From fd6873ad33493b5f395a92f03d54cd184b90d2a2 Mon Sep 17 00:00:00 2001
From: Martin Babinsky <mbabinsk@redhat.com>
Date: Tue, 25 Apr 2017 18:55:59 +0200
Subject: [PATCH] separate function to set ipaConfigString values on service
entry
There is some code duplication regarding setting ipaConfigString values
when:
* LDAP-enabling a service entry
* advertising enabled KDCProxy in LDAP
We can delegate the common work to a single re-usable function and thus
expose it to future use-cases (like PKINIT advertising).
https://pagure.io/freeipa/issue/6830
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
---
ipaserver/install/httpinstance.py | 43 +-----------
ipaserver/install/service.py | 135 ++++++++++++++++++++++++++------------
2 files changed, 94 insertions(+), 84 deletions(-)
diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
index aeb5c5e450813469e1b6cd374b30cd4aab338537..f0a477e0bf16b03ed8b937279dad88e6e2b3aab6 100644
--- a/ipaserver/install/httpinstance.py
+++ b/ipaserver/install/httpinstance.py
@@ -42,7 +42,6 @@ from ipapython.ipa_log_manager import root_logger
import ipapython.errors
from ipaserver.install import sysupgrade
from ipalib import api
-from ipalib import errors
from ipalib.constants import ANON_USER
from ipaplatform.constants import constants
from ipaplatform.tasks import tasks
@@ -451,46 +450,8 @@ class HTTPInstance(service.Service):
def enable_kdcproxy(self):
"""Add ipaConfigString=kdcProxyEnabled to cn=KDC"""
- entry_name = DN(('cn', 'KDC'), ('cn', self.fqdn), ('cn', 'masters'),
- ('cn', 'ipa'), ('cn', 'etc'), self.suffix)
- attr_name = 'kdcProxyEnabled'
-
- try:
- entry = api.Backend.ldap2.get_entry(
- entry_name, ['ipaConfigString'])
- except errors.NotFound:
- pass
- else:
- if any(attr_name.lower() == val.lower()
- for val in entry.get('ipaConfigString', [])):
- root_logger.debug("service KDCPROXY already enabled")
- return
-
- entry.setdefault('ipaConfigString', []).append(attr_name)
- try:
- api.Backend.ldap2.update_entry(entry)
- except errors.EmptyModlist:
- root_logger.debug("service KDCPROXY already enabled")
- return
- except:
- root_logger.debug("failed to enable service KDCPROXY")
- raise
-
- root_logger.debug("service KDCPROXY enabled")
- return
-
- entry = api.Backend.ldap2.make_entry(
- entry_name,
- objectclass=["nsContainer", "ipaConfigObject"],
- cn=['KDC'],
- ipaconfigstring=[attr_name]
- )
-
- try:
- api.Backend.ldap2.add_entry(entry)
- except errors.DuplicateEntry:
- root_logger.debug("failed to add service KDCPROXY entry")
- raise
+ service.set_service_entry_config(
+ 'KDC', self.fqdn, [u'kdcProxyEnabled'], self.suffix)
def create_kdcproxy_conf(self):
"""Create ipa-kdc-proxy.conf in /etc/ipa/kdcproxy"""
diff --git a/ipaserver/install/service.py b/ipaserver/install/service.py
index 9533a887ca41b8d9f9480ec30b908b213807ca7e..6b5e69ccd08444c591f15eb680b4cbdf5b6f4de1 100644
--- a/ipaserver/install/service.py
+++ b/ipaserver/install/service.py
@@ -136,6 +136,87 @@ def find_providing_server(svcname, conn, host_name=None, api=api):
return None
+def case_insensitive_attr_has_value(attr, value):
+ """
+ Helper function to find value in an attribute having case-insensitive
+ matching rules
+
+ :param attr: attribute values
+ :param value: value to find
+
+ :returns: True if the case-insensitive match succeeds, false otherwise
+
+ """
+ if any(value.lower() == val.lower()
+ for val in attr):
+ return True
+
+ return False
+
+
+def set_service_entry_config(name, fqdn, config_values,
+ ldap_suffix='',
+ post_add_config=()):
+ """
