From 1d57cf654de99077d7ece28f9210d1a2d5dee5b7 Mon Sep 17 00:00:00 2001

From: Petr Vobornik <pvoborni@redhat.com>

Date: Mon, 1 Dec 2014 10:15:21 +0100

Subject: [PATCH] add --hosts and --hostgroup options to allow/retrieve keytab

 methods

`--hosts` and `--hostgroup` options added to:

* service-allow-create-keytab

* service-allow-retrieve-keytab

* service-disallow-create-keytab

* service-disallow-retrieve-keytab

* host-allow-create-keytab

* host-allow-retrieve-keytab

* host-disallow-create-keytab

* host-disallow-retrieve-keytab

in order to allow hosts to retrieve keytab of their services or related hosts as described on http://www.freeipa.org/page/V4/Keytab_Retrieval design page

https://fedorahosted.org/freeipa/ticket/4777

Reviewed-By: Jan Cholasta <jcholast@redhat.com>

---

 API.txt                                     |  32 ++++++--

 VERSION                                     |   4 +-

 ipalib/plugins/host.py                      |  28 +++++--

 ipalib/plugins/service.py                   |  28 +++++--

 ipatests/test_xmlrpc/test_host_plugin.py    | 109 ++++++++++++++++++++++++++--

 ipatests/test_xmlrpc/test_service_plugin.py |  92 ++++++++++++++++++++---

 6 files changed, 257 insertions(+), 36 deletions(-)

diff --git a/API.txt b/API.txt

index 2a63f1e2349f0df69433fa7cb742e269cd42d79f..e9768bf1e87d6679c439b98ed696b720937099d2 100644

--- a/API.txt

+++ b/API.txt

@@ -1826,10 +1826,12 @@ output: Output('completed', <type 'int'>, None)

 output: Output('failed', <type 'dict'>, None)

 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))

 command: host_allow_create_keytab

-args: 1,6,3

+args: 1,8,3

 arg: Str('fqdn', attribute=True, cli_name='hostname', multivalue=False, primary_key=True, query=True, required=True)

 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')

 option: Str('group*', alwaysask=True, cli_name='groups', csv=True)

+option: Str('host*', alwaysask=True, cli_name='hosts', csv=True)

+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups', csv=True)

 option: Flag('no_members', autofill=True, default=False, exclude='webui')

 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')

 option: Str('user*', alwaysask=True, cli_name='users', csv=True)

@@ -1838,10 +1840,12 @@ output: Output('completed', <type 'int'>, None)

 output: Output('failed', <type 'dict'>, None)

 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))

 command: host_allow_retrieve_keytab

-args: 1,6,3

+args: 1,8,3

 arg: Str('fqdn', attribute=True, cli_name='hostname', multivalue=False, primary_key=True, query=True, required=True)

 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')

 option: Str('group*', alwaysask=True, cli_name='groups', csv=True)

+option: Str('host*', alwaysask=True, cli_name='hosts', csv=True)

+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups', csv=True)

 option: Flag('no_members', autofill=True, default=False, exclude='webui')

 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')

 option: Str('user*', alwaysask=True, cli_name='users', csv=True)

@@ -1866,10 +1870,12 @@ output: Output('result', <type 'bool'>, None)

 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)

 output: PrimaryKey('value', None, None)

 command: host_disallow_create_keytab

-args: 1,6,3

+args: 1,8,3

 arg: Str('fqdn', attribute=True, cli_name='hostname', multivalue=False, primary_key=True, query=True, required=True)

 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')

 option: Str('group*', alwaysask=True, cli_name='groups', csv=True)

+option: Str('host*', alwaysask=True, cli_name='hosts', csv=True)

+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups', csv=True)

 option: Flag('no_members', autofill=True, default=False, exclude='webui')

 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')

 option: Str('user*', alwaysask=True, cli_name='users', csv=True)

@@ -1878,10 +1884,12 @@ output: Output('completed', <type 'int'>, None)

 output: Output('failed', <type 'dict'>, None)

