mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-23 07:33:27 -06:00
Remove IPA Foreman Smart Proxy
The code has been moved to its own, separate repository at git://git.fedorahosted.org/git/freeipa-foreman-smartproxy.git Reviewed-By: Martin Kosek <mkosek@redhat.com>
This commit is contained in:
Rob Crittenden
Martin Kosek
parent
dfbd7170e9
commit
54e4891fef
5
Makefile
5
Makefile
@ -1,6 +1,6 @@
|
||||
include VERSION
|
||||
|
||||
SUBDIRS=daemons install ipapython ipa-client smartproxy
|
||||
SUBDIRS=daemons install ipapython ipa-client
|
||||
CLIENTDIRS=ipapython ipa-client
|
||||
|
||||
PRJ_PREFIX=freeipa
|
||||
@ -76,7 +76,6 @@ bootstrap-autogen: version-update client-autogen
|
||||
@echo "Building IPA $(IPA_VERSION)"
|
||||
cd daemons; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR) --with-openldap; fi
|
||||
cd install; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
|
||||
cd smartproxy; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
|
||||
|
||||
client-autogen: version-update
|
||||
cd ipa-client; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
|
||||
@ -202,7 +201,6 @@ tarballs: local-archive
|
||||
cd dist/$(TARBALL_PREFIX)/ipa-client; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
|
||||
cd dist/$(TARBALL_PREFIX)/daemons; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
|
||||
cd dist/$(TARBALL_PREFIX)/install; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
|
||||
cd dist/$(TARBALL_PREFIX)/smartproxy; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
|
||||
cd dist; tar cfz sources/$(TARBALL) $(TARBALL_PREFIX)
|
||||
rm -rf dist/$(TARBALL_PREFIX)
|
||||
|
||||
@ -269,6 +267,5 @@ maintainer-clean: clean
|
||||
cd install && $(MAKE) maintainer-clean
|
||||
cd ipa-client && $(MAKE) maintainer-clean
|
||||
cd ipapython && $(MAKE) maintainer-clean
|
||||
cd smartproxy && $(MAKE) maintainer-clean
|
||||
rm -f version.m4
|
||||
rm -f freeipa.spec
|
||||
|
||||
@ -221,19 +221,6 @@ Cross-realm trusts with Active Directory in IPA require working Samba 4
|
||||
installation. This package is provided for convenience to install all required
|
||||
dependencies at once.
|
||||
|
||||
|
||||
%package server-foreman-smartproxy
|
||||
Summary: Foreman-compatible REST API for IPA
|
||||
Group: System Environment/Base
|
||||
Requires: %{name}-client = %version-%release
|
||||
Requires: python-cherrypy
|
||||
Requires: gssproxy >= 0.3.1
|
||||
Requires: python-kerberos >= 1.1-14
|
||||
Requires: mod_wsgi
|
||||
|
||||
%description server-foreman-smartproxy
|
||||
A Foreman-compatible REST API for managing hosts and hostgroups.
|
||||
|
||||
%endif # ONLY_CLIENT
|
||||
|
||||
|
||||
@ -557,10 +544,6 @@ if [ $1 -eq 0 ]; then
|
||||
%{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
|
||||
fi
|
||||
|
||||
%post server-foreman-smartproxy
|
||||
if [ $1 -gt 1 ] ; then
|
||||
/bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :
|
||||
fi
|
||||
%endif # ONLY_CLIENT
|
||||
|
||||
%post client
|
||||
@ -795,14 +778,6 @@ fi
|
||||
%{python_sitelib}/ipaserver/install/adtrustinstance*
|
||||
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
|
||||
|
||||
%files server-foreman-smartproxy
|
||||
%doc COPYING README smartproxy/ipa-smartproxy-apache.conf
|
||||
%dir %{_usr}/share/ipa/smartproxy
|
||||
%{_usr}/share/ipa/smartproxy/ipa-smartproxy.py*
|
||||
%{_mandir}/man1/ipa-smartproxy.1.gz
|
||||
%{_mandir}/man5/ipa-smartproxy.conf.5.gz
|
||||
%config(noreplace) %{_sysconfdir}/ipa/ipa-smartproxy.conf
|
||||
|
||||
%endif # ONLY_CLIENT
|
||||
|
||||
%files client
|
||||
|
||||
@ -63,7 +63,6 @@ class BasePathNamespace(object):
|
||||
IPA_DNS_UPDATE_TXT = "/etc/ipa/.dns_update.txt"
|
||||
IPA_CA_CRT = "/etc/ipa/ca.crt"
|
||||
IPA_DEFAULT_CONF = "/etc/ipa/default.conf"
|
||||
IPA_SMARTPROXY_CONF = "/etc/ipa/ipa-smartproxy.conf"
|
||||
KRB5_CONF = "/etc/krb5.conf"
|
||||
KRB5_KEYTAB = "/etc/krb5.keytab"
|
||||
LDAP_CONF = "/etc/ldap.conf"
|
||||
|
||||
@ -1,170 +0,0 @@
|
||||
# Authors:
|
||||
# Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
"""
|
||||
Base class for all REST tests
|
||||
"""
|
||||
|
||||
import requests
|
||||
import json
|
||||
import nose
|
||||
from ipatests.util import assert_deepequal, Fuzzy
|
||||
from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_uuid, fuzzy_password
|
||||
|
||||
FQDN = 'localhost'
|
||||
PORT = 8090
|
||||
|
||||
EXPECTED = """Expected %r to raise %s.
|
||||
options = %r
|
||||
output = %r"""
|
||||
|
||||
UNEXPECTED = """Expected %r to raise %s, but caught different.
