Retrieve all cert profiles from the CA with --all

Normally IPA only returns the locally-stored certificate profiles.
In order for certmonger to request CA subsystem certificates using
cert_request we need the full set of profiles. Return them all
when --all is provided and the requesting user has permission.

Related: https://pagure.io/freeipa/issue/9738

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>

install/share/delegation.ldif

@@ -308,6 +308,19 @@ changetype: modify
 add: aci
 aci: (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,$SUFFIX";)
 
+dn: cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX
+changetype: add
+objectClass: top
+objectClass: groupofnames
+objectClass: ipapermission
+cn: List all profiles from the CA
+member: cn=ipaservers,cn=hostgroups,cn=accounts,$SUFFIX
+
+dn: $SUFFIX
+changetype: modify
+add: aci
+aci: (targetattr = "objectclass")(target = "ldap:///cn=list all profiles,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:List all profiles from the CA" ; allow (write) groupdn = "ldap:///cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX";)
+
 dn: cn=External IdP server Administrators,cn=privileges,cn=pbac,$SUFFIX
 changetype: add
 objectClass: top

install/updates/40-delegation.update

@@ -140,6 +140,14 @@ default:objectClass: top
 default:objectClass: nsContainer
 default:cn: request certificate ignore caacl
 
+dn: cn=list all profiles,cn=virtual operations,cn=etc,$SUFFIX
+default:objectClass: top
+default:objectClass: nsContainer
+default:cn: list all profiles
+
+dn: $SUFFIX
+add:aci: (targetattr = "objectclass")(target = "ldap:///cn=list all profiles,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:List all profiles from the CA" ; allow (write) groupdn = "ldap:///cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX";)
+
 dn: cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,$SUFFIX
 default:objectClass: top
 default:objectClass: groupofnames
@@ -300,6 +308,16 @@ default:objectClass: nestedgroup
 default:cn: DNS Servers
 default:description: DNS Servers
 
+dn: cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX
+default: objectClass: top
+default: objectClass: groupofnames
+default: objectClass: ipapermission
+default: cn: List all profiles from the CA
+default: member: cn=ipaservers,cn=hostgroups,cn=accounts,$SUFFIX
+
+dn: $SUFFIX
+add: aci: (targetattr = "objectclass")(target = "ldap:///cn=list all profiles,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:List all profiles from the CA" ; allow (write) groupdn = "ldap:///cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX";)
+
 dn: cn=External IdP server Administrators,cn=privileges,cn=pbac,$SUFFIX
 default:objectClass: top
 default:objectClass: groupofnames

ipapython/dogtag.py

@@ -63,6 +63,14 @@ INCLUDED_PROFILES = {
 
 DEFAULT_PROFILE = u'caIPAserviceCert'
 KDC_PROFILE = u'KDCs_PKINIT_Certs'
+OCSP_PROFILE = 'caOCSPCert'
+SUBSYSTEM_PROFILE = 'caSubsystemCert'
+AUDIT_PROFILE = 'caSignedLogCert'
+CACERT_PROFILE = 'caCACert'
+CASERVER_PROFILE = 'caServerCert'
+KRA_AUDIT_PROFILE = 'caAuditSigningCert'
+KRA_STORAGE_PROFILE = 'caStorageCert'
+KRA_TRANSPORT_PROFILE = 'caTransportCert'
 
 
 if six.PY3:

ipaserver/plugins/certprofile.py

@@ -2,6 +2,7 @@
 # Copyright (C) 2015  FreeIPA Contributors see COPYING for license
 #
 
+import logging
 import re
 
 from ipalib import api, Bool, Str
@@ -9,9 +10,11 @@ from ipalib.plugable import Registry
 from .baseldap import (
     LDAPObject, LDAPSearch, LDAPCreate,
     LDAPDelete, LDAPUpdate, LDAPRetrieve)
+from .virtual import VirtualCommand
 from ipalib.request import context
 from ipalib import ngettext
 from ipalib.text import _
+from ipapython.dn import DN
 from ipapython.dogtag import INCLUDED_PROFILES
 from ipapython.version import API_VERSION
 
@@ -71,6 +74,7 @@ The following restrictions apply to profiles managed by IPA:
 
 """)
 
+logger = logging.getLogger(__name__)
 
 register = Registry()
 
@@ -182,17 +186,49 @@ class certprofile(LDAPObject):
     }
 
 
-
 @register()
-class certprofile_find(LDAPSearch):
+class certprofile_find(LDAPSearch, VirtualCommand):
     __doc__ = _("Search for Certificate Profiles.")
     msg_summary = ngettext(
         '%(count)d profile matched', '%(count)d profiles matched', 0
     )
 
+    operation = "list all profiles"
+
     def execute(self, *args, **kwargs):
         ca_enabled_check(self.api)
-        return super(certprofile_find, self).execute(*args, **kwargs)
+        result = super(certprofile_find, self).execute(*args, **kwargs)
+
+        if len(args) == 0 and kwargs.get('all'):
+            try:
+                self.check_access()
+            except errors.ACIError:
+                logger.debug("Virtual request for profiles failed")
+            else:
+                with self.api.Backend.ra_certprofile as profile_api:
+                    profiles = profile_api.list_profiles()
+
+                ipa_list = []
+                for entry in result['result']:
+                    ipa_list.append(entry['cn'][0])
+
+                for entry in profiles:
+                    if entry['profile_id'] in ipa_list:
+                        continue
+                    new = {
+                        # We don't have a DN for profiles that come from the CA
+                        # so fill something in so all the entries contain the
+                        # same set of attributes.
+                        'dn': DN('cn={}'.format(entry['profile_id'])),
+                        'cn': [entry['profile_id']],
+                        'description': [entry['profile_name']],
+                        'ipacertprofilestoreissued': [False],
+                    }
+                    result['result'].append(new)
+
+        result['count'] = len(result['result'])
+
+        return result
 
 
 @register()

ipatests/test_xmlrpc/test_plugins_plugin.py

@@ -22,7 +22,7 @@ class TestPlugins(XMLRPC_test):
         return cmd_result
 
     def assert_result(self, cmd_result):
-        assert tuple(cmd_result.keys()) == self.EXPECTED_KEYS
+        assert sorted(tuple(cmd_result.keys())) == sorted(self.EXPECTED_KEYS)
         result = cmd_result["result"]
         assert isinstance(result, dict)