 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))

 command: host_disallow_retrieve_keytab

-args: 1,6,3

+args: 1,8,3

 arg: Str('fqdn', attribute=True, cli_name='hostname', multivalue=False, primary_key=True, query=True, required=True)

 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')

 option: Str('group*', alwaysask=True, cli_name='groups', csv=True)

+option: Str('host*', alwaysask=True, cli_name='hosts', csv=True)

+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups', csv=True)

 option: Flag('no_members', autofill=True, default=False, exclude='webui')

 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')

 option: Str('user*', alwaysask=True, cli_name='users', csv=True)

@@ -3529,10 +3537,12 @@ output: Output('completed', <type 'int'>, None)

 output: Output('failed', <type 'dict'>, None)

 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))

 command: service_allow_create_keytab

-args: 1,6,3

+args: 1,8,3

 arg: Str('krbprincipalname', attribute=True, cli_name='principal', multivalue=False, primary_key=True, query=True, required=True)

 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')

 option: Str('group*', alwaysask=True, cli_name='groups', csv=True)

+option: Str('host*', alwaysask=True, cli_name='hosts', csv=True)

+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups', csv=True)

 option: Flag('no_members', autofill=True, default=False, exclude='webui')

 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')

 option: Str('user*', alwaysask=True, cli_name='users', csv=True)

@@ -3541,10 +3551,12 @@ output: Output('completed', <type 'int'>, None)

 output: Output('failed', <type 'dict'>, None)

 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))

 command: service_allow_retrieve_keytab

-args: 1,6,3

+args: 1,8,3

 arg: Str('krbprincipalname', attribute=True, cli_name='principal', multivalue=False, primary_key=True, query=True, required=True)

 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')

 option: Str('group*', alwaysask=True, cli_name='groups', csv=True)

+option: Str('host*', alwaysask=True, cli_name='hosts', csv=True)

+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups', csv=True)

 option: Flag('no_members', autofill=True, default=False, exclude='webui')

 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')

 option: Str('user*', alwaysask=True, cli_name='users', csv=True)

@@ -3568,10 +3580,12 @@ output: Output('result', <type 'bool'>, None)

 output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)

 output: PrimaryKey('value', None, None)

 command: service_disallow_create_keytab

-args: 1,6,3

+args: 1,8,3

 arg: Str('krbprincipalname', attribute=True, cli_name='principal', multivalue=False, primary_key=True, query=True, required=True)

 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')

 option: Str('group*', alwaysask=True, cli_name='groups', csv=True)

+option: Str('host*', alwaysask=True, cli_name='hosts', csv=True)

+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups', csv=True)

 option: Flag('no_members', autofill=True, default=False, exclude='webui')

 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')

 option: Str('user*', alwaysask=True, cli_name='users', csv=True)

@@ -3580,10 +3594,12 @@ output: Output('completed', <type 'int'>, None)

 output: Output('failed', <type 'dict'>, None)

 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))

 command: service_disallow_retrieve_keytab

-args: 1,6,3

+args: 1,8,3

 arg: Str('krbprincipalname', attribute=True, cli_name='principal', multivalue=False, primary_key=True, query=True, required=True)

 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')

 option: Str('group*', alwaysask=True, cli_name='groups', csv=True)

+option: Str('host*', alwaysask=True, cli_name='hosts', csv=True)

+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups', csv=True)

 option: Flag('no_members', autofill=True, default=False, exclude='webui')

 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')

 option: Str('user*', alwaysask=True, cli_name='users', csv=True)

diff --git a/VERSION b/VERSION

index 750b5058867ca5f073a083009c4aadeeb0240c35..bfbce5604e79008afd2893e406c634718159b1e9 100644

