Blame SOURCES/0001-Implement-adcli-testjoin.patch

341f9a
From 6fd99ff6c5dd6ef0be8d942989b1c6dcee3102d9 Mon Sep 17 00:00:00 2001
341f9a
From: Sumit Bose <sbose@redhat.com>
341f9a
Date: Fri, 22 Mar 2019 12:37:39 +0100
341f9a
Subject: [PATCH] Implement 'adcli testjoin'
341f9a
341f9a
By calling adcli testjoin it will be checked if the host credentials
341f9a
stored in the keytab are still valid.
341f9a
341f9a
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1622583
341f9a
---
341f9a
 doc/adcli.xml    | 34 +++++++++++++++++++++++
341f9a
 tools/computer.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++++
341f9a
 tools/tools.c    |  1 +
341f9a
 tools/tools.h    |  4 +++
341f9a
 4 files changed, 111 insertions(+)
341f9a
341f9a
diff --git a/doc/adcli.xml b/doc/adcli.xml
341f9a
index af73433..9605b4a 100644
341f9a
--- a/doc/adcli.xml
341f9a
+++ b/doc/adcli.xml
341f9a
@@ -43,6 +43,9 @@
341f9a
 	<cmdsynopsis>
341f9a
 		<command>adcli update</command>
341f9a
 	</cmdsynopsis>
341f9a
+	<cmdsynopsis>
341f9a
+		<command>adcli testjoin</command>
341f9a
+	</cmdsynopsis>
341f9a
 	<cmdsynopsis>
341f9a
 		<command>adcli create-user</command>
341f9a
 		<arg choice="opt">--domain=domain.example.com</arg>
341f9a
@@ -474,6 +477,37 @@ $ adcli update --login-ccache=/tmp/krbcc_123
341f9a
 
341f9a
 </refsect1>
341f9a
 
341f9a
+<refsect1 id='testjoin'>
341f9a
+	<title>Testing if the machine account password is valid</title>
341f9a
+
341f9a
+	<para><command>adcli testjoin</command> uses the current credentials in
341f9a
+	the keytab and tries to authenticate with the machine account to the AD
341f9a
+	domain. If this works the machine account password and the join are
341f9a
+	still valid. If it fails the machine account password or the whole
341f9a
+	machine account have to be refreshed with
341f9a
+	<command>adcli join</command> or <command>adcli update</command>.
341f9a
+	</para>
341f9a
+
341f9a
+<programlisting>
341f9a
+$ adcli testjoin
341f9a
+</programlisting>
341f9a
+
341f9a
+	<para>Only the global options not related to authentication are
341f9a
+	available, additionally you can specify the following options to
341f9a
+	control how this operation is done.</para>
341f9a
+
341f9a
+	<variablelist>
341f9a
+		<varlistentry>
341f9a
+			<term><option>-K, --host-keytab=<parameter>/path/to/keytab</parameter></option></term>
341f9a
+			<listitem><para>Specify the path to the host keytab where
341f9a
+			current host credentials are stored and the new ones
341f9a
+			will be written to.  If not specified, the default
341f9a
+			location will be used, usually
341f9a
+			<filename>/etc/krb5.keytab</filename>.</para></listitem>
341f9a
+		</varlistentry>
341f9a
+	</variablelist>
341f9a
+</refsect1>
341f9a
+
341f9a
 <refsect1 id='create_user'>
341f9a
 	<title>Creating a User</title>
341f9a
 
341f9a
diff --git a/tools/computer.c b/tools/computer.c
341f9a
index 112340e..610ed2b 100644
341f9a
--- a/tools/computer.c
341f9a
+++ b/tools/computer.c
341f9a
@@ -566,6 +566,78 @@ adcli_tool_computer_update (adcli_conn *conn,
341f9a
 	return 0;
341f9a
 }
341f9a
 
