From b95817e35716bbab000633043817202e17d7c53e Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>

Date: Thu, 6 Aug 2020 17:07:36 +0200

Subject: [PATCH] IPA-EPN: Use a helper to retrieve LDAP attributes from an

 entry

Allow for empty attributes.

Reviewed-By: Francois Cami <fcami@redhat.com>

---

 ipaclient/install/ipa_epn.py | 22 +++++++++++++++-------

 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/ipaclient/install/ipa_epn.py b/ipaclient/install/ipa_epn.py

index 65f9f3d47..0d1ae2add 100644

--- a/ipaclient/install/ipa_epn.py

+++ b/ipaclient/install/ipa_epn.py

@@ -122,22 +122,30 @@ class EPNUserList:

         """Return len(self)."""

         return len(self._expiring_password_user_dq)

+    def get_ldap_attr(self, entry, attr):

+        """Get a single value from a multi-valued attr in a safe way"""

+        return str(entry.get(attr, [""]).pop(0))

+

     def add(self, entry):

         """Parses and appends an LDAP user entry with the uid, cn,

            givenname, sn, krbpasswordexpiration and mail attributes.

         """

         try:

             self._sorted = False

+            if entry.get("mail") is None:

+                logger.error("IPA-EPN: No mail address defined for: %s",

+                             entry.dn)

+                return

             self._expiring_password_user_dq.append(

                 dict(

-                    uid=str(entry["uid"].pop(0)),

-                    cn=str(entry["cn"].pop(0)),

-                    givenname=str(entry["givenname"].pop(0)),

-                    sn=str(entry["sn"].pop(0)),

-                    krbpasswordexpiration=str(

-                        entry["krbpasswordexpiration"].pop(0)

+                    uid=self.get_ldap_attr(entry, "uid"),

+                    cn=self.get_ldap_attr(entry, "cn"),

+                    givenname=self.get_ldap_attr(entry, "givenname"),

+                    sn=self.get_ldap_attr(entry, "sn"),

+                    krbpasswordexpiration=(

+                        self.get_ldap_attr(entry,"krbpasswordexpiration")

                     ),

-                    mail=str(entry["mail"]),

+                    mail=str(entry.get("mail")),

                 )

             )

         except IndexError as e:

-- 

2.26.2

From 8e810d8cf38ec60d76178bd673e218fb05d56c8e Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>

Date: Thu, 6 Aug 2020 17:13:19 +0200

Subject: [PATCH] IPA-EPN: fix configuration file typo

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Signed-off-by: François Cami <fcami@redhat.com>

Reviewed-By: Francois Cami <fcami@redhat.com>

---

 client/share/epn.conf | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/share/epn.conf b/client/share/epn.conf

index 0e590dfc3..e3645801c 100644

--- a/client/share/epn.conf

+++ b/client/share/epn.conf

@@ -23,7 +23,7 @@ smtp_port = 25

 # Default None (empty value).

 # smtp_password =

-# pecifies the number of seconds to wait for SMTP to respond.

+# Specifies the number of seconds to wait for SMTP to respond.

 smtp_timeout = 60

 # Specifies the type of secure connection to make. Options are: none,

-- 

2.26.2

From 1b1dbcbe9d83ba35f3cfdd01399f123816ec6e5b Mon Sep 17 00:00:00 2001

From: Rob Crittenden <rcritten@redhat.com>

Date: Thu, 6 Aug 2020 18:57:10 -0400

Subject: [PATCH] IPA-EPN: Test that users without givenname and/or mail are

 handled

The admin user does not have a givenname by default, allow for that.

Report errors for users without a default e-mail address.

Update the SHA256 hash with the typo fix.

Reviewed-By: Francois Cami <fcami@redhat.com>

---

 ipatests/test_integration/test_epn.py | 22 +++++++++++++++++++++-

 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py

index 18f73c722..c5c73835a 100644

--- a/ipatests/test_integration/test_epn.py

+++ b/ipatests/test_integration/test_epn.py

@@ -240,7 +240,7 @@ class TestEPN(IntegrationTest):

         assert epn_conf in cmd1.stdout_text

         assert epn_template in cmd1.stdout_text

         cmd2 = self.master.run_command(["sha256sum", epn_conf])

-        ck = "4c207b5c9c760c36db0d3b2b93da50ea49edcc4002d6d1e7383601f0ec30b957"

+        ck = "192481b52fb591112afd7b55b12a44c6618fdbc7e05a3b1866fd67ec579c51df"

         assert cmd2.stdout_text.find(ck) == 0

     def test_EPN_smoketest_1(self):

@@ -591,3 +591,23 @@ class TestEPN(IntegrationTest):

         self.master.put_file_contents('/etc/ipa/epn.conf', epn_conf)

         result = tasks.ipa_epn(self.master, raiseonerr=False)

         assert "smtp_delay cannot be less than zero" in result.stderr_text

+

+    def test_EPN_admin(self):

+        """The admin user is special and has no givenName by default

+           It also doesn't by default have an e-mail address

+           Check --dry-run output.

+        """

+        epn_conf = textwrap.dedent('''

+            [global]

+        ''')

+        self.master.put_file_contents('/etc/ipa/epn.conf', epn_conf)

+        self.master.run_command(

+            ['ipa', 'user-mod', 'admin', '--password-expiration',

+             datetime_to_generalized_time(

+                 datetime.datetime.utcnow() + datetime.timedelta(days=7)

+             )]

+        )

+        (unused, stderr_text, _unused) = self._check_epn_output(

+            self.master, dry_run=True

+        )

+        assert "uid=admin" in stderr_text

-- 

2.26.2