From 886153da7dd1ca1f5d37dd9c1e2141850b7177b2 Mon Sep 17 00:00:00 2001

From: Rob Crittenden <rcritten@redhat.com>

Date: Tue, 17 Nov 2020 20:37:52 -0500

Subject: [PATCH] Use trust-find and trustdomain-find to identify all AD trusts

Not all AD domains are visible to trust-find. For each trust

iterate over trustdomain-find <domain> to find the complete

list of domains.

Signed-off-by: Rob Crittenden <rcritten@redhat.com>

---

 src/ipahealthcheck/ipa/trust.py |  20 +++--

 tests/test_ipa_trust.py         | 155 ++++++++++++++++++++------------

 2 files changed, 108 insertions(+), 67 deletions(-)

diff --git a/src/ipahealthcheck/ipa/trust.py b/src/ipahealthcheck/ipa/trust.py

index 0abe5cd..00971c4 100644

--- a/src/ipahealthcheck/ipa/trust.py

+++ b/src/ipahealthcheck/ipa/trust.py

@@ -42,16 +42,18 @@ def get_trust_domains():

     Each entry is a dictionary representating an AD domain.

     """

-    result = api.Command.trust_find()

-    results = result['result']

     trust_domains = []

-    for result in results:

-        if result.get('trusttype')[0] == 'Active Directory domain':

-            domain = dict()

-            domain['domain'] = result.get('cn')[0]

-            domain['domainsid'] = result.get('ipanttrusteddomainsid')[0]

-            domain['netbios'] = result.get('ipantflatname')[0]

-            trust_domains.append(domain)

+    trusts = api.Command.trust_find(pkey_only=True, raw=True)

+    for trust in trusts['result']:

+        for cn in trust.get('cn'):

+            trustdomains = api.Command.trustdomain_find(cn, raw=True)

+            for trustdomain in trustdomains['result']:

+                domain = dict()

+                domain['domain'] = trustdomain.get('cn')[0]

+                domain['domainsid'] = trustdomain.get(

+                    'ipanttrusteddomainsid')[0]

+                domain['netbios'] = trustdomain.get('ipantflatname')[0]

+                trust_domains.append(domain)

     return trust_domains

diff --git a/tests/test_ipa_trust.py b/tests/test_ipa_trust.py

index 3c4b947..f3a9f27 100644

--- a/tests/test_ipa_trust.py

+++ b/tests/test_ipa_trust.py

@@ -72,6 +72,56 @@ class mock_ldap_conn:

         return tuple()

+#

+# Construct a setup with two direct trusts and one sub domain

+#

+def trust_find():

+    return [{

+        'result': [

+            {

+                'cn': ['ad.example'],

+            },

+            {

+                'cn': ['child.example'],

+            },

+        ]

+    }]

+

+

+def trustdomain_find():

+    return [

+        {

+            "result": [

+                {

+                    "cn": ["ad.example"],

+                    "ipantflatname": ["ADROOT"],

+                    "ipanttrusteddomainsid": ["S-1-5-21-abc"],

+                    "ipanttrusttype": ["2"],

+                    "ipanttrustattributes": ["8"],

+                },

+                {

+                    "cn": ["child.ad.example"],

+                    "ipantflatname": ["CHILD.ADROOT"],

+                    "ipanttrusteddomainsid": ["S-1-5-22-def"],

+                    "ipanttrusttype": ["2"],

+                    "ipanttrustattributes": ["1"],

+                },

+            ],

+        },

+        {

+            "result": [

+                {

+                    "cn": ["child.example"],

+                    "ipantflatname": ["CHILD"],

+                    "ipanttrusteddomainsid": ["S-1-5-21-ghi"],

+                    "ipanttrusttype": ["2"],

+                    "ipanttrustattributes": ["8"],

+                },

+            ],

+        },

+    ]

+

+

 class SSSDDomain:

     def __init__(self, return_ipa_server_mode=True, provider='ipa'):

         self.return_ipa_server_mode = return_ipa_server_mode

@@ -246,31 +296,17 @@ class TestTrustDomains(BaseTest):

         dlresult.returncode = 0

         dlresult.error_log = ''

         dlresult.output = 'implicit_files\nipa.example\nad.example\n' \

-            'child.example\n'

