From fe7778b52ac9bacbedceec641ccb41d5f79f131c Mon Sep 17 00:00:00 2001 From: Tomas Krizek Date: Wed, 3 May 2017 10:01:09 +0200 Subject: [PATCH] installutils: add DM password validator Add a validator that checks whether provided Directory Manager is valid by attempting to connect to LDAP. Related https://pagure.io/freeipa/issue/6892 Signed-off-by: Tomas Krizek Reviewed-By: Martin Basti Reviewed-By: Christian Heimes Reviewed-By: Stanislav Laznicka --- ipaserver/install/installutils.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py index 9230e70056b1a773246a0d95e6ecb943cada953c..b6f01489ccc65dcbc360929e0a7b315b074df8ce 100644 --- a/ipaserver/install/installutils.py +++ b/ipaserver/install/installutils.py @@ -50,6 +50,7 @@ import ipaplatform from ipapython import ipautil, admintool, version from ipapython.admintool import ScriptError from ipapython.ipa_log_manager import root_logger +from ipapython.ipaldap import DIRMAN_DN, LDAPClient from ipalib.util import validate_hostname from ipalib import api, errors, x509 from ipapython.dn import DN @@ -329,6 +330,21 @@ def _read_password_default_validator(password): if len(password) < 8: raise ValueError("Password must be at least 8 characters long") + +def validate_dm_password_ldap(password): + """ + Validate DM password by attempting to connect to LDAP. api.env has to + contain valid ldap_uri. + """ + client = LDAPClient(api.env.ldap_uri, cacert=paths.IPA_CA_CRT) + try: + client.simple_bind(DIRMAN_DN, password) + except errors.ACIError: + raise ValueError("Invalid Directory Manager password") + else: + client.unbind() + + def read_password(user, confirm=True, validate=True, retry=True, validator=_read_password_default_validator): correct = False pwd = None -- 2.9.4