ac7d03
From d5af6b5e3ee50f97db730a4097c46baf07e09002 Mon Sep 17 00:00:00 2001
ac7d03
From: Felipe Volpone <felipevolpone@gmail.com>
ac7d03
Date: Thu, 1 Jun 2017 16:53:11 -0300
ac7d03
Subject: [PATCH] Changing cert-find to do not use only primary key to search
ac7d03
 in LDAP.
ac7d03
ac7d03
In service.py the primary key is krbCanonicalName, which we
ac7d03
don't want to use to do searchs. Now, cert-find uses primary
ac7d03
key or a specified attribute to do searches in LDAP, instead
ac7d03
of using only a primary key.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/6948
ac7d03
ac7d03
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
ac7d03
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ac7d03
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
ac7d03
---
ac7d03
 ipaserver/plugins/cert.py | 27 +++++++++++++++++----------
ac7d03
 1 file changed, 17 insertions(+), 10 deletions(-)
ac7d03
ac7d03
diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py
ac7d03
index 68402679cf0320e9c664ea89276f6c4332730a15..bb11713317abad55577b1c280253ab5d6d68c508 100644
ac7d03
--- a/ipaserver/plugins/cert.py
ac7d03
+++ b/ipaserver/plugins/cert.py
ac7d03
@@ -981,8 +981,8 @@ class cert(BaseCertObject):
ac7d03
                 param = param.clone(flags=param.flags - {'no_search'})
ac7d03
             yield param
ac7d03
 
ac7d03
-        for owner in self._owners():
ac7d03
-            yield owner.primary_key.clone_rename(
ac7d03
+        for owner, search_key in self._owners():
ac7d03
+            yield search_key.clone_rename(
ac7d03
                 'owner_{0}'.format(owner.name),
ac7d03
                 required=False,
ac7d03
                 multivalue=True,
ac7d03
@@ -992,15 +992,22 @@ class cert(BaseCertObject):
ac7d03
             )
ac7d03
 
ac7d03
     def _owners(self):
ac7d03
-        for name in ('user', 'host', 'service'):
ac7d03
-            yield self.api.Object[name]
ac7d03
+        for obj_name, search_key in [('user', None),
ac7d03
+                                     ('host', None),
ac7d03
+                                     ('service', 'krbprincipalname')]:
ac7d03
+            obj = self.api.Object[obj_name]
ac7d03
+            if search_key is None:
ac7d03
+                pkey = obj.primary_key
ac7d03
+            else:
ac7d03
+                pkey = obj.params[search_key]
ac7d03
+            yield obj, pkey
ac7d03
 
ac7d03
     def _fill_owners(self, obj):
ac7d03
         dns = obj.pop('owner', None)
ac7d03
         if dns is None:
ac7d03
             return
ac7d03
 
ac7d03
-        for owner in self._owners():
ac7d03
+        for owner, _search_key in self._owners():
ac7d03
             container_dn = DN(owner.container_dn, self.api.env.basedn)
ac7d03
             name = 'owner_' + owner.name
ac7d03
             for dn in dns:
ac7d03
@@ -1264,8 +1271,8 @@ class cert_find(Search, CertMethod):
ac7d03
                 option = option.clone(default=None, autofill=None)
ac7d03
             yield option
ac7d03
 
ac7d03
-        for owner in self.obj._owners():
ac7d03
-            yield owner.primary_key.clone_rename(
ac7d03
+        for owner, search_key in self.obj._owners():
ac7d03
+            yield search_key.clone_rename(
ac7d03
                 '{0}'.format(owner.name),
ac7d03
                 required=False,
ac7d03
                 multivalue=True,
ac7d03
@@ -1276,7 +1283,7 @@ class cert_find(Search, CertMethod):
ac7d03
                      owner.object_name_plural),
ac7d03
                 label=owner.object_name,
ac7d03
             )
ac7d03
-            yield owner.primary_key.clone_rename(
ac7d03
+            yield search_key.clone_rename(
ac7d03
                 'no_{0}'.format(owner.name),
ac7d03
                 required=False,
ac7d03
                 multivalue=True,
ac7d03
@@ -1395,7 +1402,7 @@ class cert_find(Search, CertMethod):
ac7d03
         ldap = self.api.Backend.ldap2
ac7d03
 
ac7d03
         filters = []
ac7d03
-        for owner in self.obj._owners():
ac7d03
+        for owner, search_key in self.obj._owners():
ac7d03
             for prefix, rule in (('', ldap.MATCH_ALL),
ac7d03
                                  ('no_', ldap.MATCH_NONE)):
ac7d03
                 try:
ac7d03
@@ -1411,7 +1418,7 @@ class cert_find(Search, CertMethod):
ac7d03
                     filters.append(filter)
ac7d03
 
ac7d03
                 filter = ldap.make_filter_from_attr(
ac7d03
-                    owner.primary_key.name,
ac7d03
+                    search_key.name,
ac7d03
                     value,
ac7d03
                     rule)
ac7d03
                 filters.append(filter)
ac7d03
-- 
ac7d03
2.9.4
ac7d03