+            'child.ad.example\nchild.example\n'

         olresult = namedtuple('run', ['returncode', 'error_log'])

         olresult.returncode = 0

         olresult.error_log = ''

         olresult.output = 'Online status: Online\n\n'

-        mock_run.side_effect = [dlresult, olresult, olresult]

+        mock_run.side_effect = [dlresult, olresult, olresult, olresult]

         # get_trust_domains()

-        m_api.Command.trust_find.side_effect = [{

-            'result': [

-                {

-                    'cn': ['ad.example'],

-                    'ipantflatname': ['ADROOT'],

-                    'ipanttrusteddomainsid': ['S-1-5-21-abc'],

-                    'trusttype': ['Active Directory domain'],

-                },

-                {

-                    'cn': ['child.example'],

-                    'ipantflatname': ['ADROOT'],

-                    'ipanttrusteddomainsid': ['S-1-5-21-def'],

-                    'trusttype': ['Active Directory domain'],

-                },

-            ]

-        }]

+        m_api.Command.trust_find.side_effect = trust_find()

+        m_api.Command.trustdomain_find.side_effect = trustdomain_find()

         framework = object()

         registry.initialize(framework, config.Config)

@@ -279,15 +315,17 @@ class TestTrustDomains(BaseTest):

         self.results = capture_results(f)

-        assert len(self.results) == 3

+        assert len(self.results) == 4

         result = self.results.results[0]

         assert result.result == constants.SUCCESS

         assert result.source == 'ipahealthcheck.ipa.trust'

         assert result.check == 'IPATrustDomainsCheck'

         assert result.kw.get('key') == 'domain-list'

-        assert result.kw.get('trust_domains') == 'ad.example, child.example'

-        assert result.kw.get('sssd_domains') == 'ad.example, child.example'

+        assert result.kw.get('trust_domains') == \

+            'ad.example, child.ad.example, child.example'

+        assert result.kw.get('sssd_domains') == \

+            'ad.example, child.ad.example, child.example'

         result = self.results.results[1]

         assert result.result == constants.SUCCESS

@@ -301,6 +339,13 @@ class TestTrustDomains(BaseTest):

         assert result.source == 'ipahealthcheck.ipa.trust'

         assert result.check == 'IPATrustDomainsCheck'

         assert result.kw.get('key') == 'domain-status'

+        assert result.kw.get('domain') == 'child.ad.example'

+

+        result = self.results.results[3]

+        assert result.result == constants.SUCCESS

+        assert result.source == 'ipahealthcheck.ipa.trust'

+        assert result.check == 'IPATrustDomainsCheck'

+        assert result.kw.get('key') == 'domain-status'

         assert result.kw.get('domain') == 'child.example'

     @patch('ipapython.ipautil.run')

@@ -319,22 +364,8 @@ class TestTrustDomains(BaseTest):

         mock_run.side_effect = [dlresult, olresult, olresult]

         # get_trust_domains()

-        m_api.Command.trust_find.side_effect = [{

-            'result': [

-                {

-                    'cn': ['ad.example'],

-                    'ipantflatname': ['ADROOT'],

-                    'ipanttrusteddomainsid': ['S-1-5-21-abc'],

-                    'trusttype': ['Active Directory domain'],

-                },

-                {

-                    'cn': ['child.example'],

-                    'ipantflatname': ['ADROOT'],

-                    'ipanttrusteddomainsid': ['S-1-5-21-def'],

-                    'trusttype': ['Active Directory domain'],

-                },

-            ]

-        }]

+        m_api.Command.trust_find.side_effect = trust_find()

+        m_api.Command.trustdomain_find.side_effect = trustdomain_find()

         framework = object()

         registry.initialize(framework, config.Config)

@@ -350,7 +381,8 @@ class TestTrustDomains(BaseTest):

         assert result.source == 'ipahealthcheck.ipa.trust'

         assert result.check == 'IPATrustDomainsCheck'

         assert result.kw.get('key') == 'domain-list'

-        assert result.kw.get('trust_domains') == 'ad.example, child.example'

