IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Don't set delegation flag in client, we're using S4U2Proxy now

Browse Source 
A forwardable ticket is still required but we no longer need to send
the TGT to the IPA server. A new flag, --delegate, is available if
the old behavior is required.

Set the minimum n-v-r for mod_auth_kerb and krb5-server to pick up
needed patches for S4U2Proxy to work.

https://fedorahosted.org/freeipa/ticket/1098
https://fedorahosted.org/freeipa/ticket/2246
This commit is contained in:
Rob Crittenden 2012-02-15 17:06:54 +01:00 committed by Martin Kosek
parent 95b1848f19
commit 2da6d6e746
7 changed files with 33 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
freeipa.spec.in
View File

@ -93,17 +93,13 @@ Requires(pre): 389-ds-base >= 1.2.10-0.5.a5
Requires: openldap-clients
Requires: nss
Requires: nss-tools
%if 0%{?fedora} >= 16
Requires: krb5-server >= 1.9.1-15
%else
Requires: krb5-server
%endif
Requires: krb5-server >= 1.9.2-6
Requires: krb5-pkinit-openssl
Requires: cyrus-sasl-gssapi%{?_isa}
Requires: ntp
Requires: httpd
Requires: mod_wsgi
Requires: mod_auth_kerb >= 5.4-9
Requires: mod_auth_kerb >= 5.4-8
Requires: mod_nss >= 1.0.8-10
Requires: python-ldap
Requires: python-krbV
@ -672,8 +668,11 @@ fi
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
%changelog
* Tue Jan 31 2012 Rob Crittenden <rcritten@redhat.com> - 2.99.0-15
- Set min for krb5-server to 1.9.2-6 to pick up needed s4u2proxy patches
* Wed Jan 11 2012 Rob Crittenden <rcritten@redhat.com> - 2.99.0-14
- Set min for mod_auth_kerb to 5.4-9 to pick up s4u2proxy support
- Set min for mod_auth_kerb to 5.4-8 to pick up s4u2proxy support
* Fri Dec 9 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.99.0-13
- Fix dependency for samba4-devel package

2
install/share/bootstrap-template.ldif
View File

@ -174,7 +174,7 @@ objectClass: groupOfPrincipals
objectClass: top
cn: ipa-http-delegation
memberPrincipal: HTTP/$HOST@$REALM
ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=etc,$SUFFIX
ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
changetype: add

3
ipa.1
View File

@ -37,6 +37,9 @@ Load configuration from \fIFILE\fR.
\fB\-d\fR, \fB\-\-debug\fR
Produce full debugging output.
.TP
\fB\-\-\-delegate\fR
Delegate the user's TGT to the IPA server
.TP
\fB\-e\fR \fIKEY=VAL\fR
Set environmental variable \fIKEY\fR to the value \fIVAL\fR. This option overrides configuration files.
.TP

2
ipalib/backend.py
View File

@ -110,7 +110,7 @@ class Executioner(Backend):
self.Backend.ldap2.connect(ccache=ccache)
else:
self.Backend.xmlclient.connect(verbose=(self.env.verbose >= 2),
fallback=self.env.fallback)
fallback=self.env.fallback, delegate=self.env.delegate)
if client_ip is not None:
setattr(context, "client_ip", client_ip)

1
ipalib/constants.py
View File

@ -139,6 +139,7 @@ DEFAULT_CONFIG = (
('prompt_all', False),
('interactive', True),
('fallback', True),
('delegate', False),
# Enable certain optional plugins:
('enable_ra', False),

5
ipalib/plugable.py
View File

@ -530,6 +530,9 @@ class API(DictProxy):
parser.add_option('-d', '--debug', action='store_true',
help='Produce full debuging output',
)
parser.add_option('--delegate', action='store_true',
help='Delegate the TGT to the IPA server',
)
parser.add_option('-v', '--verbose', action='count',
help='Produce more verbose output. A second -v displays the XML-RPC request',
)
@ -570,7 +573,7 @@ class API(DictProxy):
pass
overrides[str(key.strip())] = value.strip()
for key in ('conf', 'debug', 'verbose', 'prompt_all', 'interactive',
'fallback'):
'fallback', 'delegate'):
value = getattr(options, key, None)
if value is not None:
overrides[key] = value

24
ipalib/rpc.py
View File

@ -232,6 +232,7 @@ class KerbTransport(SSLTransport):
"""
Handles Kerberos Negotiation authentication to an XML-RPC server.
"""
flags = kerberos.GSS_C_MUTUAL_FLAG | kerberos.GSS_C_SEQUENCE_FLAG
def _handle_exception(self, e, service=None):
(major, minor) = ipautil.get_gsserror(e)
@ -257,10 +258,7 @@ class KerbTransport(SSLTransport):
service = "HTTP@" + host.split(':')[0]
try:
(rc, vc) = kerberos.authGSSClientInit(service,
kerberos.GSS_C_DELEG_FLAG |
kerberos.GSS_C_MUTUAL_FLAG |
kerberos.GSS_C_SEQUENCE_FLAG)
(rc, vc) = kerberos.authGSSClientInit(service, self.flags)
except kerberos.GSSError, e:
self._handle_exception(e)
@ -284,6 +282,14 @@ class KerbTransport(SSLTransport):
return (host, extra_headers, x509)
class DelegatedKerbTransport(KerbTransport):
"""
Handles Kerberos Negotiation authentication and TGT delegation to an
XML-RPC server.
"""
flags = kerberos.GSS_C_DELEG_FLAG | kerberos.GSS_C_MUTUAL_FLAG | \
kerberos.GSS_C_SEQUENCE_FLAG
class xmlclient(Connectible):
"""
Forwarding backend plugin for XML-RPC client.
@ -303,7 +309,7 @@ class xmlclient(Connectible):
"""
if not hasattr(self.conn, '_ServerProxy__transport'):
return None
if isinstance(self.conn._ServerProxy__transport, KerbTransport):
if type(self.conn._ServerProxy__transport) in (KerbTransport, DelegatedKerbTransport):
scheme = "https"
else:
scheme = "http"
@ -337,14 +343,18 @@ class xmlclient(Connectible):
return servers
def create_connection(self, ccache=None, verbose=False, fallback=True):
def create_connection(self, ccache=None, verbose=False, fallback=True,
delegate=False):
servers = self.get_url_list()
serverproxy = None
for server in servers:
kw = dict(allow_none=True, encoding='UTF-8')
kw['verbose'] = verbose
if server.startswith('https://'):
kw['transport'] = KerbTransport()
if delegate:
kw['transport'] = DelegatedKerbTransport()
else:
kw['transport'] = KerbTransport()
else:
kw['transport'] = LanguageAwareTransport()
self.log.info('trying %s' % server)