From 9a576f7303fd1b7faae3a419f6d54720f234585b Mon Sep 17 00:00:00 2001

From: Christian Heimes <cheimes@redhat.com>

Date: Fri, 22 Jun 2018 10:04:38 +0200

Subject: [PATCH] Fix replication races in Dogtag admin code

DogtagInstance.setup_admin and related methods have multiple LDAP

replication race conditions. The bugs can cause parallel

ipa-replica-install to fail.

The code from __add_admin_to_group() has been changed to use MOD_ADD

ather than search + MOD_REPLACE. The MOD_REPLACE approach can lead to

data loss, when more than one writer changes a group.

setup_admin() now waits until both admin user and group membership have

been replicated to the master peer. The method also adds a new ACI to

allow querying group member in the replication check.

Fixes: https://pagure.io/freeipa/issue/7593

Signed-off-by: Christian Heimes <cheimes@redhat.com>

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>

---

 ipaserver/install/cainstance.py     |   1 +

 ipaserver/install/dogtaginstance.py | 101 ++++++++++++++++++++++------

 ipaserver/install/krainstance.py    |   1 +

 3 files changed, 82 insertions(+), 21 deletions(-)

diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py

index 3a3558a5ded6de3e578574d08a5cdb59338e99c4..0c4d9bf9ad8ae11ac88523857845e16eb62651b9 100644

--- a/ipaserver/install/cainstance.py

+++ b/ipaserver/install/cainstance.py

@@ -377,6 +377,7 @@ class CAInstance(DogtagInstance):

                 # Setup Database

                 self.step("creating certificate server db", self.__create_ds_db)

                 self.step("setting up initial replication", self.__setup_replication)

+                self.step("creating ACIs for admin", self.add_ipaca_aci)

                 self.step("creating installation admin user", self.setup_admin)

             self.step("configuring certificate server instance",

                       self.__spawn_instance)

diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py

index 9470e1a13608a8a84aab8a36c269a708e3f3e9f4..960b8cc7ce495bf5ca359f72b46aa0d43ccec5c3 100644

--- a/ipaserver/install/dogtaginstance.py

+++ b/ipaserver/install/dogtaginstance.py

@@ -18,6 +18,8 @@

 #

 import base64

+import time

+

 import ldap

 import os

 import shutil

@@ -84,6 +86,16 @@ class DogtagInstance(service.Service):

     tracking_reqs = None

     server_cert_name = None

+    ipaca_groups = DN(('ou', 'groups'), ('o', 'ipaca'))

+    ipaca_people = DN(('ou', 'people'), ('o', 'ipaca'))

+    groups_aci = (

+        b'(targetfilter="(objectClass=groupOfUniqueNames)")'

+        b'(targetattr="cn || description || objectclass || uniquemember")'

+        b'(version 3.0; acl "Allow users from o=ipaca to read groups"; '

+        b'allow (read, search, compare) '

+        b'userdn="ldap:///uid=*,ou=people,o=ipaca";)'

+    )

+

     def __init__(self, realm, subsystem, service_desc, host_name=None,

                  nss_db=paths.PKI_TOMCAT_ALIAS_DIR, service_prefix=None):

         """Initializer"""

@@ -101,10 +113,11 @@ class DogtagInstance(service.Service):

         self.pkcs12_info = None

         self.clone = False

-        self.basedn = DN(('o', 'ipa%s' % subsystem.lower()))

+        self.basedn = DN(('o', 'ipaca'))

         self.admin_user = "admin"

-        self.admin_dn = DN(('uid', self.admin_user),

-                           ('ou', 'people'), ('o', 'ipaca'))

+        self.admin_dn = DN(

+            ('uid', self.admin_user), self.ipaca_people

+        )

         self.admin_groups = None

         self.tmp_agent_db = None

         self.subsystem = subsystem

@@ -385,27 +398,33 @@ class DogtagInstance(service.Service):

         raise RuntimeError("%s configuration failed." % self.subsystem)

-    def __add_admin_to_group(self, group):

-        dn = DN(('cn', group), ('ou', 'groups'), ('o', 'ipaca'))

-        entry = api.Backend.ldap2.get_entry(dn)

-        members = entry.get('uniqueMember', [])

-        members.append(self.admin_dn)

-        mod = [(ldap.MOD_REPLACE, 'uniqueMember', members)]

+    def add_ipaca_aci(self):

+        """Add ACI to allow ipaca users to read their own group information

+

+        Dogtag users aren't allowed to enumerate their own groups. The

+        setup_admin() method needs the permission to wait, until all group

+        information has been replicated.

