IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

browser config: cleanup after removal of Firefox extension

Browse Source 
Firefox extension which served for configuring Kerberos auth in Firefox
until version which banned self-signed extensions was removed in commit
6c53765ac1.

Given that configure.jar, even older Firefox config tool, was removed
sometime before that, there is no use for signtool tool. It is good
because it is removed from Fedora 27 anyway. So removing last unused
function which calls it.

The removal of FF extension was not exactly clean so removing also
browserconfig.html which only purpose was to use the extension. Therefore
also related JS files are removed. This removal requires unauthorized.html
to be updated so that it doesn't point to non-existing page. And given that
it now points only to single config page, we can change link in UI login page
to this page (ssbrowser.html). While at it, improving buttons in ssbrowser.html.

Btw, commit 6c53765ac1 removed also generation of
krb.js. It had one perk - with that info ssbrowser.html could display real
Kerberos domain instead of only 'example.com'.  I don't have time to revert this
change so removing traces of krb.js as well.

https://pagure.io/freeipa/issue/7135

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
This commit is contained in:
Petr Vobornik
2017-09-01 21:50:44 +02:00
committed by Tomas Krizek
parent bf0b74bec4
commit b0184d10ab
11 changed files with 11 additions and 478 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
freeipa.spec.in
View File

@@ -1067,9 +1067,7 @@ mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
/bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt
/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con
@@ -1407,10 +1405,7 @@ fi
%{_usr}/share/ipa/profiles/README
%{_usr}/share/ipa/profiles/*.cfg
%dir %{_usr}/share/ipa/html
%{_usr}/share/ipa/html/ffconfig.js
%{_usr}/share/ipa/html/ffconfig_page.js
%{_usr}/share/ipa/html/ssbrowser.html
%{_usr}/share/ipa/html/browserconfig.html
%{_usr}/share/ipa/html/unauthorized.html
%dir %{_usr}/share/ipa/migration
%{_usr}/share/ipa/migration/error.html
@@ -1442,11 +1437,8 @@ fi
%{_usr}/share/ipa/wsgi/plugins.py*
%dir %{_sysconfdir}/ipa
%dir %{_sysconfdir}/ipa/html
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig_page.js
%config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
%config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf
@@ -1457,9 +1449,7 @@ fi
%{_usr}/share/ipa/ipa-rewrite.conf
%{_usr}/share/ipa/ipa-pki-proxy.conf
%ghost %attr(0644,root,apache) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/kerberosauth.xpi
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.con
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.js
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb5.ini
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con
%dir %{_usr}/share/ipa/updates/

3
install/html/Makefile.am
View File

@@ -2,10 +2,7 @@ NULL =
appdir = $(IPA_SYSCONF_DIR)/html
app_DATA = \
ffconfig.js \
ffconfig_page.js \
ssbrowser.html \
browserconfig.html \
unauthorized.html \
$(NULL)