|
||||
options = %r
|
||||
%s: %s"""
|
||||
|
||||
try:
|
||||
response = requests.get(
|
||||
'http://%s:%d/ipa/smartproxy/host/host.example.com' % (FQDN, PORT),
|
||||
data={})
|
||||
server_available = True
|
||||
except requests.ConnectionError:
|
||||
server_available = False
|
||||
|
||||
|
||||
class REST_test(object):
|
||||
"""
|
||||
Base class for all REST tests
|
||||
|
||||
A Declarative test suite is controlled by the ``tests`` and
|
||||
``cleanup`` class variables.
|
||||
|
||||
The ``tests`` is a list of dictionaries with the following keys:
|
||||
|
||||
``desc``
|
||||
A name/description of the test
|
||||
``command``
|
||||
A (command, args, kwargs) triple specifying the command to run
|
||||
``expected``
|
||||
Can be either an ``errors.PublicError`` instance, in which case
|
||||
the command must fail with the given error; or the
|
||||
expected result.
|
||||
The result is checked with ``tests.util.assert_deepequal``.
|
||||
``extra_check`` (optional)
|
||||
A checking function that is called with the response. It must
|
||||
return true for the test to pass.
|
||||
|
||||
The ``cleanup`` is a list of (command, args, kwargs)
|
||||
triples. These are commands get run both before and after tests,
|
||||
and must not fail.
|
||||
"""
|
||||
|
||||
cleanup = tuple()
|
||||
tests = tuple()
|
||||
|
||||
@classmethod
|
||||
def setUpClass(cls):
|
||||
if not server_available:
|
||||
raise nose.SkipTest('%r: Server not available' %
|
||||
cls.__module__)
|
||||
|
||||
def cleanup_generate(self, stage):
|
||||
for (i, request) in enumerate(self.cleanup):
|
||||
func = lambda: self.run_cleanup(request)
|
||||
func.description = '%s %s-cleanup[%d]: %r' % (
|
||||
self.__class__.__name__, stage, i, request
|
||||
)
|
||||
yield (func,)
|
||||
|
||||
def make_request(self, method, uri, data=None):
|
||||
request = method('http://%s:%d%s' % (FQDN, PORT, uri), data=data)
|
||||
return request
|
||||
|
||||
def run_cleanup(self, request):
|
||||
(uri, data) = request
|
||||
try:
|
||||
result = self.make_request(requests.delete, uri, data)
|
||||
assert request.status_code in [401, 201, 200]
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
def test_generator(self):
|
||||
"""
|
||||
Iterate through tests.
|
||||
|
||||
nose reports each one as a separate test.
|
||||
"""
|
||||
|
||||
# Iterate through pre-cleanup:
|
||||
for tup in self.cleanup_generate('pre'):
|
||||
yield tup
|
||||
|
||||
# Iterate through the tests:
|
||||
name = self.__class__.__name__
|
||||
for (i, test) in enumerate(self.tests):
|
||||
nice = '%s[%d]: %s: %s' % (
|
||||
name, i, test['request'][0], test.get('desc', '')
|
||||
)
|
||||
func = lambda: self.check(nice, **test)
|
||||
func.description = nice
|
||||
yield (func,)
|
||||
|
||||
# Iterate through post-cleanup:
|
||||
for tup in self.cleanup_generate('post'):
|
||||
yield tup
|
||||
|
||||
def check(self, nice, desc, request, method, expected_status, expected):
|
||||
(uri, data) = request
|
||||
if isinstance(expected, Exception):
|
||||
self.check_exception(nice, method, uri, data, expected)
|
||||
else:
|
||||
self.check_result(nice,
|
||||
method,
|
||||
uri,
|
||||
data,
|
||||
expected_status,
|
||||
expected)
|
||||
|
||||
def check_exception(self, nice, method, uri, data, expected):
|
||||
klass = expected.__class__
|
||||
name = klass.__name__
|
||||
try:
|
||||
output = self.make_request(method, uri, data)
|
||||
except StandardError, e:
|
||||
pass
|
||||
else:
|
||||
raise AssertionError(
|
||||
EXPECTED % (uri, name, method, data, output)
|
||||
)
|
||||
if not isinstance(e, klass):
|
||||
raise AssertionError(
|
||||
UNEXPECTED % (uri, name, method, data, e.__class__.__name__, e)
|
||||
)
|
||||
|
||||
def check_result(self, nice, method, uri, data, expected_status, expected):
|
||||
request = self.make_request(method, uri, data)
|
||||
assert expected_status == request.status_code
|
||||
|
||||
if request.status_code in [200, 201]:
|
||||
try:
|
||||
data = json.loads(request.text)
|
||||
except ValueError, e:
|
||||
raise AssertionError(
|
||||
'Could not parse JSON: %s' % e
|
||||
)
|
||||
assert_deepequal(expected, data, nice)
|
||||
@ -1,35 +0,0 @@
|
||||
# Authors:
|
||||
# Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from resttest import REST_test
|
||||
import requests
|
||||
|
||||
class test_feature(REST_test):
|
||||
|
||||
tests = [
|
||||
|
||||
dict(
|
||||
desc='Get supported features',
|
||||
request=('/features', {}),
|
||||
method=requests.get,
|
||||
