IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-26 16:16:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

Move DS's Kerberos env vars to unit file

Browse Source 
The IPA specific env vars KRB5_KTNAME and KRB5CCNAME are now defined in
a instance specific ipa-env.conf unit file.

Fixes: https://pagure.io/freeipa/issue/7860
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Christian Heimes 2019-04-02 15:37:27 +02:00
parent e4621f1204
commit 1dfac4f5b7
7 changed files with 62 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
install/share/Makefile.am
View File

@ -39,6 +39,7 @@ dist_app_DATA = \
replica-acis.ldif \
replica-prevent-time-skew.ldif \
ds-nfiles.ldif \
ds-ipa-env.conf.template \
dns.ldif \
dnssec.ldif \
domainlevel.ldif \

5
install/share/ds-ipa-env.conf.template
View File

@ -0,0 +1,5 @@
# Installed and maintained by ipa update tools, please do not modify
[Service]
Environment=KRB5_KTNAME=$KRB5_KTNAME
Environment=KRB5CCNAME=$KRB5CCNAME

2
ipaplatform/base/paths.py
View File

@ -382,6 +382,8 @@ class BasePathNamespace:
VAR_LOG_DIRSRV_INSTANCE_TEMPLATE = "/var/log/dirsrv/slapd-%s"
SLAPD_INSTANCE_ACCESS_LOG_TEMPLATE = "/var/log/dirsrv/slapd-%s/access"
SLAPD_INSTANCE_ERROR_LOG_TEMPLATE = "/var/log/dirsrv/slapd-%s/errors"
SLAPD_INSTANCE_SYSTEMD_IPA_ENV_TEMPLATE = \
"/etc/systemd/system/dirsrv@%s.service.d/ipa-env.conf"
# Legacy 389 commands
LDIF2DB = '/usr/sbin/ldif2db'
DB2LDIF = '/usr/sbin/db2ldif'

63
ipaserver/install/dsinstance.py
View File

@ -26,7 +26,6 @@ import pwd
import os
import time
import tempfile
import stat
import fnmatch
from lib389 import DirSrv
@ -200,7 +199,6 @@ class DsInstance(service.Service):
self.nickname = 'Server-Cert'
self.sub_dict = None
self.domain = domain_name
self.serverid = None
self.master_fqdn = None
self.pkcs12_info = None
self.cacert_name = None
@ -216,9 +214,11 @@ class DsInstance(service.Service):
self.domainlevel = domainlevel
if realm_name:
self.suffix = ipautil.realm_to_suffix(self.realm)
self.serverid = ipaldap.realm_to_serverid(self.realm)
self.__setup_sub_dict()
else:
self.suffix = DN()
self.serverid = None
subject_base = ipautil.dn_attribute_property('_subject_base')
@ -245,7 +245,8 @@ class DsInstance(service.Service):
self.step("enabling referential integrity plugin", self.__add_referint_module)
self.step("configuring certmap.conf", self.__certmap_conf)
self.step("configure new location for managed entries", self.__repoint_managed_entries)
self.step("configure dirsrv ccache", self.configure_dirsrv_ccache)
self.step("configure dirsrv ccache and keytab",
self.configure_systemd_ipa_env)
self.step("enabling SASL mapping fallback",
self.__enable_sasl_mapping_fallback)
@ -521,7 +522,6 @@ class DsInstance(service.Service):
def __create_instance(self):
self.backup_state("serverid", self.serverid)
self.fstore.backup_file(paths.SYSCONFIG_DIRSRV)
# The new installer is api driven. We can pass it a log function
# and it will use it. Because of this, we can pass verbose true,
@ -756,21 +756,39 @@ class DsInstance(service.Service):
def __repoint_managed_entries(self):
self._ldap_mod("repoint-managed-entries.ldif", self.sub_dict)
def configure_dirsrv_ccache(self):
def configure_systemd_ipa_env(self):
pent = pwd.getpwnam(platformconstants.DS_USER)
ccache = paths.TMP_KRB5CC % pent.pw_uid
filepath = paths.SYSCONFIG_DIRSRV
if not os.path.exists(filepath):
# file doesn't exist; create it with correct ownership & mode
open(filepath, 'a').close()
os.chmod(filepath,
stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH)
os.chown(filepath, 0, 0)
template = os.path.join(
paths.USR_SHARE_IPA_DIR, "ds-ipa-env.conf.template"
)
sub_dict = dict(
KRB5_KTNAME=paths.DS_KEYTAB,
KRB5CCNAME=paths.TMP_KRB5CC % pent.pw_uid
)
conf = ipautil.template_file(template, sub_dict)
replacevars = {'KRB5CCNAME': ccache}
ipautil.backup_config_and_replace_variables(
self.fstore, filepath, replacevars=replacevars)
tasks.restore_context(filepath)
destfile = paths.SLAPD_INSTANCE_SYSTEMD_IPA_ENV_TEMPLATE % (
self.serverid
)
destdir = os.path.dirname(destfile)
if not os.path.isdir(destdir):
# create dirsrv-$SERVERID.service.d
os.mkdir(destdir, 0o755)
with open(destfile, 'w') as f:
os.fchmod(f.fileno(), 0o644)
f.write(conf)
tasks.restore_context(destfile)
# remove variables from old /etc/sysconfig/dirsrv file
if os.path.isfile(paths.SYSCONFIG_DIRSRV):
self.fstore.backup_file(paths.SYSCONFIG_DIRSRV)
ipautil.config_replace_variables(
paths.SYSCONFIG_DIRSRV,
removevars={'KRB5_KTNAME', 'KRB5CCNAME'}
)
# reload systemd to materialize new config file
tasks.systemd_daemon_reload()
def __managed_entries(self):
self._ldap_mod("managed-entries.ldif", self.sub_dict)
@ -1083,6 +1101,17 @@ class DsInstance(service.Service):
serverid)
installutils.rmtree(scripts)
# remove systemd unit file
unitfile = paths.SLAPD_INSTANCE_SYSTEMD_IPA_ENV_TEMPLATE % (
serverid
)
installutils.remove_file(unitfile)
try:
os.rmdir(os.path.dirname(unitfile))
except OSError:
# not empty
pass
# Just eat this state
self.restore_state("user_exists")