--- a/VERSION

+++ b/VERSION

@@ -90,5 +90,5 @@ IPA_DATA_VERSION=20100614120000

 #                                                      #

 ########################################################

 IPA_API_VERSION_MAJOR=2

-IPA_API_VERSION_MINOR=109

-# Last change: npmccallum - display qrcode by default

+IPA_API_VERSION_MINOR=110

+# Last change: pvoborni - allow to retrieve keytab by hosts

diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py

index c4d4bdf6473e0f34c8c68754d6c98e93d173d8fa..39a7d3c25b9cb56fca486b2500da5fe7bd4a6fbc 100644

--- a/ipalib/plugins/host.py

+++ b/ipalib/plugins/host.py

@@ -211,12 +211,24 @@ host_output_params = (

     Str('ipaallowedtoperform_read_keys_group',

         label=_('Groups allowed to retrieve keytab'),

     ),

+    Str('ipaallowedtoperform_read_keys_host',

+        label=_('Hosts allowed to retrieve keytab'),

+    ),

+    Str('ipaallowedtoperform_read_keys_hostgroup',

+        label=_('Host Groups allowed to retrieve keytab'),

+    ),

     Str('ipaallowedtoperform_write_keys_user',

         label=_('Users allowed to create keytab'),

     ),

     Str('ipaallowedtoperform_write_keys_group',

         label=_('Groups allowed to create keytab'),

     ),

+    Str('ipaallowedtoperform_write_keys_host',

+        label=_('Hosts allowed to create keytab'),

+    ),

+    Str('ipaallowedtoperform_write_keys_hostgroup',

+        label=_('Host Groups allowed to create keytab'),

+    ),

     Str('ipaallowedtoperform_read_keys',

         label=_('Failed allowed to retrieve keytab'),

     ),

@@ -284,8 +296,8 @@ class host(LDAPObject):

         'managing': ['host'],

         'memberofindirect': ['hostgroup', 'netgroup', 'role', 'hbacrule',

         'sudorule'],

-        'ipaallowedtoperform_read_keys': ['user', 'group'],

-        'ipaallowedtoperform_write_keys': ['user', 'group'],

+        'ipaallowedtoperform_read_keys': ['user', 'group', 'host', 'hostgroup'],

+        'ipaallowedtoperform_write_keys': ['user', 'group', 'host', 'hostgroup'],

     }

     bindable = True

     relationships = {

@@ -1201,7 +1213,8 @@ class host_remove_managedby(LDAPRemoveMember):

 @register()

 class host_allow_retrieve_keytab(LDAPAddMember):

-    __doc__ = _('Allow users or groups to retrieve a keytab of this host.')

+    __doc__ = _('Allow users, groups, hosts or host groups to retrieve a keytab'

+                ' of this host.')

     member_attributes = ['ipaallowedtoperform_read_keys']

     has_output_params = LDAPAddMember.has_output_params + host_output_params

@@ -1219,7 +1232,8 @@ class host_allow_retrieve_keytab(LDAPAddMember):

 @register()

 class host_disallow_retrieve_keytab(LDAPRemoveMember):

-    __doc__ = _('Disallow users or groups to retrieve a keytab of this host.')

+    __doc__ = _('Disallow users, groups, hosts or host groups to retrieve a '

+                'keytab of this host.')

     member_attributes = ['ipaallowedtoperform_read_keys']

     has_output_params = LDAPRemoveMember.has_output_params + host_output_params

@@ -1236,7 +1250,8 @@ class host_disallow_retrieve_keytab(LDAPRemoveMember):

 @register()

 class host_allow_create_keytab(LDAPAddMember):

-    __doc__ = _('Allow users or groups to create a keytab of this host.')

+    __doc__ = _('Allow users, groups, hosts or host groups to create a keytab '

+                'of this host.')

     member_attributes = ['ipaallowedtoperform_write_keys']

     has_output_params = LDAPAddMember.has_output_params + host_output_params

@@ -1254,7 +1269,8 @@ class host_allow_create_keytab(LDAPAddMember):

 @register()

 class host_disallow_create_keytab(LDAPRemoveMember):

-    __doc__ = _('Disallow users or groups to create a keytab of this host.')