+ Sets the 'ipaConfigString' values on the entry. If the entry is not present
+ already, create a new one with desired 'ipaConfigString'
+
+ :param name: service entry name
+ :param config_values: configuration values to store
+ :param fqdn: master fqdn
+ :param ldap_suffix: LDAP backend suffix
+ :param post_add_config: additional configuration to add when adding a
+ non-existent entry
+ """
+ assert isinstance(ldap_suffix, DN)
+
+ entry_name = DN(
+ ('cn', name), ('cn', fqdn), ('cn', 'masters'),
+ ('cn', 'ipa'), ('cn', 'etc'), ldap_suffix)
+
+ # enable disabled service
+ try:
+ entry = api.Backend.ldap2.get_entry(
+ entry_name, ['ipaConfigString'])
+ except errors.NotFound:
+ pass
+ else:
+ existing_values = entry.get('ipaConnfigString', [])
+ for value in config_values:
+ if case_insensitive_attr_has_value(existing_values, value):
+ root_logger.debug(
+ "service %s: config string %s already set", name, value)
+
+ entry.setdefault('ipaConfigString', []).append(value)
+
+ try:
+ api.Backend.ldap2.update_entry(entry)
+ except errors.EmptyModlist:
+ root_logger.debug(
+ "service %s has already enabled config values %s", name,
+ config_values)
+ return
+ except:
+ root_logger.debug("failed to set service %s config values", name)
+ raise
+
+ root_logger.debug("service %s has all config values set", name)
+ return
+
+ entry = api.Backend.ldap2.make_entry(
+ entry_name,
+ objectclass=["nsContainer", "ipaConfigObject"],
+ cn=[name],
+ ipaconfigstring=config_values + list(post_add_config),
+ )
+
+ try:
+ api.Backend.ldap2.add_entry(entry)
+ except (errors.DuplicateEntry) as e:
+ root_logger.debug("failed to add service entry %s", name)
+ raise e
+
+
class Service(object):
def __init__(self, service_name, service_desc=None, sstore=None,
fstore=None, api=api, realm_name=None,
@@ -442,51 +523,19 @@ class Service(object):
def ldap_enable(self, name, fqdn, dm_password=None, ldap_suffix='',
config=[]):
- assert isinstance(ldap_suffix, DN)
- self.disable()
+ extra_config_opts = [
+ ' '.join([u'startOrder', unicode(SERVICE_LIST[name][1])])
+ ]
+ extra_config_opts.extend(config)
- entry_name = DN(('cn', name), ('cn', fqdn), ('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), ldap_suffix)
-
- # enable disabled service
- try:
- entry = api.Backend.ldap2.get_entry(
- entry_name, ['ipaConfigString'])
- except errors.NotFound:
- pass
- else:
- if any(u'enabledservice' == val.lower()
- for val in entry.get('ipaConfigString', [])):
- root_logger.debug("service %s startup entry already enabled", name)
- return
-
- entry.setdefault('ipaConfigString', []).append(u'enabledService')
-
- try:
- api.Backend.ldap2.update_entry(entry)
- except errors.EmptyModlist:
- root_logger.debug("service %s startup entry already enabled", name)
- return
- except:
- root_logger.debug("failed to enable service %s startup entry", name)
- raise
-
- root_logger.debug("service %s startup entry enabled", name)
- return
-
- order = SERVICE_LIST[name][1]
- entry = api.Backend.ldap2.make_entry(
- entry_name,
- objectclass=["nsContainer", "ipaConfigObject"],
- cn=[name],
- ipaconfigstring=[
- "enabledService", "startOrder " + str(order)] + config,
- )
+ self.disable()
- try:
- api.Backend.ldap2.add_entry(entry)
- except (errors.DuplicateEntry) as e:
- root_logger.debug("failed to add service %s startup entry", name)
- raise e
+ set_service_entry_config(
+ name,
+ fqdn,
+ [u'enabledService'],
+ ldap_suffix=ldap_suffix,
+ post_add_config=extra_config_opts)
def ldap_disable(self, name, fqdn, ldap_suffix):
assert isinstance(ldap_suffix, DN)
--
2.12.2