Make hosts more like real services so we can issue certs for host principals

This patch should make joining a client to the domain and using certmonger
to get an initial certificate work.

2 files changed, 9 insertions, 5 deletions

diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py
index c4a20b54..71aeeb20 100644
--- a/ipaserver/install/krbinstance.py
+++ b/ipaserver/install/krbinstance.py
@@ -112,7 +112,7 @@ class KrbInstance(service.Service):
         # Create a host entry for this master
         host_dn = "fqdn=%s,cn=computers,cn=accounts,%s" % (self.fqdn, self.suffix)
         host_entry = ipaldap.Entry(host_dn)
-        host_entry.setValues('objectclass', ['top', 'ipaobject', 'nshost', 'ipahost', 'pkiuser', 'krbprincipalaux', 'krbprincipal', 'krbticketpolicyaux'])
+        host_entry.setValues('objectclass', ['top', 'ipaobject', 'nshost', 'ipahost', 'ipaservice', 'pkiuser', 'krbprincipalaux', 'krbprincipal', 'krbticketpolicyaux'])
         host_entry.setValue('krbextradata', service_entry.getValue('krbextradata'))
         host_entry.setValue('krblastpwdchange', service_entry.getValue('krblastpwdchange'))
         host_entry.setValue('krbpasswordexpiration', service_entry.getValue('krbpasswordexpiration'))
@@ -123,6 +123,7 @@ class KrbInstance(service.Service):
         host_entry.setValue('cn', self.fqdn)
         host_entry.setValue('fqdn', self.fqdn)
         host_entry.setValue('ipauniqueid', str(uuid.uuid1()))
+        host_entry.setValue('managedby', host_dn)
         conn.addEntry(host_entry)
         conn.unbind()
 
diff --git a/ipaserver/plugins/join.py b/ipaserver/plugins/join.py
index 34f4c58c..fe9f88dd 100644
--- a/ipaserver/plugins/join.py
+++ b/ipaserver/plugins/join.py
@@ -91,13 +91,14 @@ class join(Command):
         try:
             # First see if the host exists
             kw = {'fqdn': hostname, 'all': True}
-            (dn, attrs_list) = api.Command['host_show'](**kw)
+            attrs_list = api.Command['host_show'](**kw)['result']
+            dn = attrs_list['dn']
 
             # If no principal name is set yet we need to try to add
             # one.
             if 'krbprincipalname' not in attrs_list:
                 service = "host/%s@%s" % (hostname, api.env.realm)
-                (d, a) = api.Command['host_mod'](hostname, krbprincipalname=service)
+                api.Command['host_mod'](hostname, krbprincipalname=service)
 
             # It exists, can we write the password attributes?
             allowed = ldap.can_write(dn, 'krblastpwdchange')
@@ -105,9 +106,11 @@ class join(Command):
                 raise errors.ACIError(info="Insufficient 'write' privilege to the 'krbLastPwdChange' attribute of entry '%s'." % dn)
 
             kw = {'fqdn': hostname, 'all': True}
-            (dn, attrs_list) = api.Command['host_show'](**kw)
+            attrs_list = api.Command['host_show'](**kw)['result']
+            dn = attrs_list['dn']
         except errors.NotFound:
-            (dn, attrs_list) = api.Command['host_add'](hostname)
+            attrs_list = api.Command['host_add'](hostname)['result']
+            dn = attrs_list['dn']
 
         return (dn, attrs_list)