590d18
From 78eaf8b944f1b8f177aedabeaaeaa72c1dc4091e Mon Sep 17 00:00:00 2001
590d18
From: Jan Cholasta <jcholast@redhat.com>
590d18
Date: Mon, 14 Sep 2015 07:56:44 +0200
590d18
Subject: [PATCH] install: support KRA update
590d18
590d18
https://fedorahosted.org/freeipa/ticket/5250
590d18
590d18
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
590d18
---
590d18
 freeipa.spec.in                  |  1 -
590d18
 install/share/Makefile.am        |  2 +-
590d18
 install/share/vault.ldif         | 29 +++++++++++++++++++++++++++++
590d18
 install/share/vault.update       | 38 --------------------------------------
590d18
 install/updates/40-vault.update  | 23 +++++++++++++++++++++++
590d18
 install/updates/Makefile.am      |  1 +
590d18
 ipaplatform/base/paths.py        |  1 -
590d18
 ipaserver/install/krainstance.py |  7 ++++++-
590d18
 8 files changed, 60 insertions(+), 42 deletions(-)
590d18
 create mode 100644 install/share/vault.ldif
590d18
 delete mode 100644 install/share/vault.update
590d18
 create mode 100644 install/updates/40-vault.update
590d18
590d18
diff --git a/freeipa.spec.in b/freeipa.spec.in
590d18
index e9ba596fec1f8d179d4f834485e35a4814db898d..d8e24a5af47fbfca89ccb9c3d07dcfca5a8073d9 100644
590d18
--- a/freeipa.spec.in
590d18
+++ b/freeipa.spec.in
590d18
@@ -746,7 +746,6 @@ fi
590d18
 %{_usr}/share/ipa/copy-schema-to-ca.py*
590d18
 %{_usr}/share/ipa/*.ldif
590d18
 %{_usr}/share/ipa/*.uldif
590d18
-%{_usr}/share/ipa/*.update
590d18
 %{_usr}/share/ipa/*.template
590d18
 %dir %{_usr}/share/ipa/advise
590d18
 %dir %{_usr}/share/ipa/advise/legacy
590d18
diff --git a/install/share/Makefile.am b/install/share/Makefile.am
590d18
index 80e959a751a0800c4d56c379a73b68a2f12570d7..d68c40e693a1d86c70d8ccd81ef2c915b2e1f61e 100644
590d18
--- a/install/share/Makefile.am
590d18
+++ b/install/share/Makefile.am
590d18
@@ -83,7 +83,7 @@ app_DATA =				\
590d18
 	copy-schema-to-ca.py		\
590d18
 	sasl-mapping-fallback.ldif	\
590d18
 	schema-update.ldif		\
590d18
-	vault.update			\
590d18
+	vault.ldif			\
590d18
 	kdcproxy.conf			\
590d18
 	kdcproxy-enable.uldif		\
590d18
 	kdcproxy-disable.uldif		\
590d18
diff --git a/install/share/vault.ldif b/install/share/vault.ldif
590d18
new file mode 100644
590d18
index 0000000000000000000000000000000000000000..06dd83c5c45bd3143b8374965b9a02d311afdb42
590d18
--- /dev/null
590d18
+++ b/install/share/vault.ldif
590d18
@@ -0,0 +1,29 @@
590d18
+dn: cn=kra,$SUFFIX
590d18
+changetype: add
590d18
+objectClass: top
590d18
+objectClass: nsContainer
590d18
+cn: kra
590d18
+
590d18
+dn: cn=vaults,cn=kra,$SUFFIX
590d18
+changetype: add
590d18
+objectClass: top
590d18
+objectClass: ipaVaultContainer
590d18
+cn: vaults
590d18
+
590d18
+dn: cn=services,cn=vaults,cn=kra,$SUFFIX
590d18
+changetype: add
590d18
+objectClass: top
590d18
+objectClass: ipaVaultContainer
590d18
+cn: services
590d18
+
590d18
+dn: cn=shared,cn=vaults,cn=kra,$SUFFIX
590d18
+changetype: add
590d18
+objectClass: top
590d18
+objectClass: ipaVaultContainer
590d18
+cn: shared
590d18
+
590d18
+dn: cn=users,cn=vaults,cn=kra,$SUFFIX
590d18
+changetype: add
590d18
+objectClass: top
590d18
+objectClass: ipaVaultContainer
590d18
+cn: users
590d18
diff --git a/install/share/vault.update b/install/share/vault.update
590d18
deleted file mode 100644
590d18
index 4f0023840b34c2d2bae4e362e34be1764c430ad1..0000000000000000000000000000000000000000
590d18
--- a/install/share/vault.update
590d18
+++ /dev/null
590d18
@@ -1,38 +0,0 @@
590d18
-dn: cn=kra,$SUFFIX
590d18
-default: objectClass: top
590d18
-default: objectClass: nsContainer
590d18
-default: cn: kra
590d18
-
590d18
-dn: cn=vaults,cn=kra,$SUFFIX
590d18
-default: objectClass: top
590d18
-default: objectClass: ipaVaultContainer
590d18
-default: cn: vaults
590d18
-default: aci: (target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,$SUFFIX")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($$attr.cn),cn=users,cn=accounts,$SUFFIX" and userattr="owner#SELFDN";)
