|
 |
177dc6 |
From a8b52eaf3cf56c90e3d94fdef0b9e426052634ea Mon Sep 17 00:00:00 2001
|
|
|
177dc6 |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
177dc6 |
Date: Wed, 18 Dec 2019 12:08:59 +0200
|
|
|
177dc6 |
Subject: [PATCH] Reset per-indicator Kerberos policy
|
|
|
177dc6 |
|
|
|
177dc6 |
When 'ipa krbtpolicy-reset' is called, we need to reset all policy
|
|
|
177dc6 |
settings, including per-indicator ones. Per-indicator policy uses
|
|
|
177dc6 |
subtyped attributes (foo;bar), the current krbtpolicy-reset code does
|
|
|
177dc6 |
not deal with those.
|
|
|
177dc6 |
|
|
|
177dc6 |
Add support for per-indicator policy reset. It is a bit tricky, as we
|
|
|
177dc6 |
need to drop the values to defaults but avoid adding non-per-indicator
|
|
|
177dc6 |
variants of the same attributes.
|
|
|
177dc6 |
|
|
|
177dc6 |
Add test to check that policy has been resetted by observing a new
|
|
|
177dc6 |
Kerberos TGT for the user after its policy reset.
|
|
|
177dc6 |
|
|
|
177dc6 |
Fixes: https://pagure.io/freeipa/issue/8153
|
|
|
177dc6 |
|
|
|
177dc6 |
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
177dc6 |
---
|
|
|
177dc6 |
ipaserver/plugins/krbtpolicy.py | 21 +++++++++++++++++++-
|
|
|
177dc6 |
ipatests/test_integration/test_krbtpolicy.py | 13 ++++++++++++
|
|
|
177dc6 |
2 files changed, 33 insertions(+), 1 deletion(-)
|
|
|
177dc6 |
|
|
|
177dc6 |
diff --git a/ipaserver/plugins/krbtpolicy.py b/ipaserver/plugins/krbtpolicy.py
|
|
|
177dc6 |
index 997fe7e81..b01c44e93 100644
|
|
|
177dc6 |
--- a/ipaserver/plugins/krbtpolicy.py
|
|
|
177dc6 |
+++ b/ipaserver/plugins/krbtpolicy.py
|
|
|
177dc6 |
@@ -68,6 +68,8 @@ register = Registry()
|
|
|
177dc6 |
_default_values = {
|
|
|
177dc6 |
'krbmaxticketlife': 86400,
|
|
|
177dc6 |
'krbmaxrenewableage': 604800,
|
|
|
177dc6 |
+ 'krbauthindmaxticketlife': 86400,
|
|
|
177dc6 |
+ 'krbauthindmaxrenewableage': 604800,
|
|
|
177dc6 |
}
|
|
|
177dc6 |
|
|
|
177dc6 |
# These attributes never have non-optional values, so they should be
|
|
|
177dc6 |
@@ -311,9 +313,26 @@ class krbtpolicy_reset(baseldap.LDAPQuery):
|
|
|
177dc6 |
def_values[a] = None
|
|
|
177dc6 |
# if reseting global policy - set values to default
|
|
|
177dc6 |
else:
|
|
|
177dc6 |
- def_values = _default_values
|
|
|
177dc6 |
+ def_values = _default_values.copy()
|
|
|
177dc6 |
|
|
|
177dc6 |
entry = ldap.get_entry(dn, list(def_values))
|
|
|
177dc6 |
+
|
|
|
177dc6 |
+ # For per-indicator policies, drop them to defaults
|
|
|
177dc6 |
+ for subtype in _supported_options:
|
|
|
177dc6 |
+ for attr in _option_based_attrs:
|
|
|
177dc6 |
+ name = '{};{}'.format(attr, subtype)
|
|
|
177dc6 |
+ if name in entry:
|
|
|
177dc6 |
+ if uid is not None:
|
|
|
177dc6 |
+ def_values[name] = None
|
|
|
177dc6 |
+ else:
|
|
|
177dc6 |
+ def_values[name] = _default_values[attr]
|
|
|
177dc6 |
+
|
|
|
177dc6 |
+ # Remove non-subtyped attrs variants,
|
|
|
177dc6 |
+ # they should never be used directly.
|
|
|
177dc6 |
+ for attr in _option_based_attrs:
|
|
|
177dc6 |
+ if attr in def_values:
|
|
|
177dc6 |
+ del def_values[attr]
|
|
|
177dc6 |
+
|
|
|
177dc6 |
entry.update(def_values)
|
|
|
177dc6 |
try:
|
|
|
177dc6 |
ldap.update_entry(entry)
|
|
|
177dc6 |
diff --git a/ipatests/test_integration/test_krbtpolicy.py b/ipatests/test_integration/test_krbtpolicy.py
|
|
|
177dc6 |
index b2264de7a..08e332096 100644
|
|
|
177dc6 |
--- a/ipatests/test_integration/test_krbtpolicy.py
|
|
|
177dc6 |
+++ b/ipatests/test_integration/test_krbtpolicy.py
|
|
|
177dc6 |
@@ -112,3 +112,16 @@ class TestPWPolicy(IntegrationTest):
|
|
|
177dc6 |
assert maxlife_within_policy(result.stdout_text, 1200) is True
|
|
|
177dc6 |
|
|
|
177dc6 |
tasks.kdestroy_all(master)
|
|
|
177dc6 |
+
|
|
|
177dc6 |
+ def test_krbtpolicy_reset(self):
|
|
|
177dc6 |
+ """Test a hardened kerberos ticket policy reset"""
|
|
|
177dc6 |
+ master = self.master
|
|
|
177dc6 |
+
|
|
|
177dc6 |
+ tasks.kinit_admin(master)
|
|
|
177dc6 |
+ master.run_command(['ipa', 'krbtpolicy-reset', USER2])
|
|
|
177dc6 |
+ master.run_command(['kinit', USER2],
|
|
|
177dc6 |
+ stdin_text=PASSWORD + '\n')
|
|
|
177dc6 |
+ result = master.run_command('klist | grep krbtgt')
|
|
|
177dc6 |
+ assert maxlife_within_policy(result.stdout_text, MAXLIFE) is True
|
|
|
177dc6 |
+
|
|
|
177dc6 |
+ tasks.kdestroy_all(master)
|
|
|
177dc6 |
--
|
|
|
177dc6 |
2.24.1
|
|
|
177dc6 |
|