Rob Crittenden
bd619adb5c
Using the client IP address was a rather poor mechanism for controlling who could request certificates for whom. Instead the client machine will bind using the host service principal and request the certificate. In order to do this: * the service will need to exist * the machine needs to be in the certadmin rolegroup * the host needs to be in the managedBy attribute of the service It might look something like: admin ipa host-add client.example.com --password=secret123 ipa service-add HTTP/client.example.com ipa service-add-host --hosts=client.example.com HTTP/client.example.com ipa rolegroup-add-member --hosts=client.example.com certadmin client ipa-client-install ipa-join -w secret123 kinit -kt /etc/krb5.keytab host/client.example.com ipa -d cert-request file://web.csr --principal=HTTP/client.example.com
123 lines
2.7 KiB
Python
123 lines
2.7 KiB
Python
# Authors:
|
|
# Rob Crittenden <rcritten@redhat.com>
|
|
# Pavel Zuna <pzuna@redhat.com>
|
|
#
|
|
# Copyright (C) 2009 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU General Public License as
|
|
# published by the Free Software Foundation; version 2 only
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
"""
|
|
Rolegroups
|
|
"""
|
|
|
|
from ipalib import api
|
|
from ipalib import Str
|
|
from ipalib.plugins.baseldap import *
|
|
|
|
|
|
class rolegroup(LDAPObject):
|
|
"""
|
|
Rolegroup object.
|
|
"""
|
|
container_dn = api.env.container_rolegroup
|
|
object_name = 'rolegroup'
|
|
object_name_plural = 'rolegroups'
|
|
object_class = ['ipaobject', 'groupofnames', 'nestedgroup']
|
|
default_attributes = ['cn', 'description', 'member', 'memberof']
|
|
uuid_attribute = 'ipauniqueid'
|
|
attribute_names = {
|
|
'cn': 'name',
|
|
'member user': 'member users',
|
|
'member group': 'member groups',
|
|
'member host': 'member hosts',
|
|
'member hostgroup': 'member hostgroups',
|
|
'memberof taskgroup': 'member of taskgroup',
|
|
}
|
|
attribute_members = {
|
|
'member': ['user', 'group', 'host', 'hostgroup'],
|
|
'memberof': ['taskgroup'],
|
|
}
|
|
|
|
takes_params = (
|
|
Str('cn',
|
|
cli_name='name',
|
|
doc='group name',
|
|
primary_key=True,
|
|
normalizer=lambda value: value.lower(),
|
|
),
|
|
Str('description',
|
|
cli_name='desc',
|
|
doc='A description of this group',
|
|
),
|
|
)
|
|
|
|
api.register(rolegroup)
|
|
|
|
|
|
class rolegroup_add(LDAPCreate):
|
|
"""
|
|
Create new rolegroup.
|
|
"""
|
|
|
|
api.register(rolegroup_add)
|
|
|
|
|
|
class rolegroup_del(LDAPDelete):
|
|
"""
|
|
Delete rolegroup.
|
|
"""
|
|
|
|
api.register(rolegroup_del)
|
|
|
|
|
|
class rolegroup_mod(LDAPUpdate):
|
|
"""
|
|
Edit rolegroup.
|
|
"""
|
|
|
|
api.register(rolegroup_mod)
|
|
|
|
|
|
class rolegroup_find(LDAPSearch):
|
|
"""
|
|
Search for rolegroups.
|
|
"""
|
|
|
|
api.register(rolegroup_find)
|
|
|
|
|
|
class rolegroup_show(LDAPRetrieve):
|
|
"""
|
|
Display rolegroup.
|
|
"""
|
|
|
|
api.register(rolegroup_show)
|
|
|
|
|
|
class rolegroup_add_member(LDAPAddMember):
|
|
"""
|
|
Add member to rolegroup.
|
|
"""
|
|
|
|
api.register(rolegroup_add_member)
|
|
|
|
|
|
class rolegroup_remove_member(LDAPRemoveMember):
|
|
"""
|
|
Remove member from rolegroup.
|
|
"""
|
|
|
|
api.register(rolegroup_remove_member)
|
|
|