and client principal is
NULL in this case, we simply calculate number of rules associated
with the server principal to decide whether to deny forwardable bit
*/
continue;
}
if (client_found == false && if (client_found == false &&
strcasecmp(dres->derefAttr, "ipaAllowToImpersonate") == 0) { strcasecmp(dres->derefAttr, "ipaAllowToImpersonate") == 0) {
/* NOTE: client_missing is used to signal that the /* NOTE: client_missing is used to signal that the
@@ -175,6 +208,10 @@ static krb5_error_code ipadb_match_acl(krb5_context kcontext,
lentry = ldap_next_entry(ipactx->lcontext, lentry); lentry = ldap_next_entry(ipactx->lcontext, lentry);
} }
if (nrules > 0) {
kerr = 0;
}
done: done:
krb5_free_unparsed_name(kcontext, client_princ); krb5_free_unparsed_name(kcontext, client_princ);
krb5_free_unparsed_name(kcontext, target_princ); krb5_free_unparsed_name(kcontext, target_princ);
@@ -196,33 +233,35 @@ krb5_error_code ipadb_check_allowed_to_delegate(krb5_context kcontext,
struct ipadb_e_data *ied_server, *ied_proxy; struct ipadb_e_data *ied_server, *ied_proxy;
LDAPMessage *res = NULL; LDAPMessage *res = NULL;
/* Handle the case where server == proxy, this is allowed in S4U*/ if (proxy != NULL) {
kerr = ipadb_get_principal(kcontext, proxy, /* Handle the case where server == proxy, this is allowed in S4U */
KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY, kerr = ipadb_get_principal(kcontext, proxy,
&proxy_entry); CLIENT_REFERRALS_FLAGS,
if (kerr) { &proxy_entry);
goto done; if (kerr) {
}
ied_server = (struct ipadb_e_data *) server->e_data;
ied_proxy = (struct ipadb_e_data *) proxy_entry->e_data;
/* If we have SIDs for both entries, compare SIDs */
if ((ied_server->has_sid && ied_server->sid != NULL) &&
(ied_proxy->has_sid && ied_proxy->sid != NULL)) {
if (dom_sid_check(ied_server->sid, ied_proxy->sid, true)) {
kerr = 0;
goto done; goto done;
} }
}
/* Otherwise, compare entry DNs */ ied_server = (struct ipadb_e_data *) server->e_data;
kerr = ulc_casecmp(ied_server->entry_dn, strlen(ied_server->entry_dn), ied_proxy = (struct ipadb_e_data *) proxy_entry->e_data;
ied_proxy->entry_dn, strlen(ied_proxy->entry_dn),
NULL, NULL, &result); /* If we have SIDs for both entries, compare SIDs */
if (kerr == 0 && result == 0) { if ((ied_server->has_sid && ied_server->sid != NULL) &&
goto done; (ied_proxy->has_sid && ied_proxy->sid != NULL)) {
if (dom_sid_check(ied_server->sid, ied_proxy->sid, true)) {
kerr = 0;
goto done;
}
}
/* Otherwise, compare entry DNs */
kerr = ulc_casecmp(ied_server->entry_dn, strlen(ied_server->entry_dn),
ied_proxy->entry_dn, strlen(ied_proxy->entry_dn),
NULL, NULL, &result);
if (kerr == 0 && result == 0) {
goto done;
}
} }
kerr = krb5_unparse_name(kcontext, server->princ, &srv_principal); kerr = krb5_unparse_name(kcontext, server->princ, &srv_principal);
@@ -241,8 +280,56 @@ krb5_error_code ipadb_check_allowed_to_delegate(krb5_context kcontext,
} }
done: done:
if (kerr) {
#if KRB5_KDB_DAL_MAJOR_VERSION < 9
kerr = KRB5KDC_ERR_POLICY;
#else
kerr = KRB5KDC_ERR_BADOPTION;
#endif
}
ipadb_free_principal(kcontext, proxy_entry); ipadb_free_principal(kcontext, proxy_entry);
krb5_free_unparsed_name(kcontext, srv_principal); krb5_free_unparsed_name(kcontext, srv_principal);
ldap_msgfree(res); ldap_msgfree(res);
return kerr; return kerr;
} }
krb5_error_code ipadb_allowed_to_delegate_from(krb5_context context,
krb5_const_principal client,
krb5_const_principal server,
krb5_pac server_pac,
const krb5_db_entry *proxy)
{
char **acl_list = NULL;
krb5_error_code kerr;
size_t i;
kerr = ipadb_get_tl_data((krb5_db_entry *) proxy, KRB5_TL_CONSTRAINED_DELEGATION_ACL,
sizeof(acl_list), (krb5_octet *)&acl_list);
if (kerr != 0 && kerr != ENOENT) {
return KRB5KDC_ERR_BADOPTION;
}
if (kerr == ENOENT) {
return KRB5_PLUGIN_OP_NOTSUPP;
}
kerr = KRB5KDC_ERR_BADOPTION;
if (acl_list != NULL) {
krb5_principal acl;
for (i = 0; acl_list[i] != NULL; i++) {
if (krb5_parse_name(context, acl_list[i], &acl) != 0)
continue;
if ((server == NULL) ||
(krb5_principal_compare(context, server, acl) == TRUE)) {
kerr = 0;
krb5_free_principal(context, acl);
break;
}
krb5_free_principal(context, acl);
}
}
return kerr;
}
daemons/ipa-kdb/ipa_kdb_kdcpolicy.c
+9
View File
@@ -143,6 +143,15 @@ ipa_kdcpolicy_check_as(krb5_context context, krb5_kdcpolicy_moddata moddata,
goto done; goto done;
} }
pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_IDP]); pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_IDP]);
} else if (strcmp(auth_indicator, "passkey") == 0) {
valid_auth_indicators++;
/* Allow hardened even if only password pre-auth is allowed */
if (!(ua & IPADB_USER_AUTH_PASSKEY)) {
*status = "Passkey pre-authentication not allowed for this user.";
kerr = KRB5KDC_ERR_POLICY;
goto done;
}
pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_PASSKEY]);
} }
} }
daemons/ipa-kdb/ipa_kdb_mspac.c
+193 -140
View File
@@ -401,31 +401,34 @@ static krb5_error_code ipadb_add_asserted_identity(struct ipadb_context *ipactx,
return 0; return 0;
} }
static bool is_master_host(struct ipadb_context *ipactx, const char *fqdn) static krb5_error_code
is_master_host(struct ipadb_context *ipactx, const char *fqdn, bool *result)
{ {
int ret; int err;
char *master_host_base = NULL; char *master_host_base = NULL;
LDAPMessage *result = NULL; LDAPMessage *ldap_res = NULL;
krb5_error_code err;
ret = asprintf(&master_host_base, "cn=%s,cn=masters,cn=ipa,cn=etc,%s", err = asprintf(&master_host_base, "cn=%s,cn=masters,cn=ipa,cn=etc,%s",
fqdn, ipactx->base); fqdn, ipactx->base);
if (ret == -1) { if (err == -1)
return false; return ENOMEM;
}
err = ipadb_simple_search(ipactx, master_host_base, LDAP_SCOPE_BASE,
NULL, NULL, &result);
free(master_host_base);
ldap_msgfree(result);
if (err == 0) {
return true;
}
return false; err = ipadb_simple_search(ipactx, master_host_base, LDAP_SCOPE_BASE,
NULL, NULL, &ldap_res);
free(master_host_base);
ldap_msgfree(ldap_res);
if (err != KRB5_KDB_NOENTRY && err != 0)
return err;
if (result)
*result = err != KRB5_KDB_NOENTRY;
return 0;
} }
static krb5_error_code ipadb_fill_info3(struct ipadb_context *ipactx, static krb5_error_code ipadb_fill_info3(struct ipadb_context *ipactx,
LDAPMessage *lentry, LDAPMessage *lentry,
LDAPMessage *sentry,
unsigned int flags, unsigned int flags,
TALLOC_CTX *memctx, TALLOC_CTX *memctx,
krb5_timestamp authtime, krb5_timestamp authtime,
@@ -565,7 +568,20 @@ static krb5_error_code ipadb_fill_info3(struct ipadb_context *ipactx,
unix_to_nt_time(&info3->base.last_password_change, timeres); unix_to_nt_time(&info3->base.last_password_change, timeres);
break; break;
case ENOENT: case ENOENT:
info3->base.last_password_change = 0; /* If second entry is present, use Kerberos attributes from it */
if (sentry != NULL) {
ret = ipadb_ldap_attr_to_time_t(ipactx->lcontext, sentry,
"krbLastPwdChange", &timeres);
switch (ret) {
case 0:
unix_to_nt_time(&info3->base.last_password_change, timeres);
break;
default:
break;
}
} else {
info3->base.last_password_change = 0;
}
break; break;
default: default:
return ret; return ret;
@@ -678,9 +694,14 @@ static krb5_error_code ipadb_fill_info3(struct ipadb_context *ipactx,
if ((is_host || is_service)) { if ((is_host || is_service)) {
/* it is either host or service, so get the hostname first */ /* it is either host or service, so get the hostname first */
char *sep = strchr(info3->base.account_name.string, '/'); char *sep = strchr(info3->base.account_name.string, '/');
bool is_master = is_master_host( bool is_master;
ipactx,
sep ? sep + 1 : info3->base.account_name.string); ret = is_master_host(ipactx,
sep ? sep + 1 : info3->base.account_name.string,
&is_master);
if (ret)
return ret;
if (is_master) { if (is_master) {
/* Well known RID of domain controllers group */ /* Well known RID of domain controllers group */
if (info3->base.rid == 0) { if (info3->base.rid == 0) {
@@ -983,16 +1004,18 @@ static krb5_error_code ipadb_get_pac_attrs_blob(TALLOC_CTX *mem_ctx,
#endif #endif
krb5_error_code ipadb_get_pac(krb5_context kcontext, krb5_error_code ipadb_get_pac(krb5_context kcontext,
krb5_db_entry *client,
unsigned int flags, unsigned int flags,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_keyblock *replaced_reply_key,
krb5_timestamp authtime, krb5_timestamp authtime,
krb5_pac *pac) krb5_pac *pac)
{ {
TALLOC_CTX *tmpctx; TALLOC_CTX *tmpctx;
struct ipadb_e_data *ied; struct ipadb_e_data *ied;
struct ipadb_context *ipactx; struct ipadb_context *ipactx;
LDAPMessage *results = NULL; LDAPMessage *results = NULL, *sresults = NULL;
LDAPMessage *lentry; LDAPMessage *lentry = NULL, *sentry = NULL;
DATA_BLOB pac_data; DATA_BLOB pac_data;
krb5_data data; krb5_data data;
union PAC_INFO pac_info; union PAC_INFO pac_info;
@@ -1048,9 +1071,40 @@ krb5_error_code ipadb_get_pac(krb5_context kcontext,
goto done; goto done;
} }
{
bool is_trust_krbtgt;
/* Trusted domain objects are part of cn=ad,cn=trusts,$BASEDN subtree.
* Anchor the search string with ',dc=' to prevent matching anything else.
* This is to avoid a string allocation with expanded base DN. */
is_trust_krbtgt = strstr(ied->entry_dn, ",cn=ad,cn=trusts,dc=") != NULL;
if (is_trust_krbtgt) {
char *sentry_dn = strchr(ied->entry_dn, ',');
if (sentry_dn != NULL) {
/* skipped "krbprincipalname=krbtgt/SOME-REALM@AT-REALM," */
sentry_dn++;
kerr = ipadb_deref_search(ipactx, sentry_dn, LDAP_SCOPE_BASE,
"(objectclass=*)", user_pac_attrs,
deref_search_attrs, memberof_pac_attrs,
&sresults);
if (kerr) {
goto done;
}
sentry = ldap_first_entry(ipactx->lcontext, sresults);
if (!sentry) {
kerr = ENOENT;
goto done;
}
}
}
}
/* == Fill Info3 == */ /* == Fill Info3 == */
kerr = ipadb_fill_info3(ipactx, lentry, flags, tmpctx, authtime, kerr = ipadb_fill_info3(ipactx, sentry ? sentry : lentry, sentry ? lentry : NULL,
&pac_info.logon_info.info->info3); flags, tmpctx, authtime, &pac_info.logon_info.info->info3);
if (kerr) { if (kerr) {
goto done; goto done;
} }
@@ -1064,9 +1118,13 @@ krb5_error_code ipadb_get_pac(krb5_context kcontext,
goto done; goto done;
} }
kerr = krb5_pac_init(kcontext, pac); /* krb5 1.20+ passes in a pre-created PAC structure but for previous
if (kerr) { * versions we have to create it ourselves */
goto done; if (pac != NULL && *pac == NULL) {
kerr = krb5_pac_init(kcontext, pac);
if (kerr) {
goto done;
}
} }
data.magic = KV5M_DATA; data.magic = KV5M_DATA;
@@ -1149,7 +1207,7 @@ krb5_error_code ipadb_get_pac(krb5_context kcontext,
#ifdef HAVE_PAC_REQUESTER_SID #ifdef HAVE_PAC_REQUESTER_SID
/* MS-KILE 3.3.5.6.4.8: add PAC_REQUESTER_SID only in TGT case */ /* MS-KILE 3.3.5.6.4.8: add PAC_REQUESTER_SID only in TGT case */
if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0) { if (flags & CLIENT_REFERRALS_FLAGS) {
union PAC_INFO pac_requester_sid; union PAC_INFO pac_requester_sid;
/* == Package PAC_REQUESTER_SID == */ /* == Package PAC_REQUESTER_SID == */
memset(&pac_requester_sid, 0, sizeof(pac_requester_sid)); memset(&pac_requester_sid, 0, sizeof(pac_requester_sid));
@@ -1177,6 +1235,9 @@ krb5_error_code ipadb_get_pac(krb5_context kcontext,
done: done:
ldap_msgfree(results); ldap_msgfree(results);
if (sresults != NULL) {
ldap_msgfree(sresults);
}
talloc_free(tmpctx); talloc_free(tmpctx);
return kerr; return kerr;
} }
@@ -1553,7 +1614,7 @@ static krb5_error_code save_logon_info(krb5_context context,
} }
static struct ipadb_adtrusts *get_domain_from_realm(krb5_context context, static struct ipadb_adtrusts *get_domain_from_realm(krb5_context context,
krb5_data realm) krb5_data *realm)
{ {
struct ipadb_context *ipactx; struct ipadb_context *ipactx;
struct ipadb_adtrusts *domain; struct ipadb_adtrusts *domain;
@@ -1570,10 +1631,10 @@ static struct ipadb_adtrusts *get_domain_from_realm(krb5_context context,
for (i = 0; i < ipactx->mspac->num_trusts; i++) { for (i = 0; i < ipactx->mspac->num_trusts; i++) {
domain = &ipactx->mspac->trusts[i]; domain = &ipactx->mspac->trusts[i];
if (strlen(domain->domain_name) != realm.length) { if (strlen(domain->domain_name) != realm->length) {
continue; continue;
} }
if (strncasecmp(domain->domain_name, realm.data, realm.length) == 0) { if (strncasecmp(domain->domain_name, realm->data, realm->length) == 0) {
return domain; return domain;
} }
} }
@@ -1582,7 +1643,7 @@ static struct ipadb_adtrusts *get_domain_from_realm(krb5_context context,
} }
static struct ipadb_adtrusts *get_domain_from_realm_update(krb5_context context, static struct ipadb_adtrusts *get_domain_from_realm_update(krb5_context context,
krb5_data realm) krb5_data *realm)
{ {
struct ipadb_context *ipactx; struct ipadb_context *ipactx;
struct ipadb_adtrusts *domain; struct ipadb_adtrusts *domain;
@@ -1637,7 +1698,7 @@ static void filter_logon_info_log_message_rid(struct dom_sid *sid, uint32_t rid)
static krb5_error_code check_logon_info_consistent(krb5_context context, static krb5_error_code check_logon_info_consistent(krb5_context context,
TALLOC_CTX *memctx, TALLOC_CTX *memctx,
krb5_const_principal client_princ, krb5_db_entry *client,
krb5_boolean is_s4u, krb5_boolean is_s4u,
struct PAC_LOGON_INFO_CTR *info) struct PAC_LOGON_INFO_CTR *info)
{ {
@@ -1645,7 +1706,6 @@ static krb5_error_code check_logon_info_consistent(krb5_context context,
struct ipadb_context *ipactx; struct ipadb_context *ipactx;
bool result; bool result;
bool is_from_trusted_domain = false; bool is_from_trusted_domain = false;
krb5_db_entry *client_actual = NULL;
struct ipadb_e_data *ied = NULL; struct ipadb_e_data *ied = NULL;
int flags = 0; int flags = 0;
struct dom_sid client_sid; struct dom_sid client_sid;
@@ -1701,18 +1761,12 @@ static krb5_error_code check_logon_info_consistent(krb5_context context,
} }
} }
if (is_s4u && is_from_trusted_domain) { if (client == NULL || (is_s4u && is_from_trusted_domain)) {
/* If the PAC belongs to a user from the trusted domain, we cannot compare SIDs */ /* If the PAC belongs to a user from the trusted domain, we cannot compare SIDs */
return 0; return 0;
} }
kerr = ipadb_get_principal(context, client_princ, flags, &client_actual); ied = (struct ipadb_e_data *)client->e_data;
if (kerr != 0) {
krb5_klog_syslog(LOG_ERR, "PAC issue: ipadb_get_principal failed.");
return KRB5KDC_ERR_TGT_REVOKED;
}
ied = (struct ipadb_e_data *)client_actual->e_data;
if (ied == NULL || ied->magic != IPA_E_DATA_MAGIC) { if (ied == NULL || ied->magic != IPA_E_DATA_MAGIC) {
krb5_klog_syslog(LOG_ERR, "PAC issue: client e_data fetching failed."); krb5_klog_syslog(LOG_ERR, "PAC issue: client e_data fetching failed.");
kerr = EINVAL; kerr = EINVAL;
@@ -1748,14 +1802,12 @@ static krb5_error_code check_logon_info_consistent(krb5_context context,
} }
done: done:
ipadb_free_principal(context, client_actual);
return kerr; return kerr;
} }
krb5_error_code filter_logon_info(krb5_context context, krb5_error_code filter_logon_info(krb5_context context,
TALLOC_CTX *memctx, TALLOC_CTX *memctx,
krb5_data realm, krb5_data *realm,
struct PAC_LOGON_INFO_CTR *info) struct PAC_LOGON_INFO_CTR *info)
{ {
@@ -1782,11 +1834,43 @@ krb5_error_code filter_logon_info(krb5_context context,
bool result; bool result;
char *domstr = NULL; char *domstr = NULL;
ipactx = ipadb_get_context(context);
if (!ipactx || !ipactx->mspac) {
return KRB5_KDB_DBNOTINITED;
}
domain = get_domain_from_realm_update(context, realm); domain = get_domain_from_realm_update(context, realm);
if (!domain) { if (!domain) {
return EINVAL; return EINVAL;
} }
/* check exact sid */
result = dom_sid_check(&domain->domsid, info->info->info3.base.domain_sid, true);
if (!result) {
struct ipadb_mspac *mspac_ctx = ipactx->mspac;
result = FALSE;
/* Didn't match but perhaps the original PAC was issued by a child domain's DC? */
for (k = 0; k < mspac_ctx->num_trusts; k++) {