1
ipaserver/install/ipa_backup.py
View File

@ -375,6 +375,7 @@ class Backup(admintool.AdminTool):
for file in (
paths.SYSCONFIG_DIRSRV_INSTANCE % serverid,
paths.ETC_TMPFILESD_DIRSRV % serverid,
paths.SLAPD_INSTANCE_SYSTEMD_IPA_ENV_TEMPLATE % serverid,
):
if os.path.exists(file):
self.files.append(file)

4
ipaserver/install/krbinstance.py
View File

@ -386,10 +386,6 @@ class KrbInstance(service.Service):
self.fstore.backup_file(paths.DS_KEYTAB)
installutils.create_keytab(paths.DS_KEYTAB, ldap_principal)
vardict = {"KRB5_KTNAME": paths.DS_KEYTAB}
ipautil.config_replace_variables(paths.SYSCONFIG_DIRSRV,
replacevars=vardict)
pent = pwd.getpwnam(constants.DS_USER)
os.chown(paths.DS_KEYTAB, pent.pw_uid, pent.pw_gid)

15
ipaserver/install/server/upgrade.py
View File

@ -1812,13 +1812,12 @@ def upgrade_configuration():
fqdn = api.env.host
# Ok, we are an IPA server, do the additional tests
ds_serverid = ipaldap.realm_to_serverid(api.env.realm)
ds = dsinstance.DsInstance()
ds = dsinstance.DsInstance(realm_name=api.env.realm)
# start DS, CA will not start without running DS, and cause error
ds_running = ds.is_running()
if not ds_running:
ds.start(ds_serverid)
ds.start(ds.serverid)
if not sysupgrade.get_upgrade_state('ntpd', 'ntpd_cleaned'):
ntpd_cleanup(fqdn, fstore)
@ -1872,7 +1871,7 @@ def upgrade_configuration():
paths.CA_CS_CFG_PATH, 'ca.crl.MasterCRL.enableCRLUpdates', '=')
sub_dict['CLONE']='#' if crl.lower() == 'true' else ''
ds_dirname = dsinstance.config_dirname(ds_serverid)
ds_dirname = dsinstance.config_dirname(ds.serverid)
upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
os.path.join(paths.USR_SHARE_IPA_DIR,
@ -1948,16 +1947,16 @@ def upgrade_configuration():
http.enable_and_start_oddjobd()
ds.configure_dirsrv_ccache()
ds.configure_systemd_ipa_env()
update_replica_config(ipautil.realm_to_suffix(api.env.realm))
if ca.is_configured():
update_replica_config(DN(('o', 'ipaca')))
ds.stop(ds_serverid)
ds.stop(ds.serverid)
fix_schema_file_syntax()
remove_ds_ra_cert(subject_base)
ds.start(ds_serverid)
ds.start(ds.serverid)
ds.fqdn = fqdn
ds.realm = api.env.realm
@ -2116,7 +2115,7 @@ def upgrade_configuration():
enable_certauth(krb)
if not ds_running:
ds.stop(ds_serverid)
ds.stop(ds.serverid)
if ca.is_configured():
if ca_running and not ca.is_running():