mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-11 00:31:56 -06:00
trust: detect and error out when non-AD trust with IPA domain name exists
Quite often users choose wrong type of trust on Active Directory side when setting up a trust to freeIPA. The trust type supported by freeIPA is just a normal forest trust to another Active Directory. However, some people follow old internet recipes that force using a trust to MIT Kerberos realm. This is a wrong type of trust. Unfortunately, when someone used MIT Kerberos realm trust, there is no way to programmatically remote the trust from freeIPA side. As result, we have to detect such situation and report an error. To do proper reporting, we need reuse some constants and trust type names we use in IPA CLI/Web UI. These common components were moved to a separate ipaserver/dcerpc_common.py module that is imported by both ipaserver/plugins/trust.py and ipaserver/dcerpc.py. Fixes https://pagure.io/freeipa/issue/7264 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
This commit is contained in:
Alexander Bokovoy
parent
956e265fae
commit
a57f613314
@ -31,6 +31,10 @@ from ipalib import errors
|
||||
from ipapython import ipautil
|
||||
from ipapython.dn import DN
|
||||
from ipaserver.install import installutils
|
||||
from ipaserver.dcerpc_common import (TRUST_BIDIRECTIONAL,
|
||||
TRUST_JOIN_EXTERNAL,
|
||||
trust_type_string)
|
||||
|
||||
from ipalib.util import normalize_name
|
||||
|
||||
import os
|
||||
@ -76,15 +80,6 @@ and Samba4 python bindings.
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# Both constants can be used as masks against trust direction
|
||||
# because bi-directional has two lower bits set.
|
||||
TRUST_ONEWAY = 1
|
||||
TRUST_BIDIRECTIONAL = 3
|
||||
|
||||
# Trust join behavior
|
||||
# External trust -- allow creating trust to a non-root domain in the forest
|
||||
TRUST_JOIN_EXTERNAL = 1
|
||||
|
||||
|
||||
def is_sid_valid(sid):
|
||||
try:
|
||||
@ -150,6 +145,7 @@ pysss_type_key_translation_dict = {
|
||||
pysss_nss_idmap.ID_BOTH: 'both',
|
||||
}
|
||||
|
||||
|
||||
class TrustTopologyConflictSolved(Exception):
|
||||
"""
|
||||
Internal trust error: raised when previously detected
|
||||
@ -1263,9 +1259,26 @@ class TrustDomainInstance(object):
|
||||
dname = lsa.String()
|
||||
dname.string = another_domain.info['dns_domain']
|
||||
res = self._pipe.QueryTrustedDomainInfoByName(
|
||||
self._policy_handle,
|
||||
dname,
|
||||
lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
|
||||
self._policy_handle,
|
||||
dname,
|
||||
lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO
|
||||
)
|
||||
if res.info_ex.trust_type != lsa.LSA_TRUST_TYPE_UPLEVEL:
|
||||
msg = _('There is already a trust to {ipa_domain} with '
|
||||
'unsupported type {trust_type}. Please remove '
|
||||
'it manually on AD DC side.')
|
||||
ttype = trust_type_string(
|
||||
res.info_ex.trust_type, res.info_ex.trust_attributes
|
||||
)
|
||||
err = unicode(msg).format(
|
||||
ipa_domain=another_domain.info['dns_domain'],
|
||||
trust_type=ttype)
|
||||
|
||||
raise errors.ValidationError(
|
||||
name=_('AD domain controller'),
|
||||
error=err
|
||||
)
|
||||
|
||||
self._pipe.DeleteTrustedDomain(self._policy_handle,
|
||||
res.info_ex.sid)
|
||||
except RuntimeError as e:
|
||||
|
||||
73
ipaserver/dcerpc_common.py
Normal file
73
ipaserver/dcerpc_common.py
Normal file
@ -0,0 +1,73 @@
|
||||
import six
|
||||
from ipalib import _
|
||||
if six.PY3:
