IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-27 09:21:59 -06:00
Code Issues Packages Projects Releases Wiki Activity
915286fed2
freeipa/ipalib/plugins/host.py

1037 lines
38 KiB
Python
Raw Normal View History

Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
# Authors:
# Rob Crittenden <rcritten@redhat.com>
# Pavel Zuna <pzuna@redhat.com>
#
# Copyright (C) 2008 Red Hat
# see file 'COPYING' for use and warranty information
#
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
# along with this program. If not, see <http://www.gnu.org/licenses/>.
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
import platform
import os
import sys
from nss.error import NSPRError
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
import nss.nss as nss
import netaddr
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
from ipalib import api, errors, util
from ipalib import Str, Flag, Bytes
from ipalib.plugins.baseldap import *
from ipalib.plugins.service import split_principal
from ipalib.plugins.service import validate_certificate
from ipalib.plugins.service import set_certificate_attrs
from ipalib.plugins.dns import dns_container_exists, _record_types
from ipalib.plugins.dns import add_forward_record
from ipalib import _, ngettext
from ipalib import x509
Add missing managing hosts filtering options Host object has a virtual attribute "managing" containing all hosts it manages (governed by managedBy attribute). This patch also adds standard membership filtering options: --man-hosts=HOSTS: Only hosts managing _all_ HOSTS are returned --not-man-hosts=HOSTS: Only hosts which do not manage _any_ host in HOSTS are returned https://fedorahosted.org/freeipa/ticket/1675
2012-01-26 06:41:39 -06:00
from ipalib.dn import *
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
from ipalib.request import context
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
from ipalib.util import validate_sshpubkey, output_sshpubkey
from ipapython.ipautil import ipa_generate_password, CheckedIPAddress, make_sshfp
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _("""
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
Hosts/Machines
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
A host represents a machine. It can be used in a number of contexts:
- service entries are associated with a host
- a host stores the host/ service principal
Fix style and grammatical issues in built-in command help. There is a rather large API.txt change but it is only due to changes in the doc string in parameters. ticket 729
2011-03-04 10:08:54 -06:00
- a host can be used in Host-based Access Control (HBAC) rules
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
- every enrolled client generates a host entry
ENROLLMENT:
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
There are three enrollment scenarios when enrolling a new client:
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
1. You are enrolling as a full administrator. The host entry may exist
Re-implement access control using an updated model. The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
2010-12-01 10:23:52 -06:00
or not. A full administrator is a member of the hostadmin role
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
or the admins group.
2. You are enrolling as a limited administrator. The host must already
Fix style and grammatical issues in built-in command help. There is a rather large API.txt change but it is only due to changes in the doc string in parameters. ticket 729
2011-03-04 10:08:54 -06:00
exist. A limited administrator is a member a role with the
Host Enrollment privilege.
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
3. The host has been created with a one-time password.
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
A host can only be enrolled once. If a client has enrolled and needs to
be re-enrolled, the host entry must be removed and re-created. Note that
re-creating the host entry will result in all services for the host being
removed, and all SSL certificates associated with those services being
revoked.
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
A host can optionally store information such as where it is located,
the OS that it runs, etc.
EXAMPLES:
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
Add a new host:
ipa host-add --location="3rd floor lab" --locality=Dallas test.example.com
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
Delete a host:
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
ipa host-del test.example.com
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
Add a new host with a one-time password:
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
ipa host-add --os='Fedora 12' --password=Secret123 test.example.com
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
Add a new host with a random one-time password:
ipa host-add --os='Fedora 12' --random test.example.com
Update command documentation based on feedback from docs team. ticket #158
2010-08-24 22:40:32 -05:00
Modify information about a host:
First pass at per-command documentation
2010-06-02 13:08:50 -05:00
ipa host-mod --os='Fedora 12' test.example.com
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
Remove SSH public keys of a host and update DNS to reflect this change:
ipa host-mod --sshpubkey= --updatedns test.example.com
Service/Host disable command output clarification When a service/host is disabled, the resulting summary message states that a Kerberos key was disabled. However, Kerberos key may not have been enabled before this command at all, which makes this information confusing for some users. Also, the summary message didn't state that an SSL certificate was disabled too. This patch rather changes the summary message to a standard phrase known from other plugins disable command and states all disable command steps in a respective command help. https://fedorahosted.org/freeipa/ticket/872
2011-02-16 03:35:49 -06:00
Disable the host Kerberos key, SSL certificate and all of its services:
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
ipa host-disable test.example.com
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
Add a host that can manage this host's keytab and certificate:
ipa host-add-managedby --hosts=test2 test
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
""")
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
def validate_host(ugettext, fqdn):
"""
Require at least one dot in the hostname (to support localhost.localdomain)
"""
Replace incorrect use of str.index with str.find in host plugin.
2010-02-23 08:24:44 -06:00
if fqdn.find('.') == -1:
Deleting a non-fully-qualified hostname should still delete its services We were being left with orphan services if the host entry was not removed using the FQDN.
2010-03-29 10:31:10 -05:00
return _('Fully-qualified hostname required')
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
return None
IPv6 enhancements * Make host-add, host-del and reverse zone creation IPv6 aware * Make Bind listen on IPv6 interfaces, too https://fedorahosted.org/freeipa/ticket/398
2011-01-31 08:30:43 -06:00
def is_forward_record(zone, str_address):
addr = netaddr.IPAddress(str_address)
if addr.version == 4:
result = api.Command['dnsrecord_find'](zone, arecord=str_address)
elif addr.version == 6:
Honor netmask in DNS reverse zone setup. ticket 910
2011-05-27 13:29:33 -05:00
result = api.Command['dnsrecord_find'](zone, aaaarecord=str_address)
IPv6 enhancements * Make host-add, host-del and reverse zone creation IPv6 aware * Make Bind listen on IPv6 interfaces, too https://fedorahosted.org/freeipa/ticket/398
2011-01-31 08:30:43 -06:00
else:
raise ValueError('Invalid address family')
return result['count'] > 0
Improve IP address handling in the host-add command. IP addresses are more strictly checked. Netmasks can be specified and are used in DNS PTR record creation. ticket 1234
2011-06-14 09:31:36 -05:00
def get_reverse_zone(ipaddr, prefixlen=None):
Honor netmask in DNS reverse zone setup. ticket 910
2011-05-27 13:29:33 -05:00
ip = netaddr.IPAddress(ipaddr)
revdns = unicode(ip.reverse_dns)
Improve IP address handling in the host-add command. IP addresses are more strictly checked. Netmasks can be specified and are used in DNS PTR record creation. ticket 1234
2011-06-14 09:31:36 -05:00
if prefixlen is None:
revzone = u''
Honor netmask in DNS reverse zone setup. ticket 910
2011-05-27 13:29:33 -05:00
Improve IP address handling in the host-add command. IP addresses are more strictly checked. Netmasks can be specified and are used in DNS PTR record creation. ticket 1234
2011-06-14 09:31:36 -05:00
result = api.Command['dnszone_find']()['result']
for zone in result:
zonename = zone['idnsname'][0]
if revdns.endswith(zonename) and len(zonename) > len(revzone):
revzone = zonename
else:
if ip.version == 4:
pos = 4 - prefixlen / 8
elif ip.version == 6:
pos = 32 - prefixlen / 4
items = ip.reverse_dns.split('.')
