From 5012843d350b7a39b78e4eb7cab6cff98cae59d5 Mon Sep 17 00:00:00 2001

From: Martin Babinsky <mbabinsk@redhat.com>

Date: Fri, 12 May 2017 17:25:30 +0200

Subject: [PATCH] Add `pkinit-status` command

This command is a more streamlined reporting tool for PKINIT feature

status in the FreeIPA topology. It prints out whether PKINIT is enabled

or disabled on individual masters in a topology. If a`--server` is

specified, it reports status for an individual server. If `--status` is

specified, it searches for all servers that have PKINIT enabled or

disabled.

https://pagure.io/freeipa/issue/6937

Reviewed-By: Jan Cholasta <jcholast@redhat.com>

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>

---

 API.txt                     |  15 ++++++

 VERSION.m4                  |   4 +-

 ipaserver/plugins/pkinit.py | 109 +++++++++++++++++++++++++++++++++++++++++++-

 3 files changed, 125 insertions(+), 3 deletions(-)

diff --git a/API.txt b/API.txt

index 4e6754afe2deab5c963577f1e1363f1123a31a86..6511ad8d1cb4dc9079628fc058312f31aaec624d 100644

--- a/API.txt

+++ b/API.txt

@@ -3736,6 +3736,20 @@ command: ping/1

 args: 0,1,1

 option: Str('version?')

 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

+command: pkinit_status/1

+args: 1,7,4

+arg: Str('criteria?')

+option: Flag('all', autofill=True, cli_name='all', default=False)

+option: Flag('raw', autofill=True, cli_name='raw', default=False)

+option: Str('server_server?', autofill=False, cli_name='server')

+option: Int('sizelimit?', autofill=False)

+option: StrEnum('status?', autofill=False, cli_name='status', values=[u'enabled', u'disabled'])

+option: Int('timelimit?', autofill=False)

+option: Str('version?')

+output: Output('count', type=[<type 'int'>])

+output: ListOfEntries('result')

+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

+output: Output('truncated', type=[<type 'bool'>])

 command: plugins/1

 args: 0,3,3

 option: Flag('all', autofill=True, cli_name='all', default=True)

@@ -6798,6 +6812,7 @@ default: permission_remove_member/1

 default: permission_show/1

 default: ping/1

 default: pkinit/1

+default: pkinit_status/1

 default: plugins/1

 default: privilege/1

 default: privilege_add/1

diff --git a/VERSION.m4 b/VERSION.m4

index e10ee3cad6f5a6e023ea3cb9ec20591b7caae0bd..8aa3ef03f352cd176579c5d5848ed9550f22105d 100644

--- a/VERSION.m4

+++ b/VERSION.m4

@@ -73,8 +73,8 @@ define(IPA_DATA_VERSION, 20100614120000)

 #                                                      #

 ########################################################

 define(IPA_API_VERSION_MAJOR, 2)

-define(IPA_API_VERSION_MINOR, 226)

-# Last change: Remove the pkinit-anonymous command

+define(IPA_API_VERSION_MINOR, 227)

+# Last change: Add `pkinit-status` command

 ########################################################

diff --git a/ipaserver/plugins/pkinit.py b/ipaserver/plugins/pkinit.py

index e49b31091d676865fa7f023be8edc3cdef9d6d2c..970f955c54bc489765d2565255e8805138a35307 100644

--- a/ipaserver/plugins/pkinit.py

+++ b/ipaserver/plugins/pkinit.py

@@ -3,11 +3,33 @@

 #

 from ipalib import Object

-from ipalib import _

+from ipalib import _, ngettext

+from ipalib.crud import Search

+from ipalib.parameters import Int, Str, StrEnum

 from ipalib.plugable import Registry

 register = Registry()

+__doc__ = _("""

+Kerberos PKINIT feature status reporting tools.

+

+Report IPA masters on which Kerberos PKINIT is enabled or disabled

+

+EXAMPLES:

+ List PKINIT status on all masters:

+   ipa pkinit-status

+

+ Check PKINIT status on `ipa.example.com`:

+   ipa pkinit-status --server ipa.example.com

+

+ List all IPA masters with disabled PKINIT:

+   ipa pkinit-status --status='disabled'

+

+For more info about PKINIT support see:

+

+https://www.freeipa.org/page/V4/Kerberos_PKINIT

+""")

+

 @register()

 class pkinit(Object):

@@ -17,3 +39,88 @@ class pkinit(Object):

     object_name = _('pkinit')

     label = _('PKINIT')

+

+    takes_params = (

+        Str(

+            'server_server?',

+            cli_name='server',

+            label=_('Server name'),

+            doc=_('IPA server hostname'),

+        ),

+        StrEnum(

+            'status?',

+            cli_name='status',

+            label=_('PKINIT status'),

+            doc=_('Whether PKINIT is enabled or disabled'),

+            values=(u'enabled', u'disabled'),

+            flags={'virtual_attribute', 'no_create', 'no_update'}

+        )

+    )

+

+

+@register()

+class pkinit_status(Search):

+    __doc__ = _('Report PKINIT status on the IPA masters')

+

+    msg_summary = ngettext('%(count)s server matched',

+                           '%(count)s servers matched', 0)

+

+    takes_options = Search.takes_options + (

+        Int(

+            'timelimit?',

+            label=_('Time Limit'),

+            doc=_('Time limit of search in seconds (0 is unlimited)'),

+            flags=['no_display'],

+            minvalue=0,

+            autofill=False,

+        ),

+        Int(

+            'sizelimit?',

+            label=_('Size Limit'),

+            doc=_('Maximum number of entries returned (0 is unlimited)'),

+            flags=['no_display'],

+            minvalue=0,

+            autofill=False,

+        ),

+    )

+

+    def get_pkinit_status(self, server, status):

+        backend = self.api.Backend.serverroles

+        ipa_master_config = backend.config_retrieve("IPA master")

+

+        if server is not None:

+            servers = [server]

+        else:

+            servers = ipa_master_config['ipa_master_server']

+

+        pkinit_servers = ipa_master_config['pkinit_server_server']

+

+        for s in servers:

+            pkinit_status = {

+                u'server_server': s,

+                u'status': (

+                    u'enabled' if s in pkinit_servers else u'disabled'

+                )

+            }

+            if status is not None and pkinit_status[u'status'] != status:

+                continue

+

+            yield pkinit_status

+

+    def execute(self, *keys, **options):

+        if keys:

+            return dict(

+                result=[],

+                count=0,

+                truncated=False

+            )

+

+        server = options.get('server_server', None)

+        status = options.get('status', None)

+

+        if server is not None:

+            self.api.Object.server_role.ensure_master_exists(server)

+

+        result = sorted(self.get_pkinit_status(server, status))

+

+        return dict(result=result, count=len(result), truncated=False)

-- 

2.9.4