pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0191-trust-mod-allow-modifying-list-of-UPNs-of-a-trusted-.patch

ac7d03
From 4df20255c1738526696ea72af6fc70e9c6aa6694 Mon Sep 17 00:00:00 2001
ac7d03
From: Alexander Bokovoy <abokovoy@redhat.com>
ac7d03
Date: Mon, 12 Jun 2017 11:05:06 +0300
ac7d03
Subject: [PATCH] trust-mod: allow modifying list of UPNs of a trusted forest
ac7d03
ac7d03
There are two ways for maintaining user principal names (UPNs) in Active
ac7d03
Directory:
ac7d03
 - associate UPN suffixes with the forest root and then allow for each
ac7d03
   user account to choose UPN suffix for logon
ac7d03
 - directly modify userPrincipalName attribute in LDAP
ac7d03
ac7d03
Both approaches lead to the same result: AD DC accepts user@UPN-Suffix
ac7d03
as a proper principal in AS-REQ and TGS-REQ.
ac7d03
ac7d03
The latter (directly modify userPrincipalName) case has a consequence
ac7d03
that this UPN suffix is not visible via netr_DsRGetForestTrustInformation
ac7d03
DCE RPC call. As result, FreeIPA KDC will not know that a particular UPN
ac7d03
suffix does belong to a trusted Active Directory forest. As result, SSSD
ac7d03
will not be able to authenticate and validate this user from a trusted
ac7d03
Active Directory forest.
ac7d03
ac7d03
This is especially true for one-word UPNs which otherwise wouldn't work
ac7d03
properly on Kerberos level for both FreeIPA and Active Directory.
ac7d03
ac7d03
Administrators are responsible for amending the list of UPNs associated
ac7d03
with the forest in this case. With this commit, an option is added to
ac7d03
'ipa trust-mod' that allows specifying arbitrary UPN suffixes to a
ac7d03
trusted forest root.
ac7d03
ac7d03
As with all '-mod' commands, the change replaces existing UPNs when
ac7d03
applied, so administrators are responsible to specify all of them:
ac7d03
ac7d03
  ipa trust-mod ad.test --upn-suffixes={existing.upn,another_upn,new}
ac7d03
ac7d03
Fixes: https://pagure.io/freeipa/issue/7015
ac7d03
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
ac7d03
---
ac7d03
 API.txt                    | 3 ++-
ac7d03
 VERSION.m4                 | 4 ++--
ac7d03
 ipaserver/plugins/trust.py | 3 ++-
ac7d03
 3 files changed, 6 insertions(+), 4 deletions(-)
ac7d03
ac7d03
diff --git a/API.txt b/API.txt
ac7d03
index 6511ad8d1cb4dc9079628fc058312f31aaec624d..86229156adfba829a46b6a831ad6843cc1a17d6a 100644
ac7d03
--- a/API.txt
ac7d03
+++ b/API.txt
ac7d03
@@ -5769,11 +5769,12 @@ output: ListOfEntries('result')
ac7d03
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
ac7d03
 output: Output('truncated', type=[<type 'bool'>])
ac7d03
 command: trust_mod/1
ac7d03
-args: 1,9,3
ac7d03
+args: 1,10,3
ac7d03
 arg: Str('cn', cli_name='realm')
ac7d03
 option: Str('addattr*', cli_name='addattr')
ac7d03
 option: Flag('all', autofill=True, cli_name='all', default=False)
ac7d03
 option: Str('delattr*', cli_name='delattr')
ac7d03
+option: Str('ipantadditionalsuffixes*', autofill=False, cli_name='upn_suffixes')
ac7d03
 option: Str('ipantsidblacklistincoming*', autofill=False, cli_name='sid_blacklist_incoming')
ac7d03
 option: Str('ipantsidblacklistoutgoing*', autofill=False, cli_name='sid_blacklist_outgoing')
ac7d03
 option: Flag('raw', autofill=True, cli_name='raw', default=False)
ac7d03
diff --git a/VERSION.m4 b/VERSION.m4
ac7d03
index 8aa3ef03f352cd176579c5d5848ed9550f22105d..25aaa1dd0e3c2868e63300dec7fe9228f1ebcb43 100644
ac7d03
--- a/VERSION.m4
ac7d03
+++ b/VERSION.m4
ac7d03
@@ -73,8 +73,8 @@ define(IPA_DATA_VERSION, 20100614120000)
ac7d03
 #                                                      #
ac7d03
 ########################################################
ac7d03
 define(IPA_API_VERSION_MAJOR, 2)
ac7d03
-define(IPA_API_VERSION_MINOR, 227)
ac7d03
-# Last change: Add `pkinit-status` command
ac7d03
+define(IPA_API_VERSION_MINOR, 228)
ac7d03
+# Last change: Expose ipaNTAdditionalSuffixes in trust-mod
ac7d03
 
ac7d03
 
ac7d03
 ########################################################
ac7d03
diff --git a/ipaserver/plugins/trust.py b/ipaserver/plugins/trust.py
ac7d03
index 075b39dcc33a79f3e73e8e1e9e31ebbef17618fe..d0bbfbc47ca65c9c5229685fc9d202c293fe41cd 100644
ac7d03
--- a/ipaserver/plugins/trust.py
ac7d03
+++ b/ipaserver/plugins/trust.py
ac7d03
@@ -553,8 +553,9 @@ class trust(LDAPObject):
ac7d03
             flags={'virtual_attribute', 'no_create', 'no_update', 'no_search'},
ac7d03
         ),
ac7d03
         Str('ipantadditionalsuffixes*',
ac7d03
+            cli_name='upn_suffixes',
ac7d03
             label=_('UPN suffixes'),
ac7d03
-            flags={'no_create', 'no_update', 'no_search'},
ac7d03
+            flags={'no_create', 'no_search'},
ac7d03
         ),
ac7d03
     )
ac7d03
 
ac7d03
-- 
ac7d03
2.9.4
ac7d03