result = dom_sid_check(&mspac_ctx->trusts[k].domsid,
info->info->info3.base.domain_sid, true);
if (result) {
domain = &mspac_ctx->trusts[k];
break;
}
}
if (!result) {
domstr = dom_sid_string(NULL, info->info->info3.base.domain_sid);
krb5_klog_syslog(LOG_ERR, "PAC Info mismatch: domain = %s, "
"expected domain SID = %s, "
"found domain SID = %s",
domain->domain_name, domain->domain_sid,
domstr ? domstr : "<failed to display>");
talloc_free(domstr);
return EINVAL;
}
}
/* At this point we may have changed the domain we look at, */
/* check netbios/flat name */ /* check netbios/flat name */
if (strcasecmp(info->info->info3.base.logon_domain.string, if (strcasecmp(info->info->info3.base.logon_domain.string,
domain->flat_name) != 0) { domain->flat_name) != 0) {
@@ -1798,21 +1882,6 @@ krb5_error_code filter_logon_info(krb5_context context,
return EINVAL; return EINVAL;
} }
/* check exact sid */
result = dom_sid_check(&domain->domsid, info->info->info3.base.domain_sid, true);
if (!result) {
domstr = dom_sid_string(NULL, info->info->info3.base.domain_sid);
if (!domstr) {
return EINVAL;
}
krb5_klog_syslog(LOG_ERR, "PAC Info mismatch: domain = %s, "
"expected domain SID = %s, "
"found domain SID = %s",
domain->domain_name, domain->domain_sid, domstr);
talloc_free(domstr);
return EINVAL;
}
/* Check if this domain has been filtered out by the trust itself*/ /* Check if this domain has been filtered out by the trust itself*/
if (domain->parent != NULL) { if (domain->parent != NULL) {
for(k = 0; k < domain->parent->len_sid_blocklist_incoming; k++) { for(k = 0; k < domain->parent->len_sid_blocklist_incoming; k++) {
@@ -1899,10 +1968,6 @@ krb5_error_code filter_logon_info(krb5_context context,
* should include different possibilities into account * should include different possibilities into account
* */ * */
if (info->info->info3.sidcount != 0) { if (info->info->info3.sidcount != 0) {
ipactx = ipadb_get_context(context);
if (!ipactx || !ipactx->mspac) {
return KRB5_KDB_DBNOTINITED;
}
count = info->info->info3.sidcount; count = info->info->info3.sidcount;
i = 0; i = 0;
j = 0; j = 0;
@@ -1980,7 +2045,8 @@ krb5_error_code filter_logon_info(krb5_context context,
static krb5_error_code ipadb_check_logon_info(krb5_context context, static krb5_error_code ipadb_check_logon_info(krb5_context context,
krb5_const_principal client_princ, krb5_db_entry *client,
krb5_db_entry *signing_krbtgt,
krb5_boolean is_cross_realm, krb5_boolean is_cross_realm,
krb5_boolean is_s4u, krb5_boolean is_s4u,
krb5_data *pac_blob, krb5_data *pac_blob,
@@ -1989,7 +2055,7 @@ static krb5_error_code ipadb_check_logon_info(krb5_context context,
struct PAC_LOGON_INFO_CTR info; struct PAC_LOGON_INFO_CTR info;
krb5_error_code kerr; krb5_error_code kerr;
TALLOC_CTX *tmpctx; TALLOC_CTX *tmpctx;
krb5_data origin_realm = client_princ->realm; krb5_data origin_realm = {0};
bool result; bool result;
tmpctx = talloc_new(NULL); tmpctx = talloc_new(NULL);
@@ -2017,12 +2083,12 @@ static krb5_error_code ipadb_check_logon_info(krb5_context context,
return KRB5_KDB_DBNOTINITED; return KRB5_KDB_DBNOTINITED;
} }
/* In S4U case we might be dealing with the PAC issued by the trusted domain */ /* In S4U case we might be dealing with the PAC issued by the trusted domain */
if (is_s4u && (ipactx->mspac->trusts != NULL)) { if ((ipactx->mspac->trusts != NULL)) {
/* Iterate through list of trusts and check if this SID belongs to /* Iterate through list of trusts and check if this SID belongs to
* one of the domains we trust */ * one of the domains we trust */
for(int i = 0 ; i < ipactx->mspac->num_trusts ; i++) { for(int i = 0 ; i < ipactx->mspac->num_trusts ; i++) {
result = dom_sid_check(&ipactx->mspac->trusts[i].domsid, result = dom_sid_check(&ipactx->mspac->trusts[i].domsid,
requester_sid, false); &client_sid, false);
if (result) { if (result) {
is_from_trusted_domain = true; is_from_trusted_domain = true;
break; break;
@@ -2030,7 +2096,7 @@ static krb5_error_code ipadb_check_logon_info(krb5_context context,
} }
} }
if (!is_from_trusted_domain) { if (!is_from_trusted_domain && !is_s4u) {
/* memctx is freed by the caller */ /* memctx is freed by the caller */
char *pac_sid = dom_sid_string(tmpctx, &client_sid); char *pac_sid = dom_sid_string(tmpctx, &client_sid);
char *req_sid = dom_sid_string(tmpctx, requester_sid); char *req_sid = dom_sid_string(tmpctx, requester_sid);
@@ -2051,11 +2117,17 @@ static krb5_error_code ipadb_check_logon_info(krb5_context context,
* is ours but operates on behalf of the cross-realm principal, we will * is ours but operates on behalf of the cross-realm principal, we will
* search through the trusted domains but otherwise skip the exact SID check * search through the trusted domains but otherwise skip the exact SID check
* as we are not responsible for the principal from the trusted domain */ * as we are not responsible for the principal from the trusted domain */
kerr = check_logon_info_consistent(context, tmpctx, client_princ, is_s4u, &info); kerr = check_logon_info_consistent(context, tmpctx, client, is_s4u, &info);
goto done; goto done;
} }
kerr = filter_logon_info(context, tmpctx, origin_realm, &info); if (client != NULL) {
origin_realm = client->princ->realm;
} else {
origin_realm = signing_krbtgt->princ->realm;
}
kerr = filter_logon_info(context, tmpctx, &origin_realm, &info);
if (kerr) { if (kerr) {
goto done; goto done;
} }
@@ -2224,24 +2296,19 @@ done:
return kerr; return kerr;
} }
krb5_error_code ipadb_verify_pac(krb5_context context, krb5_error_code ipadb_common_verify_pac(krb5_context context,
unsigned int flags, unsigned int flags,
krb5_const_principal client_princ, krb5_db_entry *client,
krb5_db_entry *proxy, krb5_db_entry *server,
krb5_db_entry *server, krb5_db_entry *signing_krbtgt,
krb5_db_entry *krbtgt, krb5_keyblock *krbtgt_key,
krb5_keyblock *server_key, krb5_timestamp authtime,
krb5_keyblock *krbtgt_key, krb5_pac old_pac,
krb5_timestamp authtime, krb5_pac *pac)
krb5_authdata **authdata,
krb5_pac *pac)
{ {
krb5_keyblock *srv_key = NULL;
krb5_keyblock *priv_key = NULL;
krb5_error_code kerr; krb5_error_code kerr;
krb5_ui_4 *types = NULL; krb5_ui_4 *types = NULL;
size_t num_buffers; size_t num_buffers;
krb5_pac old_pac = NULL;
krb5_pac new_pac = NULL; krb5_pac new_pac = NULL;
krb5_data data; krb5_data data;
krb5_data pac_blob = { 0 , 0, NULL}; krb5_data pac_blob = { 0 , 0, NULL};
@@ -2250,42 +2317,15 @@ krb5_error_code ipadb_verify_pac(krb5_context context,
struct dom_sid *requester_sid = NULL; struct dom_sid *requester_sid = NULL;
struct dom_sid req_sid; struct dom_sid req_sid;
kerr = krb5_pac_parse(context, if (signing_krbtgt != NULL &&
authdata[0]->contents, ipadb_is_cross_realm_krbtgt(signing_krbtgt->princ)) {
authdata[0]->length,
&old_pac);
if (kerr) {
goto done;
}
/* for cross realm trusts cases we need to check the right checksum.
* when the PAC is signed by our realm, we can always just check it
* passing our realm krbtgt key as the kdc checksum key (privsvr).
* But when a trusted realm passes us a PAC the kdc checksum is
* generated with that realm krbtgt key, so we need to use the cross
* realm krbtgt to check the 'server' checksum instead. */
if (ipadb_is_cross_realm_krbtgt(krbtgt->princ)) {
/* krbtgt from a trusted realm */ /* krbtgt from a trusted realm */
is_cross_realm = true; is_cross_realm = true;
srv_key = krbtgt_key;
} else {
/* krbtgt from our own realm */
priv_key = krbtgt_key;
} }
/* only pass with_realm TRUE when it is cross-realm ticket and S4U /* In krb5 1.20+ the PAC signatures are verified prior to call to issue_pac().
* extension (S4U2Self or S4U2Proxy (RBCD)) was requested */ * In krb5 before 1.20, we do verify PAC signatures before ipadb_common_verify_pac().
kerr = krb5_pac_verify_ext(context, old_pac, authtime, * Now we can do additional checks.
client_princ, srv_key, priv_key,
(is_cross_realm &&
(flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)));
if (kerr) {
goto done;
}
/* Now that the PAC is verified, do additional checks.
* Augment it with additional info if it is coming from a different realm */ * Augment it with additional info if it is coming from a different realm */
kerr = krb5_pac_get_buffer(context, old_pac, kerr = krb5_pac_get_buffer(context, old_pac,
KRB5_PAC_LOGON_INFO, &pac_blob); KRB5_PAC_LOGON_INFO, &pac_blob);
@@ -2302,7 +2342,8 @@ krb5_error_code ipadb_verify_pac(krb5_context context,
#endif #endif
kerr = ipadb_check_logon_info(context, kerr = ipadb_check_logon_info(context,
client_princ, client,
signing_krbtgt,
is_cross_realm, is_cross_realm,
(flags & KRB5_KDB_FLAGS_S4U), (flags & KRB5_KDB_FLAGS_S4U),
&pac_blob, &pac_blob,
@@ -2310,12 +2351,19 @@ krb5_error_code ipadb_verify_pac(krb5_context context,
if (kerr != 0) { if (kerr != 0) {
goto done; goto done;
} }
/* extract buffers and rebuilt pac from scratch so that when re-signing
* with a different cksum type does not cause issues due to mismatching /* krb5 1.20+ passes in a pre-created PAC structure but for previous
* signature buffer lengths */ * versions we have to create it ourselves */
kerr = krb5_pac_init(context, &new_pac); if (pac != NULL && *pac == NULL) {
if (kerr) { /* extract buffers and rebuilt pac from scratch so that when re-signing
goto done; * with a different cksum type does not cause issues due to mismatching
* signature buffer lengths */
kerr = krb5_pac_init(context, &new_pac);
if (kerr) {
goto done;
}
} else {
new_pac = *pac;
} }
kerr = krb5_pac_get_types(context, old_pac, &num_buffers, &types); kerr = krb5_pac_get_types(context, old_pac, &num_buffers, &types);
@@ -2326,7 +2374,10 @@ krb5_error_code ipadb_verify_pac(krb5_context context,
for (i = 0; i < num_buffers; i++) { for (i = 0; i < num_buffers; i++) {
if (types[i] == KRB5_PAC_SERVER_CHECKSUM || if (types[i] == KRB5_PAC_SERVER_CHECKSUM ||
types[i] == KRB5_PAC_PRIVSVR_CHECKSUM || types[i] == KRB5_PAC_PRIVSVR_CHECKSUM ||
types[i] == KRB5_PAC_CLIENT_INFO) { #ifdef KRB5_PAC_FULL_CHECKSUM
types[i] == KRB5_PAC_FULL_CHECKSUM ||
#endif
types[i] == KRB5_PAC_CLIENT_INFO) {
continue; continue;
} }
@@ -2334,7 +2385,6 @@ krb5_error_code ipadb_verify_pac(krb5_context context,
pac_blob.length != 0) { pac_blob.length != 0) {
kerr = krb5_pac_add_buffer(context, new_pac, types[i], &pac_blob); kerr = krb5_pac_add_buffer(context, new_pac, types[i], &pac_blob);
if (kerr) { if (kerr) {
krb5_pac_free(context, new_pac);
goto done; goto done;
} }
@@ -2351,21 +2401,18 @@ krb5_error_code ipadb_verify_pac(krb5_context context,
TALLOC_CTX *tmpctx = talloc_new(NULL); TALLOC_CTX *tmpctx = talloc_new(NULL);
if (tmpctx == NULL) { if (tmpctx == NULL) {
kerr = ENOMEM; kerr = ENOMEM;
krb5_pac_free(context, new_pac);
goto done; goto done;
} }
kerr = ipadb_client_requested_pac(context, old_pac, tmpctx, &pac_requested); kerr = ipadb_client_requested_pac(context, old_pac, tmpctx, &pac_requested);
if (kerr != 0) { if (kerr != 0) {
talloc_free(tmpctx); talloc_free(tmpctx);
krb5_pac_free(context, new_pac);
goto done; goto done;
} }
kerr = ipadb_get_pac_attrs_blob(tmpctx, &pac_requested, &pac_attrs_data); kerr = ipadb_get_pac_attrs_blob(tmpctx, &pac_requested, &pac_attrs_data);
if (kerr) { if (kerr) {
talloc_free(tmpctx); talloc_free(tmpctx);
krb5_pac_free(context, new_pac);
goto done; goto done;
} }
data.magic = KV5M_DATA; data.magic = KV5M_DATA;
@@ -2375,7 +2422,6 @@ krb5_error_code ipadb_verify_pac(krb5_context context,
kerr = krb5_pac_add_buffer(context, new_pac, PAC_TYPE_ATTRIBUTES_INFO, &data); kerr = krb5_pac_add_buffer(context, new_pac, PAC_TYPE_ATTRIBUTES_INFO, &data);
if (kerr) { if (kerr) {
talloc_free(tmpctx); talloc_free(tmpctx);
krb5_pac_free(context, new_pac);
goto done; goto done;
} }
@@ -2395,31 +2441,35 @@ krb5_error_code ipadb_verify_pac(krb5_context context,
krb5_free_data_contents(context, &data); krb5_free_data_contents(context, &data);
} }
if (kerr) { if (kerr) {
krb5_pac_free(context, new_pac);
goto done; goto done;
} }
} }
#if !defined(KRB5_KDB_FLAG_CLIENT)
if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
if (proxy == NULL) { if (client == NULL) {
if (new_pac != *pac) {
krb5_pac_free(context, new_pac);
}
*pac = NULL; *pac = NULL;
kerr = 0; kerr = 0;
goto done; goto done;
} }
kerr = ipadb_add_transited_service(context, proxy, server, kerr = ipadb_add_transited_service(context, client, server,
old_pac, new_pac); old_pac, new_pac);
if (kerr) { if (kerr) {
krb5_pac_free(context, new_pac);
goto done; goto done;
} }
} }
#endif
*pac = new_pac; *pac = new_pac;
done: done:
krb5_free_authdata(context, authdata); if (kerr != 0 && (new_pac != *pac)) {
krb5_pac_free(context, old_pac); krb5_pac_free(context, new_pac);
}
krb5_free_data_contents(context, &pac_blob); krb5_free_data_contents(context, &pac_blob);
free(types); free(types);
return kerr; return kerr;
@@ -2527,9 +2577,12 @@ void get_authz_data_types(krb5_context context, krb5_db_entry *entry,
none_found = true; none_found = true;
} }
} else { } else {
krb5_klog_syslog(LOG_ERR, "Ignoring unsupported " \ /* for out-of-realm entries we suppress warnings in our defaults */
"authorization data type [%s].", if (entry != NULL) {
authz_data_list[c]); krb5_klog_syslog(LOG_ERR, "Ignoring unsupported " \
"authorization data type [%s].",
authz_data_list[c]);
}
} }
} }
daemons/ipa-kdb/ipa_kdb_mspac_private.h
+13 -13
View File
@@ -53,24 +53,24 @@ struct ipadb_adtrusts {
char *dom_sid_string(TALLOC_CTX *memctx, const struct dom_sid *dom_sid); char *dom_sid_string(TALLOC_CTX *memctx, const struct dom_sid *dom_sid);
krb5_error_code filter_logon_info(krb5_context context, TALLOC_CTX *memctx, krb5_error_code filter_logon_info(krb5_context context, TALLOC_CTX *memctx,
krb5_data realm, struct PAC_LOGON_INFO_CTR *info); krb5_data *realm, struct PAC_LOGON_INFO_CTR *info);
void get_authz_data_types(krb5_context context, krb5_db_entry *entry, void get_authz_data_types(krb5_context context, krb5_db_entry *entry,
bool *_with_pac, bool *_with_pad); bool *_with_pac, bool *_with_pad);
bool ipadb_is_cross_realm_krbtgt(krb5_const_principal princ); bool ipadb_is_cross_realm_krbtgt(krb5_const_principal princ);
krb5_error_code ipadb_get_pac(krb5_context kcontext, krb5_error_code ipadb_get_pac(krb5_context kcontext,
krb5_db_entry *client,
unsigned int flags, unsigned int flags,
krb5_db_entry *client,
krb5_db_entry *server,
krb5_keyblock *replaced_reply_key,
krb5_timestamp authtime, krb5_timestamp authtime,
krb5_pac *pac); krb5_pac *pac);
krb5_error_code ipadb_verify_pac(krb5_context context, krb5_error_code ipadb_common_verify_pac(krb5_context context,
unsigned int flags, unsigned int flags,
krb5_const_principal client_princ, krb5_db_entry *client,
krb5_db_entry *proxy, krb5_db_entry *server,
krb5_db_entry *server, krb5_db_entry *signing_krbtgt,
krb5_db_entry *krbtgt, krb5_keyblock *krbtgt_key,
krb5_keyblock *server_key, krb5_timestamp authtime,
krb5_keyblock *krbtgt_key, krb5_pac old_pac,
krb5_timestamp authtime, krb5_pac *pac);
krb5_authdata **authdata,
krb5_pac *pac);
daemons/ipa-kdb/ipa_kdb_mspac_v6.c
+74 -2
View File
@@ -31,6 +31,68 @@
#include "ipa_kdb_mspac_private.h" #include "ipa_kdb_mspac_private.h"
static
krb5_error_code ipadb_verify_pac(krb5_context context,
unsigned int flags,
krb5_const_principal client_princ,
krb5_db_entry *proxy,
krb5_db_entry *server,
krb5_db_entry *krbtgt,
krb5_keyblock *server_key,
krb5_keyblock *krbtgt_key,
krb5_timestamp authtime,
krb5_authdata **authdata,
krb5_pac *pac)
{
krb5_error_code kerr;
krb5_pac old_pac = NULL;
kerr = krb5_pac_parse(context,
authdata[0]->contents,
authdata[0]->length,
&old_pac);
if (kerr == 0) {
krb5_keyblock *srv_key = NULL;
krb5_keyblock *priv_key = NULL;
bool is_cross_realm = false;
/* for cross realm trusts cases we need to check the right checksum.
