pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0077-trust-always-use-oddjobd-helper-for-fetching-trust-i.patch

ac7d03
From 3353a259bb8ace57efcfd784f2a0c0c6884d9966 Mon Sep 17 00:00:00 2001
ac7d03
From: Alexander Bokovoy <abokovoy@redhat.com>
ac7d03
Date: Wed, 5 Apr 2017 12:37:10 +0300
ac7d03
Subject: [PATCH] trust: always use oddjobd helper for fetching trust
ac7d03
 information
ac7d03
ac7d03
Since introduction of privilege separation in IPA framework none of the
ac7d03
operations that require direct access to the framework's credentials can
ac7d03
be done. All authentication has to be performed with GSSAPI.
ac7d03
ac7d03
As result, we cannot obtain TGT for HTTP/.. principal with kinit
ac7d03
anymore, so it is better to re-route all types of trust to oddjobd
ac7d03
helper and get rid of casing out two-way trust.
ac7d03
ac7d03
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1438366
ac7d03
ac7d03
Reviewed-By: Martin Basti <mbasti@redhat.com>
ac7d03
---
ac7d03
 ipaserver/plugins/trust.py | 43 ++++++++++---------------------------------
ac7d03
 1 file changed, 10 insertions(+), 33 deletions(-)
ac7d03
ac7d03
diff --git a/ipaserver/plugins/trust.py b/ipaserver/plugins/trust.py
ac7d03
index 3de2458466214044f6b1b5d8560a2a7ac53ede57..0829f8c714f15c4384a89e18ba29e417405c249c 100644
ac7d03
--- a/ipaserver/plugins/trust.py
ac7d03
+++ b/ipaserver/plugins/trust.py
ac7d03
@@ -1742,47 +1742,24 @@ class trust_fetch_domains(LDAPRetrieve):
ac7d03
         ldap = self.api.Backend.ldap2
ac7d03
         verify_samba_component_presence(ldap, self.api)
ac7d03
 
ac7d03
-        trust = self.api.Command.trust_show(
ac7d03
-            keys[0], all=True, raw=True)['result']
ac7d03
+        # Check first that the trust actually exists
ac7d03
+        result = self.api.Command.trust_show(keys[0], all=True, raw=True)
ac7d03
+        self.obj.warning_if_ad_trust_dom_have_missing_SID(result, **options)
ac7d03
 
ac7d03
         result = dict()
ac7d03
         result['result'] = []
ac7d03
         result['count'] = 0
ac7d03
         result['truncated'] = False
ac7d03
 
ac7d03
-        trust_direction = int(trust['ipanttrustdirection'][0])
ac7d03
-        is_nontransitive = int(trust.get('ipanttrustattributes',
ac7d03
-                               [0])[0]) & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE
ac7d03
         # For one-way trust and external trust fetch over DBus.
ac7d03
         # We don't get the list in this case.
ac7d03
-        if trust_direction != TRUST_BIDIRECTIONAL or is_nontransitive:
ac7d03
-            fetch_trusted_domains_over_dbus(self.api, self.log, keys[0])
ac7d03
-            result['summary'] = unicode(_('List of trust domains successfully refreshed. Use trustdomain-find command to list them.'))
ac7d03
-            return result
ac7d03
-
ac7d03
-        trustinstance = ipaserver.dcerpc.TrustDomainJoins(self.api)
ac7d03
-        if not trustinstance.configured:
ac7d03
-            raise errors.NotFound(
ac7d03
-                name=_('AD Trust setup'),
ac7d03
-                reason=_(
ac7d03
-                    'Cannot perform join operation without own domain '
ac7d03
-                    'configured. Make sure you have run ipa-adtrust-install '
ac7d03
-                    'on the IPA server first'
ac7d03
-                )
ac7d03
-            )
ac7d03
-
ac7d03
-        trustinstance.populate_remote_domain(keys[0])
ac7d03
-
ac7d03
-        res = fetch_domains_from_trust(self.api, trustinstance, **options)
ac7d03
-        domains = add_new_domains_from_trust(self.api, trustinstance, trust, res, **options)
ac7d03
-
ac7d03
-        if len(domains) > 0:
ac7d03
-            result['summary'] = unicode(_('List of trust domains successfully refreshed'))
ac7d03
-        else:
ac7d03
-            result['summary'] = unicode(_('No new trust domains were found'))
ac7d03
-
ac7d03
-        result['result'] = domains
ac7d03
-        result['count'] = len(domains)
ac7d03
+        # With privilege separation we also cannot authenticate as
ac7d03
+        # HTTP/ principal because we have no access to its key material.
ac7d03
+        # Thus, we'll use DBus call out to oddjobd helper in all cases
ac7d03
+        fetch_trusted_domains_over_dbus(self.api, self.log, keys[0])
ac7d03
+        result['summary'] = unicode(_('List of trust domains successfully '
ac7d03
+                                      'refreshed. Use trustdomain-find '
ac7d03
+                                      'command to list them.'))
ac7d03
         return result
ac7d03
 
ac7d03
 
ac7d03
-- 
ac7d03
2.9.3
ac7d03