expected_status=200,
|
||||
expected=[u'realm'],
|
||||
),
|
||||
|
||||
]
|
||||
@ -1,145 +0,0 @@
|
||||
# Authors:
|
||||
# Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from ipalib import api
|
||||
from ipapython.dn import DN
|
||||
from resttest import REST_test, fuzzy_uuid, fuzzy_password
|
||||
from ipatests.test_xmlrpc import objectclasses
|
||||
import requests
|
||||
|
||||
fqdn1 = u'testhost.example.com'
|
||||
dn1 = DN(('fqdn',fqdn1),('cn','computers'),('cn','accounts'),
|
||||
api.env.basedn)
|
||||
fqdn2 = u'testhost2.example.com'
|
||||
dn2 = DN(('fqdn',fqdn2),('cn','computers'),('cn','accounts'),
|
||||
api.env.basedn)
|
||||
|
||||
class test_host(REST_test):
|
||||
|
||||
cleanup = [
|
||||
('/ipa/smartproxy/host/%s' % fqdn1, {}),
|
||||
('/ipa/smartproxy/host/%s' % fqdn2, {}),
|
||||
]
|
||||
|
||||
tests = [
|
||||
|
||||
dict(
|
||||
desc='Get a non-existent host',
|
||||
request=('/ipa/smartproxy/host/notfound', {}),
|
||||
method=requests.get,
|
||||
expected_status=404,
|
||||
expected={},
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Create a host',
|
||||
request=('/ipa/smartproxy/host', {'hostname': fqdn1,
|
||||
'description': 'test',
|
||||
'macaddress': '00:50:56:30:F6:5F'}),
|
||||
method=requests.post,
|
||||
expected_status=201,
|
||||
expected=dict(
|
||||
dn=dn1,
|
||||
has_keytab=False,
|
||||
objectclass=[u'ipasshhost', u'ipaSshGroupOfPubKeys',
|
||||
u'ieee802device', u'ipaobject',
|
||||
u'nshost', u'ipahost', u'pkiuser',
|
||||
u'ipaservice', u'top',],
|
||||
description=[u'test'],
|
||||
macaddress=[u'00:50:56:30:F6:5F'],
|
||||
fqdn=[fqdn1],
|
||||
has_password=True,
|
||||
randompassword=fuzzy_password,
|
||||
ipauniqueid=[fuzzy_uuid],
|
||||
managedby_host=[fqdn1],
|
||||
),
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Get the host',
|
||||
request=('/ipa/smartproxy/host/%s' % fqdn1, {}),
|
||||
method=requests.get,
|
||||
expected_status=200,
|
||||
expected=dict(
|
||||
dn=dn1,
|
||||
description=[u'test'],
|
||||
macaddress=[u'00:50:56:30:F6:5F'],
|
||||
has_keytab=False,
|
||||
fqdn=[u'testhost.example.com'],
|
||||
has_password=True,
|
||||
managedby_host=[fqdn1],
|
||||
),
|
||||
),
|
||||
|
||||
# Note that this has the side-effect of confirming that description,
|
||||
# macaddress, etc. doesn't get wiped on update.
|
||||
dict(
|
||||
desc='Update the host',
|
||||
request=('/ipa/smartproxy/host/%s' % fqdn1, {'userclass': 'test'}),
|
||||
method=requests.post,
|
||||
expected_status=200,
|
||||
expected=dict(
|
||||
has_keytab=False,
|
||||
description=[u'test'],
|
||||
macaddress=[u'00:50:56:30:F6:5F'],
|
||||
fqdn=[u'testhost.example.com'],
|
||||
has_password=True,
|
||||
managedby_host=[fqdn1],
|
||||
randompassword=fuzzy_password,
|
||||
userclass=[u'test']
|
||||
|
||||
),
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Remove the host',
|
||||
request=('/ipa/smartproxy/host/%s' % fqdn1, {}),
|
||||
method=requests.delete,
|
||||
expected_status=200,
|
||||
expected=dict(failed=[]),
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Create a host with a fixed password',
|
||||
request=('/ipa/smartproxy/host', {'hostname': fqdn2, 'password': 'Secret123'}),
|
||||
method=requests.post,
|
||||
expected_status=201,
|
||||
expected=dict(
|
||||
dn=dn2,
|
||||
has_keytab=False,
|
||||
objectclass=[u'ipasshhost', u'ipaSshGroupOfPubKeys',
|
||||
u'ieee802device', u'ipaobject',
|
||||
u'nshost', u'ipahost', u'pkiuser',
|
||||
u'ipaservice', u'top',],
|
||||
fqdn=[fqdn2],
|
||||
has_password=True,
|
||||
ipauniqueid=[fuzzy_uuid],
|
||||
managedby_host=[fqdn2],
|
||||
),
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Remove a non-existent host',
|
||||
request=('/ipa/smartproxy/host/notfound', {}),
|
||||
method=requests.delete,
|
||||
expected_status=404,
|
||||
expected={},
|
||||
),
|
||||
|
||||
]
|
||||
@ -1,97 +0,0 @@
|
||||
# Authors:
|
||||
# Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from ipalib import api
|
||||
from ipapython.dn import DN
|
||||
from resttest import REST_test, fuzzy_uuid
|
||||
from ipatests.test_xmlrpc import objectclasses
|
||||
import requests
|
||||
|
||||
hostgroup1 = u'testhostgroup'
|
||||
dn1 = DN(('cn', hostgroup1),('cn','hostgroups'),('cn','accounts'),
|
||||
api.env.basedn)
|
||||
|
||||
class test_hostgroup(REST_test):
|
||||
|
||||
cleanup = [
|
||||
('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
|
||||
]
|
||||
|
||||
tests = [
|
||||
|
||||
dict(
|
||||
desc='Get a non-existent hostgroup',
|
||||