* when the PAC is signed by our realm, we can always just check it
* passing our realm krbtgt key as the kdc checksum key (privsvr).
* But when a trusted realm passes us a PAC the kdc checksum is
* generated with that realm krbtgt key, so we need to use the cross
* realm krbtgt to check the 'server' checksum instead. */
if (ipadb_is_cross_realm_krbtgt(krbtgt->princ)) {
/* krbtgt from a trusted realm */
is_cross_realm = true;
srv_key = krbtgt_key;
} else {
/* krbtgt from our own realm */
priv_key = krbtgt_key;
}
/* only pass with_realm TRUE when it is cross-realm ticket and S4U
* extension (S4U2Self or S4U2Proxy (RBCD)) was requested */
kerr = krb5_pac_verify_ext(context, old_pac, authtime,
NULL, srv_key, priv_key,
(is_cross_realm &&
(flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)));
if (kerr) {
goto done;
}
kerr = ipadb_common_verify_pac(context, flags,
proxy, server, krbtgt,
krbtgt_key,
authtime, old_pac, pac);
}
done:
krb5_free_authdata(context, authdata);
krb5_pac_free(context, old_pac);
return kerr;
}
static krb5_error_code ipadb_sign_pac(krb5_context context, static krb5_error_code ipadb_sign_pac(krb5_context context,
unsigned int flags, unsigned int flags,
@@ -114,11 +176,21 @@ static krb5_error_code ipadb_sign_pac(krb5_context context,
/* only pass with_realm TRUE when it is cross-realm ticket and S4U2Self /* only pass with_realm TRUE when it is cross-realm ticket and S4U2Self
* was requested */ * was requested */
#ifdef HAVE_KRB5_PAC_FULL_SIGN_COMPAT
kerr = krb5_pac_full_sign_compat(
context, pac, authtime, client_princ, server->princ, server_key,
right_krbtgt_signing_key,
(is_issuing_referral && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)),
pac_data
);
#else
/* Use standard function, PAC extended KDC signature not supported */
kerr = krb5_pac_sign_ext(context, pac, authtime, client_princ, server_key, kerr = krb5_pac_sign_ext(context, pac, authtime, client_princ, server_key,
right_krbtgt_signing_key, right_krbtgt_signing_key,
(is_issuing_referral && (is_issuing_referral &&
(flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)), (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)),
pac_data); pac_data);
#endif
done: done:
free(princ); free(princ);
@@ -239,7 +311,7 @@ krb5_error_code ipadb_sign_authdata(krb5_context context,
(void)ipadb_reinit_mspac(ipactx, force_reinit_mspac); (void)ipadb_reinit_mspac(ipactx, force_reinit_mspac);
kerr = ipadb_get_pac(context, client, flags, authtime, &pac); kerr = ipadb_get_pac(context, flags, client, server, NULL, authtime, &pac);
if (kerr != 0 && kerr != ENOENT) { if (kerr != 0 && kerr != ENOENT) {
goto done; goto done;
} }
@@ -253,7 +325,7 @@ krb5_error_code ipadb_sign_authdata(krb5_context context,
/* check or generate pac data */ /* check or generate pac data */
if ((pac_auth_data == NULL) || (pac_auth_data[0] == NULL)) { if ((pac_auth_data == NULL) || (pac_auth_data[0] == NULL)) {
if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
kerr = ipadb_get_pac(context, client_entry, flags, authtime, &pac); kerr = ipadb_get_pac(context, flags, client_entry, server, NULL, authtime, &pac);
if (kerr != 0 && kerr != ENOENT) { if (kerr != 0 && kerr != ENOENT) {
goto done; goto done;
} }
daemons/ipa-kdb/ipa_kdb_mspac_v9.c
+104
View File
@@ -31,4 +31,108 @@
#include "ipa_kdb_mspac_private.h" #include "ipa_kdb_mspac_private.h"
krb5_error_code
ipadb_v9_issue_pac(krb5_context context, unsigned int flags,
krb5_db_entry *client,
krb5_keyblock *replaced_reply_key,
krb5_db_entry *server,
krb5_db_entry *signing_krbtgt,
krb5_timestamp authtime,
krb5_pac old_pac,
krb5_pac new_pac,
krb5_data ***auth_indicators)
{
bool with_pac;
bool with_pad;
krb5_error_code kerr = 0;
bool is_as_req = flags & CLIENT_REFERRALS_FLAGS;
if (is_as_req) {
get_authz_data_types(context, client, &with_pac, &with_pad);
} else {
get_authz_data_types(context, server, &with_pac, &with_pad);
}
if (with_pad) {
krb5_klog_syslog(LOG_ERR, "PAD authorization data is requested but " \
"currently not supported.");
}
/*
* Get a new PAC for AS-REQ or S4U2Self for our realm.
*
* For a simple cross-realm S4U2Proxy there will be the following TGS
* requests after the client realm is identified:
*
* 1. server@SREALM to SREALM for krbtgt/CREALM@SREALM -- a regular TGS
* request with server's normal TGT and no S4U2Self padata.
* 2. server@SREALM to CREALM for server@SREALM (expressed as an
* enterprise principal), with the TGT from #1 as header ticket and
* S4U2Self padata identifying the client.
* 3. server@SREALM to SREALM for server@SREALM with S4U2Self padata,
* with the referral TGT from #2 as header ticket
*
* In request 2 the PROTOCOL_TRANSITION and CROSS_REALM flags are set,
* and the request is for a local client (so client != NULL) and we
* want to make a new PAC.
*
* In request 3 the PROTOCOL_TRANSITION and CROSS_REALM flags are also
* set, but the request is for a non-local client (so client == NULL)
* and we want to copy the subject PAC contained in the referral TGT.
*/
if (old_pac == NULL ||
(client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) {
/* generate initial PAC */
if (with_pac) {
krb5_boolean force_reinit_mspac = FALSE;
struct ipadb_context *ipactx = ipadb_get_context(context);
int result = 0;
if (!ipactx) {
kerr = ENOMEM;
goto done;
}
if (client != NULL) {
/* Be aggressive here: special case for discovering range type
* immediately after establishing the trust by IPA framework. For all
* other cases call ipadb_reinit_mspac() with force_reinit_mspac set
* to 'false' to make sure the information about trusted domains is
* updated on a regular basis for all worker processes. */
if ((krb5_princ_size(context, client->princ) == 2) &&
(strncmp(krb5_princ_component(context, client->princ, 0)->data, "HTTP",
krb5_princ_component(context, client->princ, 0)->length) == 0) &&
(ulc_casecmp(krb5_princ_component(context, client->princ, 1)->data,
krb5_princ_component(context, client->princ, 1)->length,
ipactx->kdc_hostname, strlen(ipactx->kdc_hostname),
NULL, NULL, &result) == 0)) {
force_reinit_mspac = TRUE;
}
}
(void)ipadb_reinit_mspac(ipactx, force_reinit_mspac);
/* MS-PAC needs proper configuration and if it is missing, we simply skip issuing one */
if (ipactx->mspac->flat_server_name == NULL) {
return KRB5_PLUGIN_OP_NOTSUPP;
}
kerr = ipadb_get_pac(context, flags,
client, server, replaced_reply_key,
authtime, &new_pac);
}
} else {
kerr = ipadb_common_verify_pac(context, flags,
client, server,
signing_krbtgt,
NULL,
authtime,
old_pac, &new_pac);
if (kerr == ENOENT) {
kerr = 0;
}
}
/* in krb5 1.20 no need to sign tickets anymore, KDC does it for us */
done:
return kerr;
}
daemons/ipa-kdb/ipa_kdb_principals.c
+317 -32
View File
@@ -78,10 +78,12 @@ static char *std_principal_attrs[] = {
IPA_USER_AUTH_TYPE, IPA_USER_AUTH_TYPE,
"ipatokenRadiusConfigLink", "ipatokenRadiusConfigLink",
"ipaIdpConfigLink", "ipaIdpConfigLink",
"ipaPassKey",
"krbAuthIndMaxTicketLife", "krbAuthIndMaxTicketLife",
"krbAuthIndMaxRenewableAge", "krbAuthIndMaxRenewableAge",
"ipaNTSecurityIdentifier", "ipaNTSecurityIdentifier",
"ipaUniqueID", "ipaUniqueID",
"memberPrincipal",
"objectClass", "objectClass",
NULL NULL
@@ -113,6 +115,14 @@ static char *std_principal_obj_classes[] = {
#define DEFAULT_TL_DATA_CONTENT "\x00\x00\x00\x00principal@UNINITIALIZED" #define DEFAULT_TL_DATA_CONTENT "\x00\x00\x00\x00principal@UNINITIALIZED"
#ifndef KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM
#define KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM "optional_pac_tkt_chksum"
#endif
#ifndef KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE
#define KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE "pac_privsvr_enctype"
#endif
static int ipadb_ldap_attr_to_tl_data(LDAP *lcontext, LDAPMessage *le, static int ipadb_ldap_attr_to_tl_data(LDAP *lcontext, LDAPMessage *le,
char *attrname, char *attrname,
krb5_tl_data **result, int *num) krb5_tl_data **result, int *num)
@@ -178,10 +188,56 @@ done:
return ret; return ret;
} }
static krb5_error_code ipadb_set_tl_data(krb5_db_entry *entry, static bool
krb5_int16 type, is_tgs_princ(krb5_context kcontext, krb5_const_principal princ)
krb5_ui_2 length, {
const krb5_octet *data) krb5_data *primary;
size_t l_tgs_name;
if (2 != krb5_princ_size(kcontext, princ))
return false;
primary = krb5_princ_component(kcontext, princ, 0);
l_tgs_name = strlen(KRB5_TGS_NAME);
if (l_tgs_name != primary->length)
return false;
return 0 == memcmp(primary->data, KRB5_TGS_NAME, l_tgs_name);
}
static krb5_error_code
cmp_local_tgs_princ(krb5_context kcontext, const char *local_realm,
krb5_const_principal princ, bool *result)
{
krb5_principal local_tgs_princ;
size_t l_local_realm;
krb5_error_code kerr;
bool res;
l_local_realm = strlen(local_realm);
kerr = krb5_build_principal(kcontext, &local_tgs_princ,
l_local_realm, local_realm,
KRB5_TGS_NAME, local_realm, NULL);
if (kerr)
goto end;
res = (bool) krb5_principal_compare(kcontext, local_tgs_princ, princ);
if (result)
*result = res;
end:
krb5_free_principal(kcontext, local_tgs_princ);
return kerr;
}
krb5_error_code ipadb_set_tl_data(krb5_db_entry *entry,
krb5_int16 type,
krb5_ui_2 length,
const krb5_octet *data)
{ {
krb5_error_code kerr; krb5_error_code kerr;
krb5_tl_data *new_td = NULL; krb5_tl_data *new_td = NULL;
@@ -347,6 +403,25 @@ static void ipadb_validate_idp(struct ipadb_context *ipactx,
ldap_value_free_len(vals); ldap_value_free_len(vals);
} }
static void ipadb_validate_passkey(struct ipadb_context *ipactx,
LDAPMessage *lentry,
enum ipadb_user_auth *ua)
{
struct berval **vals;
if (!(*ua & IPADB_USER_AUTH_PASSKEY))
return;
/* Ensure that the user has a link to an IdP config. */
vals = ldap_get_values_len(ipactx->lcontext, lentry,
"ipaPassKey");
if (vals == NULL || vals[0] == NULL)
*ua &= ~IPADB_USER_AUTH_PASSKEY;
if (vals != NULL)
ldap_value_free_len(vals);
}
static enum ipadb_user_auth ipadb_get_user_auth(struct ipadb_context *ipactx, static enum ipadb_user_auth ipadb_get_user_auth(struct ipadb_context *ipactx,
LDAPMessage *lentry) LDAPMessage *lentry)
{ {
@@ -380,6 +455,7 @@ static enum ipadb_user_auth ipadb_get_user_auth(struct ipadb_context *ipactx,
ipadb_validate_otp(ipactx, lentry, &ua); ipadb_validate_otp(ipactx, lentry, &ua);
ipadb_validate_radius(ipactx, lentry, &ua); ipadb_validate_radius(ipactx, lentry, &ua);
ipadb_validate_idp(ipactx, lentry, &ua); ipadb_validate_idp(ipactx, lentry, &ua);
ipadb_validate_passkey(ipactx, lentry, &ua);
return ua; return ua;
} }
@@ -564,6 +640,8 @@ static void ipadb_parse_authind_policies(krb5_context kcontext,
IPADB_USER_AUTH_HARDENED, IPADB_USER_AUTH_IDX_HARDENED}, IPADB_USER_AUTH_HARDENED, IPADB_USER_AUTH_IDX_HARDENED},
{"krbAuthIndMaxTicketLife;idp", {"krbAuthIndMaxTicketLife;idp",
IPADB_USER_AUTH_IDP, IPADB_USER_AUTH_IDX_IDP}, IPADB_USER_AUTH_IDP, IPADB_USER_AUTH_IDX_IDP},
{"krbAuthIndMaxTicketLife;passkey",
IPADB_USER_AUTH_PASSKEY, IPADB_USER_AUTH_IDX_PASSKEY},
{NULL, IPADB_USER_AUTH_NONE, IPADB_USER_AUTH_IDX_MAX}, {NULL, IPADB_USER_AUTH_NONE, IPADB_USER_AUTH_IDX_MAX},
}, age_authind_map[] = { }, age_authind_map[] = {
{"krbAuthIndMaxRenewableAge;otp", {"krbAuthIndMaxRenewableAge;otp",
@@ -576,6 +654,8 @@ static void ipadb_parse_authind_policies(krb5_context kcontext,
IPADB_USER_AUTH_HARDENED, IPADB_USER_AUTH_IDX_HARDENED}, IPADB_USER_AUTH_HARDENED, IPADB_USER_AUTH_IDX_HARDENED},
{"krbAuthIndMaxRenewableAge;idp", {"krbAuthIndMaxRenewableAge;idp",
IPADB_USER_AUTH_IDP, IPADB_USER_AUTH_IDX_IDP}, IPADB_USER_AUTH_IDP, IPADB_USER_AUTH_IDX_IDP},
{"krbAuthIndMaxRenewableAge;passkey",
IPADB_USER_AUTH_PASSKEY, IPADB_USER_AUTH_IDX_PASSKEY},
{NULL, IPADB_USER_AUTH_NONE, IPADB_USER_AUTH_IDX_MAX}, {NULL, IPADB_USER_AUTH_NONE, IPADB_USER_AUTH_IDX_MAX},
}; };
@@ -619,6 +699,7 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext,
const krb5_octet rad_string[] = "otp\0[{\"indicators\": [\"radius\"]}]"; const krb5_octet rad_string[] = "otp\0[{\"indicators\": [\"radius\"]}]";
const krb5_octet otp_string[] = "otp\0[{\"indicators\": [\"otp\"]}]"; const krb5_octet otp_string[] = "otp\0[{\"indicators\": [\"otp\"]}]";
const krb5_octet idp_string[] = "idp\0[{\"type\":\"oauth2\",\"indicators\": [\"idp\"]}]"; const krb5_octet idp_string[] = "idp\0[{\"type\":\"oauth2\",\"indicators\": [\"idp\"]}]";
const krb5_octet passkey_string[] = "passkey\0[{\"indicators\": [\"passkey\"]}]";
struct ipadb_context *ipactx; struct ipadb_context *ipactx;
enum ipadb_user_auth ua; enum ipadb_user_auth ua;
LDAP *lcontext; LDAP *lcontext;
@@ -633,6 +714,7 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext,
char *uidstring; char *uidstring;
char **authz_data_list; char **authz_data_list;
char *princ_sid; char *princ_sid;
char **acl_list;
krb5_timestamp restime; krb5_timestamp restime;
bool resbool; bool resbool;
int result; int result;
@@ -1002,6 +1084,11 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext,
sizeof(idp_string), idp_string); sizeof(idp_string), idp_string);
if (kerr) if (kerr)
goto done; goto done;
} else if (ua & IPADB_USER_AUTH_PASSKEY) {
kerr = ipadb_set_tl_data(entry, KRB5_TL_STRING_ATTRS,
sizeof(passkey_string), passkey_string);
if (kerr)
goto done;
} }
if (ua & ~IPADB_USER_AUTH_NONE) { if (ua & ~IPADB_USER_AUTH_NONE) {
@@ -1029,6 +1116,30 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext,
ied->has_sid = true; ied->has_sid = true;
} }
/* check if it has the serviceDelegation objectclass */
ret = ipadb_ldap_attr_has_value(lcontext, lentry,
"objectClass", "resourceDelegation");
if (ret != 0 && ret != ENOENT) {
kerr = ret;
goto done;
}
if (ret == 0) {
ret = ipadb_ldap_attr_to_strlist(lcontext, lentry,
"memberPrincipal", &acl_list);
if (ret != 0 && ret != ENOENT) {