revzone = u'.'.join(items[pos:])
try:
api.Command['dnszone_show'](revzone)
except errors.NotFound:
revzone = u''
Honor netmask in DNS reverse zone setup. ticket 910
2011-05-27 13:29:33 -05:00
if len(revzone) == 0:
raise errors.NotFound(
reason=_('DNS reverse zone for IP address %(addr)s not found') % dict(addr=ipaddr)
)
revname = revdns[:-len(revzone)-1]
return revzone, revname
IPv6 enhancements * Make host-add, host-del and reverse zone creation IPv6 aware * Make Bind listen on IPv6 interfaces, too https://fedorahosted.org/freeipa/ticket/398
2011-01-31 08:30:43 -06:00
def remove_fwd_ptr(ipaddr, host, domain, recordtype):
api.log.debug('deleting ipaddr %s' % ipaddr)
try:
Honor netmask in DNS reverse zone setup. ticket 910
2011-05-27 13:29:33 -05:00
revzone, revname = get_reverse_zone(ipaddr)
IPv6 enhancements * Make host-add, host-del and reverse zone creation IPv6 aware * Make Bind listen on IPv6 interfaces, too https://fedorahosted.org/freeipa/ticket/398
2011-01-31 08:30:43 -06:00
delkw = { 'ptrrecord' : "%s.%s." % (host, domain) }
api.Command['dnsrecord_del'](revzone, revname, **delkw)
except errors.NotFound:
pass
try:
delkw = { recordtype : ipaddr }
api.Command['dnsrecord_del'](domain, host, **delkw)
except errors.NotFound:
pass
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
def update_sshfp_record(zone, record, entry_attrs):
if 'ipasshpubkey' not in entry_attrs:
return
pubkeys = entry_attrs['ipasshpubkey'] or ()
sshfps=[]
for pubkey in pubkeys:
sshfp = unicode(make_sshfp(pubkey))
if sshfp is not None:
sshfps.append(sshfp)
try:
api.Command['dnsrecord_mod'](zone, record, sshfprecord=sshfps)
except errors.EmptyModlist:
pass
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
host_output_params = (
Misleading Keytab field The 'Keytab' field in output of all 'user-*' commands was changed to 'Kerberos keys available'. In order to do this change for 'user-*' commands only, the flag 'has_keytab' had to be removed from common output parametrs in ipalib/baseldap.py. This change also affected the host.py and service.py, where the 'has_keytab' flag was added to their local output params. Both host.py and service.py holds the old field caption - 'Keytab' - because of compatibility with older clients. https://fedorahosted.org/freeipa/ticket/1961
2011-11-10 06:46:16 -06:00
Flag('has_keytab',
label=_('Keytab'),
),
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
Str('managedby_host',
label='Managed by',
),
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
Str('managing_host',
label='Managing',
),
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
Str('subject',
label=_('Subject'),
),
Str('serial_number',
label=_('Serial Number'),
),
Str('issuer',
label=_('Issuer'),
),
Str('valid_not_before',
label=_('Not Before'),
),
Str('valid_not_after',
label=_('Not After'),
),
Str('md5_fingerprint',
label=_('Fingerprint (MD5)'),
),
Str('sha1_fingerprint',
label=_('Fingerprint (SHA1)'),
),
Str('revocation_reason?',
label=_('Revocation reason'),
Fix output of failed managedby hosts, allow a host to manage itself. The output problem was a missing label for failed managedby. This also fixes a call to print_entry that was missing the flags argument. Add a flag to specify whether a group can be a member of itself, defaulting to False. ticket 708
2011-01-10 13:21:45 -06:00
),
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
)
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
def validate_ipaddr(ugettext, ipaddr):
"""
Verify that we have either an IPv4 or IPv6 address.
"""
Improve IP address handling in the host-add command. IP addresses are more strictly checked. Netmasks can be specified and are used in DNS PTR record creation. ticket 1234
2011-06-14 09:31:36 -05:00
try:
ip = CheckedIPAddress(ipaddr, match_local=False)
Improve host-add error message host-add command allows to add a host and its IP address via --ip-address option. When the address is invalid, it throws an error and refuses to operate. However, the invalid IP address error message is always the same which is not right as it forces a user to guess the reason of rejection (loopback address, link-local address or invalid address at all was passed, etc.). This patch changes host-add validator to print the error message. https://fedorahosted.org/freeipa/ticket/2229
2012-01-20 08:15:11 -06:00
except Exception, e:
return unicode(e)
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
return None
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
class host(LDAPObject):
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
"""
Host object.
"""
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
container_dn = api.env.container_host
Fixed object_name and object_name_plural internationalization The object_name, object_name_plural and messages that use these attributes have been converted to support translation. The label attribute in the Param class has been modified to accept unicode string. Ticket #1435
2011-07-12 11:01:25 -05:00
object_name = _('host')
object_name_plural = _('hosts')
Make hosts more like real services so we can issue certs for host principals This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
2009-12-16 15:04:53 -06:00
object_class = ['ipaobject', 'nshost', 'ipahost', 'pkiuser', 'ipaservice']
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
# object_class_config = 'ipahostobjectclasses'
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
search_attributes = [
'fqdn', 'description', 'l', 'nshostlocation', 'krbprincipalname',
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
'nshardwareplatform', 'nsosversion', 'managedby'
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
]
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
default_attributes = [
Use the Output tuple to determine the order of output The attributes displayed is now dependant upon their definition in a Param. This enhances that, giving some level of control over how the result is displayed to the user. This also fixes displaying group membership, including failures of adding/removing entries. All tests pass now though there is still one problem. We need to return the dn as well. Once that is fixed we just need to comment out all the dn entries in the tests and they should once again pass.
2010-02-12 15:34:21 -06:00
'fqdn', 'description', 'l', 'nshostlocation', 'krbprincipalname',
'nshardwareplatform', 'nsosversion', 'usercertificate', 'memberof',
Add support for storing MAC address in host entries. macaddress is a multi-valued attribute and we allow multiple entries. This is from the objectclass ieee802device. This is added manually when doing a mod or add and not as a default to support existing host entries that do not have this objectclass. If this were added to the defaults then existing hosts missing this objectclass would not be found by host-find. It is possible to get ethers data out of nss by configuring nsswitch.conf to use ldap for ethers and running getent ethers <hostname> I tested nslcd and it only returned one macaddress value. https://fedorahosted.org/freeipa/ticket/1132
2012-01-20 14:10:44 -06:00
'managedby', 'memberindirect', 'memberofindirect', 'macaddress',
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
'sshpubkeyfp',
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
]
uuid_attribute = 'ipauniqueid'
attribute_members = {
'enrolledby': ['user'],
Add sudorule and hbacrule to memberof and indirectmemberof attributes Add Add tests for users, groups, hosts and hostgroups to verify membership Update API to version 2.3 https://fedorahosted.org/freeipa/ticket/1170
2011-05-31 16:52:35 -05:00
'memberof': ['hostgroup', 'netgroup', 'role', 'hbacrule', 'sudorule'],
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
'managedby': ['host'],
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
'managing': ['host'],
Add sudorule and hbacrule to memberof and indirectmemberof attributes Add Add tests for users, groups, hosts and hostgroups to verify membership Update API to version 2.3 https://fedorahosted.org/freeipa/ticket/1170
2011-05-31 16:52:35 -05:00
'memberofindirect': ['hostgroup', 'netgroup', 'role', 'hbacrule',
'sudorule'],
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
}
Provide list of available attributes for use in ACI UI. Also include flag indicating whether the object is bindable. This will be used to determine if the object can have a selfservice ACI. ticket 446
2010-12-02 10:05:54 -06:00
bindable = True
Improve filtering of enrollments search results. This is required for effective filtering of enrollments search results in the webUI and also gives an edge to the CLI. After this patch, each LDAPObject can define its relationships to other LDAPObjects. For now, this is used only for filtering search results by enrollments, but there are probably more benefits to come. You can do this for example: # search for all users not enrolled in group admins ipa user-find --not-in-groups=admins # search for all groups not enrolled in group global with user Pavel ipa group-find --users=Pavel --not-in-groups=global # more examples: ipa group-find --users=Pavel,Jakub --no-users=Honza ipa hostgroup-find --hosts=webui.pzuna
2011-01-04 14:15:54 -06:00
relationships = {
facet nesting correctly nest the facet groups change 'parent' to 'member of' for facet group
2011-01-06 16:14:13 -06:00
'memberof': ('Member Of', 'in_', 'not_in_'),
Improve filtering of enrollments search results. This is required for effective filtering of enrollments search results in the webUI and also gives an edge to the CLI. After this patch, each LDAPObject can define its relationships to other LDAPObjects. For now, this is used only for filtering search results by enrollments, but there are probably more benefits to come. You can do this for example: # search for all users not enrolled in group admins ipa user-find --not-in-groups=admins # search for all groups not enrolled in group global with user Pavel ipa group-find --users=Pavel --not-in-groups=global # more examples: ipa group-find --users=Pavel,Jakub --no-users=Honza ipa hostgroup-find --hosts=webui.pzuna
2011-01-04 14:15:54 -06:00
'enrolledby': ('Enrolled by', 'enroll_by_', 'not_enroll_by_'),
'managedby': ('Managed by', 'man_by_', 'not_man_by_'),
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
'managing': ('Managing', 'man_', 'not_man_'),
Improve filtering of enrollments search results. This is required for effective filtering of enrollments search results in the webUI and also gives an edge to the CLI. After this patch, each LDAPObject can define its relationships to other LDAPObjects. For now, this is used only for filtering search results by enrollments, but there are probably more benefits to come. You can do this for example: # search for all users not enrolled in group admins ipa user-find --not-in-groups=admins # search for all groups not enrolled in group global with user Pavel ipa group-find --users=Pavel --not-in-groups=global # more examples: ipa group-find --users=Pavel,Jakub --no-users=Honza ipa hostgroup-find --hosts=webui.pzuna
2011-01-04 14:15:54 -06:00
}
Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
2011-08-22 15:24:07 -05:00
password_attributes = [('userpassword', 'has_password'),
('krbprincipalkey', 'has_keytab')]
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
Add Object.label class attribute, enable in webUI
2010-02-08 06:03:28 -06:00
label = _('Hosts')
Fixed label capitalization The CSS text-transform sometimes produces incorrect capitalization, so the code has been modified to use translated labels that already contain the correct capitalization. Ticket #1424
2011-07-13 21:10:47 -05:00
label_singular = _('Host')
Add Object.label class attribute, enable in webUI
2010-02-08 06:03:28 -06:00
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
takes_params = (
Str('fqdn', validate_host,
Add regular expression pattern to host names. Limit hostnames to letters, digits and - with a maximum length of 255 https://fedorahosted.org/freeipa/ticket/1780
2011-09-12 12:51:31 -05:00
pattern='^[a-zA-Z0-9][a-zA-Z0-9-\.]{0,254}$',
pattern_errmsg='may only include letters, numbers, and -',
maxlength=255,
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
cli_name='hostname',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Host name'),
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
primary_key=True,
normalizer=lambda value: value.lower(),
),
Str('description?',
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
cli_name='desc',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Description'),
doc=_('A description of this host'),
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
),
Use the Output tuple to determine the order of output The attributes displayed is now dependant upon their definition in a Param. This enhances that, giving some level of control over how the result is displayed to the user. This also fixes displaying group membership, including failures of adding/removing entries. All tests pass now though there is still one problem. We need to return the dn as well. Once that is fixed we just need to comment out all the dn entries in the tests and they should once again pass.
