IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Change the way has_keytab is determined, also check for password.

Browse Source 
We need an indicator to see if a keytab has been set on host and
service entries. We also need a way to know if a one-time password is
set on a host.

This adds an ACI that grants search on userPassword and
krbPrincipalKey so we can do an existence search on them. This way
we can tell if the attribute is set and create a fake attribute
accordingly.

When a userPassword is set on a host a keytab is generated against
that password so we always set has_keytab to False if a password
exists. This is fine because when keytab gets generated for the
host the password is removed (hence one-time).

This adds has_keytab/has_password to the user, host and service plugins.

ticket https://fedorahosted.org/freeipa/ticket/1538
This commit is contained in:
Rob Crittenden
2011-08-22 16:24:07 -04:00
committed by Martin Kosek
parent 0147ef5b73
commit 109b79a7ac
16 changed files with 185 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tests/test_xmlrpc/test_attr.py
View File

@@ -69,6 +69,8 @@ class test_attr(Declarative):
dn=lambda x: DN(x) == \
DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
api.env.basedn),
has_keytab=False,
has_password=False,
),
),
),
@@ -91,6 +93,8 @@ class test_attr(Declarative):
mail=[u'test@example.com'],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -115,6 +119,8 @@ class test_attr(Declarative):
mail=[u'test@example.com', u'test2@example.com'],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -140,6 +146,8 @@ class test_attr(Declarative):
memberof_group=[u'ipausers'],
telephonenumber=[u'410-555-1212', u'301-555-1212'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -165,6 +173,8 @@ class test_attr(Declarative):
memberof_group=[u'ipausers'],
telephonenumber=[u'301-555-1212'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -190,6 +200,8 @@ class test_attr(Declarative):
memberof_group=[u'ipausers'],
telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -233,6 +245,8 @@ class test_attr(Declarative):
memberof_group=[u'ipausers'],
telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -258,6 +272,8 @@ class test_attr(Declarative):
memberof_group=[u'ipausers'],
telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,

4
tests/test_xmlrpc/test_group_plugin.py
View File

@@ -637,6 +637,8 @@ class test_group(Declarative):
dn=lambda x: DN(x) == \
DN(('uid',user1),('cn','users'),('cn','accounts'),
api.env.basedn),
has_keytab=False,
has_password=False,
),
),
),
@@ -753,6 +755,8 @@ class test_group(Declarative):
dn=lambda x: DN(x) == \
DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
api.env.basedn),
has_keytab=False,
has_password=False,
),
),
),

22
tests/test_xmlrpc/test_host_plugin.py
View File

@@ -109,6 +109,8 @@ class test_host(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[fqdn1],
has_keytab=False,
has_password=False,
),
),
),
@@ -140,6 +142,7 @@ class test_host(Declarative):
l=[u'Undisclosed location 1'],
krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
has_keytab=False,
has_password=False,
managedby_host=[fqdn1],
),
),
@@ -168,7 +171,8 @@ class test_host(Declarative):
managedby_host=[fqdn1],
managing_host=[fqdn1],
ipauniqueid=[fuzzy_uuid],
has_keytab=False
has_keytab=False,
has_password=False,
),
),
),
@@ -189,6 +193,8 @@ class test_host(Declarative):
l=[u'Undisclosed location 1'],
krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
managedby_host=[u'%s' % fqdn1],
has_keytab=False,
has_password=False,
),
],
),
@@ -219,6 +225,8 @@ class test_host(Declarative):
ipauniqueid=[fuzzy_uuid],
managedby_host=[u'%s' % fqdn1],
managing_host=[u'%s' % fqdn1],
has_keytab=False,
has_password=False,
),
],
),
@@ -265,6 +273,7 @@ class test_host(Declarative):
l=[u'Undisclosed location 1'],
krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
has_keytab=False,
has_password=False,
managedby_host=[u'%s' % fqdn1],
usercertificate=[base64.b64decode(servercert)],
valid_not_before=fuzzy_date,
@@ -300,6 +309,8 @@ class test_host(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[u'%s' % fqdn3],
has_keytab=False,
has_password=False,
),
),
),
@@ -326,6 +337,8 @@ class test_host(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[u'%s' % fqdn4],
has_keytab=False,
has_password=False,
),
),
),
@@ -369,6 +382,7 @@ class test_host(Declarative):
l=[u'Undisclosed location 2'],
krbprincipalname=[u'host/%s@%s' % (fqdn3, api.env.realm)],
has_keytab=False,
has_password=False,
managedby_host=[u'%s' % fqdn3, u'%s' % fqdn1],
),
),
@@ -468,6 +482,8 @@ class test_host(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[u'%s' % fqdn1],
has_keytab=False,
has_password=False,
),
),
),
@@ -479,7 +495,7 @@ class test_host(Declarative):
value=service1,
summary=u'Added service "%s"' % service1,
result=dict(
dn=service1dn,
dn=lambda x: DN(x) == service1dn,
krbprincipalname=[service1],
objectclass=objectclasses.service,
managedby_host=[fqdn1],
@@ -539,6 +555,8 @@ class test_host(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[u'%s' % fqdn2],
has_keytab=False,
has_password=False,
),
),
),