kerr = KRB5_KDB_INTERNAL_ERROR;
goto done;
}
if (ret == 0) {
kerr = ipadb_set_tl_data(entry, KRB5_TL_CONSTRAINED_DELEGATION_ACL,
sizeof(acl_list),
(const krb5_octet *) &acl_list);
if (kerr) {
goto done;
}
}
}
kerr = 0; kerr = 0;
done: done:
@@ -1362,6 +1473,9 @@ static krb5_boolean is_request_for_us(krb5_context kcontext,
{ {
krb5_boolean for_us; krb5_boolean for_us;
if (search_for == NULL) {
return FALSE;
}
for_us = krb5_realm_compare(kcontext, local_tgs, search_for) || for_us = krb5_realm_compare(kcontext, local_tgs, search_for) ||
krb5_principal_compare_any_realm(kcontext, krb5_principal_compare_any_realm(kcontext,
local_tgs, search_for); local_tgs, search_for);
@@ -1379,11 +1493,17 @@ static krb5_error_code dbget_princ(krb5_context kcontext,
LDAPMessage *res = NULL; LDAPMessage *res = NULL;
LDAPMessage *lentry; LDAPMessage *lentry;
uint32_t pol; uint32_t pol;
krb5_boolean check = FALSE;
if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0 && #if defined(KRB5_KDB_FLAG_CLIENT)
(flags & KRB5_KDB_FLAG_CANONICALIZE) != 0) { check = flags & KRB5_KDB_FLAG_CLIENT;
#else
check = (flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) &&
(flags & KRB5_KDB_FLAG_CANONICALIZE);
#endif
if (check) {
/* AS_REQ with canonicalization*/ /* AS_REQ with canonicalization*/
krb5_principal norm_princ = NULL; krb5_principal norm_princ = NULL;
@@ -1450,6 +1570,14 @@ done:
return kerr; return kerr;
} }
/* For krb5 1.19, there is no KRB5_KDB_FLAG_REFERRAL_OK, emulate it
* See krb5 commit a441fbe329ebbd7775eb5d4ccc4a05eef370f08b */
#ifndef KRB5_KDB_FLAG_REFERRAL_OK
#ifdef KRB5_KDB_FLAG_CANONICALIZE
#define KRB5_KDB_FLAG_REFERRAL_OK KRB5_KDB_FLAG_CANONICALIZE
#endif
#endif
static krb5_error_code dbget_alias(krb5_context kcontext, static krb5_error_code dbget_alias(krb5_context kcontext,
struct ipadb_context *ipactx, struct ipadb_context *ipactx,
krb5_const_principal search_for, krb5_const_principal search_for,
@@ -1462,18 +1590,40 @@ static krb5_error_code dbget_alias(krb5_context kcontext,
char *trusted_realm = NULL; char *trusted_realm = NULL;
krb5_db_entry *kentry = NULL; krb5_db_entry *kentry = NULL;
krb5_data *realm; krb5_data *realm;
krb5_boolean check = FALSE;
/* KRB5_NT_PRINCIPAL must be the last element */
krb5_int32 supported_types[] = {
[0] = KRB5_NT_ENTERPRISE_PRINCIPAL,
[1] = KRB5_NT_PRINCIPAL,
-1,
};
size_t i = 0;
/* TODO: also support hostbased aliases */ /* For TGS-REQ server principal lookup, KDC asks with KRB5_KDB_FLAG_REFERRAL_OK
* and client usually asks for an KRB5_NT_PRINCIPAL type principal. */
if ((flags & KRB5_KDB_FLAG_REFERRAL_OK) == 0) {
/* this is *not* TGS-REQ server principal search, remove
* KRB5_NT_PRINCIPAL from the supported principal types for this lookup */
supported_types[(sizeof(supported_types) / sizeof(supported_types[0])) - 2] = -1;
}
/* Enterprise principal name type is for potential aliases or principals /* Enterprise principal name type is for potential aliases or principals
* from trusted realms. The logic below only applies to this type */ * from trusted realms. Except for the TGS-REQ server lookup, we only
if (krb5_princ_type(kcontext, search_for) != KRB5_NT_ENTERPRISE_PRINCIPAL) { * expect enterprise principals here */
for (i = 0; supported_types[i] != -1; i++) {
if (krb5_princ_type(kcontext, search_for) == supported_types[i]) {
break;
}
}
if (supported_types[i] == -1) {
return KRB5_KDB_NOENTRY; return KRB5_KDB_NOENTRY;
} }
/* enterprise principal can only have single component in the name /* enterprise principal can only have single component in the name
* according to RFC6806 section 5. */ * according to RFC6806 section 5. */
if (krb5_princ_size(kcontext, search_for) != 1) { if ((krb5_princ_type(kcontext, search_for) == KRB5_NT_ENTERPRISE_PRINCIPAL) &&
(krb5_princ_size(kcontext, search_for) != 1)) {
return KRB5_KDB_NOENTRY; return KRB5_KDB_NOENTRY;
} }
@@ -1497,6 +1647,12 @@ static krb5_error_code dbget_alias(krb5_context kcontext,
if (krb5_realm_compare(kcontext, ipactx->local_tgs, norm_princ)) { if (krb5_realm_compare(kcontext, ipactx->local_tgs, norm_princ)) {
/* In realm alias, try to retrieve it and let the caller handle it. */ /* In realm alias, try to retrieve it and let the caller handle it. */
kerr = dbget_princ(kcontext, ipactx, norm_princ, flags, entry); kerr = dbget_princ(kcontext, ipactx, norm_princ, flags, entry);
}
/* if we haven't found the principal in our realm, it might still
* be a referral to a known realm. Otherwise, bail out with the result */
if ((kerr != KRB5_KDB_NOENTRY) &&
(flags & KRB5_KDB_FLAG_REFERRAL_OK) == 0) {
goto done; goto done;
} }
@@ -1507,8 +1663,14 @@ static krb5_error_code dbget_alias(krb5_context kcontext,
* both client and server referrals. But it is more useful to ignore it * both client and server referrals. But it is more useful to ignore it
* like Windows KDC does for client referrals. * like Windows KDC does for client referrals.
*/ */
if (((flags & KRB5_KDB_FLAG_CANONICALIZE) == 0) && #if defined(KRB5_KDB_FLAG_CLIENT)
((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) == 0)) { check = ((flags & KRB5_KDB_FLAG_CLIENT) == 0) &&
((flags & KRB5_KDB_FLAG_REFERRAL_OK) == 0);
#else
check = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) == 0) &&
((flags & KRB5_KDB_FLAG_CANONICALIZE) == 0);
#endif
if (check) {
kerr = KRB5_KDB_NOENTRY; kerr = KRB5_KDB_NOENTRY;
goto done; goto done;
} }
@@ -1534,13 +1696,44 @@ static krb5_error_code dbget_alias(krb5_context kcontext,
&trusted_realm); &trusted_realm);
} }
if (kerr == KRB5_KDB_NOENTRY) {
krb5_data *hstname = NULL;
int ncomponents = krb5_princ_size(kcontext, norm_princ);
/* We did not find any alias so far for non-server principal lookups */
if ((ncomponents < 2) && ((flags & KRB5_KDB_FLAG_REFERRAL_OK) == 0)) {
goto done;
}
/* At this point it is a server principal lookup that might be
* referencing a host name in a trusted domain. It might also
* have multiple service components so take the last one for the
* hostname or the domain name. See MS-ADTS 2.2.21 and MS-DRSR 2.2.4.2.
*/
hstname = krb5_princ_component(kcontext, norm_princ, ncomponents - 1);
kerr = ipadb_is_princ_from_trusted_realm(kcontext,
hstname->data,
hstname->length,
&trusted_realm);
}
if (kerr != 0) { if (kerr != 0) {
kerr = KRB5_KDB_NOENTRY;
goto done; goto done;
} }
/* This is a known trusted realm. Issue a referral depending on whether this /* This is a known trusted realm. Issue a referral depending on whether this
* is client or server referral request */ * is client or server referral request */
if (flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) { #if defined(KRB5_KDB_FLAG_CLIENT)
check = (flags & KRB5_KDB_FLAG_CLIENT) && (flags & KRB5_KDB_FLAG_REFERRAL_OK);
#else
check = (flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) &&
((flags & KRB5_KDB_FLAG_CANONICALIZE) ||
search_for->type == KRB5_NT_ENTERPRISE_PRINCIPAL);
#endif
if (check) {
/* client referral out of realm, set next realm. */ /* client referral out of realm, set next realm. */
kerr = krb5_set_principal_realm(kcontext, norm_princ, trusted_realm); kerr = krb5_set_principal_realm(kcontext, norm_princ, trusted_realm);
if (kerr != 0) { if (kerr != 0) {
@@ -1559,7 +1752,12 @@ static krb5_error_code dbget_alias(krb5_context kcontext,
goto done; goto done;
} }
if (flags & KRB5_KDB_FLAG_INCLUDE_PAC) { #if defined(KRB5_KDB_FLAG_CLIENT)
check = flags & KRB5_KDB_FLAG_CLIENT;
#else
check = flags & KRB5_KDB_FLAG_INCLUDE_PAC;
#endif
if (check) {
/* TGS request where KDC wants to generate PAC /* TGS request where KDC wants to generate PAC
* but the principal is out of our realm */ * but the principal is out of our realm */
kerr = KRB5_KDB_NOENTRY; kerr = KRB5_KDB_NOENTRY;
@@ -1603,6 +1801,8 @@ krb5_error_code ipadb_get_principal(krb5_context kcontext,
krb5_db_entry **entry) krb5_db_entry **entry)
{ {
struct ipadb_context *ipactx; struct ipadb_context *ipactx;
bool is_local_tgs_princ;
const char *opt_pac_tkt_chksum_val;
krb5_error_code kerr; krb5_error_code kerr;
*entry = NULL; *entry = NULL;
@@ -1618,11 +1818,50 @@ krb5_error_code ipadb_get_principal(krb5_context kcontext,
/* Lookup local names and aliases first. */ /* Lookup local names and aliases first. */
kerr = dbget_princ(kcontext, ipactx, search_for, flags, entry); kerr = dbget_princ(kcontext, ipactx, search_for, flags, entry);
if (kerr != KRB5_KDB_NOENTRY) { if (kerr == KRB5_KDB_NOENTRY) {
kerr = dbget_alias(kcontext, ipactx, search_for, flags, entry);
}
if (kerr)
return kerr; return kerr;
/* If TGS principal, some virtual attributes may be added */
if (is_tgs_princ(kcontext, (*entry)->princ)) {
kerr = cmp_local_tgs_princ(kcontext, ipactx->realm, (*entry)->princ,
&is_local_tgs_princ);
if (kerr)
return kerr;
/* for trusted AD forests we currently must use SHA-1-based
* encryption types. For details, see
* https://github.com/krb5/krb5/commit/5af907156f8f502bbe268f0c62274f88a61261e4
*/
if (!is_local_tgs_princ) {
kerr = krb5_dbe_set_string(kcontext, *entry,
KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE,
"aes256-sha1");
if (kerr)
return kerr;
}
/* We should have been initialized at this point already */
if (ipactx->optional_pac_tkt_chksum == IPADB_TRISTATE_UNDEFINED) {
return KRB5_KDB_SERVER_INTERNAL_ERR;
}
/* PAC ticket signature should be optional for foreign realms, and local
* realm if not supported by all servers
*/
if (!is_local_tgs_princ || ipactx->optional_pac_tkt_chksum)
opt_pac_tkt_chksum_val = "true";
else
opt_pac_tkt_chksum_val = "false";
kerr = krb5_dbe_set_string(kcontext, *entry,
KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM,
opt_pac_tkt_chksum_val);
} }
return dbget_alias(kcontext, ipactx, search_for, flags, entry); return kerr;
} }
void ipadb_free_principal_e_data(krb5_context kcontext, krb5_octet *e_data) void ipadb_free_principal_e_data(krb5_context kcontext, krb5_octet *e_data)
@@ -1653,12 +1892,20 @@ void ipadb_free_principal_e_data(krb5_context kcontext, krb5_octet *e_data)
void ipadb_free_principal(krb5_context kcontext, krb5_db_entry *entry) void ipadb_free_principal(krb5_context kcontext, krb5_db_entry *entry)
{ {
krb5_tl_data *prev, *next; krb5_tl_data *prev, *next;
size_t i;
if (entry) { if (entry) {
krb5_free_principal(kcontext, entry->princ); krb5_free_principal(kcontext, entry->princ);
prev = entry->tl_data; prev = entry->tl_data;
while(prev) { while(prev) {
next = prev->tl_data_next; next = prev->tl_data_next;
/* Handle RBCD ACL type */
if (prev->tl_data_type == KRB5_TL_CONSTRAINED_DELEGATION_ACL) {
char **acl_list = (char **) prev->tl_data_contents;
for (i = 0; (acl_list != NULL) && (acl_list[i] != NULL); i++) {
free(acl_list[i]);
}
}
free(prev->tl_data_contents); free(prev->tl_data_contents);
free(prev); free(prev);
prev = next; prev = next;
@@ -1673,10 +1920,10 @@ void ipadb_free_principal(krb5_context kcontext, krb5_db_entry *entry)
} }
} }
static krb5_error_code ipadb_get_tl_data(krb5_db_entry *entry, krb5_error_code ipadb_get_tl_data(krb5_db_entry *entry,
krb5_int16 type, krb5_int16 type,
krb5_ui_2 length, krb5_ui_2 length,
krb5_octet *data) krb5_octet *data)
{ {
krb5_tl_data *td; krb5_tl_data *td;
@@ -1925,6 +2172,21 @@ done:
return kerr; return kerr;
} }
static bool should_filter_out_attr(krb5_tl_data *data)
{
switch (data->tl_data_type) {
case KRB5_TL_CONSTRAINED_DELEGATION_ACL:
case KRB5_TL_DB_ARGS:
case KRB5_TL_KADM_DATA:
case KRB5_TL_LAST_ADMIN_UNLOCK:
case KRB5_TL_LAST_PWD_CHANGE:
case KRB5_TL_MKVNO:
return true;
default:
return false;
}
}
static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods, static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods,
krb5_tl_data *tl_data, krb5_tl_data *tl_data,
int mod_op) int mod_op)
@@ -1936,13 +2198,8 @@ static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods,
int n, i; int n, i;
for (n = 0, data = tl_data; data; data = data->tl_data_next) { for (n = 0, data = tl_data; data; data = data->tl_data_next) {
if (data->tl_data_type == KRB5_TL_LAST_PWD_CHANGE || if (should_filter_out_attr(data))
data->tl_data_type == KRB5_TL_KADM_DATA ||
data->tl_data_type == KRB5_TL_DB_ARGS ||
data->tl_data_type == KRB5_TL_MKVNO ||
data->tl_data_type == KRB5_TL_LAST_ADMIN_UNLOCK) {
continue; continue;
}
n++; n++;
} }
@@ -1958,13 +2215,8 @@ static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods,
for (i = 0, data = tl_data; data; data = data->tl_data_next) { for (i = 0, data = tl_data; data; data = data->tl_data_next) {
if (data->tl_data_type == KRB5_TL_LAST_PWD_CHANGE || if (should_filter_out_attr(data))
data->tl_data_type == KRB5_TL_KADM_DATA ||
data->tl_data_type == KRB5_TL_DB_ARGS ||
data->tl_data_type == KRB5_TL_MKVNO ||
data->tl_data_type == KRB5_TL_LAST_ADMIN_UNLOCK) {
continue; continue;
}
be_type = htons(data->tl_data_type); be_type = htons(data->tl_data_type);
@@ -2716,10 +2968,43 @@ done:
return kerr; return kerr;
} }
static krb5_error_code
remove_virtual_str_attrs(krb5_context kcontext, krb5_db_entry *entry)
{
char *str_attr_val;
krb5_error_code kerr;
const char *str_attrs[] = {
KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM,
KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE,
NULL};
for(int i = 0; str_attrs[i] != NULL; i++) {
kerr = krb5_dbe_get_string(kcontext, entry,
str_attrs[i],
&str_attr_val);
if (kerr)
return kerr;
if (str_attr_val)
kerr = krb5_dbe_set_string(kcontext, entry,
str_attrs[i],
NULL);
krb5_dbe_free_string(kcontext, str_attr_val);
}
return kerr;
}
krb5_error_code ipadb_put_principal(krb5_context kcontext, krb5_error_code ipadb_put_principal(krb5_context kcontext,
krb5_db_entry *entry, krb5_db_entry *entry,
char **db_args) char **db_args)
{ {
krb5_error_code kerr;
kerr = remove_virtual_str_attrs(kcontext, entry);