+    __doc__ = _('Disallow users, groups, hosts or host groups to create a '

+                'keytab of this host.')

     member_attributes = ['ipaallowedtoperform_write_keys']

     has_output_params = LDAPRemoveMember.has_output_params + host_output_params

diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py

index 2f703544452c6d7ee2de8eceeb5f2a26afed44f2..b37dc7b4bf56b69df204fd29e9487f1390197bbe 100644

--- a/ipalib/plugins/service.py

+++ b/ipalib/plugins/service.py

@@ -137,12 +137,24 @@ output_params = (

     Str('ipaallowedtoperform_read_keys_group',

         label=_('Groups allowed to retrieve keytab'),

     ),

+    Str('ipaallowedtoperform_read_keys_host',

+        label=_('Hosts allowed to retrieve keytab'),

+    ),

+    Str('ipaallowedtoperform_read_keys_hostgroup',

+        label=_('Host Groups allowed to retrieve keytab'),

+    ),

     Str('ipaallowedtoperform_write_keys_user',

         label=_('Users allowed to create keytab'),

     ),

     Str('ipaallowedtoperform_write_keys_group',

         label=_('Groups allowed to create keytab'),

     ),

+    Str('ipaallowedtoperform_write_keys_host',

+        label=_('Hosts allowed to create keytab'),

+    ),

+    Str('ipaallowedtoperform_write_keys_hostgroup',

+        label=_('Host Groups allowed to create keytab'),

+    ),

     Str('ipaallowedtoperform_read_keys',

         label=_('Failed allowed to retrieve keytab'),

     ),

@@ -350,8 +362,8 @@ class service(LDAPObject):

     attribute_members = {

         'managedby': ['host'],

         'memberof': ['role'],

-        'ipaallowedtoperform_read_keys': ['user', 'group'],

-        'ipaallowedtoperform_write_keys': ['user', 'group'],

+        'ipaallowedtoperform_read_keys': ['user', 'group', 'host', 'hostgroup'],

+        'ipaallowedtoperform_write_keys': ['user', 'group', 'host', 'hostgroup'],

     }

     bindable = True

     relationships = {

@@ -711,7 +723,8 @@ class service_remove_host(LDAPRemoveMember):

 @register()

 class service_allow_retrieve_keytab(LDAPAddMember):

-    __doc__ = _('Allow users or groups to retrieve a keytab of this service.')

+    __doc__ = _('Allow users, groups, hosts or host groups to retrieve a keytab'

+                ' of this service.')

     member_attributes = ['ipaallowedtoperform_read_keys']

     has_output_params = LDAPAddMember.has_output_params + output_params

@@ -729,7 +742,8 @@ class service_allow_retrieve_keytab(LDAPAddMember):

 @register()

 class service_disallow_retrieve_keytab(LDAPRemoveMember):

-    __doc__ = _('Disallow users or groups to retrieve a keytab of this service.')

+    __doc__ = _('Disallow users, groups, hosts or host groups to retrieve a '

+                'keytab of this service.')

     member_attributes = ['ipaallowedtoperform_read_keys']

     has_output_params = LDAPRemoveMember.has_output_params + output_params

@@ -746,7 +760,8 @@ class service_disallow_retrieve_keytab(LDAPRemoveMember):

 @register()

 class service_allow_create_keytab(LDAPAddMember):

-    __doc__ = _('Allow users or groups to create a keytab of this service.')

+    __doc__ = _('Allow users, groups, hosts or host groups to create a keytab '

+                'of this service.')

     member_attributes = ['ipaallowedtoperform_write_keys']

     has_output_params = LDAPAddMember.has_output_params + output_params

@@ -764,7 +779,8 @@ class service_allow_create_keytab(LDAPAddMember):

 @register()

 class service_disallow_create_keytab(LDAPRemoveMember):

-    __doc__ = _('Disallow users or groups to create a keytab of this service.')