2010-02-12 15:34:21 -06:00
Str('l?',
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
cli_name='locality',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Locality'),
doc=_('Host locality (e.g. "Baltimore, MD")'),
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
),
Str('nshostlocation?',
cli_name='location',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Location'),
doc=_('Host location (e.g. "Lab 2")'),
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
),
Str('nshardwareplatform?',
cli_name='platform',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Platform'),
doc=_('Host hardware platform (e.g. "Lenovo T61")'),
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
),
Str('nsosversion?',
cli_name='os',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Operating system'),
doc=_('Host operating system and version (e.g. "Fedora 9")'),
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
),
Str('userpassword?',
cli_name='password',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('User password'),
doc=_('Password used in bulk enrollment'),
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
),
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
Flag('random?',
doc=_('Generate a random password to be used in bulk enrollment'),
Fix LDAP object parameter encoding Parameters in LDAP objects missed an information if they are real LDAP attributes or not. Real LDAP attributes are written to entry_attrs dictionary in plugin callbacks and are being encoded. This causes issues when plugin callbacks does not expect that the parameters values are already encoded for submission to LDAP. This patch introduces a new flag "noattribute" used to mark that a parameter is not an LDAP attribute and thus should not be encoded or added to entry_attrs. Param documentation is improved to describe the meaning of this and other Param flags or attributes. https://fedorahosted.org/freeipa/ticket/2097
2011-11-14 10:03:44 -06:00
flags=('no_search', 'virtual_attribute'),
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
default=False,
),
Str('randompassword?',
label=_('Random password'),
Fix LDAP object parameter encoding Parameters in LDAP objects missed an information if they are real LDAP attributes or not. Real LDAP attributes are written to entry_attrs dictionary in plugin callbacks and are being encoded. This causes issues when plugin callbacks does not expect that the parameters values are already encoded for submission to LDAP. This patch introduces a new flag "noattribute" used to mark that a parameter is not an LDAP attribute and thus should not be encoded or added to entry_attrs. Param documentation is improved to describe the meaning of this and other Param flags or attributes. https://fedorahosted.org/freeipa/ticket/2097
2011-11-14 10:03:44 -06:00
flags=('no_create', 'no_update', 'no_search', 'virtual_attribute'),
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
),
Make hosts more like real services so we can issue certs for host principals This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
2009-12-16 15:04:53 -06:00
Bytes('usercertificate?', validate_certificate,
cli_name='certificate',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Certificate'),
doc=_('Base-64 encoded server certificate'),
Make hosts more like real services so we can issue certs for host principals This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
2009-12-16 15:04:53 -06:00
),
Use the Output tuple to determine the order of output The attributes displayed is now dependant upon their definition in a Param. This enhances that, giving some level of control over how the result is displayed to the user. This also fixes displaying group membership, including failures of adding/removing entries. All tests pass now though there is still one problem. We need to return the dn as well. Once that is fixed we just need to comment out all the dn entries in the tests and they should once again pass.
2010-02-12 15:34:21 -06:00
Str('krbprincipalname?',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Principal name'),
Use the Output tuple to determine the order of output The attributes displayed is now dependant upon their definition in a Param. This enhances that, giving some level of control over how the result is displayed to the user. This also fixes displaying group membership, including failures of adding/removing entries. All tests pass now though there is still one problem. We need to return the dn as well. Once that is fixed we just need to comment out all the dn entries in the tests and they should once again pass.
2010-02-12 15:34:21 -06:00
flags=['no_create', 'no_update', 'no_search'],
),
Add support for storing MAC address in host entries. macaddress is a multi-valued attribute and we allow multiple entries. This is from the objectclass ieee802device. This is added manually when doing a mod or add and not as a default to support existing host entries that do not have this objectclass. If this were added to the defaults then existing hosts missing this objectclass would not be found by host-find. It is possible to get ethers data out of nss by configuring nsswitch.conf to use ldap for ethers and running getent ethers <hostname> I tested nslcd and it only returned one macaddress value. https://fedorahosted.org/freeipa/ticket/1132
2012-01-20 14:10:44 -06:00
Str('macaddress*',
normalizer=lambda value: value.upper(),
pattern='^([a-fA-F0-9]{2}[:|\-]?){5}[a-fA-F0-9]{2}$',
pattern_errmsg='Must be of the form HH:HH:HH:HH:HH:HH, where each H is a hexadecimal character.',
csv=True,
label=_('MAC address'),
doc=_('Hardware MAC address(es) on this host'),
),
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
Bytes('ipasshpubkey*', validate_sshpubkey,
cli_name='sshpubkey',
label=_('Base-64 encoded SSH public key'),
flags=['no_search'],
),
Str('sshpubkeyfp*',
label=_('SSH public key fingerprint'),
flags=['virtual_attribute', 'no_create', 'no_update', 'no_search'],
),
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
)
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
def get_dn(self, *keys, **options):
Fix crash when building DN of host with name ending with period. Fix #797
2011-01-18 12:28:37 -06:00
hostname = keys[-1]
if hostname.endswith('.'):
hostname = hostname[:-1]
dn = super(host, self).get_dn(hostname, **options)
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
try:
self.backend.get_entry(dn, [''])
except errors.NotFound:
try:
(dn, entry_attrs) = self.backend.find_entry_by_attr(
Fix crash when building DN of host with name ending with period. Fix #797
2011-01-18 12:28:37 -06:00
'serverhostname', hostname, self.object_class, [''],
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
self.container_dn
)
except errors.NotFound:
pass
return dn
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
def get_managed_hosts(self, dn):
host_filter = 'managedBy=%s' % dn
host_attrs = ['fqdn']
ldap = self.api.Backend.ldap2
managed_hosts = []
try:
(hosts, truncated) = ldap.find_entries(base_dn=self.container_dn,
filter=host_filter, attrs_list=host_attrs)
for host in hosts:
managed_hosts.append(host[0])
except errors.NotFound:
return []
return managed_hosts
Suppress managed netgroups as indirect members of hosts. By design these managed netgroups are not supposed to show unless you specifically want to see them. https://fedorahosted.org/freeipa/ticket/1738
2011-09-14 15:33:33 -05:00
def suppress_netgroup_memberof(self, entry_attrs):
"""
We don't want to show managed netgroups so remove them from the
memberofindirect list.
"""
ng_container = DN(api.env.container_netgroup, api.env.basedn)
if 'memberofindirect' in entry_attrs:
for member in entry_attrs['memberofindirect']:
memberdn = DN(member)
if memberdn.endswith(ng_container):
try:
netgroup = api.Command['netgroup_show'](memberdn['cn'], all=True)['result']
if self.has_objectclass(netgroup['objectclass'], 'mepmanagedentry'):
entry_attrs['memberofindirect'].remove(member)
except errors.NotFound:
pass
Rename plugins2 to plugins.
2009-06-16 07:38:27 -05:00
api.register(host)
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
class host_add(LDAPCreate):
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _('Add a new host.')
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
has_output_params = LDAPCreate.has_output_params + host_output_params
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
msg_summary = _('Added host "%(value)s"')
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
member_attributes = ['managedby']
Require that hosts be resolvable in DNS. Use --force to ignore warnings. This also requires a resolvable hostname on services as well. I want people to think long and hard about adding things that aren't resolvable. The cert plugin can automatically create services on the user's behalf when issuing a cert. It will always set the force flag to True. We use a lot of made-up host names in the test system, all of which require the force flag now. ticket #25
2010-07-22 13:16:22 -05:00
takes_options = (
Flag('force',
Updated json_metadata and i18n_messages. The json_metadata() has been updated to return ipa.Objects and ipa.Methods. The i18n_messages() has been updated to include other messages that are not available from the metadata.