|
||||
unicode = six.text_type
|
||||
|
||||
# Both constants can be used as masks against trust direction
|
||||
# because bi-directional has two lower bits set.
|
||||
TRUST_ONEWAY = 1
|
||||
TRUST_BIDIRECTIONAL = 3
|
||||
|
||||
# Trust join behavior
|
||||
# External trust -- allow creating trust to a non-root domain in the forest
|
||||
TRUST_JOIN_EXTERNAL = 1
|
||||
|
||||
# We don't want to import any of Samba Python code here just for constants
|
||||
# Since these constants set in MS-ADTS, we can rely on their stability
|
||||
LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE = 0x00000001
|
||||
|
||||
_trust_direction_dict = {
|
||||
1: _('Trusting forest'),
|
||||
2: _('Trusted forest'),
|
||||
3: _('Two-way trust')
|
||||
}
|
||||
|
||||
_trust_status_dict = {
|
||||
True: _('Established and verified'),
|
||||
False: _('Waiting for confirmation by remote side')
|
||||
}
|
||||
|
||||
_trust_type_dict_unknown = _('Unknown')
|
||||
|
||||
# Trust type is a combination of ipanttrusttype and ipanttrustattributes
|
||||
# We shift trust attributes by 3 bits to left so bit 0 becomes bit 3 and
|
||||
# 2+(1 << 3) becomes 10.
|
||||
_trust_type_dict = {
|
||||
1: _('Non-Active Directory domain'),
|
||||
2: _('Active Directory domain'),
|
||||
3: _('RFC4120-compliant Kerberos realm'),
|
||||
10: _('Non-transitive external trust to a domain in '
|
||||
'another Active Directory forest'),
|
||||
11: _('Non-transitive external trust to an RFC4120-'
|
||||
'compliant Kerberos realm')
|
||||
}
|
||||
|
||||
|
||||
def trust_type_string(level, attrs):
|
||||
"""
|
||||
Returns a string representing a type of the trust.
|
||||
The original field is an enum:
|
||||
LSA_TRUST_TYPE_DOWNLEVEL = 0x00000001,
|
||||
LSA_TRUST_TYPE_UPLEVEL = 0x00000002,
|
||||
LSA_TRUST_TYPE_MIT = 0x00000003
|
||||
"""
|
||||
transitive = int(attrs) & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE
|
||||
string = _trust_type_dict.get(int(level) | (transitive << 3),
|
||||
_trust_type_dict_unknown)
|
||||
return unicode(string)
|
||||
|
||||
|
||||
def trust_direction_string(level):
|
||||
"""
|
||||
Returns a string representing a direction of the trust.
|
||||
The original field is a bitmask taking two bits in use
|
||||
LSA_TRUST_DIRECTION_INBOUND = 0x00000001,
|
||||
LSA_TRUST_DIRECTION_OUTBOUND = 0x00000002
|
||||
"""
|
||||
string = _trust_direction_dict.get(int(level), _trust_type_dict_unknown)
|
||||
return unicode(string)
|
||||
|
||||
|
||||
def trust_status_string(level):
|
||||
string = _trust_status_dict.get(level, _trust_type_dict_unknown)
|
||||
return unicode(string)
|
||||
@ -45,6 +45,13 @@ from ipalib import errors
|
||||
from ipalib import output
|
||||
from ldap import SCOPE_SUBTREE
|
||||
from time import sleep
|
||||
from ipaserver.dcerpc_common import (TRUST_ONEWAY,
|
||||
TRUST_BIDIRECTIONAL,
|
||||
TRUST_JOIN_EXTERNAL,
|
||||
LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE,
|
||||
trust_type_string,
|
||||
trust_direction_string,
|
||||
trust_status_string)
|
||||
|
||||
if six.PY3:
|
||||
unicode = str
|
||||
@ -64,9 +71,6 @@ except Exception as e:
|
||||
if api.env.in_server and api.env.context in ['lite', 'server']:
|
||||
try:
|
||||
import ipaserver.dcerpc
|
||||
from ipaserver.dcerpc import (TRUST_ONEWAY,
|
||||
TRUST_BIDIRECTIONAL,
|
||||
TRUST_JOIN_EXTERNAL)
|
||||
import dbus
|
||||
import dbus.mainloop.glib
|
||||
_bindings_installed = True
|
||||
@ -160,28 +164,14 @@ logger = logging.getLogger(__name__)
|
||||
|
||||
register = Registry()
