From 2eb94f86872ee7ea191dc3e44fcb3d5a4683ae67 Mon Sep 17 00:00:00 2001
From: Stanislav Laznicka <slaznick@redhat.com>
Date: Wed, 10 May 2017 15:54:21 +0200
Subject: [PATCH] Remove pkinit-anonymous command
Ever since from v4.5, FreeIPA expects at least some kind of
anonymous PKINIT to work. The pkinit-anonymous command was supposed
to enable/disable anonymous pkinit by locking/unlocking the
anonymous principal. We can't allow this for FreeIPA to work
so we are removing the command as it was never supported anyway.
https://pagure.io/freeipa/issue/6936
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
---
API.txt | 6 ---
VERSION.m4 | 4 +-
ipaserver/plugins/pkinit.py | 94 ++-------------------------------------------
3 files changed, 6 insertions(+), 98 deletions(-)
diff --git a/API.txt b/API.txt
index 7594157384511c1317738dafb41361676a2a0fd7..4e6754afe2deab5c963577f1e1363f1123a31a86 100644
--- a/API.txt
+++ b/API.txt
@@ -3736,11 +3736,6 @@ command: ping/1
args: 0,1,1
option: Str('version?')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
-command: pkinit_anonymous/1
-args: 1,1,1
-arg: Str('action')
-option: Str('version?')
-output: Output('result')
command: plugins/1
args: 0,3,3
option: Flag('all', autofill=True, cli_name='all', default=True)
@@ -6803,7 +6798,6 @@ default: permission_remove_member/1
default: permission_show/1
default: ping/1
default: pkinit/1
-default: pkinit_anonymous/1
default: plugins/1
default: privilege/1
default: privilege_add/1
diff --git a/VERSION.m4 b/VERSION.m4
index 31e7c1d6e7054d3b4ef1d9dfaf349d2959f8330a..e10ee3cad6f5a6e023ea3cb9ec20591b7caae0bd 100644
--- a/VERSION.m4
+++ b/VERSION.m4
@@ -73,8 +73,8 @@ define(IPA_DATA_VERSION, 20100614120000)
# #
########################################################
define(IPA_API_VERSION_MAJOR, 2)
-define(IPA_API_VERSION_MINOR, 224)
-# Last change: Add rename option to sudorule objects
+define(IPA_API_VERSION_MINOR, 226)
+# Last change: Remove the pkinit-anonymous command
########################################################
diff --git a/ipaserver/plugins/pkinit.py b/ipaserver/plugins/pkinit.py
index b6b3f38828e86e6e677fadc9c4a638b2eee5171f..e49b31091d676865fa7f023be8edc3cdef9d6d2c 100644
--- a/ipaserver/plugins/pkinit.py
+++ b/ipaserver/plugins/pkinit.py
@@ -1,52 +1,14 @@
-# Authors:
-# Simo Sorce <ssorce@redhat.com>
#
-# Copyright (C) 2010 Red Hat
-# see file 'COPYING' for use and warranty information
+# Copyright (C) 2017 FreeIPA Contributors see COPYING for license
#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
-from ipalib import api, errors
-from ipalib import Str
-from ipalib import Object, Command
+from ipalib import Object
from ipalib import _
from ipalib.plugable import Registry
-from ipalib.constants import ANON_USER
-from ipapython.dn import DN
-
-__doc__ = _("""
-Kerberos pkinit options
-
-Enable or disable anonymous pkinit using the principal
-WELLKNOWN/ANONYMOUS@REALM. The server must have been installed with
-pkinit support.
-
-EXAMPLES:
-
- Enable anonymous pkinit:
- ipa pkinit-anonymous enable
-
- Disable anonymous pkinit:
- ipa pkinit-anonymous disable
-
-For more information on anonymous pkinit see:
-
-http://k5wiki.kerberos.org/wiki/Projects/Anonymous_pkinit
-""")
register = Registry()
+
@register()
class pkinit(Object):
"""
@@ -54,52 +16,4 @@ class pkinit(Object):
"""
object_name = _('pkinit')
- label=_('PKINIT')
-
-
-def valid_arg(ugettext, action):
- """
- Accepts only Enable/Disable.
- """
- a = action.lower()
- if a != 'enable' and a != 'disable':
- raise errors.ValidationError(
- name='action',
- error=_('Unknown command %s') % action
- )
-
-@register()
-class pkinit_anonymous(Command):
- __doc__ = _('Enable or Disable Anonymous PKINIT.')
-
- princ_name = '%s@%s' % (ANON_USER, api.env.realm)
- default_dn = DN(('krbprincipalname', princ_name), ('cn', api.env.realm), ('cn', 'kerberos'), api.env.basedn)
-
- takes_args = (
- Str('action', valid_arg),
- )
-
- def execute(self, action, **options):
- ldap = self.api.Backend.ldap2
- set_lock = False
- lock = None
-
- entry_attrs = ldap.get_entry(self.default_dn, ['nsaccountlock'])
-
- if 'nsaccountlock' in entry_attrs:
- lock = entry_attrs['nsaccountlock'][0].lower()
-
- if action.lower() == 'enable':
- if lock == 'true':
- set_lock = True
- lock = None
- elif action.lower() == 'disable':
- if lock != 'true':
- set_lock = True
- lock = 'TRUE'
-
- if set_lock:
- entry_attrs['nsaccountlock'] = lock
- ldap.update_entry(entry_attrs)
-
- return dict(result=True)
+ label = _('PKINIT')
--
2.9.4