if (kerr)
return kerr;
if (entry->mask & KMASK_PRINCIPAL) { if (entry->mask & KMASK_PRINCIPAL) {
return ipadb_add_principal(kcontext, entry); return ipadb_add_principal(kcontext, entry);
} else { } else {
daemons/ipa-kdb/tests/ipa_kdb_tests.c
+7 -7
View File
@@ -178,7 +178,7 @@ static int teardown(void **state)
extern krb5_error_code filter_logon_info(krb5_context context, extern krb5_error_code filter_logon_info(krb5_context context,
TALLOC_CTX *memctx, TALLOC_CTX *memctx,
krb5_data realm, krb5_data *realm,
struct PAC_LOGON_INFO_CTR *info); struct PAC_LOGON_INFO_CTR *info);
static void test_filter_logon_info(void **state) static void test_filter_logon_info(void **state)
@@ -204,7 +204,7 @@ static void test_filter_logon_info(void **state)
"WRONG"); "WRONG");
assert_non_null(info->info->info3.base.logon_domain.string); assert_non_null(info->info->info3.base.logon_domain.string);
kerr = filter_logon_info(test_ctx->krb5_ctx, test_ctx, realm, info); kerr = filter_logon_info(test_ctx->krb5_ctx, test_ctx, &realm, info);
assert_int_equal(kerr, EINVAL); assert_int_equal(kerr, EINVAL);
info->info->info3.base.logon_domain.string = talloc_strdup(info->info, info->info->info3.base.logon_domain.string = talloc_strdup(info->info,
@@ -212,7 +212,7 @@ static void test_filter_logon_info(void **state)
assert_non_null(info->info->info3.base.logon_domain.string); assert_non_null(info->info->info3.base.logon_domain.string);
/* missing domain SID */ /* missing domain SID */
kerr = filter_logon_info(test_ctx->krb5_ctx, test_ctx, realm, info); kerr = filter_logon_info(test_ctx->krb5_ctx, test_ctx, &realm, info);
assert_int_equal(kerr, EINVAL); assert_int_equal(kerr, EINVAL);
/* wrong domain SID */ /* wrong domain SID */
@@ -220,7 +220,7 @@ static void test_filter_logon_info(void **state)
assert_int_equal(ret, 0); assert_int_equal(ret, 0);
info->info->info3.base.domain_sid = &dom_sid; info->info->info3.base.domain_sid = &dom_sid;
kerr = filter_logon_info(test_ctx->krb5_ctx, test_ctx, realm, info); kerr = filter_logon_info(test_ctx->krb5_ctx, test_ctx, &realm, info);
assert_int_equal(kerr, EINVAL); assert_int_equal(kerr, EINVAL);
/* matching domain SID */ /* matching domain SID */
@@ -228,7 +228,7 @@ static void test_filter_logon_info(void **state)
assert_int_equal(ret, 0); assert_int_equal(ret, 0);
info->info->info3.base.domain_sid = &dom_sid; info->info->info3.base.domain_sid = &dom_sid;
kerr = filter_logon_info(test_ctx->krb5_ctx, test_ctx, realm, info); kerr = filter_logon_info(test_ctx->krb5_ctx, test_ctx, &realm, info);
assert_int_equal(kerr, 0); assert_int_equal(kerr, 0);
/* empty SIDs */ /* empty SIDs */
@@ -243,7 +243,7 @@ static void test_filter_logon_info(void **state)
assert_non_null(info->info->info3.sids[c].sid); assert_non_null(info->info->info3.sids[c].sid);
} }
kerr = filter_logon_info(test_ctx->krb5_ctx, NULL, realm, info); kerr = filter_logon_info(test_ctx->krb5_ctx, NULL, &realm, info);
assert_int_equal(kerr, 0); assert_int_equal(kerr, 0);
assert_int_equal(info->info->info3.sidcount, 3); assert_int_equal(info->info->info3.sidcount, 3);
@@ -297,7 +297,7 @@ static void test_filter_logon_info(void **state)
assert_int_equal(ret, 0); assert_int_equal(ret, 0);
} }
kerr = filter_logon_info(test_ctx->krb5_ctx, NULL, realm, info); kerr = filter_logon_info(test_ctx->krb5_ctx, NULL, &realm, info);
assert_int_equal(kerr, 0); assert_int_equal(kerr, 0);
assert_int_equal(info->info->info3.sidcount, test_data[c].exp_sidcount); assert_int_equal(info->info->info3.sidcount, test_data[c].exp_sidcount);
if (test_data[c].exp_sidcount == 0) { if (test_data[c].exp_sidcount == 0) {
daemons/ipa-otpd/Makefile.am
+2 -2
View File
@@ -1,6 +1,6 @@
AM_CPPFLAGS := -I$(top_srcdir)/util AM_CPPFLAGS := -I$(top_srcdir)/util
AM_CFLAGS := @LDAP_CFLAGS@ @LIBVERTO_CFLAGS@ @KRB5_CFLAGS@ @NSPR_CFLAGS@ AM_CFLAGS := @LDAP_CFLAGS@ @LIBVERTO_CFLAGS@ @KRB5_CFLAGS@ @NSPR_CFLAGS@
AM_LDFLAGS := @LDAP_LIBS@ @LIBVERTO_LIBS@ @KRAD_LIBS@ @KRB5_LIBS@ AM_LDFLAGS := @LDAP_LIBS@ @LIBVERTO_LIBS@ @KRAD_LIBS@ @KRB5_LIBS@ @JANSSON_LIBS@
noinst_HEADERS = internal.h noinst_HEADERS = internal.h
appdir = $(libexecdir)/ipa/ appdir = $(libexecdir)/ipa/
@@ -10,7 +10,7 @@ dist_noinst_DATA = ipa-otpd.socket.in ipa-otpd@.service.in test.py
systemdsystemunit_DATA = ipa-otpd.socket ipa-otpd@.service systemdsystemunit_DATA = ipa-otpd.socket ipa-otpd@.service
ipa_otpd_SOURCES = bind.c forward.c main.c parse.c query.c queue.c stdio.c \ ipa_otpd_SOURCES = bind.c forward.c main.c parse.c query.c queue.c stdio.c \
oauth2.c oauth2.c passkey.c
%.socket: %.socket.in %.socket: %.socket.in
@sed -e 's|@krb5rundir[@]|$(krb5rundir)|g' \ @sed -e 's|@krb5rundir[@]|$(krb5rundir)|g' \
daemons/ipa-otpd/internal.h
+32
View File
@@ -24,6 +24,8 @@
#include "krad.h" #include "krad.h"
#include <stdbool.h>
#include <ldap.h> #include <ldap.h>
#include <errno.h> #include <errno.h>
@@ -49,6 +51,7 @@ enum ldap_query {
LDAP_QUERY_RADIUS, LDAP_QUERY_RADIUS,
LDAP_QUERY_RADIUS_USERMAP, LDAP_QUERY_RADIUS_USERMAP,
LDAP_QUERY_IDP, LDAP_QUERY_IDP,
LDAP_QUERY_PASSKEY,
LDAP_QUERY_END LDAP_QUERY_END
}; };
@@ -59,6 +62,8 @@ enum oauth2_state {
OAUTH2_GET_ACCESS_TOKEN OAUTH2_GET_ACCESS_TOKEN
}; };
struct otpd_queue_item_passkey;
struct otpd_queue_item { struct otpd_queue_item {
struct otpd_queue_item *next; struct otpd_queue_item *next;
krad_packet *req; krad_packet *req;
@@ -74,6 +79,7 @@ struct otpd_queue_item {
char *ipatokenRadiusConfigLink; char *ipatokenRadiusConfigLink;
char *ipaidpSub; char *ipaidpSub;
char *ipaidpConfigLink; char *ipaidpConfigLink;
char **ipaPassKey;
char **ipauserauthtypes; char **ipauserauthtypes;
char *other; char *other;
} user; } user;
@@ -107,6 +113,9 @@ struct otpd_queue_item {
krb5_data state; krb5_data state;
} oauth2; } oauth2;
bool get_passkey_config;
struct otpd_queue_item_passkey *passkey;
int msgid; int msgid;
}; };
@@ -161,9 +170,25 @@ void otpd_log_req_(const char * const file, int line, krad_packet *req,
void otpd_log_err_(const char * const file, int line, krb5_error_code code, void otpd_log_err_(const char * const file, int line, krb5_error_code code,
const char * const tmpl, ...); const char * const tmpl, ...);
int add_krad_attr_to_set(krad_packet *req, krad_attrset *attrset,
krb5_data *datap, krad_attr attr, const char *message);
int get_krad_attr_from_packet(const krad_packet *rres,
krad_attr attr, krb5_data *_data);
int get_string(LDAP *ldp, LDAPMessage *entry, const char *name,
char **out);
int get_string_array(LDAP *ldp, LDAPMessage *entry, const char *name,
char ***out);
bool auth_type_is(char **auth_types, const char *check);
krb5_error_code otpd_queue_item_new(krad_packet *req, krb5_error_code otpd_queue_item_new(krad_packet *req,
struct otpd_queue_item **item); struct otpd_queue_item **item);
void free_otpd_queue_item_passkey(struct otpd_queue_item *item);
void otpd_queue_item_free(struct otpd_queue_item *item); void otpd_queue_item_free(struct otpd_queue_item *item);
krb5_error_code otpd_queue_iter_new(const struct otpd_queue * const *queues, krb5_error_code otpd_queue_iter_new(const struct otpd_queue * const *queues,
@@ -206,3 +231,10 @@ const char *otpd_parse_radius_username(LDAP *ldp, LDAPMessage *entry,
struct otpd_queue_item *item); struct otpd_queue_item *item);
int oauth2(struct otpd_queue_item **item, enum oauth2_state); int oauth2(struct otpd_queue_item **item, enum oauth2_state);
const char *otpd_parse_passkey(LDAP *ldp, LDAPMessage *entry,
struct otpd_queue_item *item);
bool is_passkey(struct otpd_queue_item *item);
int do_passkey(struct otpd_queue_item *item);
daemons/ipa-otpd/ipa-otpd@.service.in
+1 -1
View File
@@ -7,4 +7,4 @@ EnvironmentFile=@sysconfdir@/ipa/default.conf
ExecStart=@libexecdir@/ipa/ipa-otpd $ldap_uri ExecStart=@libexecdir@/ipa/ipa-otpd $ldap_uri
StandardInput=socket StandardInput=socket
StandardOutput=socket StandardOutput=socket
StandardError=syslog StandardError=journal
daemons/ipa-otpd/ipa_otpd_queue_cmocka_tests.c
+12 -6
View File
@@ -59,6 +59,12 @@ static void free_elts(struct otpd_queue *q)
#define otpd_queue_item_free free_elt #define otpd_queue_item_free free_elt
#define otpd_queue_free_items free_elts #define otpd_queue_free_items free_elts
void free_otpd_queue_item_passkey(struct otpd_queue_item *item)
{
(void)item; /* Unused */
return;
}
static void assert_elt_equal(struct otpd_queue_item *e1, static void assert_elt_equal(struct otpd_queue_item *e1,
struct otpd_queue_item *e2) struct otpd_queue_item *e2)
{ {
@@ -69,7 +75,7 @@ static void assert_elt_equal(struct otpd_queue_item *e1,
assert_int_equal(e1->msgid, e2->msgid); assert_int_equal(e1->msgid, e2->msgid);
} }
static void test_single_insert() static void test_single_insert(void **state)
{ {
struct otpd_queue q = { NULL }; struct otpd_queue q = { NULL };
struct otpd_queue_item *ein, *eout; struct otpd_queue_item *ein, *eout;
@@ -90,7 +96,7 @@ static void test_single_insert()
free_elts(&q); free_elts(&q);
} }
static void test_jump_insert() static void test_jump_insert(void **state)
{ {
struct otpd_queue q = { NULL }; struct otpd_queue q = { NULL };
struct otpd_queue_item *echeck; struct otpd_queue_item *echeck;
@@ -106,7 +112,7 @@ static void test_jump_insert()
free_elts(&q); free_elts(&q);
} }
static void test_garbage_insert() static void test_garbage_insert(void **state)
{ {
struct otpd_queue q = { NULL }; struct otpd_queue q = { NULL };
struct otpd_queue_item *e, *g; struct otpd_queue_item *e, *g;
@@ -121,7 +127,7 @@ static void test_garbage_insert()
free_elts(&q); free_elts(&q);
} }
static void test_removal() static void test_removal(void **state)
{ {
struct otpd_queue q = { NULL }; struct otpd_queue q = { NULL };
@@ -149,7 +155,7 @@ static void pick_id(struct otpd_queue *q, int msgid)
e = otpd_queue_pop_msgid(q, msgid); e = otpd_queue_pop_msgid(q, msgid);
assert_ptr_equal(e, NULL); assert_ptr_equal(e, NULL);
} }
static void test_pick_removal() static void test_pick_removal(void **state)
{ {
struct otpd_queue q = { NULL }; struct otpd_queue q = { NULL };
@@ -166,7 +172,7 @@ static void test_pick_removal()
free_elts(&q); free_elts(&q);
} }
static void test_iter() static void test_iter(void **state)
{ {
krb5_error_code ret; krb5_error_code ret;
struct otpd_queue q = { NULL }; struct otpd_queue q = { NULL };
daemons/ipa-otpd/main.c
+74
View File
@@ -88,6 +88,80 @@ void otpd_log_err_(const char * const file, int line, krb5_error_code code,
fprintf(stderr, "\n"); fprintf(stderr, "\n");
} }
#define min(a,b) ((a) > (b) ? (b) : (a))
int add_krad_attr_to_set(krad_packet *req, krad_attrset *attrset,
krb5_data *datap, krad_attr attr, const char *message)
{
krb5_data state = {0};
char *p = datap->data;
unsigned int len = datap->length;
int ret = 0;
do {
state.data = p;
state.length = min(MAX_ATTRSIZE - 5, len);
p += state.length;
ret = krad_attrset_add(attrset, attr, &(state));
if (ret != 0) {
otpd_log_req(req, message);
break;
}
len -= state.length;
} while (len > 0);
return ret;
}
/* Most attributes have limited length (MAX_ATTRSIZE). In order to accept longer
* values, we will concatenate all the attribute values to single krb5_data. */
int get_krad_attr_from_packet(const krad_packet *rres,
krad_attr attr, krb5_data *_data)
{
const krb5_data *rmsg;
krb5_data data = {0};
unsigned int memindex;
unsigned int i;
i = 0;
do {
rmsg = krad_packet_get_attr(rres, attr, i);
if (rmsg != NULL) {
data.length += rmsg->length;
}
i++;
} while (rmsg != NULL);
if (data.length == 0) {
return ENOENT;
}
data.data = malloc(data.length);
if (data.data == NULL) {
return ENOMEM;
}
i = 0;
memindex = 0;
do {
rmsg = krad_packet_get_attr(rres, attr, i);
if (rmsg != NULL) {
memcpy(&data.data[memindex], rmsg->data, rmsg->length);
memindex += rmsg->length;
}
i++;
} while (rmsg != NULL);
if (memindex != data.length) {
free(data.data);
return ERANGE;
}
*_data = data;
return 0;
}
static void on_ldap_free(verto_ctx *vctx, verto_ev *ev) static void on_ldap_free(verto_ctx *vctx, verto_ev *ev)
{ {
(void)vctx; /* Unused */ (void)vctx; /* Unused */
daemons/ipa-otpd/oauth2.c
+8 -81
View File
@@ -135,82 +135,6 @@ static void oauth2_on_child_writable(verto_ctx *vctx, verto_ev *ev)
verto_del(ev); verto_del(ev);
} }
#define min(a,b) ((a) > (b) ? (b) : (a))
static int add_krad_attr_to_set(struct child_ctx *child_ctx,
krad_attrset *attrset,
krb5_data *datap,
krad_attr attr, const char *message)
{
krb5_data state = {0};
char *p = datap->data;
unsigned int len = datap->length;
int ret = 0;
do {
state.data = p;
state.length = min(MAX_ATTRSIZE - 5, len);
p += state.length;
ret = krad_attrset_add(attrset, attr, &(state));
if (ret != 0) {
otpd_log_req(child_ctx->item->req, message);
break;
}
len -= state.length;
} while (len > 0);
return ret;
}
/* Most attributes have limited length (MAX_ATTRSIZE). In order to accept longer
* values, we will concatenate all the attribute values to single krb5_data. */
static int get_krad_attr_from_packet(const krad_packet *rres,
krad_attr attr, krb5_data *_data)
{
const krb5_data *rmsg;
krb5_data data = {0};
unsigned int memindex;
unsigned int i;
i = 0;
do {
rmsg = krad_packet_get_attr(rres, attr, i);
if (rmsg != NULL) {
data.length += rmsg->length;
}
i++;
} while (rmsg != NULL);
if (data.length == 0) {
return ENOENT;
}
data.data = malloc(data.length);
if (data.data == NULL) {
return ENOMEM;
}
i = 0;
memindex = 0;
do {
rmsg = krad_packet_get_attr(rres, attr, i);
if (rmsg != NULL) {
memcpy(&data.data[memindex], rmsg->data, rmsg->length);
memindex += rmsg->length;
}
i++;
} while (rmsg != NULL);
if (memindex != data.length) {
free(data.data);
return ERANGE;
}
*_data = data;
return 0;
}
/* oidc_child will return two lines. /* oidc_child will return two lines.
