IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

user, migration: use LDAPClient for ad-hoc LDAP connections

Browse Source 
Use LDAPClient instead of ldap2 for ad-hoc remote LDAP connections in the
user_status and migrate-ds plugins.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
This commit is contained in:
Jan Cholasta 2017-02-23 09:44:04 +00:00 committed by Martin Basti
parent 53c5c0ad7b
commit e9cb74fd27
2 changed files with 10 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ipaserver/plugins/migration.py
View File

@ -28,13 +28,9 @@ from ipalib import Command, Password, Str, Flag, StrEnum, DNParam, Bool
from ipalib.cli import to_cli from ipalib.cli import to_cli
from ipalib.plugable import Registry from ipalib.plugable import Registry
from .user import NO_UPG_MAGIC from .user import NO_UPG_MAGIC
if api.env.in_server and api.env.context in ['lite', 'server']:
try:
from ipaserver.plugins.ldap2 import ldap2
except Exception as e:
raise e
from ipalib import _ from ipalib import _
from ipapython.dn import DN from ipapython.dn import DN
from ipapython.ipaldap import LDAPClient
from ipapython.ipautil import write_tmp_file from ipapython.ipautil import write_tmp_file
from ipapython.kerberos import Principal from ipapython.kerberos import Principal
import datetime import datetime
@ -885,8 +881,6 @@ migration process might be incomplete\n''')
return dict(result={}, failed={}, enabled=False, compat=True) return dict(result={}, failed={}, enabled=False, compat=True)
# connect to DS # connect to DS
ds_ldap = ldap2(self.api, ldap_uri=ldapuri)
cacert = None cacert = None
if options.get('cacertfile') is not None: if options.get('cacertfile') is not None:
# store CA cert into file # store CA cert into file
@ -894,12 +888,13 @@ migration process might be incomplete\n''')
cacert = tmp_ca_cert_f.name cacert = tmp_ca_cert_f.name
# start TLS connection # start TLS connection
ds_ldap.connect(bind_dn=options['binddn'], bind_pw=bindpw, ds_ldap = LDAPClient(ldapuri, cacert=cacert)
cacert=cacert) ds_ldap.simple_bind(options['binddn'], bindpw)
tmp_ca_cert_f.close() tmp_ca_cert_f.close()
else: else:
ds_ldap.connect(bind_dn=options['binddn'], bind_pw=bindpw) ds_ldap = LDAPClient(ldapuri, cacert=cacert)
ds_ldap.simple_bind(options['binddn'], bindpw)
# check whether the compat plugin is enabled # check whether the compat plugin is enabled
if not options.get('compat'): if not options.get('compat'):

12
ipaserver/plugins/user.py
View File

@ -21,7 +21,7 @@
import time import time
from time import gmtime, strftime from time import gmtime, strftime
import posixpath import posixpath
import os
import six import six
from ipalib import api from ipalib import api
@ -63,12 +63,10 @@ from ipalib import _, ngettext
from ipalib import output from ipalib import output
from ipaplatform.paths import paths from ipaplatform.paths import paths
from ipapython.dn import DN from ipapython.dn import DN
from ipapython.ipaldap import LDAPClient
from ipapython.ipautil import ipa_generate_password, TMP_PWD_ENTROPY_BITS from ipapython.ipautil import ipa_generate_password, TMP_PWD_ENTROPY_BITS
from ipalib.capabilities import client_has_capability from ipalib.capabilities import client_has_capability
if api.env.in_server:
from ipaserver.plugins.ldap2 import ldap2
if six.PY3: if six.PY3:
unicode = str unicode = str
@ -1119,9 +1117,9 @@ class user_status(LDAPQuery):
if host == api.env.host: if host == api.env.host:
other_ldap = self.obj.backend other_ldap = self.obj.backend
else: else:
other_ldap = ldap2(self.api, ldap_uri='ldap://%s' % host)
try: try:
other_ldap.connect(ccache=os.environ['KRB5CCNAME']) other_ldap = LDAPClient(ldap_uri='ldap://%s' % host)
other_ldap.gssapi_bind()
except Exception as e: except Exception as e:
self.error("user_status: Connecting to %s failed with %s" % (host, str(e))) self.error("user_status: Connecting to %s failed with %s" % (host, str(e)))
newresult = {'dn': dn} newresult = {'dn': dn}
@ -1166,7 +1164,7 @@ class user_status(LDAPQuery):
count += 1 count += 1
if host != api.env.host: if host != api.env.host:
other_ldap.disconnect() other_ldap.close()
return dict(result=entries, return dict(result=entries,
count=count, count=count,