128
install/html/browserconfig.html
View File

@@ -1,128 +0,0 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>IPA: Identity Policy Audit</title>
<script type="text/javascript" src="../ui/js/libs/loader.js"></script>
<script type="text/javascript">
(function() {
var styles = [
'../ui/css/patternfly.css',
'../ui/css/ipa.css'
];
var scripts = [
'../ui/js/libs/jquery.js',
'krb.js',
'ffconfig.js',
'ffconfig_page.js'
];
ipa_loader.scripts(scripts);
ipa_loader.styles(styles);
})();
</script>
</head>
<body class="info-page">
<nav class="navbar navbar-default navbar-pf" role="navigation">
<div class="navbar-header">
<a class="brand" href="../ui/index.html"><img src="../ui/images/header-logo.png" alt="FreeIPA"></a>
</div>
</nav>
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">
<div class="browser-config">
<h1>Firefox configuration</h1>
<div id="wrongbrowser" style="display:none" class="step">
<h2>Wrong Browser!</h2>
<p>
<a href="ssbrowser.html" id="notfirefox-link" class="btn btn-default" >Proceed to configuration for other browsers</a>
</p>
<p>
You are not using Firefox. Please use configuration page for other browsers.
</p>
</div>
<div id="step1" class="step">
<h2>Step 1</h2>
<p>
<a href="ca.crt" id="ca-link" class="btn btn-default">Import Certificate Authority certificate</a>
</p>
<p>
Make sure you select <b>all three</b> checkboxes.
</p>
</div>
<div id="step2a" style="display:none" class="step">
<h2>Step 2a</h2>
<p>
<a href="ssbrowser.html#oldfirefox" id="oldfirefox-link" class="btn btn-default">Proceed to configuration page for older versions of Firefox</a>
</p>
<!--<p id="older-compatible">
Your version of Firefox can be configured by an older method. You don't have to use the Kerberos Configuration extension.
</p>-->
<p id="older-required">
Your version of Firefox is not compatible with configuration method on this page. Please use configuration page for older versions of Firefox.
<p>
</div>
<div id="step2" style="display:none" class="step">
<h2>Step 2</h2>
<div id="ext-installed">
<p>
<a href="kerberosauth.xpi" id="reinstall-link" class="btn btn-default">Re-install extension</a>
</p>
<p>
Extension installed. You can proceed to Step 3.
</p>
</div>
<div id="ext-missing">
<p><a href="kerberosauth.xpi" id="install-link" class="btn btn-default">Install Kerberos Configuration Firefox extension</a></p>
<p>Kerberos Configuration extension is required for Step 3</p>
</div>
</div>
<div id="step3" style="display:none" class="step">
<h2>Step 3</h2>
<p><a href="#configure-browser" id="configure-link" class="btn btn-default">Configure browser</a></p>
<p id="config-success" style="display:none">Browser successfully configured</p>
<p id="config-aborted" style="display:none">Configuration aborted</p>
<p id="config-noext" style="display:none">Configuration was not successful, extension isn't installed or is disabled. Please proceed to step 2.</p>
<p id="config-error" style="display:none">Configuration was not successful, unknown error occurred.</p>
</div>
<div id="step2b" class="step">
<h2>Step 2</h2>
<ol>
<li>
In the address bar of Firefox, type <code>about:config</code> and press enter to display the list of current configuration options.
</li>
<li>
In the Filter field, type <code>network.negotiate-auth.trusted-uris</code> to restrict the list of options.
</li>
<li>
Double-click the entry to display the "Enter string value" dialog box.
</li>
<li>
Enter the name of the domain against which you want to authenticate, <code class="example-domain">.example.com</code> as an example.
</li>
</ol>
</div>
<div id="step4" class="step">
<h2 id="step4header" style="display:none">Step 4</h2>
<h2 id="step3bheader">Step 3</h2>
<p><a href="../ui/index.html" id="return-link" class="btn btn-default">Return to Web UI</a></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>

146
install/html/ffconfig.js
View File

@@ -1,146 +0,0 @@
/* Authors:
* Petr Vobornik <pvoborni@redhat.com>
*
* Copyright (C) 2012 Red Hat
* see file 'COPYING' for use and warranty information
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
var IPA = IPA || {};
IPA.browser_config = {
configure_firefox: function(domain) {
var self = this;
domain = domain || self.get_domain();
self.send_message({
method: 'configure',
predefined: 'ipa',
trusted_uris: domain
});
},
get_configure_result: function() {
var self = this;
var el = self.get_data_element();
var answer = el.getAttribute('answer');
return answer;
},
get_domain: function() {
return "."+IPA_DOMAIN;
},
send_message: function(options) {
options = options || {};
var self = this;
self.clear_data_element();
var opt_element = self.get_data_element();
for (var opt in options) {
opt_element.setAttribute(opt, options[opt]);
}
var msg_evt = document.createEvent('HTMLEvents');
msg_evt.initEvent('kerberos-auth-config', true, false);
opt_element.dispatchEvent(msg_evt);
},
get_data_element: function() {
var els = document.getElementsByTagName('kerberosauthdataelement');
var element;
if (els.length === 0) {
element = document.createElement('kerberosauthdataelement');
document.documentElement.appendChild(element);
} else {
element = els[0];
}
return element;
},
clear_data_element: function() {
var self = this;
var el = self.get_data_element();
var to_remove = [];
for (var i=0; i<el.attributes.length; i++) {
to_remove.push(el.attributes[i].name);
}
for (i=0; i<to_remove.length; i++) {
el.removeAttribute(to_remove[i]);
}
},
extension_installed: function() {
var self = this;
self.send_message({
method: 'can_configure'
});
var element = self.get_data_element();
var ext_installed = element.getAttribute('answer') === 'true';
return ext_installed;
},
get_browser: function() {
var ua = window.navigator.userAgent.toLowerCase();
var match = (/(chrome)[ \/]([\w.]+)/.exec(ua)) ||
(/(webkit)[ \/]([\w.]+)/.exec(ua)) ||
(/(opera)(?:.*version|)[ \/]([\w.]+)/.exec(ua)) ||
(/(msie) ([\w.]+)/.exec(ua)) ||
ua.indexOf("compatible") < 0 && (/(mozilla)(?:.*? rv:([\w.]+)|)/.exec(ua)) ||
[];
var matched = {
browser: match[ 1 ] || "",
version: match[ 2 ] || "0"
};
var browser = {};
if (matched.browser) {
browser[matched.browser] = true;
browser.version = matched.version;
}
// Chrome is Webkit, but Webkit is also Safari.
if (browser.chrome) {
browser.webkit = true;
} else if ( browser.webkit ) {
browser.safari = true;
}
return browser;
}
};

