pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0101-API-for-retrieval-of-master-s-PKINIT-status-and-publ.patch

ac7d03
From a6f958875f3b42a8ea5856b672f5e8416c0aad90 Mon Sep 17 00:00:00 2001
ac7d03
From: Martin Babinsky <mbabinsk@redhat.com>
ac7d03
Date: Fri, 31 Mar 2017 14:44:29 +0200
ac7d03
Subject: [PATCH] API for retrieval of master's PKINIT status and publishing it
ac7d03
 in LDAP
ac7d03
ac7d03
An API was provided to report whether PKINIT is enabled for clients or
ac7d03
not. If yes, the pkinitEnabled value will be added to the
ac7d03
ipaConfigString attribute of master's KDC entry.
ac7d03
ac7d03
See http://www.freeipa.org/page/V4/Kerberos_PKINIT#Configuration for
ac7d03
more details.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/6830
ac7d03
ac7d03
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
ac7d03
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ac7d03
Reviewed-By: Martin Basti <mbasti@redhat.com>
ac7d03
Reviewed-By: Simo Sorce <ssorce@redhat.com>
ac7d03
---
ac7d03
 ipaserver/install/krbinstance.py | 41 ++++++++++++++++++++++++++++++++++++++++
ac7d03
 1 file changed, 41 insertions(+)
ac7d03
ac7d03
diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py
ac7d03
index 80215788cf4031ef82e9ec7e08bde6cfc4390303..ad3475f95371c9ae17c8b0ac082039c041d5c64c 100644
ac7d03
--- a/ipaserver/install/krbinstance.py
ac7d03
+++ b/ipaserver/install/krbinstance.py
ac7d03
@@ -48,6 +48,38 @@ from ipaplatform.constants import constants
ac7d03
 from ipaplatform.tasks import tasks
ac7d03
 from ipaplatform.paths import paths
ac7d03
 
ac7d03
+PKINIT_ENABLED = 'pkinitEnabled'
ac7d03
+
ac7d03
+
ac7d03
+def get_pkinit_request_ca():
ac7d03
+    """
ac7d03
+    Return the certmonger CA name which is serving the PKINIT certificate
ac7d03
+    request. If the certificate is not tracked by Certmonger, return None
ac7d03
+    """
ac7d03
+    pkinit_request_id = certmonger.get_request_id(
ac7d03
+        {'cert-file': paths.KDC_CERT})
ac7d03
+
ac7d03
+    if pkinit_request_id is None:
ac7d03
+        return
ac7d03
+
ac7d03
+    return certmonger.get_request_value(pkinit_request_id, 'ca-name')
ac7d03
+
ac7d03
+
ac7d03
+def is_pkinit_enabled():
ac7d03
+    """
ac7d03
+    check whether PKINIT is enabled on the master by checking for the presence
ac7d03
+    of KDC certificate and it's tracking CA
ac7d03
+    """
ac7d03
+
ac7d03
+    if os.path.exists(paths.KDC_CERT):
ac7d03
+        pkinit_request_ca = get_pkinit_request_ca()
ac7d03
+
ac7d03
+        if pkinit_request_ca != "SelfSign":
ac7d03
+            return True
ac7d03
+
ac7d03
+    return False
ac7d03
+
ac7d03
+
ac7d03
 class KpasswdInstance(service.SimpleServiceInstance):
ac7d03
     def __init__(self):
ac7d03
         service.SimpleServiceInstance.__init__(self, "kadmin")
ac7d03
@@ -399,6 +431,13 @@ class KrbInstance(service.Service):
ac7d03
             if prev_helper is not None:
ac7d03
                 certmonger.modify_ca_helper(certmonger_ca, prev_helper)
ac7d03
 
ac7d03
+    def pkinit_enable(self):
ac7d03
+        """
ac7d03
+        advertise enabled PKINIT feature in master's KDC entry in LDAP
ac7d03
+        """
ac7d03
+        service.set_service_entry_config(
ac7d03
+            'KDC', self.fqdn, [PKINIT_ENABLED], self.suffix)
ac7d03
+
ac7d03
     def issue_selfsigned_pkinit_certs(self):
ac7d03
         self._call_certmonger(certmonger_ca="SelfSign")
ac7d03
         # for self-signed certificate, the certificate is its own CA, copy it
ac7d03
@@ -410,6 +449,7 @@ class KrbInstance(service.Service):
ac7d03
             self._call_certmonger()
ac7d03
             # copy IPA CA bundle to the KDC's CA cert bundle
ac7d03
             shutil.copyfile(paths.IPA_CA_CRT, paths.CACERT_PEM)
ac7d03
+            self.pkinit_enable()
ac7d03
         except RuntimeError as e:
ac7d03
             root_logger.error("PKINIT certificate request failed: %s", e)
ac7d03
             root_logger.error("Failed to configure PKINIT")
ac7d03
@@ -427,6 +467,7 @@ class KrbInstance(service.Service):
ac7d03
         # NOTE: this may not be the same set of CA certificates trusted by
ac7d03
         # externally provided PKINIT cert.
ac7d03
         shutil.copyfile(paths.IPA_CA_CRT, paths.CACERT_PEM)
ac7d03
+        self.pkinit_enable()
ac7d03
 
ac7d03
     def setup_pkinit(self):
ac7d03
         if self.pkcs12_info:
ac7d03
-- 
ac7d03
2.12.2
ac7d03