+        assert result.kw.get('trust_domains') == \

+            'ad.example, child.ad.example, child.example'

         assert result.kw.get('sssd_domains') == 'child.example'

         result = self.results.results[1]

@@ -428,29 +460,16 @@ class TestTrustCatalog(BaseTest):

         ds2result.output = 'Active servers:\nAD Global Catalog: ' \

             'root-dc.ad.vm\nAD Domain Controller: root-dc.ad.vm\n' \

-        mock_run.side_effect = [dsresult, ds2result]

+        mock_run.side_effect = [dsresult, ds2result, ds2result]

         mock_getnamebysid.side_effect = [

            {'S-1-5-21-abc-500': {'name': 'admin@ad.example', 'type': 3}},

+           {'S-1-5-21-ghi-500': {'name': 'admin@child.ad.example', 'type': 3}},

            {'S-1-5-21-def-500': {'name': 'admin@child.example', 'type': 3}}

         ]

         # get_trust_domains()

-        m_api.Command.trust_find.side_effect = [{

-            'result': [

-                {

-                    'cn': ['ad.example'],

-                    'ipantflatname': ['ADROOT'],

-                    'ipanttrusteddomainsid': ['S-1-5-21-abc'],

-                    'trusttype': ['Active Directory domain'],

-                },

-                {

-                    'cn': ['child.example'],

-                    'ipantflatname': ['ADROOT'],

-                    'ipanttrusteddomainsid': ['S-1-5-21-def'],

-                    'trusttype': ['Active Directory domain'],

-                },

-            ]

-        }]

+        m_api.Command.trust_find.side_effect = trust_find()

+        m_api.Command.trustdomain_find.side_effect = trustdomain_find()

         framework = object()

         registry.initialize(framework, config.Config)

@@ -459,7 +478,7 @@ class TestTrustCatalog(BaseTest):

         self.results = capture_results(f)

-        assert len(self.results) == 6

+        assert len(self.results) == 9

         result = self.results.results[0]

         assert result.result == constants.SUCCESS

@@ -487,20 +506,40 @@ class TestTrustCatalog(BaseTest):

         assert result.source == 'ipahealthcheck.ipa.trust'

         assert result.check == 'IPATrustCatalogCheck'

         assert result.kw.get('key') == 'Domain Security Identifier'

-        assert result.kw.get('sid') == 'S-1-5-21-def'

+        assert result.kw.get('sid') == 'S-1-5-22-def'

         result = self.results.results[4]

         assert result.result == constants.SUCCESS

         assert result.source == 'ipahealthcheck.ipa.trust'

         assert result.check == 'IPATrustCatalogCheck'

         assert result.kw.get('key') == 'AD Global Catalog'

-        assert result.kw.get('domain') == 'child.example'

+        assert result.kw.get('domain') == 'child.ad.example'

         result = self.results.results[5]

         assert result.result == constants.SUCCESS

         assert result.source == 'ipahealthcheck.ipa.trust'

         assert result.check == 'IPATrustCatalogCheck'

         assert result.kw.get('key') == 'AD Domain Controller'

+

+        result = self.results.results[6]

+        assert result.result == constants.SUCCESS

+        assert result.source == 'ipahealthcheck.ipa.trust'

+        assert result.check == 'IPATrustCatalogCheck'

+        assert result.kw.get('key') == 'Domain Security Identifier'

+        assert result.kw.get('sid') == 'S-1-5-21-ghi'

+

+        result = self.results.results[7]

+        assert result.result == constants.SUCCESS

+        assert result.source == 'ipahealthcheck.ipa.trust'

+        assert result.check == 'IPATrustCatalogCheck'

+        assert result.kw.get('key') == 'AD Global Catalog'

+        assert result.kw.get('domain') == 'child.example'

+

+        result = self.results.results[8]

+        assert result.result == constants.SUCCESS

+        assert result.source == 'ipahealthcheck.ipa.trust'

+        assert result.check == 'IPATrustCatalogCheck'

+        assert result.kw.get('key') == 'AD Domain Controller'

         assert result.kw.get('domain') == 'child.example'

-- 

2.25.4