163
install/html/ffconfig_page.js
View File

@@ -1,163 +0,0 @@
/* Authors:
* Petr Vobornik <pvoborni@redhat.com>
*
* Copyright (C) 2012 Red Hat
* see file 'COPYING' for use and warranty information
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
$(document).ready(function() {
var set_enabled = function(steps, enabled) {
for (var i=0; i<steps.length; i++) {
$(steps[i]).toggleClass('disabled', !enabled);
$(steps[i]+" .btn").toggleClass('disabled', !enabled);
}
};
var show_installed = function(installed) {
if (installed) {
$('#ext-installed').show();
$('#ext-missing').hide();
} else {
$('#ext-installed').hide();
$('#ext-missing').show();
}
set_enabled(['#step3'], installed);
};
var install = function(event) {
window.location = $(event.target).attr('href');
check_until_installed();
return false;
};
var check_until_installed = function() {
var installed = IPA.browser_config.extension_installed();
show_installed(installed);
if (!installed) {
window.setTimeout(function() {
check_until_installed();
}, 300);
}
};
var configure = function() {
IPA.browser_config.configure_firefox();
var result = IPA.browser_config.get_configure_result();
var installed = IPA.browser_config.extension_installed();
$('#config-success').hide();
$('#config-aborted').hide();
$('#config-noext').hide();
$('#config-error').hide();
if (result === 'configured') {
$('#config-success').show();
} else if (result == 'aborted') {
$('#config-aborted').show();
} else if (!installed) {
$('#config-noext').show();
} else {
$('#config-error').show();
}
return false;
};
var check_version = function() {
var browser = IPA.browser_config.get_browser();
if (!browser.mozilla) {
$('#wrongbrowser').show();
set_enabled(['#step2b'], false);
} else {
// Disable for all version of FF older than 15. Theoretically
// the extension is compatible with version 3.6, 10 and later
// FF 4-9 are not compatible because there is an error in loading
// resource from chrome.manifest
if (compare_version(browser.version, '15') === -1) {
$('#step2a').show();
$('#step2').show();
$('#step3').show();
$('#step4header').show();
$('#step3bheader').hide();
set_enabled(['#step2', '#step3', '#step2b'], false);
} else if (compare_version(browser.version, '40') === -1) {
// FF is > 15 < 40
// show krb extension method
$('#step2').show();
$('#step3').show();
$('#step4header').show();
$('#step3bheader').hide();
$('#step2b').hide();
}
// else
// Firefox since version 40 has new extension signing policy
// this policy prevents to use self-signed FF extension and
// thus a manual config is needed - which is the default (step2b)
// else if (compare_version(version, '15') === -1) {
// $('#step2a').show();
// $('#older-compatible').show();
// $('#older-required').hide();
// }
}
};
var compare_version = function(a, b) {
var only_digits =/[^\d.]/g;
var a_parts = a.replace(only_digits, '').split('.');
var b_parts = b.replace(only_digits, '').split('.');
for (var i=0; i<a_parts.length && i<b_parts.length; i++) {
var a_num = Number(a_parts[i]);
var b_num = Number(b_parts[i]);
if (a_num > b_num) return 1;
else if (a_num < b_num) return -1;
}
if (a_parts.length !== b_parts.length) {
return a_parts.length > b_parts.length ? 1 : -1;
}
return 0;
};
var button_handler = function(handler) {
return function(e) {
if ($(this).hasClass('disabled')) {
e.preventDefault();
return false;
}
return handler.call(this, e);
};
};
$('#install-link').click(button_handler(install));
$('#reinstall-link').click(button_handler(install));
$('#configure-link').click(button_handler(configure));
check_version();
show_installed(IPA.browser_config.extension_installed());
});