request=('/ipa/smartproxy/hostgroup/notfound', {}),
|
||||
method=requests.get,
|
||||
expected_status=404,
|
||||
expected={},
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Create a hostgroup',
|
||||
request=('/ipa/smartproxy/hostgroup', {'name': hostgroup1, 'description': u'test'}),
|
||||
method=requests.post,
|
||||
expected_status=201,
|
||||
expected=dict(
|
||||
dn=dn1,
|
||||
cn=[hostgroup1],
|
||||
objectclass=objectclasses.hostgroup,
|
||||
description=[u'test'],
|
||||
mepmanagedentry=[DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),
|
||||
api.env.basedn)],
|
||||
ipauniqueid=[fuzzy_uuid],
|
||||
),
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Get the hostgroup',
|
||||
request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
|
||||
method=requests.get,
|
||||
expected_status=200,
|
||||
expected=dict(
|
||||
dn=dn1,
|
||||
cn=[u'testhostgroup'],
|
||||
description=[u'test'],
|
||||
),
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Add a duplicate hostgroup',
|
||||
request=('/ipa/smartproxy/hostgroup', {'name': hostgroup1, 'description': u'test'}),
|
||||
method=requests.post,
|
||||
expected_status=400,
|
||||
expected={},
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Remove the hostgroup',
|
||||
request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
|
||||
method=requests.delete,
|
||||
expected_status=200,
|
||||
expected=dict(failed=[]),
|
||||
),
|
||||
|
||||
dict(
|
||||
desc='Remove a non-existent hostgroup',
|
||||
request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
|
||||
method=requests.delete,
|
||||
expected_status=404,
|
||||
expected={},
|
||||
),
|
||||
]
|
||||
@ -1,37 +0,0 @@
|
||||
# This file will be processed with automake-1.7 to create Makefile.in
|
||||
|
||||
AUTOMAKE_OPTIONS = 1.7
|
||||
|
||||
NULL =
|
||||
|
||||
etcdir = $(IPA_SYSCONF_DIR)
|
||||
etc_DATA = \
|
||||
ipa-smartproxy.conf \
|
||||
$(NULL)
|
||||
|
||||
appdir = $(IPA_DATA_DIR)/smartproxy
|
||||
app_DATA = \
|
||||
ipa-smartproxy.py \
|
||||
$(NULL)
|
||||
|
||||
SUBDIRS = \
|
||||
man \
|
||||
$(NULL)
|
||||
|
||||
EXTRA_DIST = \
|
||||
$(app_DATA) \
|
||||
$(etc_DATA) \
|
||||
$(rotate_DATA) \
|
||||
$(NULL)
|
||||
|
||||
DISTCLEANFILES = \
|
||||
$(NULL)
|
||||
|
||||
MAINTAINERCLEANFILES = \
|
||||
*~ \
|
||||
aclocal.m4 \
|
||||
configure \
|
||||
install-sh \
|
||||
missing \
|
||||
Makefile.in \
|
||||
$(NULL)
|
||||
@ -1,73 +0,0 @@
|
||||
AC_PREREQ(2.59)
|
||||
m4_include(../version.m4)
|
||||
AC_INIT([ipa-server],
|
||||
IPA_VERSION,
|
||||
[https://hosted.fedoraproject.org/projects/freeipa/newticket])
|
||||
|
||||
AM_INIT_AUTOMAKE([foreign])
|
||||
|
||||
AM_MAINTAINER_MODE
|
||||
|
||||
AC_SUBST(VERSION)
|
||||
AC_SUBST([INSTALL_DATA], ['$(INSTALL) -m 644 -p'])
|
||||
|
||||
AC_PROG_MKDIR_P
|
||||
AC_PROG_AWK
|
||||
AC_PROG_SED
|
||||
|
||||
AC_PATH_PROG(XGETTEXT, xgettext, [no])
|
||||
if test "x$XGETTEXT" = "xno"; then
|
||||
AC_MSG_ERROR([xgettext not found, install gettext])
|
||||
fi
|
||||
|
||||
AC_PATH_PROG(MSGFMT, msgfmt, [no])
|
||||
if test "x$MSGFMT" = "xno"; then
|
||||
AC_MSG_ERROR([msgfmt not found, install gettext])
|
||||
fi
|
||||
|
||||
AC_PATH_PROG(MSGINIT, msginit, [no])
|
||||
if test "x$MSGINIT" = "xno"; then
|
||||
AC_MSG_ERROR([msginit not found, install gettext])
|
||||
fi
|
||||
|
||||
AC_PATH_PROG(MSGMERGE, msgmerge, [no])
|
||||
if test "x$MSGMERGE" = "xno"; then
|
||||
AC_MSG_ERROR([msgmerge not found, install gettext])
|
||||
fi
|
||||
|
||||
AC_PATH_PROG(MSGCMP, msgcmp, [no])
|
||||
if test "x$MSGCMP" = "xno"; then
|
||||
AC_MSG_ERROR([msgcmp not found, install gettext])
|
||||
fi
|
||||
|
||||
AC_PATH_PROG(MSGATTRIB, msgattrib, [no])
|
||||
if test "x$MSGATTRIB" = "xno"; then
|
||||
AC_MSG_ERROR([msgattrib not found, install gettext])
|
||||
fi
|
||||
|
||||
AC_PATH_PROG(TX, tx, [/usr/bin/tx])
|
||||
|
||||
AC_ARG_WITH([gettext_domain],
|
||||
[AS_HELP_STRING([--with-gettext-domain=name],
|
||||
[set the name of the i18n message catalog])],
|
||||
[],
|
||||
[with_gettext_domain=ipa])
|
||||
AC_SUBST(GETTEXT_DOMAIN, $with_gettext_domain)
|
||||
|
||||
dnl ---------------------------------------------------------------------------
|
||||
dnl - Set the data install directory since we don't use pkgdatadir
|
||||
dnl ---------------------------------------------------------------------------
|
||||
|
||||
IPA_DATA_DIR="$datadir/ipa"
|
||||
IPA_SYSCONF_DIR="$sysconfdir/ipa"
|
||||
AC_SUBST(IPA_DATA_DIR)
|
||||
AC_SUBST(IPA_SYSCONF_DIR)
|
