diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif index e35aeeef4..eca77488c 100644 --- a/install/share/delegation.ldif +++ b/install/share/delegation.ldif @@ -308,6 +308,19 @@ changetype: modify add: aci aci: (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,$SUFFIX";) +dn: cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX +changetype: add +objectClass: top +objectClass: groupofnames +objectClass: ipapermission +cn: List all profiles from the CA +member: cn=ipaservers,cn=hostgroups,cn=accounts,$SUFFIX + +dn: $SUFFIX +changetype: modify +add: aci +aci: (targetattr = "objectclass")(target = "ldap:///cn=list all profiles,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:List all profiles from the CA" ; allow (write) groupdn = "ldap:///cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX";) + dn: cn=External IdP server Administrators,cn=privileges,cn=pbac,$SUFFIX changetype: add objectClass: top diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index 2704b6776..d385fa648 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -140,6 +140,14 @@ default:objectClass: top default:objectClass: nsContainer default:cn: request certificate ignore caacl +dn: cn=list all profiles,cn=virtual operations,cn=etc,$SUFFIX +default:objectClass: top +default:objectClass: nsContainer +default:cn: list all profiles + +dn: $SUFFIX +add:aci: (targetattr = "objectclass")(target = "ldap:///cn=list all profiles,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:List all profiles from the CA" ; allow (write) groupdn = "ldap:///cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX";) + dn: cn=Request Certificate ignoring CA ACLs,cn=permissions,cn=pbac,$SUFFIX default:objectClass: top default:objectClass: groupofnames @@ -300,6 +308,16 @@ default:objectClass: nestedgroup default:cn: DNS Servers default:description: DNS Servers +dn: cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX +default: objectClass: top +default: objectClass: groupofnames +default: objectClass: ipapermission +default: cn: List all profiles from the CA +default: member: cn=ipaservers,cn=hostgroups,cn=accounts,$SUFFIX + +dn: $SUFFIX +add: aci: (targetattr = "objectclass")(target = "ldap:///cn=list all profiles,cn=virtual operations,cn=etc,$SUFFIX" )(version 3.0 ; acl "permission:List all profiles from the CA" ; allow (write) groupdn = "ldap:///cn=List all profiles from the CA,cn=permissions,cn=pbac,$SUFFIX";) + dn: cn=External IdP server Administrators,cn=privileges,cn=pbac,$SUFFIX default:objectClass: top default:objectClass: groupofnames diff --git a/ipapython/dogtag.py b/ipapython/dogtag.py index 795bf681a..8cfc0c041 100644 --- a/ipapython/dogtag.py +++ b/ipapython/dogtag.py @@ -63,6 +63,14 @@ INCLUDED_PROFILES = { DEFAULT_PROFILE = u'caIPAserviceCert' KDC_PROFILE = u'KDCs_PKINIT_Certs' +OCSP_PROFILE = 'caOCSPCert' +SUBSYSTEM_PROFILE = 'caSubsystemCert' +AUDIT_PROFILE = 'caSignedLogCert' +CACERT_PROFILE = 'caCACert' +CASERVER_PROFILE = 'caServerCert' +KRA_AUDIT_PROFILE = 'caAuditSigningCert' +KRA_STORAGE_PROFILE = 'caStorageCert' +KRA_TRANSPORT_PROFILE = 'caTransportCert' if six.PY3: diff --git a/ipaserver/plugins/certprofile.py b/ipaserver/plugins/certprofile.py index 978fce8a5..5b27307af 100644 --- a/ipaserver/plugins/certprofile.py +++ b/ipaserver/plugins/certprofile.py @@ -2,6 +2,7 @@ # Copyright (C) 2015 FreeIPA Contributors see COPYING for license # +import logging import re from ipalib import api, Bool, Str @@ -9,9 +10,11 @@ from ipalib.plugable import Registry from .baseldap import ( LDAPObject, LDAPSearch, LDAPCreate, LDAPDelete, LDAPUpdate, LDAPRetrieve) +from .virtual import VirtualCommand from ipalib.request import context from ipalib import ngettext from ipalib.text import _ +from ipapython.dn import DN from ipapython.dogtag import INCLUDED_PROFILES from ipapython.version import API_VERSION @@ -71,6 +74,7 @@ The following restrictions apply to profiles managed by IPA: """) +logger = logging.getLogger(__name__) register = Registry() @@ -182,17 +186,49 @@ class certprofile(LDAPObject): } - @register() -class certprofile_find(LDAPSearch): +class certprofile_find(LDAPSearch, VirtualCommand): __doc__ = _("Search for Certificate Profiles.") msg_summary = ngettext( '%(count)d profile matched', '%(count)d profiles matched', 0 ) + operation = "list all profiles" + def execute(self, *args, **kwargs): ca_enabled_check(self.api) - return super(certprofile_find, self).execute(*args, **kwargs) + result = super(certprofile_find, self).execute(*args, **kwargs) + + if len(args) == 0 and kwargs.get('all'): + try: + self.check_access() + except errors.ACIError: + logger.debug("Virtual request for profiles failed") + else: + with self.api.Backend.ra_certprofile as profile_api: + profiles = profile_api.list_profiles() + + ipa_list = [] + for entry in result['result']: + ipa_list.append(entry['cn'][0]) + + for entry in profiles: + if entry['profile_id'] in ipa_list: + continue + new = { + # We don't have a DN for profiles that come from the CA + # so fill something in so all the entries contain the + # same set of attributes. + 'dn': DN('cn={}'.format(entry['profile_id'])), + 'cn': [entry['profile_id']], + 'description': [entry['profile_name']], + 'ipacertprofilestoreissued': [False], + } + result['result'].append(new) + + result['count'] = len(result['result']) + + return result @register() diff --git a/ipatests/test_xmlrpc/test_plugins_plugin.py b/ipatests/test_xmlrpc/test_plugins_plugin.py index e35d9f044..30fa5ac68 100644 --- a/ipatests/test_xmlrpc/test_plugins_plugin.py +++ b/ipatests/test_xmlrpc/test_plugins_plugin.py @@ -22,7 +22,7 @@ class TestPlugins(XMLRPC_test): return cmd_result def assert_result(self, cmd_result): - assert tuple(cmd_result.keys()) == self.EXPECTED_KEYS + assert sorted(tuple(cmd_result.keys())) == sorted(self.EXPECTED_KEYS) result = cmd_result["result"] assert isinstance(result, dict)