IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-27 09:21:59 -06:00
Code Issues Packages Projects Releases Wiki Activity

anon-pkinit: add well known principal

Browse Source 
leave it disabled for now
we can change this default once we will have some restriction on what services
this principal can get tickets for.
This commit is contained in:
Simo Sorce 2010-11-02 18:02:59 -04:00
parent 59cf6f8619
commit e05c247490
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
ipaserver/install/krbinstance.py
View File

@ -195,6 +195,7 @@ class KrbInstance(service.Service):
self.step("adding the kerberos master key to the directory", self.__add_master_key)
if setup_pkinit:
self.step("creating X509 Certificate for PKINIT", self.__setup_pkinit)
self.step("creating principal for anonymous PKINIT", self.__add_anonymous_pkinit_principal)
self.__common_post_setup()
@ -521,6 +522,23 @@ class KrbInstance(service.Service):
shutil.copyfile("/usr/share/ipa/html/ca.crt",
"/var/kerberos/krb5kdc/cacert.pem")
def __add_anonymous_pkinit_principal(self):
princ = "WELLKNOWN/ANONYMOUS"
princ_realm = "%s@%s" % (princ, self.realm)
# Create the special anonymous principal
installutils.kadmin_addprinc(princ_realm)
try:
conn = ipaldap.IPAdmin("127.0.0.1")
conn.simple_bind_s("cn=directory manager", self.admin_password)
except Exception, e:
logging.critical("Could not connect to the Directory Server on %s" % self.fqdn)
raise e
dn = "krbprincipalname=%s,cn=%s,cn=kerberos,%s" % (princ_realm, self.realm, self.suffix)
conn.inactivateEntry(dn, False)
conn.unbind()
def uninstall(self):
if self.is_configured():
self.print_msg("Unconfiguring %s" % self.service_name)