|
 |
403b09 |
From 07ff43d198055bc5b95a0acdf516216d00a85cc3 Mon Sep 17 00:00:00 2001
|
|
|
403b09 |
From: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
403b09 |
Date: Fri, 1 Jul 2016 18:09:04 +0200
|
|
|
403b09 |
Subject: [PATCH] Preserve user principal aliases during rename operation
|
|
|
403b09 |
|
|
|
403b09 |
When a MODRDN is performed on the user entry, the MODRDN plugin resets both
|
|
|
403b09 |
krbPrincipalName and krbCanonicalName to the value constructed from uid. In
|
|
|
403b09 |
doing so, hovewer, any principal aliases added to the krbPrincipalName are
|
|
|
403b09 |
wiped clean. In this patch old aliases are fetched before the MODRDN operation
|
|
|
403b09 |
takes place and inserted back after it is performed.
|
|
|
403b09 |
|
|
|
403b09 |
This also preserves previous user logins which can be used further for
|
|
|
403b09 |
authentication as aliases.
|
|
|
403b09 |
|
|
|
403b09 |
https://fedorahosted.org/freeipa/ticket/6028
|
|
|
403b09 |
|
|
|
403b09 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
403b09 |
Reviewed-By: Simo Sorce <ssorce@redhat.com>
|
|
|
403b09 |
---
|
|
|
403b09 |
ipaserver/plugins/baseuser.py | 46 +++++++++++++++++++++++++++++++++++++++++++
|
|
|
403b09 |
1 file changed, 46 insertions(+)
|
|
|
403b09 |
|
|
|
403b09 |
diff --git a/ipaserver/plugins/baseuser.py b/ipaserver/plugins/baseuser.py
|
|
|
403b09 |
index 0052e718afe639bcc1c0a698ded39ea8407a0551..e4288a5a131157815ffb2452692a7edb342f6ac3 100644
|
|
|
403b09 |
--- a/ipaserver/plugins/baseuser.py
|
|
|
403b09 |
+++ b/ipaserver/plugins/baseuser.py
|
|
|
403b09 |
@@ -498,6 +498,50 @@ class baseuser_mod(LDAPUpdate):
|
|
|
403b09 |
len = int(config.get('ipamaxusernamelength')[0])
|
|
|
403b09 |
)
|
|
|
403b09 |
)
|
|
|
403b09 |
+
|
|
|
403b09 |
+ def preserve_krbprincipalname_pre(self, ldap, entry_attrs, *keys, **options):
|
|
|
403b09 |
+ """
|
|
|
403b09 |
+ preserve user principal aliases during rename operation. This is the
|
|
|
403b09 |
+ pre-callback part of this. Another method called during post-callback
|
|
|
403b09 |
+ shall insert the principals back
|
|
|
403b09 |
+ """
|
|
|
403b09 |
+ if options.get('rename', None) is None:
|
|
|
403b09 |
+ return
|
|
|
403b09 |
+
|
|
|
403b09 |
+ try:
|
|
|
403b09 |
+ old_entry = ldap.get_entry(
|
|
|
403b09 |
+ entry_attrs.dn, attrs_list=(
|
|
|
403b09 |
+ 'krbprincipalname', 'krbcanonicalname'))
|
|
|
403b09 |
+
|
|
|
403b09 |
+ if 'krbcanonicalname' not in old_entry:
|
|
|
403b09 |
+ return
|
|
|
403b09 |
+ except errors.NotFound:
|
|
|
403b09 |
+ self.obj.handle_not_found(*keys)
|
|
|
403b09 |
+
|
|
|
403b09 |
+ self.context.krbprincipalname = old_entry.get(
|
|
|
403b09 |
+ 'krbprincipalname', [])
|
|
|
403b09 |
+
|
|
|
403b09 |
+ def preserve_krbprincipalname_post(self, ldap, entry_attrs, **options):
|
|
|
403b09 |
+ """
|
|
|
403b09 |
+ Insert the preserved aliases back to the user entry during rename
|
|
|
403b09 |
+ operation
|
|
|
403b09 |
+ """
|
|
|
403b09 |
+ if options.get('rename', None) is None or not hasattr(
|
|
|
403b09 |
+ self.context, 'krbprincipalname'):
|
|
|
403b09 |
+ return
|
|
|
403b09 |
+
|
|
|
403b09 |
+ obj_pkey = self.obj.get_primary_key_from_dn(entry_attrs.dn)
|
|
|
403b09 |
+ canonical_name = entry_attrs['krbcanonicalname'][0]
|
|
|
403b09 |
+
|
|
|
403b09 |
+ principals_to_add = tuple(p for p in self.context.krbprincipalname if
|
|
|
403b09 |
+ p != canonical_name)
|
|
|
403b09 |
+
|
|
|
403b09 |
+ if principals_to_add:
|
|
|
403b09 |
+ result = self.api.Command.user_add_principal(
|
|
|
403b09 |
+ obj_pkey, principals_to_add)['result']
|
|
|
403b09 |
+
|
|
|
403b09 |
+ entry_attrs['krbprincipalname'] = result.get('krbprincipalname', [])
|
|
|
403b09 |
+
|
|
|
403b09 |
def check_mail(self, entry_attrs):
|
|
|
403b09 |
if 'mail' in entry_attrs:
|
|
|
403b09 |
entry_attrs['mail'] = self.obj.normalize_and_validate_email(entry_attrs['mail'])
|
|
|
403b09 |
@@ -557,9 +601,11 @@ class baseuser_mod(LDAPUpdate):
|
|
|
403b09 |
|
|
|
403b09 |
self.check_objectclass(ldap, dn, entry_attrs)
|
|
|
403b09 |
self.obj.convert_usercertificate_pre(entry_attrs)
|
|
|
403b09 |
+ self.preserve_krbprincipalname_pre(ldap, entry_attrs, *keys, **options)
|
|
|
403b09 |
|
|
|
403b09 |
def post_common_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
|
|
403b09 |
assert isinstance(dn, DN)
|
|
|
403b09 |
+ self.preserve_krbprincipalname_post(ldap, entry_attrs, **options)
|
|
|
403b09 |
if options.get('random', False):
|
|
|
403b09 |
try:
|
|
|
403b09 |
entry_attrs['randompassword'] = unicode(getattr(context, 'randompassword'))
|
|
|
403b09 |
--
|
|
|
403b09 |
2.7.4
|
|
|
403b09 |
|