2
tests/test_xmlrpc/test_hostgroup_plugin.py
View File

@@ -121,6 +121,8 @@ class test_hostgroup(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[fqdn1],
has_keytab=False,
has_password=False,
),
),
),

2
tests/test_xmlrpc/test_krbtpolicy.py
View File

@@ -116,6 +116,8 @@ class test_krbtpolicy(Declarative):
[DN(('cn',user1),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid',user1),('cn','users'),('cn','accounts'),
api.env.basedn)

11
tests/test_xmlrpc/test_nesting.py
View File

@@ -186,6 +186,8 @@ class test_nesting(Declarative):
[DN(('cn',user1),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid',user1),('cn','users'),('cn','accounts'),
api.env.basedn)
@@ -224,6 +226,8 @@ class test_nesting(Declarative):
[DN(('cn',user2),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid',user2),('cn','users'),('cn','accounts'),
api.env.basedn)
@@ -262,6 +266,8 @@ class test_nesting(Declarative):
[DN(('cn',user3),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid',user3),('cn','users'),('cn','accounts'),
api.env.basedn)
@@ -300,6 +306,8 @@ class test_nesting(Declarative):
[DN(('cn',user4),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid',user4),('cn','users'),('cn','accounts'),
api.env.basedn)
@@ -676,6 +684,8 @@ class test_nesting(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[fqdn1],
has_keytab=False,
has_password=False,
),
),
),
@@ -801,6 +811,7 @@ class test_nesting(Declarative):
l=[u'Undisclosed location 1'],
krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
has_keytab=False,
has_password=False,
managedby_host=[fqdn1],
memberof_hostgroup = [u'testhostgroup2'],
memberofindirect_hostgroup = [u'testhostgroup1'],

6
tests/test_xmlrpc/test_netgroup_plugin.py
View File

@@ -168,6 +168,8 @@ class test_netgroup(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[host1],
has_keytab=False,
has_password=False,
),
),
),
@@ -225,6 +227,8 @@ class test_netgroup(Declarative):
[DN(('cn',user1),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid',user1),('cn','users'),('cn','accounts'),
api.env.basedn),
@@ -262,6 +266,8 @@ class test_netgroup(Declarative):
[DN(('cn',user2),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid',user2),('cn','users'),('cn','accounts'),
api.env.basedn),

14
tests/test_xmlrpc/test_replace.py
View File

@@ -73,6 +73,8 @@ class test_replace(Declarative):
[DN(('cn',user1),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
api.env.basedn),
@@ -98,6 +100,8 @@ class test_replace(Declarative):
mail=[u'test1@example.com', u'test3@example.com'],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -122,6 +126,8 @@ class test_replace(Declarative):
mail=[u'test4@example.com'],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -146,6 +152,8 @@ class test_replace(Declarative):
mail=[u'test6@example.com', u'test7@example.com', u'test5@example.com'],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -169,6 +177,8 @@ class test_replace(Declarative):
gidnumber=[fuzzy_digits],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -193,6 +203,8 @@ class test_replace(Declarative):
initials=[u'ABC'],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -216,6 +228,8 @@ class test_replace(Declarative):
gidnumber=[fuzzy_digits],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,