+    __doc__ = _('Disallow users, groups, hosts or host groups to create a '

+                'keytab of this service.')

     member_attributes = ['ipaallowedtoperform_write_keys']

     has_output_params = LDAPRemoveMember.has_output_params + output_params

diff --git a/ipatests/test_xmlrpc/test_host_plugin.py b/ipatests/test_xmlrpc/test_host_plugin.py

index 67acb765fc1716e10ac7846d8780bf031c9f079e..1c46ce9131554b799d25a15922d26ccb92763e93 100644

--- a/ipatests/test_xmlrpc/test_host_plugin.py

+++ b/ipatests/test_xmlrpc/test_host_plugin.py

@@ -147,6 +147,9 @@ group1 = u'group1'

 group1_dn = get_group_dn(group1)

 group2 = u'group2'

 group2_dn = get_group_dn(group2)

+hostgroup1 = u'testhostgroup1'

+hostgroup1_dn = DN(('cn',hostgroup1),('cn','hostgroups'),('cn','accounts'),

+                    api.env.basedn)

 class test_host(Declarative):

@@ -1420,6 +1423,8 @@ class test_host_allowed_to(Declarative):

         ('group_del', [group1], {}),

         ('group_del', [group2], {}),

         ('host_del', [fqdn1], {}),

+        ('host_del', [fqdn3], {}),

+        ('hostgroup_del', [hostgroup1], {}),

     ]

     tests = [

@@ -1503,6 +1508,49 @@ class test_host_allowed_to(Declarative):

                 ),

             ),

         ),

+        dict(

+            desc='Create %r' % fqdn3,

+            command=(

+                'host_add', [fqdn3],

+                dict(

+                    force=True,

+                ),

+            ),

+            expected=dict(

+                value=fqdn3,

+                summary=u'Added host "%s"' % fqdn3,

+                result=dict(

+                    dn=dn3,

+                    fqdn=[fqdn3],

+                    krbprincipalname=[u'host/%s@%s' % (fqdn3, api.env.realm)],

+                    objectclass=objectclasses.host,

+                    ipauniqueid=[fuzzy_uuid],

+                    managedby_host=[fqdn3],

+                    has_keytab=False,

+                    has_password=False,

+                ),

+            ),

+        ),

+

+        dict(

+            desc='Create %r' % hostgroup1,

+            command=('hostgroup_add', [hostgroup1],

+                dict(description=u'Test hostgroup 1')

+            ),

+            expected=dict(

+                value=hostgroup1,

+                summary=u'Added hostgroup "testhostgroup1"',

+                result=dict(

+                    dn=hostgroup1_dn,

+                    cn=[hostgroup1],

+                    objectclass=objectclasses.hostgroup,

+                    description=[u'Test hostgroup 1'],

+                    ipauniqueid=[fuzzy_uuid],

+                    mepmanagedentry=[DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),

+                                        api.env.basedn)],

+                ),

+            ),

+        ),

         # verify

         dict(

@@ -1513,6 +1561,8 @@ class test_host_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[],

                     ),

                 ),

@@ -1535,6 +1585,8 @@ class test_host_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[[user1, u'This entry is already a member']],

                     ),

                 ),

@@ -1553,20 +1605,25 @@ class test_host_allowed_to(Declarative):

             desc='Allow %r, %r to a retrieve keytab of %r' % (

                 group1, group2, fqdn1),

             command=('host_allow_retrieve_keytab', [fqdn1],

-                     dict(group=[group1, group2])),

+                     dict(group=[group1, group2], host=[fqdn3],

+                          hostgroup=[hostgroup1])),

             expected=dict(

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[],

                     ),

                 ),

-                completed=2,

+                completed=4,

                 result=dict(

                     dn=dn1,

                     fqdn=[fqdn1],

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1, group2],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

@@ -1581,6 +1638,8 @@ class test_host_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[[user2, u'This entry is not a member']],

                     ),

                 ),

@@ -1590,6 +1649,8 @@ class test_host_allowed_to(Declarative):

                     fqdn=[fqdn1],

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1, group2],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

@@ -1604,6 +1665,8 @@ class test_host_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[],