2
install/html/jsl.conf
View File

@@ -127,5 +127,3 @@
# To add a set of files, use "+process FileName", "+process Folder\Path\*.js",
# or "+process Folder\Path\*.htm".
#
+process ffconfig.js
+process ffconfig_page.js

22
install/html/ssbrowser.html
View File

@@ -6,23 +6,14 @@
<script type="text/javascript" src="../ui/js/libs/loader.js"></script>
<script type="text/javascript">
(function() {
function loaded() {
$(document).ready(function() {
var domain = '.' + (IPA_DOMAIN || 'example.com');
$('.example-domain').text(domain);
});
}
var styles = [
'../ui/css/patternfly.css',
'../ui/css/ipa.css'
];
var scripts = [
'../ui/js/libs/jquery.js',
'krb.js',
'ffconfig.js'
'../ui/js/libs/jquery.js'
];
ipa_loader.scripts(scripts, loaded);
ipa_loader.scripts(scripts);
ipa_loader.styles(styles);
})();
</script>
@@ -51,7 +42,12 @@
<ol>
<li>
Import <a href="ca.crt">CA certificate</a>. Make sure you checked all three checkboxes.
<p>
<a href="ca.crt" id="ca-link" class="btn btn-default">Import Certificate Authority certificate</a>
</p>
<p>
Make sure you select <b>all three</b> checkboxes.
</p>
</li>
<li>
In the address bar of Firefox, type <code>about:config</code> to display the list of current configuration options.
@@ -65,7 +61,7 @@
<li>
Enter the name of the domain against which you want to authenticate, for example, <code class="example-domain">.example.com.</code>
</li>
<li><strong> You are all set. </strong></li>
<li><a href="../ui/index.html" id="return-link" class="btn btn-default">Return to Web UI</a></li>
</ol>
<h2>Chrome</h2>

4
install/html/unauthorized.html
View File

@@ -36,9 +36,7 @@
<div id="first-time">
<p>
If this is your first time, please <strong>configure your browser</strong>.
Use <a href="browserconfig.html">Firefox configuration page</a> for Firefox
or <a href="ssbrowser.html">manual configuration page</a> for other browsers.
If this is your first time, please <a href="ssbrowser.html">configure your browser</a>.
</p>
</div>
</div>

2
install/ui/src/freeipa/widgets/LoginScreen.js
View File

@@ -55,7 +55,7 @@ define(['dojo/_base/declare',
kerberos_msg: "<i class=\"fa fa-info-circle\"></i> To login with <strong>Kerberos</strong>, please make sure you" +
" have valid tickets (obtainable via kinit) and " +
"<a href='http://${host}/ipa/config/unauthorized.html'>configured</a>" +
"<a href='http://${host}/ipa/config/ssbrowser.html'>configured</a>" +
" the browser correctly, then click Login. ",
cert_msg: "<i class=\"fa fa-info-circle\"></i> To login with <strong>certificate</strong>," +
" please make sure you have valid personal certificate. ",

1
ipaplatform/base/paths.py
View File

@@ -171,7 +171,6 @@ class BasePathNamespace(object):
ODS_SIGNER = "/usr/sbin/ods-signer"
OPENSSL = "/usr/bin/openssl"
PK12UTIL = "/usr/bin/pk12util"
SIGNTOOL = "/usr/bin/signtool"
SOFTHSM2_UTIL = "/usr/bin/softhsm2-util"
SSLGET = "/usr/bin/sslget"
SSS_SSH_AUTHORIZEDKEYS = "/usr/bin/sss_ssh_authorizedkeys"

8
ipaserver/install/certs.py
View File

@@ -226,14 +226,6 @@ class CertDB(object):
def run_certutil(self, args, stdin=None, **kwargs):
return self.nssdb.run_certutil(args, stdin, **kwargs)
def run_signtool(self, args, stdin=None):
with open(self.passwd_fname, "r") as f:
password = f.readline()
new_args = [paths.SIGNTOOL, "-d", self.secdir, "-p", password]
new_args = new_args + args
ipautil.run(new_args, stdin)
def create_noise_file(self):
if ipautil.file_exists(self.noise_fname):
os.remove(self.noise_fname)