590d18
-default: aci: (target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,$SUFFIX")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($$attr.cn)@$REALM,cn=services,cn=accounts,$SUFFIX" and userattr="owner#SELFDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)
590d18
-default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)
590d18
-
590d18
-dn: cn=services,cn=vaults,cn=kra,$SUFFIX
590d18
-default: objectClass: top
590d18
-default: objectClass: ipaVaultContainer
590d18
-default: cn: services
590d18
-
590d18
-dn: cn=shared,cn=vaults,cn=kra,$SUFFIX
590d18
-default: objectClass: top
590d18
-default: objectClass: ipaVaultContainer
590d18
-default: cn: shared
590d18
-
590d18
-dn: cn=users,cn=vaults,cn=kra,$SUFFIX
590d18
-default: objectClass: top
590d18
-default: objectClass: ipaVaultContainer
590d18
-default: cn: users
590d18
diff --git a/install/updates/40-vault.update b/install/updates/40-vault.update
590d18
new file mode 100644
590d18
index 0000000000000000000000000000000000000000..3daea5b1988333d4d482463af0eec4163e4f0760
590d18
--- /dev/null
590d18
+++ b/install/updates/40-vault.update
590d18
@@ -0,0 +1,23 @@
590d18
+dn: cn=vaults,cn=kra,$SUFFIX
590d18
+remove: aci: (target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,$SUFFIX")(version 3.0; acl "Allow users to create private container"; allow (add) userdn = "ldap:///uid=($$attr.cn),cn=users,cn=accounts,$SUFFIX";)
590d18
+remove: aci: (target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,$SUFFIX")(version 3.0; acl "Allow services to create private container"; allow (add) userdn = "ldap:///krbprincipalname=($$attr.cn)@$REALM,cn=services,cn=accounts,$SUFFIX";)
590d18
+remove: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Container owners can manage vaults in the container"; allow(read, search, compare, add, delete) userattr="parent[1].owner#USERDN";)
590d18
+remove: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect container owners can manage vaults in the container"; allow(read, search, compare, add, delete) userattr="parent[1].owner#GROUPDN";)
590d18
+remove: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)
590d18
+remove: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)
590d18
+remove: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Vault owners can manage the vault"; allow(read, search, compare, write) userattr="owner#USERDN";)
590d18
+remove: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(read, search, compare, write) userattr="owner#GROUPDN";)
590d18
+addifexist: aci: (target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,$SUFFIX")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow users to create private container"; allow(add) userdn="ldap:///uid=($$attr.cn),cn=users,cn=accounts,$SUFFIX" and userattr="owner#SELFDN";)
590d18
+addifexist: aci: (target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,$SUFFIX")(targetfilter="(objectClass=ipaVaultContainer)")(version 3.0; acl "Allow services to create private container"; allow(add) userdn="ldap:///krbprincipalname=($$attr.cn)@$REALM,cn=services,cn=accounts,$SUFFIX" and userattr="owner#SELFDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Container owners can access the container"; allow(read, search, compare) userattr="owner#USERDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description || owner")(version 3.0; acl "Indirect container owners can access the container"; allow(read, search, compare) userattr="owner#GROUPDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Container owners can manage the container"; allow(write, delete) userattr="owner#USERDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVaultContainer)")(targetattr="objectClass || cn || description")(version 3.0; acl "Indirect container owners can manage the