2011-02-18 00:02:51 -06:00
label=_('Force'),
Require that hosts be resolvable in DNS. Use --force to ignore warnings. This also requires a resolvable hostname on services as well. I want people to think long and hard about adding things that aren't resolvable. The cert plugin can automatically create services on the user's behalf when issuing a cert. It will always set the force flag to True. We use a lot of made-up host names in the test system, all of which require the force flag now. ticket #25
2010-07-22 13:16:22 -05:00
doc=_('force host name even if not in DNS'),
),
Added option --no-reverse to add-host When adding a host with specific IP address, the operation would fail in case IPA doesn't own the reverse DNS. This new option overrides the check for reverse DNS zone and falls back to different IP address existence check. https://fedorahosted.org/freeipa/ticket/417
2010-12-14 12:02:18 -06:00
Flag('no_reverse',
doc=_('skip reverse DNS detection'),
),
Rename --ipaddr option of host-add command The option is renamed to --ip-address to be consistent with ipa-replica-prepare. https://fedorahosted.org/freeipa/ticket/655
2011-01-05 14:37:53 -06:00
Str('ip_address?', validate_ipaddr,
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
doc=_('Add the host to DNS with this IP address'),
ipaddress for host add updated label triggered an API change
2011-06-20 11:04:02 -05:00
label=_('IP Address'),
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
),
Require that hosts be resolvable in DNS. Use --force to ignore warnings. This also requires a resolvable hostname on services as well. I want people to think long and hard about adding things that aren't resolvable. The cert plugin can automatically create services on the user's behalf when issuing a cert. It will always set the force flag to True. We use a lot of made-up host names in the test system, all of which require the force flag now. ticket #25
2010-07-22 13:16:22 -05:00
)
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
Add --all to LDAPCreate and make LDAP commands always display default attributes.
2009-12-10 09:39:24 -06:00
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
Use correct option name in host plugin
2011-01-12 11:18:01 -06:00
if 'ip_address' in options and dns_container_exists(ldap):
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
parts = keys[-1].split('.')
domain = unicode('.'.join(parts[1:]))
Port installer and host plugin to the new DNS plugin * move ipa dns-resolve to the new plugin * port the installer and the host plugin to the new interface * remove the old plugin
2011-01-12 14:02:05 -06:00
result = api.Command['dnszone_find']()['result']
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
match = False
for zone in result:
if domain == zone['idnsname'][0]:
match = True
break
if not match:
Fix translatable strings in ipalib plugins. Needed for xgettext/pygettext processing.
2011-02-23 15:47:49 -06:00
raise errors.NotFound(
reason=_('DNS zone %(zone)s not found') % dict(zone=domain)
)
Improve IP address handling in the host-add command. IP addresses are more strictly checked. Netmasks can be specified and are used in DNS PTR record creation. ticket 1234
2011-06-14 09:31:36 -05:00
ip = CheckedIPAddress(options['ip_address'], match_local=False)
Port installer and host plugin to the new DNS plugin * move ipa dns-resolve to the new plugin * port the installer and the host plugin to the new interface * remove the old plugin
2011-01-12 14:02:05 -06:00
if not options.get('no_reverse', False):
Added option --no-reverse to add-host When adding a host with specific IP address, the operation would fail in case IPA doesn't own the reverse DNS. This new option overrides the check for reverse DNS zone and falls back to different IP address existence check. https://fedorahosted.org/freeipa/ticket/417
2010-12-14 12:02:18 -06:00
try:
Improve IP address handling in the host-add command. IP addresses are more strictly checked. Netmasks can be specified and are used in DNS PTR record creation. ticket 1234
2011-06-14 09:31:36 -05:00
prefixlen = None
if not ip.defaultnet:
prefixlen = ip.prefixlen
Honor netmask in DNS reverse zone setup. ticket 910
2011-05-27 13:29:33 -05:00
# we prefer lookup of the IP through the reverse zone
Improve IP address handling in the host-add command. IP addresses are more strictly checked. Netmasks can be specified and are used in DNS PTR record creation. ticket 1234
2011-06-14 09:31:36 -05:00
revzone, revname = get_reverse_zone(ip, prefixlen)
Port installer and host plugin to the new DNS plugin * move ipa dns-resolve to the new plugin * port the installer and the host plugin to the new interface * remove the old plugin
2011-01-12 14:02:05 -06:00
reverse = api.Command['dnsrecord_find'](revzone, idnsname=revname)
Added option --no-reverse to add-host When adding a host with specific IP address, the operation would fail in case IPA doesn't own the reverse DNS. This new option overrides the check for reverse DNS zone and falls back to different IP address existence check. https://fedorahosted.org/freeipa/ticket/417
2010-12-14 12:02:18 -06:00
if reverse['count'] > 0:
raise errors.DuplicateEntry(message=u'This IP address is already assigned.')
except errors.NotFound:
pass
else:
Improve IP address handling in the host-add command. IP addresses are more strictly checked. Netmasks can be specified and are used in DNS PTR record creation. ticket 1234
2011-06-14 09:31:36 -05:00
if is_forward_record(domain, unicode(ip)):
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
raise errors.DuplicateEntry(message=u'This IP address is already assigned.')
Use correct option name in host plugin
2011-01-12 11:18:01 -06:00
if not options.get('force', False) and not 'ip_address' in options:
Require that hosts be resolvable in DNS. Use --force to ignore warnings. This also requires a resolvable hostname on services as well. I want people to think long and hard about adding things that aren't resolvable. The cert plugin can automatically create services on the user's behalf when issuing a cert. It will always set the force flag to True. We use a lot of made-up host names in the test system, all of which require the force flag now. ticket #25
2010-07-22 13:16:22 -05:00
util.validate_host_dns(self.log, keys[-1])
Use 'l' instead of 'localityname' in host plugin. It seems that 'localityname' and 'locality' aliases were dropped in newer versions of DS.
2010-01-12 13:09:17 -06:00
if 'locality' in entry_attrs:
entry_attrs['l'] = entry_attrs['locality']
del entry_attrs['locality']
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
entry_attrs['cn'] = keys[-1]
entry_attrs['serverhostname'] = keys[-1].split('.', 1)[0]
Fix password/random logic in host plugin. Fix #798
2011-01-18 14:43:07 -06:00
if 'userpassword' not in entry_attrs and not options.get('random', False):
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
entry_attrs['krbprincipalname'] = 'host/%s@%s' % (
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
keys[-1], self.api.env.realm
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
)
Fix minor bug in host-add logic. Ticket #798
2011-02-02 12:47:21 -06:00
if 'krbprincipalaux' not in entry_attrs['objectclass']:
Make a copy of objectclasses so a call can't update them globally. In the host plugin we may change the default objectclasses based on the options selected. This was affecting it globally and causing subsequent calls to fail.
2011-01-24 09:46:44 -06:00
entry_attrs['objectclass'].append('krbprincipalaux')
Fix minor bug in host-add logic. Ticket #798
2011-02-02 12:47:21 -06:00
if 'krbprincipal' not in entry_attrs['objectclass']:
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
entry_attrs['objectclass'].append('krbprincipal')
Fix password/random logic in host plugin. Fix #798
2011-01-18 14:43:07 -06:00
else:
if 'krbprincipalaux' in entry_attrs['objectclass']:
entry_attrs['objectclass'].remove('krbprincipalaux')
Make a copy of objectclasses so a call can't update them globally. In the host plugin we may change the default objectclasses based on the options selected. This was affecting it globally and causing subsequent calls to fail.
2011-01-24 09:46:44 -06:00
if 'krbprincipal' in entry_attrs['objectclass']:
entry_attrs['objectclass'].remove('krbprincipal')
Fix LDAP object parameter encoding Parameters in LDAP objects missed an information if they are real LDAP attributes or not. Real LDAP attributes are written to entry_attrs dictionary in plugin callbacks and are being encoded. This causes issues when plugin callbacks does not expect that the parameters values are already encoded for submission to LDAP. This patch introduces a new flag "noattribute" used to mark that a parameter is not an LDAP attribute and thus should not be encoded or added to entry_attrs. Param documentation is improved to describe the meaning of this and other Param flags or attributes. https://fedorahosted.org/freeipa/ticket/2097
2011-11-14 10:03:44 -06:00
if options.get('random'):
entry_attrs['userpassword'] = ipa_generate_password()
# save the password so it can be displayed in post_callback
setattr(context, 'randompassword', entry_attrs['userpassword'])
Require an imported certificate's issuer to match our issuer. The goal is to not import foreign certificates. This caused a bunch of tests to fail because we had a hardcoded server certificate. Instead a developer will need to run make-testcert to create a server certificate generated by the local CA to test against. ticket 1134
2011-04-26 15:45:19 -05:00
cert = options.get('usercertificate')
if cert:
Make data type of certificates more obvious/predictable internally. For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
2011-06-08 09:54:41 -05:00
cert = x509.normalize_certificate(cert)
x509.verify_cert_subject(ldap, keys[-1], cert)
Require an imported certificate's issuer to match our issuer. The goal is to not import foreign certificates. This caused a bunch of tests to fail because we had a hardcoded server certificate. Instead a developer will need to run make-testcert to create a server certificate generated by the local CA to test against. ticket 1134
2011-04-26 15:45:19 -05:00
entry_attrs['usercertificate'] = cert
Make hosts more like real services so we can issue certs for host principals This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
2009-12-16 15:04:53 -06:00
entry_attrs['managedby'] = dn
Add support for storing MAC address in host entries. macaddress is a multi-valued attribute and we allow multiple entries. This is from the objectclass ieee802device. This is added manually when doing a mod or add and not as a default to support existing host entries that do not have this objectclass. If this were added to the defaults then existing hosts missing this objectclass would not be found by host-find. It is possible to get ethers data out of nss by configuring nsswitch.conf to use ldap for ethers and running getent ethers <hostname> I tested nslcd and it only returned one macaddress value. https://fedorahosted.org/freeipa/ticket/1132
2012-01-20 14:10:44 -06:00
entry_attrs['objectclass'].append('ieee802device')
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
entry_attrs['objectclass'].append('ipasshhost')
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
return dn
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
exc = None
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
if dns_container_exists(ldap):
try:
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
parts = keys[-1].split('.')
