mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
ipa-adtrust-install: allow configuring of trust agents
Trust agents are IPA master without Samba which can serve information about users from trusted forests. Such IPA masters cannot be used to configure trust but they can resolve AD users and groups for IPA clients enrolled to them. Since support from both FreeIPA and SSSD is needed to enable trust agent support, we currently only consider those IPA masters which have been upgraded to FreeIPA 4.2 or later. Part of https://fedorahosted.org/freeipa/ticket/4951 Reviewed-By: Tomas Babej <tbabej@redhat.com>
This commit is contained in:
Alexander Bokovoy
Tomas Babej
parent
aa21600822
commit
14992a07fc
@ -61,6 +61,9 @@ def parse_options():
|
||||
parser.add_option("--add-sids", dest="add_sids", action="store_true",
|
||||
default=False, help="Add SIDs for existing users and" \
|
||||
" groups as the final step")
|
||||
parser.add_option("--add-agents", dest="add_agents", action="store_true",
|
||||
default=False, help="Add IPA masters to a list of hosts allowed to serve" \
|
||||
"information about users from trusted forests")
|
||||
parser.add_option("--enable-compat",
|
||||
dest="enable_compat", default=False, action="store_true",
|
||||
help="Enable support for trusted domains for old clients")
|
||||
@ -380,6 +383,84 @@ def main():
|
||||
smb.find_local_id_range()
|
||||
smb.create_instance()
|
||||
|
||||
if options.add_agents:
|
||||
# Find out IPA masters which are not part of the cn=adtrust agents
|
||||
# and propose them to be added to the list
|
||||
base_dn = api.env.basedn
|
||||
masters_dn = DN(('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), base_dn)
|
||||
agents_dn = DN(('cn', 'adtrust agents'), ('cn', 'sysaccounts'), ('cn', 'etc'), base_dn)
|
||||
new_agents = []
|
||||
entries_m = []
|
||||
entries_a = []
|
||||
try:
|
||||
# Search only masters which have support for domain levels
|
||||
# because only these masters will have SSSD recent enough to support AD trust agents
|
||||
(entries_m, truncated) = smb.admin_conn.find_entries(
|
||||
filter="(&(objectclass=ipaSupportedDomainLevelConfig)(!(ipaMaxDomainLevel=0)))",
|
||||
base_dn=masters_dn, attrs_list=['cn'], scope=ldap.SCOPE_ONELEVEL)
|
||||
except errors.NotFound:
|
||||
pass
|
||||
except (errors.DatabaseError, errors.NetworkError), e:
|
||||
print "Could not retrieve a list of existing IPA masters:"
|
||||
print unicode(e)
|
||||
|
||||
try:
|
||||
(entries_a, truncated) = smb.admin_conn.find_entries(filter="",
|
||||
base_dn=agents_dn, attrs_list=['member'], scope=ldap.SCOPE_BASE)
|
||||
except errors.NotFound:
|
||||
pass
|
||||
except (errors.DatabaseError, errors.NetworkError), e:
|
||||
print "Could not retrieve a list of adtrust agents:"
|
||||
print unicode(e)
|
||||
|
||||
if len(entries_m) > 0:
|
||||
existing_masters = [x['cn'][0] for x in entries_m]
|
||||
adtrust_agents = entries_a[0]['member']
|
||||
potential_agents = []
|
||||
for m in existing_masters:
|
||||
mdn = DN(('fqdn', m), api.env.container_host, api.env.basedn)
|
||||
found = False
|
||||
for a in adtrust_agents:
|
||||
if mdn == a:
|
||||
found = True
|
||||
break
|
||||
if not found:
|
||||
potential_agents += [[m, mdn]]
|
||||
|
||||
object_count = len(potential_agents)
|
||||
if object_count > 0:
|
||||
print ""
|
||||
print "WARNING: %d IPA masters are not yet able to serve information about users from trusted forests." \
|
||||
% (object_count)
|
||||
print "Installer can add them to the list of IPA masters allowed to access infromation about trusts."
|
||||
print "If you choose to do so, you also need to restart LDAP service on those masters."
|
||||
print "Refer to ipa-adtrust-install(1) man page for details."
|
||||
print ""
|
||||
if options.unattended:
|
||||
print "Unattended mode was selected, installer will NOT add other IPA masters to the list of allowed to"
|
||||
print "access information about trusted forests!"
|
||||
else:
|
||||
print "Do you want to allow following IPA masters to serve information about users from trusted forests?"
|
||||
for (name, dn) in potential_agents:
|
||||
if name == api.env.host:
|
||||
# Don't add this host here
|
||||
# it shouldn't be here as it was added by the adtrustinstance setup code
|
||||
continue
|
||||
if ipautil.user_input("IPA master [%s]?" % (name), default=False, allow_empty=False):
|
||||
new_agents += [[name, dn]]
|
||||
|
||||
if len(new_agents) > 0:
|
||||
# Add the CIFS and host principals to the 'adtrust agents' group
|
||||
# as 389-ds only operates with GroupOfNames, we have to use
|
||||
# the principal's proper dn as defined in self.cifs_agent
|
||||
service.add_principals_to_group(smb.admin_conn, agents_dn, "member",
|
||||
[x[1] for x in new_agents])
|
||||
print """
|
||||
WARNING: you MUST restart (e.g. ipactl restart) the following IPA masters in order
|
||||
to activate them to serve information about users from trusted forests:"""
|
||||
for x in new_agents:
|
||||
print x[0]
|
||||
|
||||
print """
|
||||
=============================================================================
|
||||
Setup complete
|
||||
|
||||
@ -76,7 +76,7 @@ are needed for the IPA domain which should point to all IPA servers:
|
||||
\(bu _kerberos._udp.Default-First-Site-Name._sites.dc._msdcs
|
||||
.TP
|
||||
\fB\-\-add\-sids\fR
|
||||
Add SIDs to existing users and groups as a final step of the
|
||||
Add SIDs to existing users and groups as on of final steps of the
|
||||
ipa\-adtrust\-install run. If there a many existing users and groups and a
|
||||
couple of replicas in the environment this operation might lead to a high
|
||||
replication traffic and a performance degradation of all IPA servers in the
|
||||
@ -85,6 +85,19 @@ ipa\-adtrust\-install is run and scheduled independently. To start this task
|
||||
you have to load an edited version of ipa-sidgen-task-run.ldif with the
|
||||
ldapmodify command info the directory server.
|
||||
.TP
|
||||
\fB\-\-add\-agents\fR
|
||||
Add IPA masters to the list that allows to serve information about
|
||||
users from trusted forests. Starting with FreeIPA 4.2, a regular IPA master
|
||||
can provide this information to SSSD clients. IPA masters aren't added
|
||||
to the list automatically as restart of the LDAP service on each of them
|
||||
is required. The host where ipa\-adtrust\-install is being run is added
|
||||
automatically.
|
||||
.IP
|
||||
Note that IPA masters where ipa\-adtrust\-install wasn't run, can serve
|
||||
information about users from trusted forests only if they are enabled
|
||||
via \ipa-adtrust\-install run on any other IPA master. At least SSSD
|
||||
version 1.13 on IPA master is required to be able to perform as a trust agent.
|
||||
.TP
|
||||
\fB\-U\fR, \fB\-\-unattended\fR
|
||||
An unattended installation that will never prompt for user input
|
||||
.TP
|
||||
|
||||
Loading…
Reference in New Issue
Block a user