container"; allow(write, delete) userattr="owner#GROUPDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#USERDN" and userattr="owner#SELFDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVault)")(version 3.0; acl "Indirect container owners can add vaults in the container"; allow(add) userattr="parent[1].owner#GROUPDN" and userattr="owner#SELFDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault owners can access the vault"; allow(read, search, compare) userattr="owner#USERDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault owners can access the vault"; allow(read, search, compare) userattr="owner#GROUPDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || owner || member")(version 3.0; acl "Indirect vault members can access the vault"; allow(read, search, compare) userattr="member#GROUPDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Vault owners can manage the vault"; allow(write, delete) userattr="owner#USERDN";)
590d18
+addifexist: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="objectClass || cn || description || ipaVaultType || ipaVaultSalt || ipaVaultPublicKey || member")(version 3.0; acl "Indirect vault owners can manage the vault"; allow(write, delete) userattr="owner#GROUPDN";)
590d18
diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am
590d18
index 1f4a91c9bb4222f99ad7a7ad16e376aeef7f525b..26e4c04ed66a4a2061a3bb3ca2f4a6cd84502598 100644
590d18
--- a/install/updates/Makefile.am
590d18
+++ b/install/updates/Makefile.am
590d18
@@ -34,6 +34,7 @@ app_DATA =				\
590d18
 	40-automember.update		\
590d18
 	40-certprofile.update		\
590d18
 	40-otp.update			\
590d18
+	40-vault.update			\
590d18
 	41-caacl.update			\
590d18
 	45-roles.update			\
590d18
 	50-7_bit_check.update	        \
590d18
diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py
590d18
index ff75e0d7a5a0250ce71e67b0302bbaab64c5e935..3930c93fcba06959dd34507ecc29f92e33637775 100644
590d18
--- a/ipaplatform/base/paths.py
590d18
+++ b/ipaplatform/base/paths.py
590d18
@@ -251,7 +251,6 @@ class BasePathNamespace(object):
590d18
     SCHEMA_COMPAT_ULDIF = "/usr/share/ipa/schema_compat.uldif"
590d18
     IPA_JS_PLUGINS_DIR = "/usr/share/ipa/ui/js/plugins"
590d18
     UPDATES_DIR = "/usr/share/ipa/updates/"
590d18
-    VAULT_UPDATE = "/usr/share/ipa/vault.update"
590d18
     PKI_CONF_SERVER_XML_TEMPLATE = "/usr/share/pki/%s/conf/server.xml"
590d18
     CACHE_IPA_SESSIONS = "/var/cache/ipa/sessions"
590d18
     VAR_KERBEROS_KRB5KDC_DIR = "/var/kerberos/krb5kdc/"
590d18
diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py
590d18
index 958fe6fb095e69f83342ce8299d1586b8bbacd47..48268b0be5331cced1aee6b7f3358333b65de6dd 100644
590d18
--- a/ipaserver/install/krainstance.py
590d18
+++ b/ipaserver/install/krainstance.py
590d18
@@ -124,6 +124,7 @@ class KRAInstance(DogtagInstance):
590d18
         self.step("configure HTTP to proxy connections",
590d18
                   self.http_proxy)
590d18
         self.step("add vault container", self.__add_vault_container)
590d18
+        self.step("apply LDAP updates", self.__apply_updates)
590d18
 
590d18
         self.start_creation(runtime=126)
590d18
 
590d18
@@ -313,13 +314,17 @@ class KRAInstance(DogtagInstance):
590d18
         conn.disconnect()
590d18
 
590d18
     def __add_vault_container(self):
590d18
+        self._ldap_mod('vault.ldif', {'SUFFIX': self.suffix})
590d18
+        self.ldap_disconnect()
590d18
+
590d18
+    def __apply_updates(self):
590d18
         sub_dict = {
590d18
             'SUFFIX': self.suffix,
590d18
         }
590d18
 
590d18
         ld = ldapupdate.LDAPUpdate(dm_password=self.dm_password,
590d18
                                    sub_dict=sub_dict)
590d18
-        ld.update([paths.VAULT_UPDATE])
590d18
+        ld.update([os.path.join(paths.UPDATES_DIR, '40-vault.update')])
590d18
 
590d18
     @staticmethod
590d18
     def update_cert_config(nickname, cert, dogtag_constants=None):
590d18
-- 
590d18
2.4.3
590d18