||||
|
||||
# Files
|
||||
|
||||
AC_CONFIG_FILES([
|
||||
Makefile
|
||||
man/Makefile
|
||||
])
|
||||
|
||||
AC_OUTPUT
|
||||
@ -1,30 +0,0 @@
|
||||
Listen 8090
|
||||
|
||||
<VirtualHost *:8090>
|
||||
|
||||
WSGIDaemonProcess smartproxy user=smartproxy processes=2 threads=1
|
||||
WSGIProcessGroup smartproxy
|
||||
|
||||
WSGIScriptAlias /realm /usr/share/ipa/smartproxy/ipa-smartproxy.py
|
||||
WSGIScriptAlias /features /usr/share/ipa/smartproxy/ipa-smartproxy.py
|
||||
WSGIScriptAlias /ipa/smartproxy /usr/share/ipa/smartproxy/ipa-smartproxy.py
|
||||
|
||||
<Location "/realm">
|
||||
Satisfy Any
|
||||
Order Deny,Allow
|
||||
Allow from all
|
||||
</Location>
|
||||
|
||||
<Location "/features">
|
||||
Satisfy Any
|
||||
Order Deny,Allow
|
||||
Allow from all
|
||||
</Location>
|
||||
|
||||
<Location "/ipa/smartproxy">
|
||||
Satisfy Any
|
||||
Order Deny,Allow
|
||||
Allow from all
|
||||
</Location>
|
||||
|
||||
</VirtualHost>
|
||||
@ -1,14 +0,0 @@
|
||||
[global]
|
||||
server.socket_port: 8090
|
||||
#server.socket_host: 'server.example.com'
|
||||
|
||||
request.show_tracebacks: False
|
||||
|
||||
# Only handle requests on 127.0.0.1 or ::1
|
||||
local_only: True
|
||||
|
||||
# Use gssproxy to manage the ccache
|
||||
use_gssproxy: True
|
||||
|
||||
# Remove assocaited DNS entries when deleting a host
|
||||
remove_dns: False
|
||||
@ -1,399 +0,0 @@
|
||||
# Authors:
|
||||
# Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
import sys
|
||||
sys.stdout = sys.stderr
|
||||
|
||||
import cherrypy
|
||||
import os
|
||||
import json
|
||||
from functools import wraps
|
||||
import traceback as tb_internal
|
||||
from cherrypy import response
|
||||
from ipalib import api
|
||||
from ipalib import errors
|
||||
from ipaplatform.paths import paths
|
||||
from ipalib.request import context
|
||||
from ipalib.rpc import json_encode_binary
|
||||
from ipapython.version import VERSION, API_VERSION
|
||||
from ipapython.ipa_log_manager import root_logger
|
||||
|
||||
|
||||
def jsonout(func):
|
||||
'''JSON output decorator'''
|
||||
@wraps(func)
|
||||
def wrapper(*args, **kw):
|
||||
value = func(*args, **kw)
|
||||
response.headers["Content-Type"] = "application/json;charset=utf-8"
|
||||
data = json_encode_binary(value, version=API_VERSION)
|
||||
return json.dumps(data, sort_keys=True, indent=2)
|
||||
|
||||
return wrapper
|
||||
|
||||
|
||||
def handle_error(status, message, traceback, version):
|
||||
"""
|
||||
Return basic messages to user and log backtrace in case of 500
|
||||
error.
|
||||
"""
|
||||
if status.startswith('500'):
|
||||
root_logger.error(message)
|
||||
root_logger.error(tb_internal.format_exc())
|
||||
|
||||
resp = cherrypy.response
|
||||
resp.headers['Content-Type'] = 'application/json'
|
||||
return json.dumps({'status': status, 'message': message})
|
||||
|
||||
|
||||
def convert_unicode(value):
|
||||
"""
|
||||
IPA requires all incoming values to be unicode. Recursively
|
||||
convert the values.
|
||||
"""
|
||||
if not isinstance(value, basestring):
|
||||
return value
|
||||
|
||||
if value is not None:
|
||||
return unicode(value)
|
||||
else:
|
||||
return None
|
||||
|
||||
|
||||
def raise_rest_exception(e):
|
||||
"""
|
||||
Raise a REST-specific exception.
|
||||
"""
|
||||
try:
|
||||
raise e
|
||||
except (errors.DuplicateEntry, errors.DNSNotARecordError,
|
||||
errors.ValidationError, errors.ConversionError,) as e:
|
||||
raise IPAError(
|
||||
status=400,
|
||||
message=e
|
||||
)
|
||||
except errors.ACIError as e:
|
||||
raise IPAError(
|
||||
status=401,
|
||||
message=e
|
||||
)
|
||||
except errors.NotFound as e:
|
||||
raise IPAError(
|
||||
status=404,
|
||||
message=e
|
||||
)
|
||||
except Exception as e:
|
||||
raise IPAError(
|
||||
status=500,
|
||||
message=e
|
||||
)
|
||||
|
||||
|
||||
def popifnone(params, option):
|
||||
"""
|
||||
If option, a string, exists in params, a dict, and is None then
|
||||
remove it from the dict.
|
||||
|
||||
No return value. The dict is updated in-place if necessary.
|
||||
"""
|
||||
if params.get(option) is None:
|
||||
params.pop(option, None)
|
||||
|
||||
|
||||
def Command(command, *args, **options):
|
||||
"""
|
||||
Execute an IPA command with the given arguments and options.
|
||||
|
||||
This doesn't care what the options are, it passes them along to
|
||||
the IPA API. The exceptions are:
|
||||
|
||||
:param nomaskexceptions: boolean to decide if we raise the real IPA
|
||||
exception or a REST-specific exceptioon.