* The first is a JSON formatted string containing the device code and other * The first is a JSON formatted string containing the device code and other
* data needed to get the access token in the second round. This will be * data needed to get the access token in the second round. This will be
@@ -225,7 +149,7 @@ static int handle_device_code_reply(struct child_ctx *child_ctx,
krad_attrset *attrset = NULL; krad_attrset *attrset = NULL;
int ret; int ret;
krb5_data data = { 0 }; krb5_data data = { 0 };
struct otpd_queue_item *state_item; struct otpd_queue_item *state_item = NULL;
ret = otpd_queue_item_new(NULL, &state_item); ret = otpd_queue_item_new(NULL, &state_item);
if (ret != 0) { if (ret != 0) {
@@ -256,7 +180,8 @@ static int handle_device_code_reply(struct child_ctx *child_ctx,
} }
state_item->oauth2.state.length = strlen(dc_reply); state_item->oauth2.state.length = strlen(dc_reply);
ret = add_krad_attr_to_set(child_ctx, attrset, &(state_item->oauth2.state), ret = add_krad_attr_to_set(child_ctx->item->req,
attrset, &(state_item->oauth2.state),
krad_attr_name2num("Proxy-State"), krad_attr_name2num("Proxy-State"),
"Failed to serialize state to attribute set"); "Failed to serialize state to attribute set");
if (ret != 0) { if (ret != 0) {
@@ -266,7 +191,7 @@ static int handle_device_code_reply(struct child_ctx *child_ctx,
data.magic = 0; data.magic = 0;
data.data = rad_reply; data.data = rad_reply;
data.length = strlen(rad_reply); data.length = strlen(rad_reply);
ret = add_krad_attr_to_set(child_ctx, attrset, &data, ret = add_krad_attr_to_set(child_ctx->item->req, attrset, &data,
krad_attr_name2num("Reply-Message"), krad_attr_name2num("Reply-Message"),
"Failed to serialize reply to attribute set"); "Failed to serialize reply to attribute set");
if (ret != 0) { if (ret != 0) {
@@ -319,7 +244,7 @@ static int check_access_token_reply(struct child_ctx *child_ctx,
return ret; return ret;
} }
static void oauth2_on_child_readable(verto_ctx *, verto_ev *ev) static void oauth2_on_child_readable(verto_ctx *vctx, verto_ev *ev)
{ {
static char buf[10240]; static char buf[10240];
ssize_t io = 0; ssize_t io = 0;
@@ -328,6 +253,8 @@ static void oauth2_on_child_readable(verto_ctx *, verto_ev *ev)
char *rad_reply; char *rad_reply;
char *end; char *end;
(void) vctx; /* Unused */
child_ctx = (struct child_ctx *) verto_get_private(ev); child_ctx = (struct child_ctx *) verto_get_private(ev);
if (child_ctx == NULL) { if (child_ctx == NULL) {
otpd_log_err(EINVAL, "Lost child context"); otpd_log_err(EINVAL, "Lost child context");
@@ -426,7 +353,7 @@ int oauth2(struct otpd_queue_item **item, enum oauth2_state oauth2_state)
char *args[50] = {NULL}; char *args[50] = {NULL};
size_t args_idx = 0; size_t args_idx = 0;
krb5_data data_state = {0}; krb5_data data_state = {0};
struct otpd_queue_item *saved_item; struct otpd_queue_item *saved_item = NULL;
if (oauth2_state != OAUTH2_GET_DEVICE_CODE if (oauth2_state != OAUTH2_GET_DEVICE_CODE
&& oauth2_state != OAUTH2_GET_ACCESS_TOKEN) { && oauth2_state != OAUTH2_GET_ACCESS_TOKEN) {
daemons/ipa-otpd/parse.c
+10 -5
View File
@@ -34,8 +34,8 @@
#define DEFAULT_RETRIES 3 #define DEFAULT_RETRIES 3
/* Convert an LDAP entry into an allocated string. */ /* Convert an LDAP entry into an allocated string. */
static int get_string(LDAP *ldp, LDAPMessage *entry, const char *name, int get_string(LDAP *ldp, LDAPMessage *entry, const char *name,
char **out) char **out)
{ {
struct berval **vals; struct berval **vals;
ber_len_t i; ber_len_t i;
@@ -69,12 +69,12 @@ static int get_string(LDAP *ldp, LDAPMessage *entry, const char *name,
} }
/* Convert an LDAP entry into an allocated string array. */ /* Convert an LDAP entry into an allocated string array. */
static int get_string_array(LDAP *ldp, LDAPMessage *entry, const char *name, int get_string_array(LDAP *ldp, LDAPMessage *entry, const char *name,
char ***out) char ***out)
{ {
struct berval **vals; struct berval **vals;
ber_len_t i; ber_len_t i;
char **buf; char **buf = NULL;
int tmp; int tmp;
size_t count; size_t count;
size_t c; size_t c;
@@ -188,6 +188,11 @@ const char *otpd_parse_user(LDAP *ldp, LDAPMessage *entry,
if (i != 0 && i != ENOENT) if (i != 0 && i != ENOENT)
return strerror(i); return strerror(i);
i = get_string_array(ldp, entry, "ipaPassKey",
&item->user.ipaPassKey);
if (i != 0 && i != ENOENT)
return strerror(i);
i = get_string_array(ldp, entry, "ipauserauthtype", i = get_string_array(ldp, entry, "ipauserauthtype",
&item->user.ipauserauthtypes); &item->user.ipauserauthtypes);
if (i != 0 && i != ENOENT) if (i != 0 && i != ENOENT)
daemons/ipa-otpd/passkey.c
+824
View File
@@ -0,0 +1,824 @@
/*
* FreeIPA 2FA companion daemon
*
* Authors: Sumit Bose <sbose@redhat.com>
*
* Copyright (C) 2022 Sumit Bose, Red Hat
* see file 'COPYING' for use and warranty information
*
* This program is free software you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
* This file contains various helper functions for the passkey feature.
*/
#define _GNU_SOURCE /* for asprintf() */
#include <stdio.h>
#include <fcntl.h>
#include <jansson.h>
#include <openssl/rand.h>
#include <openssl/evp.h>
#include "internal.h"
struct passkey_data {
int phase;
char *state;
union {
struct passkey_challenge {
char *domain;
json_t *credential_id_list;
int user_verification;
unsigned char *cryptographic_challenge;
} challenge;
struct sss_passkey_reply {
char *credential_id;
char *cryptographic_challenge;
char *authenticator_data;
char *assertion_signature;
char *user_id;
} response;
} data;
json_t *jdata;
json_t *jroot;
};
struct otpd_queue_item_passkey {
char *domain;
char *ipaRequireUserVerification;
struct passkey_data *data_in;
struct passkey_data *data_out;
krb5_data state;
char* ipapasskeyDebugLevelStr;
krb5_boolean ipapasskeyDebugFido2;
};
static void free_passkey_data(struct passkey_data *p)
{
if (p == NULL) {
return;
}
if (p->phase == 1) {
free(p->data.challenge.domain);
free(p->data.challenge.cryptographic_challenge);
}
json_decref(p->jdata);
json_decref(p->jroot);
free(p);
}
void free_otpd_queue_item_passkey(struct otpd_queue_item *item)
{
if (item == NULL || item->passkey == NULL) {
return;
}
free(item->passkey->domain);
free(item->passkey->ipaRequireUserVerification);
free_passkey_data(item->passkey->data_in);
free_passkey_data(item->passkey->data_out);
free(item->passkey);
}
static struct otpd_queue_item_passkey *get_otpd_queue_item_passkey(void)
{
struct otpd_queue_item_passkey *p;
p = calloc(1, sizeof(struct otpd_queue_item_passkey));
if (p == NULL) {
return NULL;
}
p->data_in = calloc(1, sizeof(struct passkey_data));
if (p->data_in == NULL) {
free(p);
return NULL;
}
p->data_out = calloc(1, sizeof(struct passkey_data));
if (p->data_out == NULL) {
free(p->data_in);
free(p);
return NULL;
}
p->data_in->phase = -1;
p->data_out->phase = -1;
return p;
}
#define PASSKEY_PREFIX "passkey "
#define ENV_PASSKEY_CHILD_DEBUG_LEVEL "passkey_child_debug_level"
/* Parse the passkey configuration */
const char *otpd_parse_passkey(LDAP *ldp, LDAPMessage *entry,
struct otpd_queue_item *item)
{
int i;
char **objectclasses = NULL;
long dbg_lvl = 0;
const char *dbg_env = NULL;
char *endptr = NULL;
if (item->passkey == NULL) {
otpd_log_req(item->req,
"Missing passkey struct to store passkey configuration");
return strerror(EINVAL);
}
while (entry != NULL) {
i = get_string_array(ldp, entry, "objectclass", &objectclasses);
if (i != 0) {
return strerror(i);
}
if (auth_type_is(objectclasses, "ipapasskeyconfigobject")) {
free(objectclasses);
i = get_string(ldp, entry, "ipaRequireUserVerification",
&item->passkey->ipaRequireUserVerification);
if ((i != 0) && (i != ENOENT)) {
return strerror(i);
}
} else if (auth_type_is(objectclasses, "domainRelatedObject")) {
free(objectclasses);
i = get_string(ldp, entry, "associatedDomain",
&item->passkey->domain);
if ((i != 0) && (i != ENOENT)) {
return strerror(i);
}
}
entry = ldap_next_entry(ldp, entry);
};
item->passkey->ipapasskeyDebugLevelStr = NULL;
item->passkey->ipapasskeyDebugFido2 = FALSE;
dbg_env = getenv(ENV_PASSKEY_CHILD_DEBUG_LEVEL);
if (dbg_env != NULL && *dbg_env != '\0') {
errno = 0;
dbg_lvl = strtoul(dbg_env, &endptr, 10);
if (errno == 0 && *endptr == '\0') {
if (dbg_lvl < 0) {
dbg_lvl = 0;
} else if (dbg_lvl > 10) {
dbg_lvl = 10;
}
if (asprintf(&item->passkey->ipapasskeyDebugLevelStr, "%ld",
dbg_lvl) != -1) {
if (dbg_lvl > 5) {
item->passkey->ipapasskeyDebugFido2 = TRUE;
}
} else {
otpd_log_req(item->req, "Failed to copy debug level");
}
} else {
otpd_log_req(item->req,
"Cannot parse value [%s] from environment variable [%s]",
dbg_env, ENV_PASSKEY_CHILD_DEBUG_LEVEL);
}
}
return NULL;
}
static int decode_json(const char *inp, size_t size, struct passkey_data *data)
{
json_error_t jret;
int ret;
data->jroot = json_loadb(inp, size, 0, &jret);
if (data->jroot == NULL) {
return EINVAL;
}
data->jdata = NULL;
data->phase = -1;
ret = json_unpack(data->jroot, "{s:i, s?:s, s?:o}",
"phase", &data->phase,
"state", &data->state,
"data", &data->jdata);
if (ret != 0) {
ret = EINVAL;
goto done;
}
switch (data->phase) {
case 0: /* SSS_PASSKEY_PHASE_INIT */
/* no data */
if (data->jdata != NULL) {
ret = EINVAL;
} else {
ret = 0;
}
break;
case 2: /* SSS_PASSKEY_PHASE_REPLY */
ret = json_unpack(data->jdata, "{s:s, s:s, s:s, s:s}",
"credential_id", &data->data.response.credential_id,
"cryptographic_challenge", &data->data.response.cryptographic_challenge,
"authenticator_data", &data->data.response.authenticator_data,
"assertion_signature", &data->data.response.assertion_signature,
"user_id", &data->data.response.user_id);
break;
default:
ret = EINVAL;
}
done:
if (ret != 0) {
json_decref(data->jdata);
data->jdata = NULL;
json_decref(data->jroot);
data->jroot = NULL;
}
return ret;
}
static int passkey_parse_data(const char *data, size_t size, struct otpd_queue_item *item)
{
item->passkey = get_otpd_queue_item_passkey();
if (item->passkey == NULL) {
return ENOMEM;
}
return decode_json(data, size, item->passkey->data_in);
}
bool is_passkey(struct otpd_queue_item *item)
{
const krb5_data *data_pwd;
krb5_data data_state = { 0 };
int ret;
if (item->passkey != NULL) {
return true;
}
data_pwd = krad_packet_get_attr(item->req,
krad_attr_name2num("User-Password"), 0);
ret = get_krad_attr_from_packet(item->req,
krad_attr_name2num("Proxy-State"),
&data_state);
if (data_pwd == NULL && ret == 0
&& data_state.length > strlen(PASSKEY_PREFIX)
&& strncmp(data_state.data, PASSKEY_PREFIX,
strlen(PASSKEY_PREFIX)) == 0
&& (item->user.ipauserauthtypes == NULL
|| item->user.ipauserauthtypes[0] == NULL
|| *(item->user.ipauserauthtypes[0]) == '\0'
|| auth_type_is(item->user.ipauserauthtypes, "passkey"))) {
ret = passkey_parse_data(data_state.data + strlen(PASSKEY_PREFIX),
data_state.length - strlen(PASSKEY_PREFIX) - 1,
item);
krb5_free_data_contents(NULL, &data_state);
if (ret != 0) {
return false;
}
return true;
}
return false;
}
#define PK_PREF "passkey:"
static json_t *ipa_passkey_to_json_array(char **ipa_passkey)
{
int ret;
const char *sep;
char *start;
size_t c;
json_t *ja = NULL;
json_t *js;
if (ipa_passkey == NULL || *ipa_passkey == NULL) {
return NULL;
}
ja = json_array();
if (ja == NULL) {
return NULL;
}
for (c = 0; ipa_passkey[c] != NULL; c++) {
if (strncmp(ipa_passkey[c], PK_PREF, strlen(PK_PREF)) != 0) {
otpd_log_err(ret, "Missing prefix in [%s]", ipa_passkey[c]);
continue;
}
start = ipa_passkey[c] + strlen(PK_PREF);
sep = strchr(start, ',');
if (sep == NULL || sep == start) {
otpd_log_err(ret, "Missing seperator in [%s]", ipa_passkey[c]);
continue;
}
js = json_stringn(start, sep - start);
if (js == NULL) {
ret = ENOMEM;
goto done;
}
ret = json_array_append_new(ja, js);
if (ret != 0) {
goto done;
}
}
done:
if (ret != 0) {
json_decref(ja);
return NULL;
}
return ja;
}
/* passkey string:
* key_handle,public_key(,optional_user_id)
*/
static char *ipa_passkey_get_public_key(char **ipa_passkey, const char *key_id)
{
char *sep;
char *sep2;
size_t c;
char *start;
if (ipa_passkey == NULL || *ipa_passkey == NULL
|| key_id == NULL || *key_id == '\0') {
return NULL;
}
for (c = 0; ipa_passkey[c] != NULL; c++) {
if (strncmp(ipa_passkey[c], PK_PREF, strlen(PK_PREF)) != 0) {
otpd_log_err(EINVAL, "Missing prefix in [%s]", ipa_passkey[c]);
continue;
}
start = ipa_passkey[c] + strlen(PK_PREF);
sep = strchr(start, ',');
if (sep == NULL || sep == start) {
otpd_log_err(EINVAL, "Missing seperator in [%s]", ipa_passkey[c]);
continue;
}
if (strncmp(start, key_id, sep - start) == 0) {
sep2 = strchrnul(sep + 1, ',');
if (sep2 == sep + 1) {
return NULL;
}
*sep2 = '\0';
return (sep + 1);
}
}
return NULL;
}
#define CHALLENGE_LENGTH 32
static unsigned char *get_b64_challenge(void)
{
int ret;
unsigned char buf[CHALLENGE_LENGTH];
unsigned char *b64;
ret = RAND_bytes(buf, CHALLENGE_LENGTH);
if (ret != 1) {
return NULL;
}
b64 = calloc(1, 2 * CHALLENGE_LENGTH);
if (b64 == NULL) {
return NULL;
}
ret = EVP_EncodeBlock(b64, buf, CHALLENGE_LENGTH);
if (ret == 0) {
free(b64);
return NULL;
}
return b64;
}
static int prepare_rad_reply(struct otpd_queue_item *item)
{
krad_attrset *attrset = NULL;
int ret;
json_t *jtmp = NULL;
char *stmp = NULL;
krb5_data data = { 0 };
ret = krad_attrset_new(ctx.kctx, &attrset);
if (ret != 0) {
otpd_log_err(ret, "Failed to create radius attribute set");
goto done;
}
jtmp = json_pack("{s:i, s:s, s:o}", "phase", item->passkey->data_out->phase,
"state", item->passkey->data_out->state,
"data", item->passkey->data_out->jdata);
if (jtmp == NULL) {
ret = EIO;
otpd_log_err(ret, "Failed to pack JSON reply");
goto done;
}
stmp = json_dumps(jtmp, JSON_COMPACT);
if (stmp == NULL) {
ret = EIO;
otpd_log_err(ret, "Failed to dump JSON string");
goto done;
}
ret = asprintf(&(data.data), "passkey %s", stmp);
if (ret < 0) {
ret = ENOMEM;
otpd_log_err(ret, "Failed to generate reply string");
goto done;
}
data.length = strlen(data.data);
data.magic = 0;
ret = add_krad_attr_to_set(item->req, attrset, &data,
krad_attr_name2num("Proxy-State"),
"Failed to serialize state to attribute set");
if (ret != 0) {
otpd_log_err(ret, "Failed to add Proxy-State");
goto done;
}
ret = krad_packet_new_response(ctx.kctx, SECRET,
krad_code_name2num("Access-Challenge"),
attrset,
item->req, &item->rsp);
if (ret != 0) {
otpd_log_err(ret, "Failed to create radius response");
item->rsp = NULL;
}
ret = 0;
done:
krad_attrset_free(attrset);
free(stmp);
json_decref(jtmp);
if (ret != 0) {
free(data.data);
}
return ret;
}
static int do_passkey_challenge(struct otpd_queue_item *item)
{
unsigned char *challenge = NULL;
int ret;
struct passkey_data *d;
d = item->passkey->data_out;
d->data.challenge.credential_id_list = ipa_passkey_to_json_array(
item->user.ipaPassKey);
if (d->data.challenge.credential_id_list == NULL) {
return EINVAL;
}
/* Secure by default, assume user verification is enabled and disable it
* only if the option is set to 'false'. */
d->data.challenge.user_verification = 1;
if (item->passkey->ipaRequireUserVerification != NULL
&& strcasecmp(item->passkey->ipaRequireUserVerification,
"false") == 0) {
d->data.challenge.user_verification = 0;
}
d->data.challenge.cryptographic_challenge = get_b64_challenge();
if (d->data.challenge.cryptographic_challenge == NULL) {
ret = ENOMEM;
goto done;
}
d->jdata = json_pack("{s:s, s:o, s:i, s:s}",
"domain", item->passkey->domain,
"credential_id_list",
d->data.challenge.credential_id_list,
"user_verification",
d->data.challenge.user_verification,
"cryptographic_challenge",
d->data.challenge.cryptographic_challenge);
if (d->jdata == NULL) {
ret = EIO;
goto done;
}
d->phase = 1; /* SSS_PASSKEY_PHASE_CHALLENGE */
d->state = strdup("ipa_otpd state");
ret = prepare_rad_reply(item);
if (ret != 0) {
otpd_log_err(ret, "prepare_rad_reply() failed.");
goto done;
}
ret = 0;
done:
free(challenge);
otpd_queue_push(&ctx.stdio.responses, item);
verto_set_flags(ctx.stdio.writer, VERTO_EV_FLAG_PERSIST |
VERTO_EV_FLAG_IO_ERROR |
VERTO_EV_FLAG_IO_READ |
VERTO_EV_FLAG_IO_WRITE);
return ret;
}
struct child_ctx {
int read_from_child;
int write_to_child;
verto_ev *read_ev;
verto_ev *write_ev;
verto_ev *child_ev;
struct otpd_queue_item *item;
};
static void passkey_on_child_writable(verto_ctx *vctx, verto_ev *ev)
{
(void)vctx; /* Unused */
/* no input needed */
verto_del(ev);
return;
}
static void passkey_on_child_readable(verto_ctx *vctx, verto_ev *ev)
{
(void)vctx; /* Unused */
/* no output expected */
verto_del(ev);
return;
}
static void passkey_on_child_exit(verto_ctx *vctx, verto_ev *ev)
{
(void)vctx; /* Unused */
int ret;
verto_proc_status st;
struct child_ctx *child_ctx = NULL;
child_ctx = (struct child_ctx *) verto_get_private(ev);
if (child_ctx == NULL) {
otpd_log_err(EINVAL, "Lost child context");
verto_del(ev);
return;
}
/* Make sure ctx.stdio.responses will at least return an error */
child_ctx->item->rsp = NULL;
child_ctx->item->sent = 0;
st = verto_get_proc_status(ev);
if (!WIFEXITED(st)) {
otpd_log_err(0, "Child didn't exit normally.");
verto_del(ev);
goto done;
}
/* The krad req might not be available at this stage anymore, so
* otpd_log_err() is used. */
otpd_log_err(0, "Child finished with status [%d].", WEXITSTATUS(st));
verto_del(ev);