341f9a
+int
341f9a
+adcli_tool_computer_testjoin (adcli_conn *conn,
341f9a
+                              int argc,
341f9a
+                              char *argv[])
341f9a
+{
341f9a
+	adcli_enroll *enroll;
341f9a
+	adcli_result res;
341f9a
+	const char *ktname;
341f9a
+	int opt;
341f9a
+
341f9a
+	struct option options[] = {
341f9a
+		{ "domain", required_argument, NULL, opt_domain },
341f9a
+		{ "domain-controller", required_argument, NULL, opt_domain_controller },
341f9a
+		{ "host-keytab", required_argument, 0, opt_host_keytab },
341f9a
+		{ "verbose", no_argument, NULL, opt_verbose },
341f9a
+		{ "help", no_argument, NULL, 'h' },
341f9a
+		{ 0 },
341f9a
+	};
341f9a
+
341f9a
+	static adcli_tool_desc usages[] = {
341f9a
+		{ 0, "usage: adcli testjoin" },
341f9a
+		{ 0 },
341f9a
+	};
341f9a
+
341f9a
+	enroll = adcli_enroll_new (conn);
341f9a
+	if (enroll == NULL)
341f9a
+		errx (-1, "unexpected memory problems");
341f9a
+
341f9a
+	while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {
341f9a
+		switch (opt) {
341f9a
+		case 'h':
341f9a
+		case '?':
341f9a
+		case ':':
341f9a
+			adcli_tool_usage (options, usages);
341f9a
+			adcli_tool_usage (options, common_usages);
341f9a
+			adcli_enroll_unref (enroll);
341f9a
+			return opt == 'h' ? 0 : 2;
341f9a
+		default:
341f9a
+			parse_option ((Option)opt, optarg, conn, enroll);
341f9a
+			break;
341f9a
+		}
341f9a
+	}
341f9a
+
341f9a
+	/* Force use of a keytab to test the join/machine account password */
341f9a
+	adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_COMPUTER_ACCOUNT);
341f9a
+	ktname = adcli_enroll_get_keytab_name (enroll);
341f9a
+	adcli_conn_set_login_keytab_name (conn, ktname ? ktname : "");
341f9a
+
341f9a
+	res = adcli_enroll_load (enroll);
341f9a
+	if (res != ADCLI_SUCCESS) {
341f9a
+		adcli_enroll_unref (enroll);
341f9a
+		adcli_conn_unref (conn);
341f9a
+		errx (-res, "couldn't lookup domain info from keytab: %s",
341f9a
+		      adcli_get_last_error ());
341f9a
+	}
341f9a
+
341f9a
+	res = adcli_conn_connect (conn);
341f9a
+	if (res != ADCLI_SUCCESS) {
341f9a
+		adcli_enroll_unref (enroll);
341f9a
+		adcli_conn_unref (conn);
341f9a
+		errx (-res, "couldn't connect to %s domain: %s",
341f9a
+		      adcli_conn_get_domain_name (conn),
341f9a
+		      adcli_get_last_error ());
341f9a
+	}
341f9a
+
341f9a
+	printf ("Sucessfully validated join to domain %s\n",
341f9a
+	        adcli_conn_get_domain_name (conn));
341f9a
+
341f9a
+	adcli_enroll_unref (enroll);
341f9a
+
341f9a
+	return 0;
341f9a
+}
341f9a
 
341f9a
 int
341f9a
 adcli_tool_computer_preset (adcli_conn *conn,
341f9a
diff --git a/tools/tools.c b/tools/tools.c
341f9a
index 915130e..c4e2851 100644
341f9a
--- a/tools/tools.c
341f9a
+++ b/tools/tools.c
341f9a
@@ -55,6 +55,7 @@ struct {
341f9a
 	{ "info", adcli_tool_info, "Print information about a domain", CONNECTION_LESS },
341f9a
 	{ "join", adcli_tool_computer_join, "Join this machine to a domain", },
341f9a
 	{ "update", adcli_tool_computer_update, "Update machine membership in a domain", },
341f9a
+	{ "testjoin", adcli_tool_computer_testjoin, "Test if machine account password is valid", },
341f9a
 	{ "preset-computer", adcli_tool_computer_preset, "Pre setup computers accounts", },
341f9a
 	{ "reset-computer", adcli_tool_computer_reset, "Reset a computer account", },
341f9a
 	{ "delete-computer", adcli_tool_computer_delete, "Delete a computer account", },
341f9a
diff --git a/tools/tools.h b/tools/tools.h
341f9a
index 6c97ccf..8cebbf9 100644
341f9a
--- a/tools/tools.h
341f9a
+++ b/tools/tools.h
341f9a
@@ -70,6 +70,10 @@ int       adcli_tool_computer_update   (adcli_conn *conn,
341f9a
                                         int argc,
341f9a
                                         char *argv[]);
341f9a
 
341f9a
+int       adcli_tool_computer_testjoin (adcli_conn *conn,
341f9a
+                                        int argc,
341f9a
+                                        char *argv[]);
341f9a
+
341f9a
 int       adcli_tool_computer_delete   (adcli_conn *conn,
341f9a
                                         int argc,
341f9a
                                         char *argv[]);
341f9a
-- 
341f9a
2.20.1
341f9a