domain = unicode('.'.join(parts[1:]))
IPv6 enhancements * Make host-add, host-del and reverse zone creation IPv6 aware * Make Bind listen on IPv6 interfaces, too https://fedorahosted.org/freeipa/ticket/398
2011-01-31 08:30:43 -06:00
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
if 'ip_address' in options:
ip = CheckedIPAddress(options['ip_address'], match_local=False)
add_forward_record(domain, parts[0], unicode(ip))
host-add should not add a PTR record with --no-reverse https://fedorahosted.org/freeipa/ticket/866
2011-01-28 07:25:47 -06:00
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
if not options.get('no_reverse', False):
try:
prefixlen = None
if not ip.defaultnet:
prefixlen = ip.prefixlen
revzone, revname = get_reverse_zone(ip, prefixlen)
addkw = { 'ptrrecord' : keys[-1]+'.' }
api.Command['dnsrecord_add'](revzone, revname, **addkw)
except errors.EmptyModlist:
# the entry already exists and matches
pass
host-add should not add a PTR record with --no-reverse https://fedorahosted.org/freeipa/ticket/866
2011-01-28 07:25:47 -06:00
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
del options['ip_address']
update_sshfp_record(domain, unicode(parts[0]), entry_attrs)
except Exception, e:
exc = e
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
if options.get('random', False):
try:
entry_attrs['randompassword'] = unicode(getattr(context, 'randompassword'))
except AttributeError:
# On the off-chance some other extension deletes this from the
# context, don't crash.
pass
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
if exc:
Fix translatable strings in ipalib plugins. Needed for xgettext/pygettext processing.
2011-02-23 15:47:49 -06:00
raise errors.NonFatalError(
reason=_('The host was added but the DNS update failed with: %(exc)s') % dict(exc=exc)
)
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
set_certificate_attrs(entry_attrs)
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
if options.get('all', False):
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
entry_attrs['managing'] = self.obj.get_managed_hosts(dn)
Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
2011-08-22 15:24:07 -05:00
self.obj.get_password_attributes(ldap, dn, entry_attrs)
if entry_attrs['has_password']:
# If an OTP is set there is no keytab, at least not one
# fetched anywhere.
entry_attrs['has_keytab'] = False
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
output_sshpubkey(ldap, dn, entry_attrs)
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
return dn
Rename *-create/*-delete commands to *-add/*-del respectively.
2009-06-16 09:51:44 -05:00
api.register(host_add)
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
class host_del(LDAPDelete):
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _('Delete a host.')
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
msg_summary = _('Deleted host "%(value)s"')
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
member_attributes = ['managedby']
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
Remove unnecessary options from host-del. For some reason it was inheriting LDAPCreate.options... ticket 652
2011-01-03 15:03:06 -06:00
takes_options = (
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
Flag('updatedns?',
doc=_('Remove entries from DNS'),
default=False,
),
)
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
def pre_callback(self, ldap, dn, *keys, **options):
Deleting a non-fully-qualified hostname should still delete its services We were being left with orphan services if the host entry was not removed using the FQDN.
2010-03-29 10:31:10 -05:00
# If we aren't given a fqdn, find it
if validate_host(None, keys[-1]) is not None:
hostentry = api.Command['host_show'](keys[-1])['result']
fqdn = hostentry['fqdn'][0]
else:
fqdn = keys[-1]
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
# Remove all service records for this host
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
truncated = True
while truncated:
try:
Deleting a non-fully-qualified hostname should still delete its services We were being left with orphan services if the host entry was not removed using the FQDN.
2010-03-29 10:31:10 -05:00
ret = api.Command['service_find'](fqdn)
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
truncated = ret['truncated']
services = ret['result']
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
except errors.NotFound:
break
else:
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
for entry_attrs in services:
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
principal = entry_attrs['krbprincipalname'][0]
(service, hostname, realm) = split_principal(principal)
Deleting a non-fully-qualified hostname should still delete its services We were being left with orphan services if the host entry was not removed using the FQDN.
2010-03-29 10:31:10 -05:00
if hostname.lower() == fqdn:
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
api.Command['service_del'](principal)
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
updatedns = options.get('updatedns', False)
if updatedns:
try:
updatedns = dns_container_exists(ldap)
except errors.NotFound:
updatedns = False
if updatedns:
# Remove DNS entries
parts = fqdn.split('.')
domain = unicode('.'.join(parts[1:]))
Port installer and host plugin to the new DNS plugin * move ipa dns-resolve to the new plugin * port the installer and the host plugin to the new interface * remove the old plugin
2011-01-12 14:02:05 -06:00
result = api.Command['dnszone_find']()['result']
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
match = False
for zone in result:
if domain == zone['idnsname'][0]:
match = True
break
if not match:
Fix translatable strings in ipalib plugins. Needed for xgettext/pygettext processing.
2011-02-23 15:47:49 -06:00
raise errors.NotFound(
reason=_('DNS zone %(zone)s not found') % dict(zone=domain)
)
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
# Get all forward resources for this host
Port installer and host plugin to the new DNS plugin * move ipa dns-resolve to the new plugin * port the installer and the host plugin to the new interface * remove the old plugin
2011-01-12 14:02:05 -06:00
records = api.Command['dnsrecord_find'](domain, idnsname=parts[0])['result']
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
for record in records:
if 'arecord' in record:
IPv6 enhancements * Make host-add, host-del and reverse zone creation IPv6 aware * Make Bind listen on IPv6 interfaces, too https://fedorahosted.org/freeipa/ticket/398
2011-01-31 08:30:43 -06:00
remove_fwd_ptr(record['arecord'][0], parts[0],
domain, 'arecord')
if 'aaaarecord' in record:
remove_fwd_ptr(record['aaaarecord'][0], parts[0],
domain, 'aaaarecord')
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
else:
# Try to delete all other record types too
Port installer and host plugin to the new DNS plugin * move ipa dns-resolve to the new plugin * port the installer and the host plugin to the new interface * remove the old plugin
2011-01-12 14:02:05 -06:00
_attribute_types = [str('%srecord' % t.lower()) for t in _record_types]
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
for attr in _attribute_types:
IPv6 enhancements * Make host-add, host-del and reverse zone creation IPv6 aware * Make Bind listen on IPv6 interfaces, too https://fedorahosted.org/freeipa/ticket/398
2011-01-31 08:30:43 -06:00
if attr not in ['arecord', 'aaaarecord'] and attr in record:
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
for i in xrange(len(record[attr])):
if (record[attr][i].endswith(parts[0]) or
record[attr][i].endswith(fqdn+'.')):
Port installer and host plugin to the new DNS plugin * move ipa dns-resolve to the new plugin * port the installer and the host plugin to the new interface * remove the old plugin
2011-01-12 14:02:05 -06:00
delkw = { unicode(attr) : record[attr][i] }
api.Command['dnsrecord_del'](domain,
record['idnsname'][0],
**delkw)
Add ability to add/remove DNS records when adding/removing a host entry. A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
2010-11-23 16:47:29 -06:00
break
Handle error messages during Host operations Only a generic error message were displayed when a non-existing host was passed to host-del or host-disable operations. This patch adds catching these generic exceptions and raising new exceptions with the correct error message. https://fedorahosted.org/freeipa/ticket/303
2011-01-06 06:27:24 -06:00
try:
(dn, entry_attrs) = ldap.get_entry(dn, ['usercertificate'])
except errors.NotFound:
self.obj.handle_not_found(*keys)
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
if 'usercertificate' in entry_attrs:
Make data type of certificates more obvious/predictable internally. For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
2011-06-08 09:54:41 -05:00
cert = x509.normalize_certificate(entry_attrs.get('usercertificate')[0])
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
try:
serial = unicode(x509.get_serial_number(cert, x509.DER))
try:
result = api.Command['cert_show'](unicode(serial))['result'
]
if 'revocation_reason' not in result:
try:
api.Command['cert_revoke'](unicode(serial), revocation_reason=4)
except errors.NotImplementedError:
# some CA's might not implement revoke
pass
except errors.NotImplementedError:
# some CA's might not implement revoke
pass
except NSPRError, nsprerr:
if nsprerr.errno == -8183:
# If we can't decode the cert them proceed with
# removing the host.
self.log.info("Problem decoding certificate %s" % nsprerr.args[1])
else:
raise nsprerr
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
return dn
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Rename *-create/*-delete commands to *-add/*-del respectively.
