summaryrefslogtreecommitdiffstats
path: root/install/tools/ipa-replica-manage
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2010-02-19 13:29:14 -0500
committerRob Crittenden <rcritten@redhat.com>2010-03-19 17:17:14 -0400
commitc19911845d93e4cbbf296caf18568231549a3e60 (patch)
tree7215db333db05cefbe712e63f7c99d651afff908 /install/tools/ipa-replica-manage
parent664ae51eb6e76ceb3630687d2ee423f69fb0ba19 (diff)
downloadfreeipa-c19911845d93e4cbbf296caf18568231549a3e60.tar.gz
freeipa-c19911845d93e4cbbf296caf18568231549a3e60.tar.xz
freeipa-c19911845d93e4cbbf296caf18568231549a3e60.zip
Use GSSAPI auth for the ipa-replica-manage list and del commands.
This creates a new role, replicaadmin, so a non-DM user can do limited management of replication agreements. Note that with cn=config if an unauthorized user performs a search an error is not returned, no entries are returned. This makes it difficult to determine if there are simply no replication agreements or we aren't allowed to see them. Once the ipaldap.py module gets replaced by ldap2 we can use Get Effective Rights to easily tell the difference.
Diffstat (limited to 'install/tools/ipa-replica-manage')
-rwxr-xr-xinstall/tools/ipa-replica-manage22
1 files changed, 18 insertions, 4 deletions
diff --git a/install/tools/ipa-replica-manage b/install/tools/ipa-replica-manage
index 20d261c8f..b85c491e5 100755
--- a/install/tools/ipa-replica-manage
+++ b/install/tools/ipa-replica-manage
@@ -27,6 +27,7 @@ from ipaserver.install import replication, dsinstance, installutils
from ipaserver import ipaldap
from ipapython import version
from ipalib import util
+from ipalib import errors
def parse_options():
from optparse import OptionParser
@@ -102,12 +103,15 @@ def del_master(replman, hostname, force=False):
try:
t = replman.get_agreement_type(hostname)
except ldap.NO_SUCH_OBJECT:
- print "No replication agreement found for %s" % hostname
+ print "No replication agreement found for '%s'" % hostname
+ return
+ except errors.NotFound:
+ print "No replication agreement found for '%s'" % hostname
+ return
if t == replication.IPA_REPLICA:
- dirman_passwd = getpass.getpass("Directory Manager password (%s): " % hostname)
try:
- other_replman = replication.ReplicationManager(hostname, dirman_passwd)
+ other_replman = replication.ReplicationManager(hostname, dirman_passwd=None)
other_replman.suffix = get_suffix()
other_replman.delete_agreement(replman.conn.host)
except Exception, e:
@@ -179,10 +183,13 @@ def synch_master(replman, hostname):
def main():
options, args = parse_options()
+ dirman_passwd = None
+
if options.dirman_passwd:
dirman_passwd = options.dirman_passwd
else:
- dirman_passwd = getpass.getpass("Directory Manager password: ")
+ if args[0] in ["add", "init"]:
+ dirman_passwd = getpass.getpass("Directory Manager password: ")
if options.host:
host = options.host
@@ -227,5 +234,12 @@ except SystemExit, e:
except ldap.INVALID_CREDENTIALS:
print "Invalid password"
sys.exit(1)
+except ldap.INSUFFICIENT_ACCESS:
+ print "Insufficient access"
+ sys.exit(1)
+except ldap.LOCAL_ERROR, e:
+ print e.args[0]['info']
+ sys.exit(1)
except Exception, e:
print "unexpected error: %s" % str(e)
+ sys.exit(1)