From be7de56e5d403fb97bcb583f6b7b5dd7e3fb914c Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Mon, 22 Aug 2011 16:24:07 -0400
Subject: Change the way has_keytab is determined, also check for password.

We need an indicator to see if a keytab has been set on host and
service entries. We also need a way to know if a one-time password is
set on a host.

This adds an ACI that grants search on userPassword and
krbPrincipalKey so we can do an existence search on them. This way
we can tell if the attribute is set and create a fake attribute
accordingly.

When a userPassword is set on a host a keytab is generated against
that password so we always set has_keytab to False if a password
exists. This is fine because when keytab gets generated for the
host the password is removed (hence one-time).

This adds has_keytab/has_password to the user, host and service plugins.

ticket https://fedorahosted.org/freeipa/ticket/1538
---
 ipalib/plugins/baseldap.py | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

(limited to 'ipalib/plugins/baseldap.py')

diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index 1ff7a2a6d..94f57388d 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -36,6 +36,12 @@ from ipalib.util import json_serialize
 from ipalib.dn import *
 
 global_output_params = (
+    Flag('has_keytab',
+        label=_('Keytab'),
+    ),
+    Flag('has_password',
+        label=_('Password'),
+    ),
     Str('member',
         label=_('Failed members'),
     ),
@@ -319,6 +325,7 @@ class LDAPObject(Object):
     uuid_attribute = ''
     attribute_members = {}
     rdnattr = None
+    password_attributes = []
     # Can bind as this entry (has userPassword or krbPrincipalKey)
     bindable = False
     relationships = {
@@ -407,6 +414,25 @@ class LDAPObject(Object):
                         )
             del entry_attrs[attr]
 
+    def get_password_attributes(self, ldap, dn, entry_attrs):
+        """
+        Search on the entry to determine if it has a password or
+        keytab set.
+
+        A tuple is used to determine which attribute is set
+        in entry_attrs. The value is set to True/False whether a
+        given password type is set.
+        """
+        for (pwattr, attr) in self.password_attributes:
+            search_filter = '(%s=*)' % pwattr
+            try:
+                (entries, truncated) = ldap.find_entries(
+                    search_filter, [pwattr], dn, ldap.SCOPE_BASE
+                )
+                entry_attrs[attr] = True
+            except errors.NotFound:
+                entry_attrs[attr] = False
+
     def handle_not_found(self, *keys):
         pkey = ''
         if self.primary_key:
-- 
cgit