2009-06-16 09:51:44 -05:00
api.register(host_del)
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
class host_mod(LDAPUpdate):
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _('Modify information about a host.')
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
has_output_params = LDAPUpdate.has_output_params + host_output_params
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
msg_summary = _('Modified host "%(value)s"')
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
member_attributes = ['managedby']
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
takes_options = LDAPUpdate.takes_options + (
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
Str('krbprincipalname?',
cli_name='principalname',
Translatable Param.label, Param.doc
2010-02-19 10:08:16 -06:00
label=_('Principal name'),
doc=_('Kerberos principal name for this host'),
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
attribute=True,
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
),
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
Flag('updatedns?',
doc=_('Update DNS entries'),
default=False,
),
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
)
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
Don't allow a OTP to be set on an enrolled host Setting a password invalidates the existing keytab https://fedorahosted.org/freeipa/ticket/1719
2011-09-08 12:47:37 -05:00
# Allow an existing OTP to be reset but don't allow a OTP to be
# added to an enrolled host.
if 'userpassword' in options:
entry = {}
self.obj.get_password_attributes(ldap, dn, entry)
if not entry['has_password'] and entry['has_keytab']:
raise errors.ValidationError(name='password', error=_('Password cannot be set on enrolled host.'))
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
# Once a principal name is set it cannot be changed
Don't allow host cn to be changed (it isn't used anyway). We are required by LDAP schema to have a cn value. Don't let users change it thinking they are actually doing something. tickets 706 and 707
2011-02-15 14:04:40 -06:00
if 'cn' in entry_attrs:
raise errors.ACIError(info='cn is immutable')
Use 'l' instead of 'localityname' in host plugin. It seems that 'localityname' and 'locality' aliases were dropped in newer versions of DS.
2010-01-12 13:09:17 -06:00
if 'locality' in entry_attrs:
entry_attrs['l'] = entry_attrs['locality']
del entry_attrs['locality']
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
if 'krbprincipalname' in entry_attrs:
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
(dn, entry_attrs_old) = ldap.get_entry(
dn, ['objectclass', 'krbprincipalname']
)
if 'krbprincipalname' in entry_attrs_old:
msg = 'Principal name already set, it is unchangeable.'
raise errors.ACIError(info=msg)
obj_classes = entry_attrs_old['objectclass']
if 'krbprincipalaux' not in obj_classes:
obj_classes.append('krbprincipalaux')
entry_attrs['objectclass'] = obj_classes
Make data type of certificates more obvious/predictable internally. For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
2011-06-08 09:54:41 -05:00
cert = x509.normalize_certificate(entry_attrs.get('usercertificate'))
Make hosts more like real services so we can issue certs for host principals This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
2009-12-16 15:04:53 -06:00
if cert:
Make data type of certificates more obvious/predictable internally. For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
2011-06-08 09:54:41 -05:00
x509.verify_cert_subject(ldap, keys[-1], cert)
Make hosts more like real services so we can issue certs for host principals This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
2009-12-16 15:04:53 -06:00
(dn, entry_attrs_old) = ldap.get_entry(dn, ['usercertificate'])
if 'usercertificate' in entry_attrs_old:
Make data type of certificates more obvious/predictable internally. For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
2011-06-08 09:54:41 -05:00
oldcert = x509.normalize_certificate(entry_attrs_old.get('usercertificate')[0])
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
try:
serial = unicode(x509.get_serial_number(oldcert, x509.DER))
try:
result = api.Command['cert_show'](unicode(serial))['result']
if 'revocation_reason' not in result:
try:
api.Command['cert_revoke'](unicode(serial), revocation_reason=4)
except errors.NotImplementedError:
# some CA's might not implement revoke
pass
except errors.NotImplementedError:
# some CA's might not implement revoke
pass
except NSPRError, nsprerr:
if nsprerr.errno == -8183:
# If we can't decode the cert them proceed with
# modifying the host.
self.log.info("Problem decoding certificate %s" % nsprerr.args[1])
else:
raise nsprerr
entry_attrs['usercertificate'] = cert
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
Fix LDAP object parameter encoding Parameters in LDAP objects missed an information if they are real LDAP attributes or not. Real LDAP attributes are written to entry_attrs dictionary in plugin callbacks and are being encoded. This causes issues when plugin callbacks does not expect that the parameters values are already encoded for submission to LDAP. This patch introduces a new flag "noattribute" used to mark that a parameter is not an LDAP attribute and thus should not be encoded or added to entry_attrs. Param documentation is improved to describe the meaning of this and other Param flags or attributes. https://fedorahosted.org/freeipa/ticket/2097
2011-11-14 10:03:44 -06:00
if options.get('random'):
entry_attrs['userpassword'] = ipa_generate_password()
setattr(context, 'randompassword', entry_attrs['userpassword'])
Add support for storing MAC address in host entries. macaddress is a multi-valued attribute and we allow multiple entries. This is from the objectclass ieee802device. This is added manually when doing a mod or add and not as a default to support existing host entries that do not have this objectclass. If this were added to the defaults then existing hosts missing this objectclass would not be found by host-find. It is possible to get ethers data out of nss by configuring nsswitch.conf to use ldap for ethers and running getent ethers <hostname> I tested nslcd and it only returned one macaddress value. https://fedorahosted.org/freeipa/ticket/1132
2012-01-20 14:10:44 -06:00
if 'macaddress' in entry_attrs:
if 'objectclass' in entry_attrs:
obj_classes = entry_attrs['objectclass']
else:
(_dn, _entry_attrs) = ldap.get_entry(
dn, ['objectclass']
)
obj_classes = _entry_attrs['objectclass']
if 'ieee802device' not in obj_classes:
obj_classes.append('ieee802device')
entry_attrs['objectclass'] = obj_classes
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
if options.get('updatedns', False) and dns_container_exists(ldap):
parts = keys[-1].split('.')
domain = unicode('.'.join(parts[1:]))
result = api.Command['dnszone_find']()['result']
match = False
for zone in result:
if domain == zone['idnsname'][0]:
match = True
break
if not match:
raise errors.NotFound(
reason=_('DNS zone %(zone)s not found') % dict(zone=domain)
)
update_sshfp_record(domain, unicode(parts[0]), entry_attrs)
if 'ipasshpubkey' in entry_attrs:
if 'objectclass' in entry_attrs:
obj_classes = entry_attrs['objectclass']
else:
(_dn, _entry_attrs) = ldap.get_entry(dn, ['objectclass'])
obj_classes = entry_attrs['objectclass'] = _entry_attrs['objectclass']
if 'ipasshhost' not in obj_classes:
obj_classes.append('ipasshhost')
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
return dn
Make hosts more like real services so we can issue certs for host principals This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
2009-12-16 15:04:53 -06:00
Add option to generate random one-time password for hosts for bulk enrollment ticket 228
2010-10-05 21:00:40 -05:00
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
if options.get('random', False):
entry_attrs['randompassword'] = unicode(getattr(context, 'randompassword'))
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
set_certificate_attrs(entry_attrs)
Retrieve password/keytab state when modifying a host. ticket https://fedorahosted.org/freeipa/ticket/1714
2011-08-25 08:24:47 -05:00
self.obj.get_password_attributes(ldap, dn, entry_attrs)
if entry_attrs['has_password']:
# If an OTP is set there is no keytab, at least not one
# fetched anywhere.
entry_attrs['has_keytab'] = False
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
if options.get('all', False):
entry_attrs['managing'] = self.obj.get_managed_hosts(dn)
Suppress managed netgroups as indirect members of hosts. By design these managed netgroups are not supposed to show unless you specifically want to see them. https://fedorahosted.org/freeipa/ticket/1738
2011-09-14 15:33:33 -05:00
self.obj.suppress_netgroup_memberof(entry_attrs)
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
output_sshpubkey(ldap, dn, entry_attrs)
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
return dn
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Rename plugins2 to plugins.
2009-06-16 07:38:27 -05:00
api.register(host_mod)
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
class host_find(LDAPSearch):
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _('Search for hosts.')
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
has_output_params = LDAPSearch.has_output_params + host_output_params
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
msg_summary = ngettext(
Fix translatable strings in ipalib plugins. Needed for xgettext/pygettext processing.
