From 5012843d350b7a39b78e4eb7cab6cff98cae59d5 Mon Sep 17 00:00:00 2001 From: Martin Babinsky Date: Fri, 12 May 2017 17:25:30 +0200 Subject: [PATCH] Add `pkinit-status` command This command is a more streamlined reporting tool for PKINIT feature status in the FreeIPA topology. It prints out whether PKINIT is enabled or disabled on individual masters in a topology. If a`--server` is specified, it reports status for an individual server. If `--status` is specified, it searches for all servers that have PKINIT enabled or disabled. https://pagure.io/freeipa/issue/6937 Reviewed-By: Jan Cholasta Reviewed-By: Stanislav Laznicka --- API.txt | 15 ++++++ VERSION.m4 | 4 +- ipaserver/plugins/pkinit.py | 109 +++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 125 insertions(+), 3 deletions(-) diff --git a/API.txt b/API.txt index 4e6754afe2deab5c963577f1e1363f1123a31a86..6511ad8d1cb4dc9079628fc058312f31aaec624d 100644 --- a/API.txt +++ b/API.txt @@ -3736,6 +3736,20 @@ command: ping/1 args: 0,1,1 option: Str('version?') output: Output('summary', type=[, ]) +command: pkinit_status/1 +args: 1,7,4 +arg: Str('criteria?') +option: Flag('all', autofill=True, cli_name='all', default=False) +option: Flag('raw', autofill=True, cli_name='raw', default=False) +option: Str('server_server?', autofill=False, cli_name='server') +option: Int('sizelimit?', autofill=False) +option: StrEnum('status?', autofill=False, cli_name='status', values=[u'enabled', u'disabled']) +option: Int('timelimit?', autofill=False) +option: Str('version?') +output: Output('count', type=[]) +output: ListOfEntries('result') +output: Output('summary', type=[, ]) +output: Output('truncated', type=[]) command: plugins/1 args: 0,3,3 option: Flag('all', autofill=True, cli_name='all', default=True) @@ -6798,6 +6812,7 @@ default: permission_remove_member/1 default: permission_show/1 default: ping/1 default: pkinit/1 +default: pkinit_status/1 default: plugins/1 default: privilege/1 default: privilege_add/1 diff --git a/VERSION.m4 b/VERSION.m4 index e10ee3cad6f5a6e023ea3cb9ec20591b7caae0bd..8aa3ef03f352cd176579c5d5848ed9550f22105d 100644 --- a/VERSION.m4 +++ b/VERSION.m4 @@ -73,8 +73,8 @@ define(IPA_DATA_VERSION, 20100614120000) # # ######################################################## define(IPA_API_VERSION_MAJOR, 2) -define(IPA_API_VERSION_MINOR, 226) -# Last change: Remove the pkinit-anonymous command +define(IPA_API_VERSION_MINOR, 227) +# Last change: Add `pkinit-status` command ######################################################## diff --git a/ipaserver/plugins/pkinit.py b/ipaserver/plugins/pkinit.py index e49b31091d676865fa7f023be8edc3cdef9d6d2c..970f955c54bc489765d2565255e8805138a35307 100644 --- a/ipaserver/plugins/pkinit.py +++ b/ipaserver/plugins/pkinit.py @@ -3,11 +3,33 @@ # from ipalib import Object -from ipalib import _ +from ipalib import _, ngettext +from ipalib.crud import Search +from ipalib.parameters import Int, Str, StrEnum from ipalib.plugable import Registry register = Registry() +__doc__ = _(""" +Kerberos PKINIT feature status reporting tools. + +Report IPA masters on which Kerberos PKINIT is enabled or disabled + +EXAMPLES: + List PKINIT status on all masters: + ipa pkinit-status + + Check PKINIT status on `ipa.example.com`: + ipa pkinit-status --server ipa.example.com + + List all IPA masters with disabled PKINIT: + ipa pkinit-status --status='disabled' + +For more info about PKINIT support see: + +https://www.freeipa.org/page/V4/Kerberos_PKINIT +""") + @register() class pkinit(Object): @@ -17,3 +39,88 @@ class pkinit(Object): object_name = _('pkinit') label = _('PKINIT') + + takes_params = ( + Str( + 'server_server?', + cli_name='server', + label=_('Server name'), + doc=_('IPA server hostname'), + ), + StrEnum( + 'status?', + cli_name='status', + label=_('PKINIT status'), + doc=_('Whether PKINIT is enabled or disabled'), + values=(u'enabled', u'disabled'), + flags={'virtual_attribute', 'no_create', 'no_update'} + ) + ) + + +@register() +class pkinit_status(Search): + __doc__ = _('Report PKINIT status on the IPA masters') + + msg_summary = ngettext('%(count)s server matched', + '%(count)s servers matched', 0) + + takes_options = Search.takes_options + ( + Int( + 'timelimit?', + label=_('Time Limit'), + doc=_('Time limit of search in seconds (0 is unlimited)'), + flags=['no_display'], + minvalue=0, + autofill=False, + ), + Int( + 'sizelimit?', + label=_('Size Limit'), + doc=_('Maximum number of entries returned (0 is unlimited)'), + flags=['no_display'], + minvalue=0, + autofill=False, + ), + ) + + def get_pkinit_status(self, server, status): + backend = self.api.Backend.serverroles + ipa_master_config = backend.config_retrieve("IPA master") + + if server is not None: + servers = [server] + else: + servers = ipa_master_config['ipa_master_server'] + + pkinit_servers = ipa_master_config['pkinit_server_server'] + + for s in servers: + pkinit_status = { + u'server_server': s, + u'status': ( + u'enabled' if s in pkinit_servers else u'disabled' + ) + } + if status is not None and pkinit_status[u'status'] != status: + continue + + yield pkinit_status + + def execute(self, *keys, **options): + if keys: + return dict( + result=[], + count=0, + truncated=False + ) + + server = options.get('server_server', None) + status = options.get('status', None) + + if server is not None: + self.api.Object.server_role.ensure_master_exists(server) + + result = sorted(self.get_pkinit_status(server, status)) + + return dict(result=result, count=len(result), truncated=False) -- 2.9.4