|
||||
"""
|
||||
if (cherrypy.request.config.get('local_only', False) and
|
||||
cherrypy.request.remote.ip not in ['::1', '127.0.0.1']):
|
||||
raise IPAError(
|
||||
status=401,
|
||||
message="Not a local request"
|
||||
)
|
||||
|
||||
try:
|
||||
if not api.Backend.rpcclient.isconnected():
|
||||
api.Backend.rpcclient.connect()
|
||||
except errors.CCacheError as e:
|
||||
root_logger.info('Connection failed: %s', e)
|
||||
raise IPAError(
|
||||
status=401,
|
||||
message=e
|
||||
)
|
||||
|
||||
# IPA wants all its strings as unicode
|
||||
args = map(lambda v: convert_unicode(v), args)
|
||||
options = dict(zip(options, map(convert_unicode, options.values())))
|
||||
|
||||
nomaskexception = options.pop('nomaskexception', False)
|
||||
|
||||
api.Command[command].args_options_2_params(*args, **options)
|
||||
try:
|
||||
return api.Command[command](*args, **options)['result']
|
||||
except Exception as e:
|
||||
if not nomaskexception:
|
||||
raise_rest_exception(e)
|
||||
else:
|
||||
# The caller needs to be able to handle IPA-specific
|
||||
# exceptions.
|
||||
raise e
|
||||
|
||||
|
||||
@jsonout
|
||||
def GET(command, *args, **options):
|
||||
return Command(command, *args, **options)
|
||||
|
||||
|
||||
@jsonout
|
||||
def POST(status, command, *args, **options):
|
||||
cherrypy.response.status = status
|
||||
return Command(command, *args, **options)
|
||||
|
||||
|
||||
@jsonout
|
||||
def DELETE(command, *args, **options):
|
||||
return Command(command, *args, **options)
|
||||
|
||||
|
||||
class IPAError(cherrypy.HTTPError):
|
||||
"""
|
||||
Return errors in IPA-style json.
|
||||
|
||||
Local errors are treated as strings so do not include the code and
|
||||
name attributes within the error dict.
|
||||
|
||||
This is not padded for IE.
|
||||
"""
|
||||
|
||||
def set_response(self):
|
||||
response = cherrypy.serving.response
|
||||
|
||||
cherrypy._cperror.clean_headers(self.code)
|
||||
|
||||
# In all cases, finalize will be called after this method,
|
||||
# so don't bother cleaning up response values here.
|
||||
response.status = self.status
|
||||
|
||||
if isinstance(self._message, Exception):
|
||||
try:
|
||||
code = self._message.errno
|
||||
except AttributeError:
|
||||
code = 0
|
||||
error = {'code': code,
|
||||
'message': self._message.message,
|
||||
'name': self._message.__class__.__name__}
|
||||
elif isinstance(self._message, basestring):
|
||||
error = {'message': self._message}
|
||||
else:
|
||||
error = {'message':
|
||||
'Unable to handle error message type %s' %
|
||||
type(self._message)}
|
||||
|
||||
principal = getattr(context, 'principal', None)
|
||||
response.headers["Content-Type"] = "application/json;charset=utf-8"
|
||||
response.body = json.dumps({'error': error,
|
||||
'id': 0,
|
||||
'principal': principal,
|
||||
'result': None,
|
||||
'version': VERSION},
|
||||
sort_keys=True, indent=2)
|
||||
|
||||
|
||||
class Host(object):
|
||||
"""
|
||||
Manage IPA host objects
|
||||
"""
|
||||
|
||||
exposed = True
|
||||
|
||||
def GET(self, fqdn=None):
|
||||
|
||||
if fqdn is None:
|
||||
command = 'host_find'
|
||||
else:
|
||||
command = 'host_show'
|
||||
|
||||
return GET(command, fqdn)
|
||||
|
||||
def POST(self, hostname, description=None,
|
||||
macaddress=None, userclass=None, ip_address=None,
|
||||
password=None, rebuild=None):
|
||||
cmd = 'host_add'
|
||||
|
||||
if password is None:
|
||||
random = True
|
||||
else:
|
||||
random = False
|
||||
|
||||
params = {'description' : description,
|
||||
'random' : random,
|
||||
'macaddress' : macaddress,
|
||||
'userclass' : userclass,
|
||||
'userpassword' : password}
|
||||
|
||||
# If the host is being rebuilt, disable it in order to revoke
|
||||
# existing certs, keytabs, etc.
|
||||
try:
|
||||
Command('host_show', hostname, nomaskexception=True)
|
||||
except errors.NotFound:
|
||||
# Adding a new host
|
||||
status = 201
|
||||
params['ip_address'] = ip_address
|
||||
params['force'] = True
|
||||
except Exception as e:
|
||||
raise_rest_exception(e)
|
||||
else:
|
||||
if ip_address is not None:
|
||||
raise IPAError(
|
||||
status=400,
|
||||
message='IP address must be changed in DNS'
|
||||
)
|
||||
cmd = 'host_mod'
|
||||
|
||||
# Foreman doesn't pass these in on update so drop them otherwise
|
||||
# IPA will consider these as being set to None which deletes them.
|
||||
popifnone(params, 'description')
|
||||
popifnone(params, 'macaddress')
|
||||
popifnone(params, 'userclass')
|
||||
popifnone(params, 'userpassword')
|
||||
status = 200
|
||||
if rebuild:
|
||||
root_logger.info("Attempting to disable %s", hostname)
|
||||
try:
|
||||
Command('host_disable', hostname, nomaskexception=True)
|
||||
except errors.AlreadyInactive as e:
|
||||
pass
|
||||
else:
|
||||
raise e
|
||||
return POST(status, cmd, hostname, **params)
|
||||
|
||||
def DELETE(self, fqdn):