2011-02-23 15:47:49 -06:00
'%(count)d host matched', '%(count)d hosts matched', 0
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
)
Improve filtering of enrollments search results. This is required for effective filtering of enrollments search results in the webUI and also gives an edge to the CLI. After this patch, each LDAPObject can define its relationships to other LDAPObjects. For now, this is used only for filtering search results by enrollments, but there are probably more benefits to come. You can do this for example: # search for all users not enrolled in group admins ipa user-find --not-in-groups=admins # search for all groups not enrolled in group global with user Pavel ipa group-find --users=Pavel --not-in-groups=global # more examples: ipa group-find --users=Pavel,Jakub --no-users=Honza ipa hostgroup-find --hosts=webui.pzuna
2011-01-04 14:15:54 -06:00
member_attributes = ['memberof', 'enrolledby', 'managedby']
Take 2: Extensible return values and validation; steps toward a single output_for_cli(); enable more webUI stuff
2009-12-09 10:09:53 -06:00
Add missing managing hosts filtering options Host object has a virtual attribute "managing" containing all hosts it manages (governed by managedBy attribute). This patch also adds standard membership filtering options: --man-hosts=HOSTS: Only hosts managing _all_ HOSTS are returned --not-man-hosts=HOSTS: Only hosts which do not manage _any_ host in HOSTS are returned https://fedorahosted.org/freeipa/ticket/1675
2012-01-26 06:41:39 -06:00
def get_options(self):
for option in super(host_find, self).get_options():
yield option
# "managing" membership has to be added and processed separately
for option in self.get_member_options('managing'):
yield option
Change signature of LDAPSearch.pre_callback. Add the opportunity to change base DN and scope in the callback.
2010-11-23 08:02:54 -06:00
def pre_callback(self, ldap, filter, attrs_list, base_dn, scope, *args, **options):
Use 'l' instead of 'localityname' in host plugin. It seems that 'localityname' and 'locality' aliases were dropped in newer versions of DS.
2010-01-12 13:09:17 -06:00
if 'locality' in attrs_list:
attrs_list.remove('locality')
attrs_list.append('l')
Add missing managing hosts filtering options Host object has a virtual attribute "managing" containing all hosts it manages (governed by managedBy attribute). This patch also adds standard membership filtering options: --man-hosts=HOSTS: Only hosts managing _all_ HOSTS are returned --not-man-hosts=HOSTS: Only hosts which do not manage _any_ host in HOSTS are returned https://fedorahosted.org/freeipa/ticket/1675
2012-01-26 06:41:39 -06:00
if 'man_host' in options or 'not_man_host' in options:
hosts = []
if options.get('man_host') is not None:
for pkey in options.get('man_host', []):
dn = self.obj.get_dn(pkey)
try:
(dn, entry_attrs) = ldap.get_entry(dn, ['managedby'])
except errors.NotFound:
self.obj.handle_not_found(pkey)
hosts.append(set(entry_attrs.get('managedby', '')))
hosts = list(reduce(lambda s1, s2: s1 & s2, hosts))
if not hosts:
# There is no host managing _all_ hosts in --man-hosts
filter = ldap.combine_filters(
(filter, '(objectclass=disabled)'), ldap.MATCH_ALL
)
not_hosts = []
if options.get('not_man_host') is not None:
for pkey in options.get('not_man_host', []):
dn = self.obj.get_dn(pkey)
try:
(dn, entry_attrs) = ldap.get_entry(dn, ['managedby'])
except errors.NotFound:
self.obj.handle_not_found(pkey)
not_hosts += entry_attrs.get('managedby', [])
not_hosts = list(set(not_hosts))
for target_hosts, filter_op in ((hosts, ldap.MATCH_ANY),
(not_hosts, ldap.MATCH_NONE)):
hosts_avas = [DN(host)[0][0] for host in target_hosts]
hosts_filters = [ldap.make_filter_from_attr(ava.attr, ava.value) for ava in hosts_avas]
hosts_filter = ldap.combine_filters(hosts_filters, filter_op)
filter = ldap.combine_filters(
(filter, hosts_filter), ldap.MATCH_ALL
)
Change signature of LDAPSearch.pre_callback. Add the opportunity to change base DN and scope in the callback.
2010-11-23 08:02:54 -06:00
return (filter.replace('locality', 'l'), base_dn, scope)
Use 'l' instead of 'localityname' in host plugin. It seems that 'localityname' and 'locality' aliases were dropped in newer versions of DS.
2010-01-12 13:09:17 -06:00
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
def post_callback(self, ldap, entries, truncated, *args, **options):
Create pkey-only option for find commands New option --pkey-only is available for all LDAPSearch based classes with primary key visible in the output. This option makes LDAPSearch commands search for primary attribute only. This may be useful when manipulating large data sets. User can at first retrieve all primary keys in a relatively small data package and then run further commands with retrieved primary keys. https://fedorahosted.org/freeipa/ticket/1262
2011-10-26 04:12:38 -05:00
if options.get('pkey_only', False):
return
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
for entry in entries:
Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
2011-08-22 15:24:07 -05:00
(dn, entry_attrs) = entry
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
set_certificate_attrs(entry_attrs)
Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
2011-08-22 15:24:07 -05:00
self.obj.get_password_attributes(ldap, dn, entry_attrs)
Suppress managed netgroups as indirect members of hosts. By design these managed netgroups are not supposed to show unless you specifically want to see them. https://fedorahosted.org/freeipa/ticket/1738
2011-09-14 15:33:33 -05:00
self.obj.suppress_netgroup_memberof(entry_attrs)
Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
2011-08-22 15:24:07 -05:00
if entry_attrs['has_password']:
# If an OTP is set there is no keytab, at least not one
# fetched anywhere.
entry_attrs['has_keytab'] = False
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
if options.get('all', False):
entry_attrs['managing'] = self.obj.get_managed_hosts(entry[0])
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
output_sshpubkey(ldap, dn, entry_attrs)
Rename plugins2 to plugins.
2009-06-16 07:38:27 -05:00
api.register(host_find)
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Make the host plugin use baseldap classes.
2009-09-15 07:01:58 -05:00
class host_show(LDAPRetrieve):
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _('Display information about a host.')
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
has_output_params = LDAPRetrieve.has_output_params + host_output_params
Add --out option to service, host and cert-show to save the cert to a file. Override forward() to grab the result and if a certificate is in the entry and the file is writable then dump the certificate in PEM format. ticket 473
2010-12-10 09:53:20 -06:00
takes_options = LDAPRetrieve.takes_options + (
Str('out?',
doc=_('file to store certificate in'),
),
)
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
member_attributes = ['managedby']
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
2011-08-22 15:24:07 -05:00
self.obj.get_password_attributes(ldap, dn, entry_attrs)
if entry_attrs['has_password']:
# If an OTP is set there is no keytab, at least not one
# fetched anywhere.
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
entry_attrs['has_keytab'] = False
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
set_certificate_attrs(entry_attrs)
Host certificate management The service certificate management UI has been generalized and moved into certificate.js. The host details page is now using the same code to manage certificates. The host.py has been modified to return host certificate info. The Get/Revoke/View buttons behavior has been modified such that they are visible only if there is a valid certificate. The Get dialog box has been fixed to show the correct certificate header and footer. The ipa.css has been modified to store the style of the status bullets. New unit tests for certificate has been added. The test data has been modified to include sample host certificate.
2010-10-15 23:40:38 -05:00
Add a list of managed hosts Enhance Host plugin to provide not only "Managed By" list but also a list of managed hosts. The new list is generated only when --all option is passed. https://fedorahosted.org/freeipa/ticket/993
2011-06-13 09:23:09 -05:00
if options.get('all', False):
entry_attrs['managing'] = self.obj.get_managed_hosts(dn)
Suppress managed netgroups as indirect members of hosts. By design these managed netgroups are not supposed to show unless you specifically want to see them. https://fedorahosted.org/freeipa/ticket/1738
2011-09-14 15:33:33 -05:00
self.obj.suppress_netgroup_memberof(entry_attrs)
Add support for SSH public keys to user and host objects. This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
2011-12-07 01:50:31 -06:00
output_sshpubkey(ldap, dn, entry_attrs)
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
return dn
Add host plugin port to new LDAP backend.
2009-05-27 08:55:49 -05:00
Add --out option to service, host and cert-show to save the cert to a file. Override forward() to grab the result and if a certificate is in the entry and the file is writable then dump the certificate in PEM format. ticket 473
2010-12-10 09:53:20 -06:00
def forward(self, *keys, **options):
if 'out' in options:
Make data type of certificates more obvious/predictable internally. For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
2011-06-08 09:54:41 -05:00
util.check_writable_file(options['out'])
Add --out option to service, host and cert-show to save the cert to a file. Override forward() to grab the result and if a certificate is in the entry and the file is writable then dump the certificate in PEM format. ticket 473
2010-12-10 09:53:20 -06:00
result = super(host_show, self).forward(*keys, **options)
if 'usercertificate' in result['result']:
Make data type of certificates more obvious/predictable internally. For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
2011-06-08 09:54:41 -05:00
x509.write_certificate(result['result']['usercertificate'][0], options['out'])
Add --out option to service, host and cert-show to save the cert to a file. Override forward() to grab the result and if a certificate is in the entry and the file is writable then dump the certificate in PEM format. ticket 473
2010-12-10 09:53:20 -06:00
result['summary'] = _('Certificate stored in file \'%(file)s\'') % dict(file=options['out'])
return result
else:
raise errors.NoCertificateError(entry=keys[-1])
else:
return super(host_show, self).forward(*keys, **options)
Rename plugins2 to plugins.