if (WEXITSTATUS(st) != 0) {
/* verification failed */
goto done;
}
ret = krad_packet_new_response(ctx.kctx, SECRET,
krad_code_name2num("Access-Accept"), NULL,
child_ctx->item->req, &child_ctx->item->rsp);
if (ret != 0) {
otpd_log_err(ret, "Failed to create radius response");
child_ctx->item->rsp = NULL;
}
done:
otpd_queue_push(&ctx.stdio.responses, child_ctx->item);
verto_set_flags(ctx.stdio.writer, VERTO_EV_FLAG_PERSIST |
VERTO_EV_FLAG_IO_ERROR |
VERTO_EV_FLAG_IO_READ |
VERTO_EV_FLAG_IO_WRITE);
}
static void free_child_ctx(verto_ctx *vctx, verto_ev *ev)
{
(void)vctx; /* Unused */
struct child_ctx *child_ctx;
child_ctx = verto_get_private(ev);
free(child_ctx);
}
static int set_fd_nonblocking(int fd)
{
int flags;
int ret;
flags = fcntl(fd, F_GETFL, 0);
if (flags == -1) {
ret = errno;
return ret;
}
if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
ret = errno;
return ret;
}
return 0;
}
#ifndef PASSKEY_CHILD_PATH
#define PASSKEY_CHILD_PATH "/usr/libexec/sssd/passkey_child"
#endif
static int do_passkey_response(struct otpd_queue_item *item)
{
int ret;
pid_t child_pid;
int pipefd_to_child[2] = { -1, -1};
int pipefd_from_child[2] = { -1, -1};
/* Up to 50 arguments to the helper supported. The amount of arguments
* is controlled inside this function. Right now max used is below 20 */
char *args[50] = {NULL};
size_t args_idx = 0;
struct child_ctx *child_ctx;
char *pk = NULL;
child_ctx = calloc(sizeof(struct child_ctx), 1);
if (child_ctx == NULL) {
ret = ENOMEM;
goto done;
}
child_ctx->item = item;
pk = ipa_passkey_get_public_key(item->user.ipaPassKey,
item->passkey->data_in->data.response.credential_id);
if (pk == NULL) {
ret = EINVAL;
otpd_log_err(ret, "No matching public key found for [%s]",
item->passkey->data_in->data.response.credential_id);
goto done;
}
args[args_idx++] = PASSKEY_CHILD_PATH;
args[args_idx++] = "--verify-assert";
args[args_idx++] = "--domain";
args[args_idx++] = item->passkey->domain;
args[args_idx++] = "--key-handle";
args[args_idx++] = item->passkey->data_in->data.response.credential_id;
args[args_idx++] = "--public-key";
args[args_idx++] = pk;
args[args_idx++] = "--cryptographic-challenge";
args[args_idx++] = item->passkey->data_in->data.response.cryptographic_challenge;
args[args_idx++] = "--auth-data";
args[args_idx++] = item->passkey->data_in->data.response.authenticator_data;
args[args_idx++] = "--signature";
args[args_idx++] = item->passkey->data_in->data.response.assertion_signature;
if (item->passkey->ipapasskeyDebugLevelStr != NULL) {
args[args_idx++] = "--debug-level";
args[args_idx++] = item->passkey->ipapasskeyDebugLevelStr;
}
if (item->passkey->ipapasskeyDebugFido2) {
args[args_idx++] = "--debug-libfido2";
}
ret = pipe(pipefd_from_child);
if (ret == -1) {
ret = errno;
goto done;
}
ret = pipe(pipefd_to_child);
if (ret == -1) {
ret = errno;
goto done;
}
child_pid = fork();
if (child_pid == 0) { /* child */
close(pipefd_to_child[1]);
ret = dup2(pipefd_to_child[0], STDIN_FILENO);
if (ret == -1) {
exit(EXIT_FAILURE);
}
close(pipefd_from_child[0]);
ret = dup2(pipefd_from_child[1], STDOUT_FILENO);
if (ret == -1) {
exit(EXIT_FAILURE);
}
execv(args[0], args);
exit(EXIT_FAILURE);
} else if (child_pid > 0) { /* parent */
close(pipefd_to_child[0]);
set_fd_nonblocking(pipefd_to_child[1]);
child_ctx->write_to_child = pipefd_to_child[1];
close(pipefd_from_child[1]);
set_fd_nonblocking(pipefd_from_child[0]);
child_ctx->read_from_child = pipefd_from_child[0];
child_ctx->write_ev = verto_add_io(ctx.vctx, VERTO_EV_FLAG_PERSIST |
VERTO_EV_FLAG_IO_CLOSE_FD |
VERTO_EV_FLAG_IO_ERROR |
VERTO_EV_FLAG_IO_WRITE,
passkey_on_child_writable,
child_ctx->write_to_child);
if (child_ctx->write_ev == NULL) {
ret = ENOMEM;
otpd_log_err(ret, "Unable to initialize passkey writer event");
goto done;
}
verto_set_private(child_ctx->write_ev, child_ctx, NULL);
child_ctx->read_ev = verto_add_io(ctx.vctx, VERTO_EV_FLAG_PERSIST |
VERTO_EV_FLAG_IO_CLOSE_FD |
VERTO_EV_FLAG_IO_ERROR |
VERTO_EV_FLAG_IO_READ,
passkey_on_child_readable,
child_ctx->read_from_child);
if (child_ctx->read_ev == NULL) {
ret = ENOMEM;
otpd_log_err(ret, "Unable to initialize passkey reader event");
goto done;
}
verto_set_private(child_ctx->read_ev, child_ctx, NULL);
child_ctx->child_ev = verto_add_child(ctx.vctx, VERTO_EV_FLAG_NONE,
passkey_on_child_exit, child_pid);
verto_set_private(child_ctx->child_ev, child_ctx, free_child_ctx);
} else { /* error */
ret = errno;
otpd_log_err(ret, "Failed to fork passkey_child");
goto done;
}
ret = 0;
done:
if (ret != 0) {
free(child_ctx);
}
return ret;
}
int do_passkey(struct otpd_queue_item *item)
{
if (item == NULL || item->passkey == NULL
|| item->passkey->data_in == NULL) {
return EINVAL;
}
switch (item->passkey->data_in->phase) {
case 0: /* SSS_PASSKEY_PHASE_INIT */
return do_passkey_challenge(item);
case 2: /* SSS_PASSKEY_PHASE_REPLY */
return do_passkey_response(item);
default:
return EINVAL;
}
}
daemons/ipa-otpd/query.c
+48 -1
View File
@@ -36,6 +36,16 @@
#define DEFAULT_TIMEOUT 15 #define DEFAULT_TIMEOUT 15
#define DEFAULT_RETRIES 3 #define DEFAULT_RETRIES 3
/* To read passkey configuration and attributes from a different server than
* FreeIPA you might have to the following two defines of the search filter
* for the global configuration data and the attribute name where if passkey
* information is stored in the user entry. Additionally otpd_parse_passkey()
* might need some updates depending on how the global configuration is stored
* in the configuration objects.
*/
#define PASSKEY_CONFIG_FILTER "(|(objectclass=ipapasskeyconfigobject)(&(objectclass=domain)(objectclass=domainRelatedObject)))"
#define PASSKEY_USER_ATTR "ipapasskey"
static char *user[] = { static char *user[] = {
"uid", "uid",
"ipatokenRadiusUserName", "ipatokenRadiusUserName",
@@ -43,6 +53,7 @@ static char *user[] = {
"ipaidpSub", "ipaidpSub",
"ipaidpConfigLink", "ipaidpConfigLink",
"ipauserauthtype", "ipauserauthtype",
PASSKEY_USER_ATTR,
NULL NULL
}; };
@@ -69,7 +80,7 @@ static char *idp[] = {
NULL NULL
}; };
static bool auth_type_is(char **auth_types, const char *check) bool auth_type_is(char **auth_types, const char *check)
{ {
size_t c; size_t c;
@@ -122,6 +133,14 @@ static void on_query_writable(verto_ctx *vctx, verto_ev *ev)
NULL, NULL, 1, &item->msgid); NULL, NULL, 1, &item->msgid);
free(filter); free(filter);
} else if (item->get_passkey_config) {
otpd_log_req(item->req, "passkey config query start:");
item->ldap_query = LDAP_QUERY_PASSKEY;
i = ldap_search_ext(verto_get_private(ev), ctx.query.base,
LDAP_SCOPE_SUBTREE, PASSKEY_CONFIG_FILTER, NULL, 0, NULL,
NULL, NULL, 0, &item->msgid);
} else if (auth_type_is(item->user.ipauserauthtypes, "idp")) { } else if (auth_type_is(item->user.ipauserauthtypes, "idp")) {
otpd_log_req(item->req, "idp query start: %s", otpd_log_req(item->req, "idp query start: %s",
item->user.ipaidpConfigLink); item->user.ipaidpConfigLink);
@@ -283,6 +302,9 @@ static void on_query_readable(verto_ctx *vctx, verto_ev *ev)
case LDAP_QUERY_IDP: case LDAP_QUERY_IDP:
err = otpd_parse_idp(ldp, entry, item); err = otpd_parse_idp(ldp, entry, item);
break; break;
case LDAP_QUERY_PASSKEY:
err = otpd_parse_passkey(ldp, entry, item);
break;
default: default:
ldap_msgfree(entry); ldap_msgfree(entry);
goto egress; goto egress;
@@ -331,10 +353,35 @@ static void on_query_readable(verto_ctx *vctx, verto_ev *ev)
goto egress; goto egress;
} }
break; break;
case LDAP_QUERY_PASSKEY:
otpd_log_req(item->req, "passkey query end: %s",
item->error == NULL ? "ok" : item->error);
if (item->passkey == NULL) {
goto egress;
}
break;
default: default:
goto egress; goto egress;
} }
/* Check for passkey */
if (is_passkey(item)) {
if (item->ldap_query == LDAP_QUERY_USER) {
item->get_passkey_config = true;
push = &ctx.query.requests;
event = ctx.query.io;
goto egress;
}
i = do_passkey(item);
if (i != 0) {
goto egress;
}
/* do_passkey will call ctx.stdio.writer, so we can return here */
return;
}
/* Check for oauth2 */ /* Check for oauth2 */
oauth2_state = get_oauth2_state(item->ldap_query, item); oauth2_state = get_oauth2_state(item->ldap_query, item);
if (oauth2_state == OAUTH2_GET_ISSUER) { if (oauth2_state == OAUTH2_GET_ISSUER) {
daemons/ipa-otpd/queue.c
+3
View File
@@ -87,6 +87,9 @@ void otpd_queue_item_free(struct otpd_queue_item *item)
free(item->error); free(item->error);
krad_packet_free(item->req); krad_packet_free(item->req);
krad_packet_free(item->rsp); krad_packet_free(item->rsp);
free_otpd_queue_item_passkey(item);
free(item); free(item);
} }
daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_cmocka_tests.c
+8 -6
View File
@@ -503,8 +503,8 @@ void test_pack_ber_user_timeout(void **state)
oldgetgrgid_r = test_data->ctx->nss_ctx->getgrgid_r; oldgetgrgid_r = test_data->ctx->nss_ctx->getgrgid_r;
test_data->ctx->nss_ctx->getgrgid_r = getgrgid_r_timeout; test_data->ctx->nss_ctx->getgrgid_r = getgrgid_r_timeout;
ret = pack_ber_user(test_data->ctx, RESP_USER_GROUPLIST, ret = pack_ber_user(test_data->ctx, RESP_USER_GROUPLIST, TEST_DOMAIN_NAME,
TEST_DOMAIN_NAME, "member001", 12345, 54321, "member001@"TEST_DOMAIN_NAME, 12345, 54321,
"gecos", "homedir", "shell", NULL, &resp_val); "gecos", "homedir", "shell", NULL, &resp_val);
test_data->ctx->nss_ctx->getgrgid_r = oldgetgrgid_r; test_data->ctx->nss_ctx->getgrgid_r = oldgetgrgid_r;
assert_int_equal(ret, LDAP_TIMELIMIT_EXCEEDED); assert_int_equal(ret, LDAP_TIMELIMIT_EXCEEDED);
@@ -548,15 +548,17 @@ void test_encode(void **state)
assert_memory_equal(res_nam, resp_val->bv_val, resp_val->bv_len); assert_memory_equal(res_nam, resp_val->bv_val, resp_val->bv_len);
ber_bvfree(resp_val); ber_bvfree(resp_val);
ret = pack_ber_user(ctx, RESP_USER, TEST_DOMAIN_NAME, "test", 12345, 54321, ret = pack_ber_user(ctx, RESP_USER, TEST_DOMAIN_NAME,
NULL, NULL, NULL, NULL, &resp_val); "test@"TEST_DOMAIN_NAME, 12345, 54321, NULL, NULL,
NULL, NULL, &resp_val);
assert_int_equal(ret, LDAP_SUCCESS); assert_int_equal(ret, LDAP_SUCCESS);
assert_int_equal(sizeof(res_uid), resp_val->bv_len); assert_int_equal(sizeof(res_uid), resp_val->bv_len);
assert_memory_equal(res_uid, resp_val->bv_val, resp_val->bv_len); assert_memory_equal(res_uid, resp_val->bv_val, resp_val->bv_len);
ber_bvfree(resp_val); ber_bvfree(resp_val);
ret = pack_ber_group(RESP_GROUP, TEST_DOMAIN_NAME, "test_group", 54321, ret = pack_ber_group(RESP_GROUP, TEST_DOMAIN_NAME,
NULL, NULL, &resp_val); "test_group@"TEST_DOMAIN_NAME, 54321, NULL, NULL,
&resp_val);
assert_int_equal(ret, LDAP_SUCCESS); assert_int_equal(ret, LDAP_SUCCESS);
assert_int_equal(sizeof(res_gid), resp_val->bv_len); assert_int_equal(sizeof(res_gid), resp_val->bv_len);
assert_memory_equal(res_gid, resp_val->bv_val, resp_val->bv_len); assert_memory_equal(res_gid, resp_val->bv_val, resp_val->bv_len);
daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_common.c
+54 -25
View File
@@ -41,6 +41,7 @@
#define _GNU_SOURCE 1 /* for asprintf() */ #define _GNU_SOURCE 1 /* for asprintf() */
#endif #endif
#include <stdbool.h>
#include <errno.h> #include <errno.h>
#include <stdio.h> #include <stdio.h>
#include <sys/param.h> #include <sys/param.h>
@@ -106,7 +107,7 @@ static int inc_buffer(size_t buf_max, size_t *_buf_len, char **_buf)
return 0; return 0;
} }
int __nss_to_err(enum nss_status errcode) static int __nss_to_err(enum nss_status errcode)
{ {
switch(errcode) { switch(errcode) {
case NSS_STATUS_SUCCESS: case NSS_STATUS_SUCCESS:
@@ -526,6 +527,30 @@ int pack_ber_sid(const char *sid, struct berval **berval)
return LDAP_SUCCESS; return LDAP_SUCCESS;
} }
static bool verify_domain(const char *fqdn, const char *domain_name)
{
const char *pos = strrchr(fqdn, SSSD_DOMAIN_SEPARATOR);
if (pos == NULL) {
return false;
}
return (strcasecmp(pos + 1, domain_name) == 0);
}
static char *get_short_name(const char *fqdn, const char *domain_name)
{
const char *pos = strrchr(fqdn, SSSD_DOMAIN_SEPARATOR);
if (pos == NULL) {
return NULL;
}
if (strcasecmp(pos + 1, domain_name) != 0) {
return NULL;
}
return strndup(fqdn, pos - fqdn);
}
int pack_ber_user(struct ipa_extdom_ctx *ctx, int pack_ber_user(struct ipa_extdom_ctx *ctx,
enum response_types response_type, enum response_types response_type,
const char *domain_name, const char *user_name, const char *domain_name, const char *user_name,
@@ -542,19 +567,13 @@ int pack_ber_user(struct ipa_extdom_ctx *ctx,
char *buf = NULL; char *buf = NULL;
struct group grp; struct group grp;
size_t c; size_t c;
char *locat;
char *short_user_name = NULL; char *short_user_name = NULL;
short_user_name = strdup(user_name); short_user_name = get_short_name(user_name, domain_name);
if ((locat = strrchr(short_user_name, SSSD_DOMAIN_SEPARATOR)) != NULL) { if (short_user_name == NULL) {
if (strcasecmp(locat+1, domain_name) == 0 ) { /* domain mismatch */
locat[0] = '\0'; ret = LDAP_NO_SUCH_OBJECT;
} else { goto done;
/* The found object is from a different domain than requested,
* that means it does not exist in the requested domain */
ret = LDAP_NO_SUCH_OBJECT;
goto done;
}
} }
ber = ber_alloc_t( LBER_USE_DER ); ber = ber_alloc_t( LBER_USE_DER );
@@ -657,19 +676,13 @@ int pack_ber_group(enum response_types response_type,
BerElement *ber = NULL; BerElement *ber = NULL;
int ret; int ret;
size_t c; size_t c;
char *locat;
char *short_group_name = NULL; char *short_group_name = NULL;
short_group_name = strdup(group_name); short_group_name = get_short_name(group_name, domain_name);
if ((locat = strrchr(short_group_name, SSSD_DOMAIN_SEPARATOR)) != NULL) { if (short_group_name == NULL) {
if (strcasecmp(locat+1, domain_name) == 0 ) { /* domain mismatch */
locat[0] = '\0'; ret = LDAP_NO_SUCH_OBJECT;
} else { goto done;
/* The found object is from a different domain than requested,
* that means it does not exist in the requested domain */
ret = LDAP_NO_SUCH_OBJECT;
goto done;
}
} }
ber = ber_alloc_t( LBER_USE_DER ); ber = ber_alloc_t( LBER_USE_DER );
@@ -735,8 +748,8 @@ done:
return ret; return ret;
} }
int pack_ber_name_list(struct extdom_req *req, char **fq_name_list, static int pack_ber_name_list(struct extdom_req *req, char **fq_name_list,
struct berval **berval) struct berval **berval)
{ {
BerElement *ber = NULL; BerElement *ber = NULL;
int ret; int ret;
@@ -892,6 +905,10 @@ static int handle_uid_request(struct ipa_extdom_ctx *ctx,
} }
goto done; goto done;
} }
if (!verify_domain(pwd.pw_name, domain_name)) {
ret = LDAP_NO_SUCH_OBJECT;
goto done;
}
if (request_type == REQ_FULL_WITH_GROUPS) { if (request_type == REQ_FULL_WITH_GROUPS) {
ret = sss_nss_getorigbyusername_timeout(pwd.pw_name, get_timeout(ctx), ret = sss_nss_getorigbyusername_timeout(pwd.pw_name, get_timeout(ctx),
@@ -971,6 +988,10 @@ static int handle_gid_request(struct ipa_extdom_ctx *ctx,
} }
goto done; goto done;
} }
if (!verify_domain(grp.gr_name, domain_name)) {
ret = LDAP_NO_SUCH_OBJECT;
goto done;
}
if (request_type == REQ_FULL_WITH_GROUPS) { if (request_type == REQ_FULL_WITH_GROUPS) {
ret = sss_nss_getorigbygroupname_timeout(grp.gr_name, get_timeout(ctx), ret = sss_nss_getorigbygroupname_timeout(grp.gr_name, get_timeout(ctx),
@@ -1273,6 +1294,10 @@ static int handle_username_request(struct ipa_extdom_ctx *ctx,
ret = getpwnam_r_wrapper(ctx, fq_name, &pwd, &buf, &buf_len); ret = getpwnam_r_wrapper(ctx, fq_name, &pwd, &buf, &buf_len);
switch(ret) { switch(ret) {
case 0: case 0:
if (!verify_domain(pwd.pw_name, domain_name)) {
ret = LDAP_NO_SUCH_OBJECT;
goto done;
}
if (request_type == REQ_FULL_WITH_GROUPS) { if (request_type == REQ_FULL_WITH_GROUPS) {
ret = sss_nss_getorigbyusername_timeout(pwd.pw_name, ret = sss_nss_getorigbyusername_timeout(pwd.pw_name,
get_timeout(ctx), get_timeout(ctx),
@@ -1363,6 +1388,10 @@ static int handle_groupname_request(struct ipa_extdom_ctx *ctx,
} }
goto done; goto done;
} }
if (!verify_domain(grp.gr_name, domain_name)) {
ret = LDAP_NO_SUCH_OBJECT;
goto done;
}
if (request_type == REQ_FULL_WITH_GROUPS) { if (request_type == REQ_FULL_WITH_GROUPS) {
ret = sss_nss_getorigbygroupname_timeout(grp.gr_name, get_timeout(ctx), ret = sss_nss_getorigbygroupname_timeout(grp.gr_name, get_timeout(ctx),
daemons/ipa-slapi-plugins/ipa-graceperiod/ipa_graceperiod.c
+10 -4
View File
@@ -359,7 +359,8 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
Slapi_ValueSet *values = NULL; Slapi_ValueSet *values = NULL;
long grace_limit = 0; long grace_limit = 0;
int grace_user_time; int grace_user_time;
char *pwd_expiration = NULL; char *tmpstr = NULL;
time_t pwd_expiration;
int pwresponse_requested = 0; int pwresponse_requested = 0;
Slapi_PBlock *pbtm = NULL; Slapi_PBlock *pbtm = NULL;
Slapi_Mods *smods = NULL; Slapi_Mods *smods = NULL;
@@ -414,12 +415,17 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
} }
slapi_value_free(&objectclass); slapi_value_free(&objectclass);
pwd_expiration = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration"); tmpstr = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration");
if (pwd_expiration == NULL) { if (tmpstr == NULL) {
/* No expiration means nothing to do */ /* No expiration means nothing to do */
LOG_TRACE("No krbPasswordExpiration for %s, nothing to do\n", dn); LOG_TRACE("No krbPasswordExpiration for %s, nothing to do\n", dn);