|
||||
# The host-del behavior is a bit off due to
|
||||
# https://fedorahosted.org/freeipa/ticket/4329
|
||||
# A NotFound is returned if the user can't read DNS.
|
||||
# Do a GET to see if the host exists, then we can more blindly
|
||||
# try the delete.
|
||||
|
||||
# If the GET is ok then we know there is a host, though this is a
|
||||
# bit racy.
|
||||
GET('host_show', fqdn)
|
||||
|
||||
remove_dns = cherrypy.request.config.get('remove_dns', False)
|
||||
|
||||
return DELETE('host_del', fqdn, updatedns=remove_dns)
|
||||
|
||||
|
||||
class Hostgroup(object):
|
||||
"""
|
||||
Manage IPA hostgroup objects
|
||||
"""
|
||||
|
||||
exposed = True
|
||||
|
||||
def GET(self, name=None):
|
||||
|
||||
if name is None:
|
||||
command = 'hostgroup_find'
|
||||
else:
|
||||
command = 'hostgroup_show'
|
||||
|
||||
return GET(command, name)
|
||||
|
||||
def POST(self, name=None, description=None):
|
||||
cherrypy.response.status = 201
|
||||
return POST(201, 'hostgroup_add', name,
|
||||
description=description,)
|
||||
|
||||
def DELETE(self, name):
|
||||
return DELETE('hostgroup_del', name)
|
||||
|
||||
|
||||
class Features(object):
|
||||
exposed = True
|
||||
|
||||
def GET(self):
|
||||
return '["realm"]'
|
||||
|
||||
|
||||
def start(config=None):
|
||||
# Set the umask so only the owner can read the log files
|
||||
old_umask = os.umask(077)
|
||||
|
||||
cherrypy.tree.mount(
|
||||
Features(), '/features',
|
||||
{'/':
|
||||
{'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
|
||||
}
|
||||
)
|
||||
cherrypy.tree.mount(
|
||||
Host(), '/ipa/smartproxy/host',
|
||||
{'/':
|
||||
{'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
|
||||
}
|
||||
)
|
||||
cherrypy.tree.mount(
|
||||
Hostgroup(), '/ipa/smartproxy/hostgroup',
|
||||
{'/':
|
||||
{'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
|
||||
}
|
||||
)
|
||||
|
||||
# Register the realm for requests from Foreman
|
||||
root_logger.info("Mounting /realm/%s", api.env.realm)
|
||||
cherrypy.tree.mount(
|
||||
Host(), '/realm/%s' % api.env.realm,
|
||||
{'/':
|
||||
{'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
|
||||
}
|
||||
)
|
||||
|
||||
for c in config or []:
|
||||
try:
|
||||
cherrypy.config.update(c)
|
||||
except (IOError, OSError) as e:
|
||||
root_logger.error("Exception trying to load %s: %s", c, e)
|
||||
return 1
|
||||
|
||||
# Log files are created, reset umask
|
||||
os.umask(old_umask)
|
||||
|
||||
cherrypy.config.update({'error_page.500': handle_error})
|
||||
|
||||
return 0
|
||||
|
||||
def application(environ, start_response):
|
||||
root_logger.info("IPA smartproxy WSGI start")
|
||||
return cherrypy.tree(environ, start_response)
|
||||
|
||||
wsgi_config = {'environment': 'embedded',
|
||||
'log.screen': False,
|
||||
'show_tracebacks': False,
|
||||
'engine.autoreload_on': False
|
||||
}
|
||||
|
||||
api.bootstrap(context='ipasmartproxy', log=paths.DEV_NULL)
|
||||
api.finalize()
|
||||
|
||||
cherrypy.config.update(wsgi_config)
|
||||
start([paths.IPA_SMARTPROXY_CONF])
|
||||
@ -1,19 +0,0 @@
|
||||
# This file will be processed with automake-1.7 to create Makefile.in
|
||||
|
||||
AUTOMAKE_OPTIONS = 1.7
|
||||
|
||||
NULL =
|
||||
|
||||
man1_MANS = \
|
||||
ipa-smartproxy.1
|
||||
|
||||
man5_MANS = \
|
||||
ipa-smartproxy.conf.5
|
||||
|
||||
install-data-hook:
|
||||
@for i in $(man1_MANS) ; do gzip -f $(DESTDIR)$(man1dir)/$$i ; done
|
||||
@for i in $(man5_MANS) ; do gzip -f $(DESTDIR)$(man5dir)/$$i ; done
|
||||
|
||||
MAINTAINERCLEANFILES = \
|
||||
Makefile.in \
|
||||
$(NULL)
|
||||
@ -1,105 +0,0 @@
|
||||
.\" A man page for ipa-smartproxy
|
||||
.\" Copyright (C) 2014 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.TH "ipa-smartproxy" "1" "Jan 8 2014" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-smartproxy \- IPA Foreman Smartproxy server
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-smartproxy [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
A WSGI service that provides a RESTful API for a use as a Foreman smart proxy. It is run in the context of the Apache web server.
|
||||
|
||||
The RESTful interface is not authenticated so it is expected that the server is not generally accessible. By default it listens only on the localhost interface.
|
||||
|
||||
The server needs access to an principal that is granted permission to perform host and hostgroup operations on an IPA master.