                     ),

                 ),

@@ -1613,6 +1676,8 @@ class test_host_allowed_to(Declarative):

                     fqdn=[fqdn1],

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

@@ -1623,22 +1688,29 @@ class test_host_allowed_to(Declarative):

             desc='Allow %r, %r to a create keytab of %r' % (

                 group1, user1, fqdn1),

             command=('host_allow_create_keytab', [fqdn1],

-                     dict(group=[group1, group2], user=[user1])),

+                     dict(group=[group1, group2], user=[user1], host=[fqdn3],

+                          hostgroup=[hostgroup1])),

             expected=dict(

                 failed=dict(

                     ipaallowedtoperform_write_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[],

                     ),

                 ),

-                completed=3,

+                completed=5,

                 result=dict(

                     dn=dn1,

                     fqdn=[fqdn1],

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     ipaallowedtoperform_write_keys_user=[user1],

                     ipaallowedtoperform_write_keys_group=[group1, group2],

+                    ipaallowedtoperform_write_keys_host=[fqdn3],

+                    ipaallowedtoperform_write_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

@@ -1648,12 +1720,15 @@ class test_host_allowed_to(Declarative):

         dict(

             desc='Duplicate add: %r, %r' % (user1, group1),

             command=('host_allow_create_keytab', [fqdn1],

-                     dict(group=[group1], user=[user1])),

+                     dict(group=[group1], user=[user1], host=[fqdn3],

+                          hostgroup=[hostgroup1])),

             expected=dict(

                 failed=dict(

                     ipaallowedtoperform_write_keys=dict(

                         group=[[group1, u'This entry is already a member']],

+                        host=[[fqdn3, u'This entry is already a member']],

                         user=[[user1, u'This entry is already a member']],

+                        hostgroup=[[hostgroup1, u'This entry is already a member']],

                     ),

                 ),

                 completed=0,

@@ -1662,8 +1737,12 @@ class test_host_allowed_to(Declarative):

                     fqdn=[fqdn1],

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     ipaallowedtoperform_write_keys_user=[user1],

                     ipaallowedtoperform_write_keys_group=[group1, group2],

+                    ipaallowedtoperform_write_keys_host=[fqdn3],

+                    ipaallowedtoperform_write_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

@@ -1678,6 +1757,8 @@ class test_host_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_write_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[[user2, u'This entry is not a member']],

                     ),

                 ),

@@ -1687,8 +1768,12 @@ class test_host_allowed_to(Declarative):

                     fqdn=[fqdn1],

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     ipaallowedtoperform_write_keys_user=[user1],

                     ipaallowedtoperform_write_keys_group=[group1, group2],

+                    ipaallowedtoperform_write_keys_host=[fqdn3],

+                    ipaallowedtoperform_write_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

@@ -1703,6 +1788,8 @@ class test_host_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_write_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[],

                     ),

                 ),

@@ -1712,8 +1799,12 @@ class test_host_allowed_to(Declarative):

                     fqdn=[fqdn1],

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     ipaallowedtoperform_write_keys_user=[user1],

                     ipaallowedtoperform_write_keys_group=[group1],

+                    ipaallowedtoperform_write_keys_host=[fqdn3],

+                    ipaallowedtoperform_write_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

@@ -1733,8 +1824,12 @@ class test_host_allowed_to(Declarative):

                     has_password=False,

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     ipaallowedtoperform_write_keys_user=[user1],

                     ipaallowedtoperform_write_keys_group=[group1],

+                    ipaallowedtoperform_write_keys_host=[fqdn3],

+                    ipaallowedtoperform_write_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