8
tests/test_xmlrpc/test_service_plugin.py
View File

@@ -47,7 +47,7 @@ fd.close()
badservercert = 'MIICbzCCAdigAwIBAgICA/4wDQYJKoZIhvcNAQEFBQAwKTEnMCUGA1UEAxMeSVBBIFRlc3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTEwMDgwOTE1MDIyN1oXDTIwMDgwOTE1MDIyN1owKTEMMAoGA1UEChMDSVBBMRkwFwYDVQQDExBwdW1hLmdyZXlvYWsuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwYbfEOQPgGenPn9vt1JFKvWm/Je3y2tawGWA3LXDuqfFJyYtZ8ib3TcBUOnLk9WK5g2qCwHaNlei7bj8ggIfr5hegAVe10cun+wYErjnYo7hsHYd+57VZezeipWrXu+7NoNd4+c4A5lk4A/xJay9j3bYx2oOM8BEox4xWYoWge1ljPrc5JK46f0X7AGW4F2VhnKPnf8rwSuzI1U8VGjutyM9TWNy3m9KMWeScjyG/ggIpOjUDMV7HkJL0Di61lznR9jXubpiEC7gWGbTp84eGl/Nn9bgK1AwHfJ2lHwfoY4uiL7ge1gyP6EvuUlHoBzdb7pekiX28iePjW3iEG9IawIDAQABoyIwIDARBglghkgBhvhCAQEEBAMCBkAwCwYDVR0PBAQDAgUgMA0GCSqGSIb3DQEBBQUAA4GBACRESLemRV9BPxfEgbALuxH5oE8jQm8WZ3pm2pALbpDlAd9wQc3yVf6RtkfVthyDnM18bg7IhxKpd77/p3H8eCnS8w5MLVRda6ktUC6tGhFTS4QKAf0WyDGTcIgkXbeDw0OPAoNHivoXbIXIIRxlw/XgaSaMzJQDBG8iROsN4kCv'
class test_host(Declarative):
class test_service(Declarative):
cleanup_commands = [
('host_del', [fqdn1], {}),
@@ -99,6 +99,8 @@ class test_host(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[u'%s' % fqdn1],
has_keytab=False,
has_password=False,
),
),
),
@@ -125,6 +127,8 @@ class test_host(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[u'%s' % fqdn2],
has_keytab=False,
has_password=False,
),
),
),
@@ -151,6 +155,8 @@ class test_host(Declarative):
objectclass=objectclasses.host,
ipauniqueid=[fuzzy_uuid],
managedby_host=[u'%s' % fqdn3.lower()],
has_keytab=False,
has_password=False,
),
),
),

30
tests/test_xmlrpc/test_user_plugin.py
View File

@@ -104,6 +104,8 @@ class test_user(Declarative):
[DN(('cn',user1),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
api.env.basedn),
@@ -140,6 +142,8 @@ class test_user(Declarative):
gidnumber=[fuzzy_digits],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
value=user1,
summary=None,
@@ -178,6 +182,8 @@ class test_user(Declarative):
[DN(('cn','global_policy'),('cn',api.env.realm),
('cn','kerberos'),api.env.basedn)],
'nsaccountlock': False,
'has_keytab': False,
'has_password': False,
'displayname': [u'Test User1'],
'cn': [u'Test User1'],
'initials': [u'TU'],
@@ -206,6 +212,8 @@ class test_user(Declarative):
sn=[u'User1'],
uid=[user1],
nsaccountlock=False,
has_keytab=False,
has_password=False,
uidnumber=[fuzzy_digits],
gidnumber=[fuzzy_digits],
),
@@ -233,6 +241,8 @@ class test_user(Declarative):
sn=[u'Administrator'],
uid=[u'admin'],
nsaccountlock=False,
has_keytab=True,
has_password=True,
uidnumber=[fuzzy_digits],
gidnumber=[fuzzy_digits],
),
@@ -246,6 +256,8 @@ class test_user(Declarative):
sn=[u'User1'],
uid=[user1],
nsaccountlock=False,
has_keytab=False,
has_password=False,
uidnumber=[fuzzy_digits],
gidnumber=[fuzzy_digits],
),
@@ -273,6 +285,8 @@ class test_user(Declarative):
sn=[u'Administrator'],
uid=[u'admin'],
nsaccountlock=False,
has_keytab=True,
has_password=True,
uidnumber=[fuzzy_digits],
gidnumber=[fuzzy_digits],
),
@@ -326,6 +340,8 @@ class test_user(Declarative):
gidnumber=[fuzzy_digits],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "tuser1"',
value=user1,
@@ -359,6 +375,8 @@ class test_user(Declarative):
gidnumber=[fuzzy_digits],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=None,
value=user1,
@@ -381,6 +399,8 @@ class test_user(Declarative):
gidnumber=[fuzzy_digits],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "%s"' % user1,
value=user1,
@@ -409,6 +429,8 @@ class test_user(Declarative):
gidnumber=[fuzzy_digits],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
),
summary=u'Modified user "%s"' % renameduser1,
value=renameduser1,
@@ -475,6 +497,8 @@ class test_user(Declarative):
[DN(('cn',user1),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
api.env.basedn),
@@ -513,6 +537,8 @@ class test_user(Declarative):
[DN(('cn',user2),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid','tuser2'),('cn','users'),('cn','accounts'),
api.env.basedn),
@@ -542,6 +568,8 @@ class test_user(Declarative):
gidnumber=[fuzzy_digits],
memberof_group=[u'ipausers'],
nsaccountlock=False,
has_keytab=False,
has_password=False,
manager=[user1],
),
summary=u'Modified user "%s"' % user2,
@@ -655,6 +683,8 @@ class test_user(Declarative):
[DN(('cn',user1),('cn','groups'),('cn','accounts'),
api.env.basedn)],
memberof_group=[u'ipausers'],
has_keytab=False,
has_password=False,
dn=lambda x: DN(x) == \
DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
api.env.basedn),