|
||||
|
||||
# Trust type is a combination of ipanttrusttype and ipanttrustattributes
|
||||
# We shift trust attributes by 3 bits to left so bit 0 becomes bit 3 and
|
||||
# 2+(1 << 3) becomes 10.
|
||||
_trust_type_dict = {1 : _('Non-Active Directory domain'),
|
||||
2 : _('Active Directory domain'),
|
||||
3 : _('RFC4120-compliant Kerberos realm'),
|
||||
10: _('Non-transitive external trust to a domain in another Active Directory forest')}
|
||||
|
||||
_trust_direction_dict = {1 : _('Trusting forest'),
|
||||
2 : _('Trusted forest'),
|
||||
3 : _('Two-way trust')}
|
||||
_trust_status_dict = {True : _('Established and verified'),
|
||||
False : _('Waiting for confirmation by remote side')}
|
||||
_trust_type_dict_unknown = _('Unknown')
|
||||
|
||||
_trust_type_option = StrEnum('trust_type',
|
||||
cli_name='type',
|
||||
label=_('Trust type (ad for Active Directory, default)'),
|
||||
values=(u'ad',),
|
||||
default=u'ad',
|
||||
autofill=True,
|
||||
)
|
||||
_trust_type_option = StrEnum(
|
||||
'trust_type',
|
||||
cli_name='type',
|
||||
label=_('Trust type (ad for Active Directory, default)'),
|
||||
values=(u'ad',),
|
||||
default=u'ad',
|
||||
autofill=True,
|
||||
)
|
||||
|
||||
DEFAULT_RANGE_SIZE = 200000
|
||||
|
||||
@ -190,31 +180,6 @@ DBUS_IFACE_TRUST = 'com.redhat.idm.trust'
|
||||
CRED_STYLE_SAMBA = 1
|
||||
CRED_STYLE_KERBEROS = 2
|
||||
|
||||
LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE = 0x00000001
|
||||
|
||||
def trust_type_string(level, attrs):
|
||||
"""
|
||||
Returns a string representing a type of the trust. The original field is an enum:
|
||||
LSA_TRUST_TYPE_DOWNLEVEL = 0x00000001,
|
||||
LSA_TRUST_TYPE_UPLEVEL = 0x00000002,
|
||||
LSA_TRUST_TYPE_MIT = 0x00000003
|
||||
"""
|
||||
transitive = int(attrs) & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE
|
||||
string = _trust_type_dict.get(int(level) | (transitive << 3), _trust_type_dict_unknown)
|
||||
return unicode(string)
|
||||
|
||||
def trust_direction_string(level):
|
||||
"""
|
||||
Returns a string representing a direction of the trust. The original field is a bitmask taking two bits in use
|
||||
LSA_TRUST_DIRECTION_INBOUND = 0x00000001,
|
||||
LSA_TRUST_DIRECTION_OUTBOUND = 0x00000002
|
||||
"""
|
||||
string = _trust_direction_dict.get(int(level), _trust_type_dict_unknown)
|
||||
return unicode(string)
|
||||
|
||||
def trust_status_string(level):
|
||||
string = _trust_status_dict.get(level, _trust_type_dict_unknown)
|
||||
return unicode(string)
|
||||
|
||||
def make_trust_dn(env, trust_type, dn):
|
||||
assert isinstance(dn, DN)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user