@@ -1756,8 +1851,12 @@ class test_host_allowed_to(Declarative):

                     has_password=False,

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1],

+                    ipaallowedtoperform_read_keys_host=[fqdn3],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     ipaallowedtoperform_write_keys_user=[user1],

                     ipaallowedtoperform_write_keys_group=[group1],

+                    ipaallowedtoperform_write_keys_host=[fqdn3],

+                    ipaallowedtoperform_write_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],

                     managedby_host=[fqdn1],

                 ),

diff --git a/ipatests/test_xmlrpc/test_service_plugin.py b/ipatests/test_xmlrpc/test_service_plugin.py

index 927ce73f86a0025b8384cf0126ef00be3598975a..946dc572b0d0e5b3f26cd7bfd6ad8128f113493f 100644

--- a/ipatests/test_xmlrpc/test_service_plugin.py

+++ b/ipatests/test_xmlrpc/test_service_plugin.py

@@ -54,6 +54,9 @@ group1 = u'group1'

 group1_dn = get_group_dn(group1)

 group2 = u'group2'

 group2_dn = get_group_dn(group2)

+hostgroup1 = u'testhostgroup1'

+hostgroup1_dn = DN(('cn',hostgroup1),('cn','hostgroups'),('cn','accounts'),

+                    api.env.basedn)

 class test_service(Declarative):

@@ -770,6 +773,7 @@ class test_service_allowed_to(Declarative):

         ('group_del', [group2], {}),

         ('host_del', [fqdn1], {}),

         ('service_del', [service1], {}),

+        ('hostgroup_del', [hostgroup1], {}),

     ]

     tests = [

@@ -858,6 +862,25 @@ class test_service_allowed_to(Declarative):

             ),

         ),

         dict(

+            desc='Create %r' % hostgroup1,

+            command=('hostgroup_add', [hostgroup1],

+                dict(description=u'Test hostgroup 1')

+            ),

+            expected=dict(

+                value=hostgroup1,

+                summary=u'Added hostgroup "testhostgroup1"',

+                result=dict(

+                    dn=hostgroup1_dn,

+                    cn=[hostgroup1],

+                    objectclass=objectclasses.hostgroup,

+                    description=[u'Test hostgroup 1'],

+                    ipauniqueid=[fuzzy_uuid],

+                    mepmanagedentry=[DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),

+                                        api.env.basedn)],

+                ),

+            ),

+        ),

+        dict(

             desc='Create %r' % service1,

             command=('service_add', [service1_no_realm], dict(force=True)),

             expected=dict(

@@ -882,6 +905,8 @@ class test_service_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[],

                     ),

                 ),

@@ -903,6 +928,8 @@ class test_service_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[[user1, u'This entry is already a member']],

                     ),

                 ),

@@ -917,22 +944,27 @@ class test_service_allowed_to(Declarative):

         ),

         dict(

-            desc='Allow %r, %r to a retrieve keytab of %r' % (

-                group1, group2, service1),

+            desc='Allow %r, %r, %r to a retrieve keytab of %r' % (

+                group1, group2, fqdn1, service1),

             command=('service_allow_retrieve_keytab', [service1],

-                     dict(group=[group1, group2])),

+                     dict(group=[group1, group2], host=[fqdn1],

+                          hostgroup=[hostgroup1])),

             expected=dict(

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[],

                     ),

                 ),

-                completed=2,

+                completed=4,

                 result=dict(

                     dn=service1dn,

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1, group2],

+                    ipaallowedtoperform_read_keys_host=[fqdn1],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[service1],

                     managedby_host=[fqdn1],

                 ),

@@ -947,6 +979,8 @@ class test_service_allowed_to(Declarative):

                 failed=dict(

                     ipaallowedtoperform_read_keys=dict(

                         group=[],

+                        host=[],

+                        hostgroup=[],

                         user=[[user2, u'This entry is not a member']],

                     ),

                 ),

@@ -955,6 +989,8 @@ class test_service_allowed_to(Declarative):

                     dn=service1dn,

                     ipaallowedtoperform_read_keys_user=[user1],

                     ipaallowedtoperform_read_keys_group=[group1, group2],

+                    ipaallowedtoperform_read_keys_host=[fqdn1],

+                    ipaallowedtoperform_read_keys_hostgroup=[hostgroup1],

                     krbprincipalname=[service1],