goto done; goto done;
} }
pwd_expiration = ipapwd_gentime_to_time_t(tmpstr);
if (pwd_expiration > time(NULL)) {
/* Not expired, nothing to see here */
goto done;
}
ldrc = ipagraceperiod_getpolicy(target_entry, &policy_entry, ldrc = ipagraceperiod_getpolicy(target_entry, &policy_entry,
&values, &actual_type_name, &values, &actual_type_name,
@@ -473,7 +479,7 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
if (pwresponse_requested) { if (pwresponse_requested) {
slapi_pwpolicy_make_response_control(pb, -1, grace_limit - grace_user_time , -1); slapi_pwpolicy_make_response_control(pb, -1, grace_limit - grace_user_time , -1);
} }
} else if ((grace_limit > 0) && (grace_user_time >= grace_limit)) { } else if (grace_user_time >= grace_limit) {
LOG_TRACE("%s password is expired and out of grace limit\n", dn); LOG_TRACE("%s password is expired and out of grace limit\n", dn);
errstr = "Password is expired.\n"; errstr = "Password is expired.\n";
ret = LDAP_INVALID_CREDENTIALS; ret = LDAP_INVALID_CREDENTIALS;
daemons/ipa-slapi-plugins/ipa-otp-lasttoken/ipa_otp_lasttoken.c
+26 -12
View File
@@ -54,7 +54,7 @@ void *ipa_otp_lasttoken_plugin_id;
static bool entry_is_token(Slapi_Entry *entry) static bool entry_is_token(Slapi_Entry *entry)
{ {
char **ocls; char **ocls = NULL;
ocls = slapi_entry_attr_get_charray(entry, SLAPI_ATTR_OBJECTCLASS); ocls = slapi_entry_attr_get_charray(entry, SLAPI_ATTR_OBJECTCLASS);
for (size_t i = 0; ocls != NULL && ocls[i] != NULL; i++) { for (size_t i = 0; ocls != NULL && ocls[i] != NULL; i++) {
@@ -64,6 +64,7 @@ static bool entry_is_token(Slapi_Entry *entry)
} }
} }
slapi_ch_array_free(ocls);
return false; return false;
} }
@@ -138,7 +139,8 @@ static bool is_pwd_enabled(const char *user_dn)
static bool is_allowed(Slapi_PBlock *pb, Slapi_Entry *entry) static bool is_allowed(Slapi_PBlock *pb, Slapi_Entry *entry)
{ {
Slapi_DN *target_sdn = NULL; Slapi_DN *target_sdn = NULL;
const char *bind_dn; char *bind_dn;
bool rv = false;
/* Ignore internal operations. */ /* Ignore internal operations. */
if (slapi_op_internal(pb)) if (slapi_op_internal(pb))
@@ -147,23 +149,35 @@ static bool is_allowed(Slapi_PBlock *pb, Slapi_Entry *entry)
/* Load parameters. */ /* Load parameters. */
(void) slapi_pblock_get(pb, SLAPI_TARGET_SDN, &target_sdn); (void) slapi_pblock_get(pb, SLAPI_TARGET_SDN, &target_sdn);
(void) slapi_pblock_get(pb, SLAPI_CONN_DN, &bind_dn); (void) slapi_pblock_get(pb, SLAPI_CONN_DN, &bind_dn);
if (target_sdn == NULL || bind_dn == NULL) { if (bind_dn == NULL) {
LOG_FATAL("Missing parameters!\n"); LOG_FATAL("bind_dn parameter missing!\n");
return false; goto done;
}
if (target_sdn == NULL) {
LOG_FATAL("target_sdn parameter missing!\n");
goto done;
} }
if (entry != NULL if (entry != NULL
? !entry_is_token(entry) ? !entry_is_token(entry)
: !sdn_in_otp_container(target_sdn)) : !sdn_in_otp_container(target_sdn)) {
return true; rv = true;
goto done;
}
if (!sdn_is_only_enabled_token(target_sdn, bind_dn)) if (!sdn_is_only_enabled_token(target_sdn, bind_dn)) {
return true; rv = true;
goto done;
}
if (is_pwd_enabled(bind_dn)) if (is_pwd_enabled(bind_dn)) {
return true; rv = true;
goto done;
}
return false; done:
slapi_ch_free_string(&bind_dn);
return rv;
} }
static inline int send_error(Slapi_PBlock *pb, int rc, const char *errstr) static inline int send_error(Slapi_PBlock *pb, int rc, const char *errstr)
daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c
+7 -2
View File
@@ -1433,7 +1433,7 @@ static int ipapwd_pre_bind(Slapi_PBlock *pb)
Slapi_DN *target_sdn = NULL; Slapi_DN *target_sdn = NULL;
Slapi_DN *sdn = NULL; Slapi_DN *sdn = NULL;
const char *dn = NULL; const char *dn = NULL;
int method = 0; ber_tag_t method = 0;
bool syncreq; bool syncreq;
bool otpreq; bool otpreq;
int ret = 0; int ret = 0;
@@ -1454,8 +1454,10 @@ static int ipapwd_pre_bind(Slapi_PBlock *pb)
} }
/* We're only interested in simple authentication. */ /* We're only interested in simple authentication. */
if (method != LDAP_AUTH_SIMPLE || credentials->bv_len == 0) if (method != LDAP_AUTH_SIMPLE || credentials->bv_len == 0) {
LOG("Not handled (not simple bind or NULL dn/credentials)\n");
return 0; return 0;
}
/* Retrieve the user's entry. */ /* Retrieve the user's entry. */
sdn = slapi_sdn_dup(target_sdn); sdn = slapi_sdn_dup(target_sdn);
@@ -1513,6 +1515,9 @@ static int ipapwd_pre_bind(Slapi_PBlock *pb)
} }
} }
/* Reset rc to make sure errors are reported*/
rc = LDAP_INVALID_CREDENTIALS;
/* Authenticate the user. */ /* Authenticate the user. */
ret = ipapwd_authenticate(dn, entry, credentials); ret = ipapwd_authenticate(dn, entry, credentials);
if (ret) { if (ret) {
daemons/ipa-slapi-plugins/libotp/otp_token.c
+1
View File
@@ -398,6 +398,7 @@ static struct otp_token **find(const struct otp_config *cfg, const char *user_dn
} }
error: error:
slapi_free_search_results_internal(pb);
slapi_pblock_destroy(pb); slapi_pblock_destroy(pb);
return tokens; return tokens;
} }
doc/Makefile
+2 -1
View File
@@ -35,4 +35,5 @@ distclean: clean
venv: venv:
$(PYTHON) -m venv $(VENVDIR) $(PYTHON) -m venv $(VENVDIR)
$(VENVDIR)/bin/python3 -m pip install -U pip setuptools $(VENVDIR)/bin/python3 -m pip install -U pip setuptools
$(VENVDIR)/bin/python3 -m pip install -U -r ./requirements.txt $(VENVDIR)/bin/python3 -m pip install -U -r ./requirements.txt \
-c constraints.txt
doc/api/A6Record.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _A6Record:
# A6Record
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A6 DNS record.
doc/api/AAAARecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _AAAARecord:
# AAAARecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
AAAA DNS record.
doc/api/AFSDBRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _AFSDBRecord:
# AFSDBRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
AFSDB DNS record.
doc/api/APLRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _APLRecord:
# APLRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
APL DNS record.
doc/api/ARecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _ARecord:
# ARecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A DNS record.
doc/api/AccessTime.md
+9
View File
@@ -0,0 +1,9 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _AccessTime:
# AccessTime
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Access time parameter type.
Accepts values conforming to generalizedTime as defined in RFC 4517 section 3.3.13 without time zone information.
doc/api/Any.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Any:
# Any
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A parameter capable of holding values of any type. For internal use only.
doc/api/BinaryFile.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _BinaryFile:
# BinaryFile
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Binary file parameter type.
doc/api/Bool.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Bool:
# Bool
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A parameter for boolean values (stored in the ``bool`` type).
doc/api/Bytes.md
+11
View File
@@ -0,0 +1,11 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Bytes:
# Bytes
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A parameter for binary data (stored in the ``str`` type).
This class is named *Bytes* instead of *Str* so it's aligned with the
Python v3 ``(str, unicode) => (bytes, str)`` clean-up.
See: http://docs.python.org/3.0/whatsnew/3.0.html
Also see the `Str` parameter.
doc/api/BytesEnum.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _BytesEnum:
# BytesEnum
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Enumerable for binary data (stored in the ``str`` type).
doc/api/CERTRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _CERTRecord:
# CERTRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
CERT DNS record.
doc/api/CNAMERecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _CNAMERecord:
# CNAMERecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
CNAME DNS record.
doc/api/Certificate.md
+5
View File
@@ -0,0 +1,5 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Certificate:
# Certificate
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
doc/api/CertificateSigningRequest.md
+5
View File
@@ -0,0 +1,5 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _CertificateSigningRequest:
# CertificateSigningRequest
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
doc/api/DHCIDRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DHCIDRecord:
# DHCIDRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
DHCID DNS record.
doc/api/DLVRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DLVRecord:
# DLVRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
DLV DNS record.
doc/api/DNAMERecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DNAMERecord:
# DNAMERecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
DNAME DNS record.
doc/api/DNOrURL.md
+9
View File
@@ -0,0 +1,9 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DNOrURL:
# DNOrURL
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
DN parameter that allows, and strips, a "ldap:///" prefix on input.
Used for ``subtree`` to maintain backward compatibility.
doc/api/DNParam.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DNParam:
# DNParam
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
LDAP DN.
doc/api/DNSNameParam.md
+10
View File
@@ -0,0 +1,10 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DNSNameParam:
# DNSNameParam
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Domain name parameter type.
* `only_absolute`: a domain name has to be absolute (makes it absolute from unicode input)
* `only_relative`: a domain name has to be relative
doc/api/DNSRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DNSRecord:
# DNSRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Base class for DNS records, subclass of `Str`.
doc/api/DSRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DSRecord:
# DSRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
DS DNS record.
doc/api/Data.md
+11
View File
@@ -0,0 +1,11 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Data:
# Data
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Base class for the `Bytes` and `Str` parameters.
Previously `Str` was as subclass of `Bytes`. Now the common functionality
has been split into this base class so that ``isinstance(foo, Bytes)`` wont
be ``True`` when ``foo`` is actually an `Str` instance (which is confusing).
doc/api/DateTime.md
+19
View File
@@ -0,0 +1,19 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _DateTime:
# DateTime
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
DateTime parameter type.
Accepts LDAP Generalized time without in the following format:
'%Y%m%d%H%M%SZ'
Accepts subset of values defined by ISO 8601:
'%Y-%m-%dT%H:%M:%SZ'
'%Y-%m-%dT%H:%MZ'
'%Y-%m-%dZ'
Also accepts above formats using ' ' (space) as a separator instead of 'T'.
Refer to the `man strftime` for the explanations for the %Y,%m,%d,%H.%M,%S.
doc/api/Decimal.md
+12
View File
@@ -0,0 +1,12 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Decimal:
# Decimal
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A parameter for floating-point values (stored in the ``Decimal`` type).
Python Decimal type helps overcome problems tied to plain "float" type,
e.g. problem with representation or value comparison. In order to safely
transfer the value over RPC libraries, it is being converted to string
which is then converted back to Decimal number.
doc/api/Dict.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Dict:
# Dict
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A parameter for dictionary.
doc/api/Enum.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Enum:
# Enum
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Base class for parameters with enumerable values.
doc/api/File.md
+9
View File
@@ -0,0 +1,9 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _File:
# File
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Text file parameter type.
Accepts file names and loads their content into the parameter value.
doc/api/Flag.md
+37
View File
@@ -0,0 +1,37 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Flag:
# Flag
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A boolean parameter that always gets filled in with a default value.
This `Bool` subclass forces ``autofill=True`` in `Flag.__init__()`. If no
default is provided, it also fills in a default value of ``False``.
Lastly, unlike the `Bool` class, the default must be either ``True`` or
``False`` and cannot be ``None``.
For example:
```
>>> flag = Flag('my_flag')
>>> (flag.autofill, flag.default)
(True, False)
```
To have a default value of ``True``, create your `Flag` intance with
``default=True``. For example:
```
>>> flag = Flag('my_flag', default=True)
>>> (flag.autofill, flag.default)
(True, True)
```
Also note that creating a `Flag` instance with ``autofill=False`` will have
no effect. For example:
```
>>> flag = Flag('my_flag', autofill=False)
>>> flag.autofill
True
```
doc/api/ForwardRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _ForwardRecord:
# ForwardRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Forward DNS record.
doc/api/HINFORecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _HINFORecord:
# HINFORecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
HINFO DNS record.
doc/api/HIPRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _HIPRecord:
# HIPRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
HIP DNS record.
doc/api/HostPassword.md
+11
View File
@@ -0,0 +1,11 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _HostPassword:
# HostPassword
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A data type for host passwords to not log password values.
The `Password` type cannot be used because it disallows
setting a password on the command-line which would break
backwards compatibility.
doc/api/IA5Str.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _IA5Str:
# IA5Str
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
An IA5String per RFC 4517.
doc/api/IPSECKEYRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _IPSECKEYRecord:
# IPSECKEYRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
IPSECKEY DNS record.
doc/api/Int.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Int:
# Int
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A parameter for integer values (stored in the ``int`` type).
doc/api/IntEnum.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _IntEnum:
# IntEnum
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Enumerable for integer data (stored in the ``int`` type).
doc/api/KEYRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _KEYRecord:
# KEYRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
KEY DNS record.
doc/api/KXRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _KXRecord:
# KXRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
KX DNS record.
doc/api/LOCRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _LOCRecord:
# LOCRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
LOC DNS record.
doc/api/MDRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _MDRecord:
# MDRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
MD DNS record.
doc/api/MINFORecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _MINFORecord:
# MINFORecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
MINFO DNS record.
doc/api/MXRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _MXRecord:
# MXRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
MX DNS record.
doc/api/NAPTRRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _NAPTRRecord:
# NAPTRRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
NAPTR DNS record.
doc/api/NSECRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _NSECRecord:
# NSECRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
NSEC DNS record.
doc/api/NSRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _NSRecord:
# NSRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
NS DNS record.
doc/api/NXTRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _NXTRecord:
# NXTRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
NXT DNS record.
doc/api/Number.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Number:
# Number
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
Base class for the `Int` and `Decimal` parameters.
doc/api/OTPTokenKey.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _OTPTokenKey:
# OTPTokenKey
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A binary password type specified in base32.
doc/api/PTRRecord.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _PTRRecord:
# PTRRecord
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
PTR DNS record.
doc/api/Password.md
+7
View File
@@ -0,0 +1,7 @@
[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
.. _Password:
# Password
[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
A parameter for passwords (stored in the ``unicode`` type).
Loaded 100 of 962 files, more files were not shown because too many files have changed in this diff. Show more