2009-06-16 07:38:27 -05:00
api.register(host_show)
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
class host_disable(LDAPQuery):
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _('Disable the Kerberos key, SSL certificate and all services of a host.')
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
has_output = output.standard_value
Service/Host disable command output clarification When a service/host is disabled, the resulting summary message states that a Kerberos key was disabled. However, Kerberos key may not have been enabled before this command at all, which makes this information confusing for some users. Also, the summary message didn't state that an SSL certificate was disabled too. This patch rather changes the summary message to a standard phrase known from other plugins disable command and states all disable command steps in a respective command help. https://fedorahosted.org/freeipa/ticket/872
2011-02-16 03:35:49 -06:00
msg_summary = _('Disabled host "%(value)s"')
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
def execute(self, *keys, **options):
ldap = self.obj.backend
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
# If we aren't given a fqdn, find it
if validate_host(None, keys[-1]) is not None:
hostentry = api.Command['host_show'](keys[-1])['result']
fqdn = hostentry['fqdn'][0]
else:
fqdn = keys[-1]
# See if we actually do anthing here, and if not raise an exception
done_work = False
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
dn = self.obj.get_dn(*keys, **options)
Handle error messages during Host operations Only a generic error message were displayed when a non-existing host was passed to host-del or host-disable operations. This patch adds catching these generic exceptions and raising new exceptions with the correct error message. https://fedorahosted.org/freeipa/ticket/303
2011-01-06 06:27:24 -06:00
try:
Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
2011-08-22 15:24:07 -05:00
(dn, entry_attrs) = ldap.get_entry(dn, ['usercertificate'])
Handle error messages during Host operations Only a generic error message were displayed when a non-existing host was passed to host-del or host-disable operations. This patch adds catching these generic exceptions and raising new exceptions with the correct error message. https://fedorahosted.org/freeipa/ticket/303
2011-01-06 06:27:24 -06:00
except errors.NotFound:
self.obj.handle_not_found(*keys)
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
truncated = True
while truncated:
try:
ret = api.Command['service_find'](fqdn)
truncated = ret['truncated']
services = ret['result']
except errors.NotFound:
break
else:
for entry_attrs in services:
principal = entry_attrs['krbprincipalname'][0]
(service, hostname, realm) = split_principal(principal)
if hostname.lower() == fqdn:
try:
api.Command['service_disable'](principal)
done_work = True
except errors.AlreadyInactive:
pass
if 'usercertificate' in entry_attrs:
Make data type of certificates more obvious/predictable internally. For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
2011-06-08 09:54:41 -05:00
cert = x509.normalize_certificate(entry_attrs.get('usercertificate')[0])
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
try:
serial = unicode(x509.get_serial_number(cert, x509.DER))
try:
result = api.Command['cert_show'](unicode(serial))['result'
]
if 'revocation_reason' not in result:
try:
api.Command['cert_revoke'](unicode(serial), revocation_reason=4)
except errors.NotImplementedError:
# some CA's might not implement revoke
pass
except errors.NotImplementedError:
# some CA's might not implement revoke
pass
except NSPRError, nsprerr:
if nsprerr.errno == -8183:
# If we can't decode the cert them proceed with
# disabling the host.
self.log.info("Problem decoding certificate %s" % nsprerr.args[1])
else:
raise nsprerr
# Remove the usercertificate altogether
ldap.update_entry(dn, {'usercertificate': None})
done_work = True
Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
2011-08-22 15:24:07 -05:00
self.obj.get_password_attributes(ldap, dn, entry_attrs)
if entry_attrs['has_keytab']:
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
ldap.remove_principal_key(dn)
done_work = True
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
Revoke a host's certificate (if any) when it is deleted or disabled. Disable any services when its host is disabled. This also adds displaying the certificate attributes (subject, etc) a bit more universal and centralized in a single function. ticket 297
2010-11-05 14:16:53 -05:00
if not done_work:
raise errors.AlreadyInactive()
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
return dict(
result=True,
value=keys[0],
)
Suppress managed netgroups as indirect members of hosts. By design these managed netgroups are not supposed to show unless you specifically want to see them. https://fedorahosted.org/freeipa/ticket/1738
2011-09-14 15:33:33 -05:00
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
self.obj.suppress_netgroup_memberof(entry_attrs)
return dn
Add API to delete a service principal key, service-disable. I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
2010-07-12 16:45:06 -05:00
api.register(host_disable)
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
class host_add_managedby(LDAPAddMember):
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _('Add hosts that can manage this host.')
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
member_attributes = ['managedby']
has_output_params = LDAPAddMember.has_output_params + host_output_params
Fix output of failed managedby hosts, allow a host to manage itself. The output problem was a missing label for failed managedby. This also fixes a call to print_entry that was missing the flags argument. Add a flag to specify whether a group can be a member of itself, defaulting to False. ticket 708
2011-01-10 13:21:45 -06:00
allow_same = True
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
Suppress managed netgroups as indirect members of hosts. By design these managed netgroups are not supposed to show unless you specifically want to see them. https://fedorahosted.org/freeipa/ticket/1738
2011-09-14 15:33:33 -05:00
def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
self.obj.suppress_netgroup_memberof(entry_attrs)
return (completed, dn)
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
api.register(host_add_managedby)
class host_remove_managedby(LDAPRemoveMember):
ticket 1669 - improve i18n docstring extraction This patch reverts the use of pygettext for i18n string extraction. It was originally introduced because the help documentation for commands are in the class docstring and module docstring. Docstrings are a Python construct whereby any string which immediately follows a class declaration, function/method declaration or appears first in a module is taken to be the documentation for that object. Python automatically assigns that string to the __doc__ variable associated with the object. Explicitly assigning to the __doc__ variable is equivalent and permitted. We mark strings in the source for i18n translation by embedding them in _() or ngettext(). Specialized extraction tools (e.g. xgettext) scan the source code looking for strings with those markers and extracts the string for inclusion in a translation catalog. It was mistakingly assumed one could not mark for translation Python docstrings. Since some docstrings are vital for our command help system some method had to be devised to extract docstrings for the translation catalog. pygettext has the ability to locate and extract docstrings and it was introduced to acquire the documentation for our commands located in module and class docstrings. However pygettext was too large a hammer for this task, it lacked any fined grained ability to extract only the docstrings we were interested in. In practice it extracted EVERY docstring in each file it was presented with. This caused a large number strings to be extracted for translation which had no reason to be translated, the string might have been internal code documentation never meant to be seen by users. Often the superfluous docstrings were long, complex and likely difficult to translate. This placed an unnecessary burden on our volunteer translators. Instead what is needed is some method to extract only those strings intended for translation. We already have such a mechanism and it is already widely used, namely wrapping strings intended for translation in calls to _() or _negettext(), i.e. marking a string for i18n translation. Thus the solution to the docstring translation problem is to mark the docstrings exactly as we have been doing, it only requires that instead of a bare Python docstring we instead assign the marked string to the __doc__ variable. Using the hypothetical class foo as an example. class foo(Command): ''' The foo command takes out the garbage. ''' Would become: class foo(Command): __doc__ = _('The foo command takes out the garbage.') But which docstrings need to be marked for translation? The makeapi tool knows how to iterate over every command in our public API. It was extended to validate every command's documentation and report if any documentation is missing or not marked for translation. That information was then used to identify each docstring in the code which needed to be transformed. In summary what this patch does is: * Remove the use of pygettext (modification to install/po/Makefile.in) * Replace every docstring with an explicit assignment to __doc__ where the rhs of the assignment is an i18n marking function. * Single line docstrings appearing in multi-line string literals (e.g. ''' or """) were replaced with single line string literals because the multi-line literals were introducing unnecessary whitespace and newlines in the string extracted for translation. For example: ''' The foo command takes out the garbage. ''' Would appear in the translation catalog as: "\n The foo command takes out the garbage.\n " The superfluous whitespace and newlines are confusing to translators and requires us to strip leading and trailing whitespace from the translation at run time. * Import statements were moved from below the docstring to above it. This was necessary because the i18n markers are imported functions and must be available before the the doc is parsed. Technically only the import of the i18n markers had to appear before the doc but stylistically it's better to keep all the imports together. * It was observed during the docstring editing process that the command documentation was inconsistent with respect to the use of periods to terminate a sentence. Some doc had a trailing period, others didn't. Consistency was enforced by adding a period to end of every docstring if one was missing.
2011-08-24 21:48:30 -05:00
__doc__ = _('Remove hosts that can manage this host.')
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
member_attributes = ['managedby']
has_output_params = LDAPRemoveMember.has_output_params + host_output_params
Suppress managed netgroups as indirect members of hosts. By design these managed netgroups are not supposed to show unless you specifically want to see them. https://fedorahosted.org/freeipa/ticket/1738
2011-09-14 15:33:33 -05:00
def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
self.obj.suppress_netgroup_memberof(entry_attrs)
return (completed, dn)
Add managedby to Host entries This will allow others to provision on behalf of the host. ticket 280
2010-11-10 15:47:29 -06:00
api.register(host_remove_managedby)
Reference in New Issue Copy Permalink