+        """

+        dn = self.ipaca_groups

+        mod = [(ldap.MOD_ADD, 'aci', [self.groups_aci])]

         try:

             api.Backend.ldap2.modify_s(dn, mod)

         except ldap.TYPE_OR_VALUE_EXISTS:

-            # already there

-            pass

+            self.log.debug(

+                "%s already has ACI to read group information", dn

+            )

+        else:

+            self.log.debug("Added ACI to read groups to %s", dn)

     def setup_admin(self):

         self.admin_user = "admin-%s" % self.fqdn

         self.admin_password = ipautil.ipa_generate_password()

-        self.admin_dn = DN(('uid', self.admin_user),

-                           ('ou', 'people'), ('o', 'ipaca'))

-

+        self.admin_dn = DN(

+            ('uid', self.admin_user), self.ipaca_people

+        )

         # remove user if left-over exists

         try:

-            entry = api.Backend.ldap2.delete_entry(self.admin_dn)

+            api.Backend.ldap2.delete_entry(self.admin_dn)

         except errors.NotFound:

             pass

@@ -424,18 +443,58 @@ class DogtagInstance(service.Service):

         )

         api.Backend.ldap2.add_entry(entry)

+        wait_groups = []

         for group in self.admin_groups:

-            self.__add_admin_to_group(group)

+            group_dn = DN(('cn', group), self.ipaca_groups)

+            mod = [(ldap.MOD_ADD, 'uniqueMember', [self.admin_dn])]

+            try:

+                api.Backend.ldap2.modify_s(group_dn, mod)

+            except ldap.TYPE_OR_VALUE_EXISTS:

+                # already there

+                return None

+            else:

+                wait_groups.append(group_dn)

         # Now wait until the other server gets replicated this data

         ldap_uri = ipaldap.get_ldap_uri(self.master_host)

-        master_conn = ipaldap.LDAPClient(ldap_uri)

-        master_conn.gssapi_bind()

-        replication.wait_for_entry(master_conn, entry.dn)

-        del master_conn

+        master_conn = ipaldap.LDAPClient(

+            ldap_uri, start_tls=True, cacert=paths.IPA_CA_CRT

+        )

+        self.log.debug(

+            "Waiting for %s to appear on %s", self.admin_dn, master_conn

+        )

+        deadline = time.time() + api.env.replication_wait_timeout

+        while time.time() < deadline:

+            time.sleep(1)

+            try:

+                master_conn.simple_bind(self.admin_dn, self.admin_password)

+            except ldap.INVALID_CREDENTIALS:

+                pass

+            else:

+                self.log.debug("Successfully logged in as %s", self.admin_dn)

+                break

+        else:

+            self.log.error(

+                "Unable to log in as %s on %s", self.admin_dn, master_conn

+            )

+            raise errors.NotFound(

+                reason="{} did not replicate to {}".format(

+                    self.admin_dn, master_conn

+                )

+            )

+

+        # wait for group membership

+        for group_dn in wait_groups:

+            replication.wait_for_entry(

+                master_conn,

+                group_dn,

+                timeout=api.env.replication_wait_timeout,

+                attr='uniqueMember',

+                attrvalue=self.admin_dn

+            )

     def __remove_admin_from_group(self, group):

-        dn = DN(('cn', group), ('ou', 'groups'), ('o', 'ipaca'))

+        dn = DN(('cn', group), self.ipaca_groups)

         mod = [(ldap.MOD_DELETE, 'uniqueMember', self.admin_dn)]

         try:

             api.Backend.ldap2.modify_s(dn, mod)

diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py

index 990bb87ca2f0029d2450cbef47958399f534f2a6..915d3c3c6e038eeb6a8f94f1ed7f7008c0ef4ead 100644

--- a/ipaserver/install/krainstance.py

+++ b/ipaserver/install/krainstance.py

@@ -111,6 +111,7 @@ class KRAInstance(DogtagInstance):

                 "A Dogtag CA must be installed first")

         if promote:

+            self.step("creating ACIs for admin", self.add_ipaca_aci)

             self.step("creating installation admin user", self.setup_admin)

         self.step("configuring KRA instance", self.__spawn_instance)

         if not self.clone:

-- 

2.17.1