|
||||
|
||||
Smartproxy server\-specific privileges and roles can be created with this:
|
||||
|
||||
.na
|
||||
$ ipa privilege\-add 'Smart Proxy Host Management' \-\-desc='Smartproxy host management'
|
||||
$ ipa privilege\-add\-permission 'Smart Proxy Host Management' \-\-permission='add hosts' \-\-permission='remove hosts'
|
||||
$ ipa permission-add 'modify host password' --permissions='write' --type='host' --attrs='userpassword'
|
||||
$ ipa permission-add 'write host certificate' --permissions='write' --type='host' --attrs='usercertificate'
|
||||
$ ipa permission-add 'modify host userclass' --permissions='write' --type='host' --attrs='userclass'
|
||||
$ ipa privilege-add-permission 'Smart Proxy Host Management' --permission='add hosts' --permission='remove hosts' --permission='modify host password' --permission='modify host userclass' --permission='modify hosts' --permission='revoke certificate' --permission='manage host keytab' --permission='write host certificate' --permissions='retrieve certificates from the ca' --permissions='modify services' --permissions='manage service keytab' --permission='read dns entries' --permission='add dns entries' --permissions='update dns entries' --permissions='remove dns entries'
|
||||
$ ipa role\-add 'Smartproxy management' \-\-desc='Smartproxy management'
|
||||
$ ipa role\-add\-privilege 'Smartproxy management' \-\-privilege='Smart Proxy Host Management' \-\-privilege='Host Group Administrators'
|
||||
|
||||
Create a host or user whose credentials will be used by the server to make requests and add it to the role:
|
||||
|
||||
$ ipa user\-add smartproxy \-\-first=Smartproxy \-\-last=Server --shell=/sbin/nologin --homedir=/var/www
|
||||
$ ipa role\-add\-member \-\-users=smartproxy 'Smartproxy management'
|
||||
|
||||
On the smartproxy server create a keytab for this user:
|
||||
|
||||
# kinit admin
|
||||
# ipa\-getkeytab \-s ipa.example.com \-p smartproxy@EXAMPLE.COM \-k /etc/ipa/ipa\-smartproxy.keytab
|
||||
# chown root:root /etc/ipa/ipa\-smartproxy.keytab
|
||||
# chmod 600 /etc/ipa/ipa\-smartproxy.keytab
|
||||
|
||||
Configure the GSS\-Proxy to manage the credentials. Add this to the top of the gssproxy configuration file (by default /etc/gssproxy/gssproxy.conf), before any other services:
|
||||
|
||||
[service/smartproxy]
|
||||
mechs = krb5
|
||||
cred_store = client_keytab:/etc/ipa/ipa\-smartproxy.keytab
|
||||
cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
|
||||
cred_usage = initiate
|
||||
euid = <uid of the smartproxy user>
|
||||
|
||||
Restart GSS\-Proxy
|
||||
|
||||
# systemctl restart gssproxy
|
||||
|
||||
Configure Apache to enable GSS\-Proxy. Create the directory /etc/systemd/system/httpd.service.d/ and create the file smartproxy.conf in it:
|
||||
|
||||
# mkdir /etc/systemd/system/httpd.service.d/
|
||||
# cat > /etc/systemd/system/httpd.service.d/smartproxy.conf <<EOF
|
||||
[Service]
|
||||
Environment=GSS_USE_PROXY=1
|
||||
EOF
|
||||
# systemctl daemon-reload
|
||||
|
||||
Copy /usr/share/doc/freeipa-server-foreman-smartproxy/ipa-smartproxy-apache.conf to /etc/httpd/conf.d/ipa-smartproxy.conf . This will configure the smartproxy WSGI application.
|
||||
|
||||
Add a SELinux rule so Apache can use the port
|
||||
|
||||
# semanage port -a -t http_port_t -p tcp 8090
|
||||
|
||||
Restart Apache
|
||||
|
||||
# systemctl restart httpd
|
||||
|
||||
.SH "TEST"
|
||||
|
||||
To do simple verification that the proxy was installed properly and is working first confirm that it is providing the realm feature:
|
||||
|
||||
# curl http://localhost:8090/features
|
||||
["realm"]
|
||||
|
||||
Retrieve information on the current host, using your Kerberos realm in place of EXAMPLE.COM:
|
||||
|
||||
# curl http://localhost:8090/realm/EXAMPLE.COM/`hostname`
|
||||
{
|
||||
"dn": "fqdn=..."
|
||||
"fqdn": [
|
||||
...
|
||||
]
|
||||
"has_keytab": true,
|
||||
...
|
||||
}
|
||||
.SH "SEE ALSO"
|
||||
.BR ipa\-smartproxy.conf(5)
|
||||
@ -1,62 +0,0 @@
|
||||
.\" A man page for ipa-smartproxy.conf
|
||||
.\" Copyright (C) 2014 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-smartproxy.conf" "5" "Jan 8 2014" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-smartproxy.conf \- IPA Smartproxy server configuration file
|
||||
.SH "SYNOPSIS"
|
||||
/etc/ipa/ipa\-smartproxy.conf
|
||||
.SH "DESCRIPTION"
|
||||
The \fIipa\-smartproxy.conf \fRconfiguration file is used to set system\-wide defaults to be applied when running the IPA Foreman Smartproxy server.
|
||||
.SH "SYNTAX"
|
||||
The configuration options are not case sensitive. The values may be case sensitive, depending on the option.
|
||||
|
||||
Blank lines are ignored.
|
||||
|
||||
Lines beginning with # are comments and are ignored.
|
||||
|
||||
Valid lines consist of an option name, an equals sign and a value. Spaces surrounding equals sign are ignored. An option terminates at the end of a line.
|
||||
|
||||
The value is a Python object so needs to adhere to Python rules. If the value should be an integer then it needs to be passed as an integer (like port). If the value is a string then it must be quoted.
|
||||
|
||||
Options must appear in the section named [global]. There are no other sections defined or used currently.
|
||||
|
||||
Options may be defined that are not used by the IPA Foreman Smartproxy server. Be careful of misspellings, they will not be rejected.
|
||||
.SH "OPTIONS"
|
||||
The server runs using the CherryPy so all the CherryPy configuration options are valid. Here are some common ones.
|
||||
|
||||
.TP
|
||||
.B server.socket_port\fR <port>
|
||||
Port for the server to listen on. The default port is 8090.
|
||||
.TP
|
||||
.B server.socket_host\fR <host>
|
||||
If not specified then the server will listen on localhost. This is the expected mode. Specifiy a hostname or IP address to listen on another address. See also the .B local_only\fR option if setting this to something other than a local address.
|
||||
.B request.show_tracebacks\fR <boolean>
|
||||
Display tracebacks to the client when errors occur. Errors will always log on the server side. The default is False.
|
||||
.TP
|
||||
.B local_only\fR <boolean>
|
||||
If True then requires that all requests be local. It is not recommended that this be enabled because this server accepts unathenticated requests to manage IPA entries.
|
||||
.TP
|
||||
.B remove_dns\fR <boolean>
|
||||
Remove DNS entries when deleting a host
|
||||
.SH "FILES"
|
||||
.TP
|
||||
.I /etc/ipa/ipa\-smartproxy.conf
|
||||
IPA Foreman Smartproxy server configuration file
|
||||
.SH "SEE ALSO"
|
||||
.BR ipa\-smartproxy (1)
|
||||
Loading…
Reference in New Issue
Block a user