From 414c1303d60e6e7ca46b29e0e2e066bca03c9e0b Mon Sep 17 00:00:00 2001

From: Martin Kosek <mkosek@redhat.com>

Date: Fri, 5 Sep 2014 11:26:18 +0200

Subject: [PATCH] Remove pkinit plugin

This patch completely removes any signs of pkinit in the IPA package. It

should be used only as addition to the first patch attached to the

ticket.

Rebased patch by Jan Zeleny and Rob Crittenden.

https://fedorahosted.org/freeipa/ticket/616

---

 API.txt                  |   5 ---

 ipalib/plugins/pkinit.py | 105 -----------------------------------------------

 2 files changed, 110 deletions(-)

 delete mode 100644 ipalib/plugins/pkinit.py

diff --git a/API.txt b/API.txt

index 5253e1585e000f39d6e185a94548037dfe54d4d8..0b626cb0db44ec9adfb688bd5afddb4b17d950d6 100644

--- a/API.txt

+++ b/API.txt

@@ -3199,11 +3199,6 @@ command: ping

 args: 0,1,1

 option: Str('version?', exclude='webui')

 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)

-command: pkinit_anonymous

-args: 1,1,1

-arg: Str('action')

-option: Str('version?', exclude='webui')

-output: Output('result', None, None)

 command: plugins

 args: 0,3,3

 option: Flag('all', autofill=True, cli_name='all', default=True, exclude='webui')

diff --git a/ipalib/plugins/pkinit.py b/ipalib/plugins/pkinit.py

deleted file mode 100644

index 5f00b2b46ff94cca7f98876c0171f455c210d778..0000000000000000000000000000000000000000

--- a/ipalib/plugins/pkinit.py

+++ /dev/null

@@ -1,105 +0,0 @@

-# Authors:

-#   Simo Sorce <ssorce@redhat.com>

-#

-# Copyright (C) 2010  Red Hat

-# see file 'COPYING' for use and warranty information

-#

-# This program is free software; you can redistribute it and/or modify

-# it under the terms of the GNU General Public License as published by

-# the Free Software Foundation, either version 3 of the License, or

-# (at your option) any later version.

-#

-# This program is distributed in the hope that it will be useful,

-# but WITHOUT ANY WARRANTY; without even the implied warranty of

-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

-# GNU General Public License for more details.

-#

-# You should have received a copy of the GNU General Public License

-# along with this program.  If not, see <http://www.gnu.org/licenses/>.

-

-from ipalib import api, errors

-from ipalib import Int, Str

-from ipalib import Object, Command

-from ipalib import _

-from ipalib.plugable import Registry

-from ipapython.dn import DN

-

-__doc__ = _("""

-Kerberos pkinit options

-

-Enable or disable anonymous pkinit using the principal

-WELLKNOWN/ANONYMOUS@REALM. The server must have been installed with

-pkinit support.

-

-EXAMPLES:

-

- Enable anonymous pkinit:

-  ipa pkinit-anonymous enable

-

- Disable anonymous pkinit:

-  ipa pkinit-anonymous disable

-

-For more information on anonymous pkinit see:

-

-http://k5wiki.kerberos.org/wiki/Projects/Anonymous_pkinit

-""")

-

-register = Registry()

-

-@register()

-class pkinit(Object):

-    """

-    PKINIT Options

-    """

-    object_name = _('pkinit')

-

-    label=_('PKINIT')

-

-

-def valid_arg(ugettext, action):

-    """

-    Accepts only Enable/Disable.

-    """

-    a = action.lower()

-    if a != 'enable' and a != 'disable':

-        raise errors.ValidationError(

-            name='action',

-            error=_('Unknown command %s') % action

-        )

-

-@register()

-class pkinit_anonymous(Command):

-    __doc__ = _('Enable or Disable Anonymous PKINIT.')

-

-    princ_name = 'WELLKNOWN/ANONYMOUS@%s' % api.env.realm

-    default_dn = DN(('krbprincipalname', princ_name), ('cn', api.env.realm), ('cn', 'kerberos'), api.env.basedn)

-

-    takes_args = (

-        Str('action', valid_arg),

-    )

-

-    def execute(self, action, **options):

-        ldap = self.api.Backend.ldap2

-        set_lock = False

-        lock = None

-

-        entry_attrs = ldap.get_entry(self.default_dn, ['nsaccountlock'])

-

-        if 'nsaccountlock' in entry_attrs:

-            lock = entry_attrs['nsaccountlock'][0].lower()

-

-        if action.lower() == 'enable':

-            if lock == 'true':

-                set_lock = True

-                lock = None

-        elif action.lower() == 'disable':

-            if lock != 'true':

-                set_lock = True

-                lock = 'TRUE'

-

-        if set_lock:

-            entry_attrs['nsaccountlock'] = lock

-            ldap.update_entry(entry_attrs)

-

-        return dict(result=True)

-

-- 

2.5.1