From 5012843d350b7a39b78e4eb7cab6cff98cae59d5 Mon Sep 17 00:00:00 2001
From: Martin Babinsky <mbabinsk@redhat.com>
Date: Fri, 12 May 2017 17:25:30 +0200
Subject: [PATCH] Add `pkinit-status` command
This command is a more streamlined reporting tool for PKINIT feature
status in the FreeIPA topology. It prints out whether PKINIT is enabled
or disabled on individual masters in a topology. If a`--server` is
specified, it reports status for an individual server. If `--status` is
specified, it searches for all servers that have PKINIT enabled or
disabled.
https://pagure.io/freeipa/issue/6937
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
---
API.txt | 15 ++++++
VERSION.m4 | 4 +-
ipaserver/plugins/pkinit.py | 109 +++++++++++++++++++++++++++++++++++++++++++-
3 files changed, 125 insertions(+), 3 deletions(-)
diff --git a/API.txt b/API.txt
index 4e6754afe2deab5c963577f1e1363f1123a31a86..6511ad8d1cb4dc9079628fc058312f31aaec624d 100644
--- a/API.txt
+++ b/API.txt
@@ -3736,6 +3736,20 @@ command: ping/1
args: 0,1,1
option: Str('version?')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
+command: pkinit_status/1
+args: 1,7,4
+arg: Str('criteria?')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('server_server?', autofill=False, cli_name='server')
+option: Int('sizelimit?', autofill=False)
+option: StrEnum('status?', autofill=False, cli_name='status', values=[u'enabled', u'disabled'])
+option: Int('timelimit?', autofill=False)
+option: Str('version?')
+output: Output('count', type=[<type 'int'>])
+output: ListOfEntries('result')
+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
+output: Output('truncated', type=[<type 'bool'>])
command: plugins/1
args: 0,3,3
option: Flag('all', autofill=True, cli_name='all', default=True)
@@ -6798,6 +6812,7 @@ default: permission_remove_member/1
default: permission_show/1
default: ping/1
default: pkinit/1
+default: pkinit_status/1
default: plugins/1
default: privilege/1
default: privilege_add/1
diff --git a/VERSION.m4 b/VERSION.m4
index e10ee3cad6f5a6e023ea3cb9ec20591b7caae0bd..8aa3ef03f352cd176579c5d5848ed9550f22105d 100644
--- a/VERSION.m4
+++ b/VERSION.m4
@@ -73,8 +73,8 @@ define(IPA_DATA_VERSION, 20100614120000)
# #
########################################################
define(IPA_API_VERSION_MAJOR, 2)
-define(IPA_API_VERSION_MINOR, 226)
-# Last change: Remove the pkinit-anonymous command
+define(IPA_API_VERSION_MINOR, 227)
+# Last change: Add `pkinit-status` command
########################################################
diff --git a/ipaserver/plugins/pkinit.py b/ipaserver/plugins/pkinit.py
index e49b31091d676865fa7f023be8edc3cdef9d6d2c..970f955c54bc489765d2565255e8805138a35307 100644
--- a/ipaserver/plugins/pkinit.py
+++ b/ipaserver/plugins/pkinit.py
@@ -3,11 +3,33 @@
#
from ipalib import Object
-from ipalib import _
+from ipalib import _, ngettext
+from ipalib.crud import Search
+from ipalib.parameters import Int, Str, StrEnum
from ipalib.plugable import Registry
register = Registry()
+__doc__ = _("""
+Kerberos PKINIT feature status reporting tools.
+
+Report IPA masters on which Kerberos PKINIT is enabled or disabled
+
+EXAMPLES:
+ List PKINIT status on all masters:
+ ipa pkinit-status
+
+ Check PKINIT status on `ipa.example.com`:
+ ipa pkinit-status --server ipa.example.com
+
+ List all IPA masters with disabled PKINIT:
+ ipa pkinit-status --status='disabled'
+
+For more info about PKINIT support see:
+
+https://www.freeipa.org/page/V4/Kerberos_PKINIT
+""")
+
@register()
class pkinit(Object):
@@ -17,3 +39,88 @@ class pkinit(Object):
object_name = _('pkinit')
label = _('PKINIT')
+
+ takes_params = (
+ Str(
+ 'server_server?',
+ cli_name='server',
+ label=_('Server name'),
+ doc=_('IPA server hostname'),
+ ),
+ StrEnum(
+ 'status?',
+ cli_name='status',
+ label=_('PKINIT status'),
+ doc=_('Whether PKINIT is enabled or disabled'),
+ values=(u'enabled', u'disabled'),
+ flags={'virtual_attribute', 'no_create', 'no_update'}
+ )
+ )
+
+
+@register()
+class pkinit_status(Search):
+ __doc__ = _('Report PKINIT status on the IPA masters')
+
+ msg_summary = ngettext('%(count)s server matched',
+ '%(count)s servers matched', 0)
+
+ takes_options = Search.takes_options + (
+ Int(
+ 'timelimit?',
+ label=_('Time Limit'),
+ doc=_('Time limit of search in seconds (0 is unlimited)'),
+ flags=['no_display'],
+ minvalue=0,
+ autofill=False,
+ ),
+ Int(
+ 'sizelimit?',
+ label=_('Size Limit'),
+ doc=_('Maximum number of entries returned (0 is unlimited)'),
+ flags=['no_display'],
+ minvalue=0,
+ autofill=False,
+ ),
+ )
+
+ def get_pkinit_status(self, server, status):
+ backend = self.api.Backend.serverroles
+ ipa_master_config = backend.config_retrieve("IPA master")
+
+ if server is not None:
+ servers = [server]
+ else:
+ servers = ipa_master_config['ipa_master_server']
+
+ pkinit_servers = ipa_master_config['pkinit_server_server']
+
+ for s in servers:
+ pkinit_status = {
+ u'server_server': s,
+ u'status': (
+ u'enabled' if s in pkinit_servers else u'disabled'
+ )
+ }
+ if status is not None and pkinit_status[u'status'] != status:
+ continue
+
+ yield pkinit_status
+
+ def execute(self, *keys, **options):
+ if keys:
+ return dict(
+ result=[],
+ count=0,
+ truncated=False
+ )
+
+ server = options.get('server_server', None)
+ status = options.get('status', None)
+
+ if server is not None:
+ self.api.Object.server_role.ensure_master_exists(server)
+
+ result = sorted(self.get_pkinit_status(server, status))
+
+ return dict(result=result, count=len(result), truncated=False)
--
2.9.4