|
 |
0b494d |
From d45545807106958d924d0b92b3e275ac75c3a6fd Mon Sep 17 00:00:00 2001
|
|
|
0b494d |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
0b494d |
Date: Thu, 12 Sep 2019 11:21:51 +0300
|
|
|
0b494d |
Subject: [PATCH] adtrust: add default read_keys permission for TDO objects
|
|
|
0b494d |
|
|
|
0b494d |
If trusted domain object (TDO) is lacking ipaAllowedToPerform;read_keys
|
|
|
0b494d |
attribute values, it cannot be used by SSSD to retrieve TDO keys and the
|
|
|
0b494d |
whole communication with Active Directory domain controllers will not be
|
|
|
0b494d |
possible.
|
|
|
0b494d |
|
|
|
0b494d |
This seems to affect trusts which were created before
|
|
|
0b494d |
ipaAllowedToPerform;read_keys permission granting was introduced
|
|
|
0b494d |
(FreeIPA 4.2). Add back the default setting for the permissions which
|
|
|
0b494d |
grants access to trust agents and trust admins.
|
|
|
0b494d |
|
|
|
0b494d |
Resolves: https://pagure.io/freeipa/issue/8067
|
|
|
0b494d |
|
|
|
0b494d |
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
0b494d |
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
|
|
|
0b494d |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
0b494d |
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
0b494d |
---
|
|
|
0b494d |
.../updates/90-post_upgrade_plugins.update | 1 +
|
|
|
0b494d |
ipaserver/install/plugins/adtrust.py | 56 +++++++++++++++++++
|
|
|
0b494d |
2 files changed, 57 insertions(+)
|
|
|
0b494d |
|
|
|
0b494d |
diff --git a/install/updates/90-post_upgrade_plugins.update b/install/updates/90-post_upgrade_plugins.update
|
|
|
0b494d |
index a9f5f6a924d330b924d9adb8b7eee728258f27c6..77b910fc26858611e44a5ba3f4f4c18f4895c95e 100644
|
|
|
0b494d |
--- a/install/updates/90-post_upgrade_plugins.update
|
|
|
0b494d |
+++ b/install/updates/90-post_upgrade_plugins.update
|
|
|
0b494d |
@@ -12,6 +12,7 @@ plugin: update_default_range
|
|
|
0b494d |
plugin: update_default_trust_view
|
|
|
0b494d |
plugin: update_tdo_gidnumber
|
|
|
0b494d |
plugin: update_tdo_to_new_layout
|
|
|
0b494d |
+plugin: update_tdo_default_read_keys_permissions
|
|
|
0b494d |
plugin: update_ca_renewal_master
|
|
|
0b494d |
plugin: update_idrange_type
|
|
|
0b494d |
plugin: update_pacs
|
|
|
0b494d |
diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py
|
|
|
0b494d |
index 0dd2c840899abe3b51b9308d38a9d0f4d1fb2f9b..fca83aa6df2cc3fafca91f2ed55339dba016a1fa 100644
|
|
|
0b494d |
--- a/ipaserver/install/plugins/adtrust.py
|
|
|
0b494d |
+++ b/ipaserver/install/plugins/adtrust.py
|
|
|
0b494d |
@@ -727,3 +727,59 @@ class update_tdo_to_new_layout(Updater):
|
|
|
0b494d |
self.KRB_PRINC_CREATE_DISABLED)
|
|
|
0b494d |
|
|
|
0b494d |
return False, []
|
|
|
0b494d |
+
|
|
|
0b494d |
+
|
|
|
0b494d |
+@register()
|
|
|
0b494d |
+class update_tdo_default_read_keys_permissions(Updater):
|
|
|
0b494d |
+ trust_filter = \
|
|
|
0b494d |
+ "(&(objectClass=krbPrincipal)(krbPrincipalName=krbtgt/{nbt}@*))"
|
|
|
0b494d |
+
|
|
|
0b494d |
+ def execute(self, **options):
|
|
|
0b494d |
+ ldap = self.api.Backend.ldap2
|
|
|
0b494d |
+
|
|
|
0b494d |
+ # First, see if trusts are enabled on the server
|
|
|
0b494d |
+ if not self.api.Command.adtrust_is_enabled()['result']:
|
|
|
0b494d |
+ logger.debug('AD Trusts are not enabled on this server')
|
|
|
0b494d |
+ return False, []
|
|
|
0b494d |
+
|
|
|
0b494d |
+ result = self.api.Command.trustconfig_show()['result']
|
|
|
0b494d |
+ our_nbt_name = result.get('ipantflatname', [None])[0]
|
|
|
0b494d |
+ if not our_nbt_name:
|
|
|
0b494d |
+ return False, []
|
|
|
0b494d |
+
|
|
|
0b494d |
+ trusts_dn = self.api.env.container_adtrusts + self.api.env.basedn
|
|
|
0b494d |
+ trust_filter = self.trust_filter.format(nbt=our_nbt_name)
|
|
|
0b494d |
+
|
|
|
0b494d |
+ # We might be in a situation when no trusts exist yet
|
|
|
0b494d |
+ # In such case there is nothing to upgrade but we have to catch
|
|
|
0b494d |
+ # an exception or it will abort the whole upgrade process
|
|
|
0b494d |
+ try:
|
|
|
0b494d |
+ tdos = ldap.get_entries(
|
|
|
0b494d |
+ base_dn=trusts_dn,
|
|
|
0b494d |
+ scope=ldap.SCOPE_SUBTREE,
|
|
|
0b494d |
+ filter=trust_filter,
|
|
|
0b494d |
+ attrs_list=['*'])
|
|
|
0b494d |
+ except errors.EmptyResult:
|
|
|
0b494d |
+ tdos = []
|
|
|
0b494d |
+
|
|
|
0b494d |
+ for tdo in tdos:
|
|
|
0b494d |
+ updates = dict()
|
|
|
0b494d |
+ oc = tdo.get('objectClass', [])
|
|
|
0b494d |
+ if 'ipaAllowedOperations' not in oc:
|
|
|
0b494d |
+ updates['objectClass'] = oc + ['ipaAllowedOperations']
|
|
|
0b494d |
+
|
|
|
0b494d |
+ read_keys = tdo.get('ipaAllowedToPerform;read_keys', [])
|
|
|
0b494d |
+ if not read_keys:
|
|
|
0b494d |
+ read_keys_values = list(map(
|
|
|
0b494d |
+ lambda x: x.format(basedn=self.api.env.basedn),
|
|
|
0b494d |
+ trust_read_keys_template))
|
|
|
0b494d |
+ updates['ipaAllowedToPerform;read_keys'] = read_keys_values
|
|
|
0b494d |
+
|
|
|
0b494d |
+ tdo.update(updates)
|
|
|
0b494d |
+ try:
|
|
|
0b494d |
+ ldap.update_entry(tdo)
|
|
|
0b494d |
+ except errors.EmptyModlist:
|
|
|
0b494d |
+ logger.debug("No update was required for TDO %s",
|
|
|
0b494d |
+ tdo.single_value.get('krbCanonicalName'))
|
|
|
0b494d |
+
|
|
|
0b494d |
+ return False, []
|
|
|
0b494d |
--
|
|
|
0b494d |
2.20.1
|
|
|
0b494d |
|