diff options
Diffstat (limited to 'ipalib/plugins')
| -rw-r--r-- | ipalib/plugins/baseldap.py | 2 | ||||
| -rw-r--r-- | ipalib/plugins/host.py | 2 | ||||
| -rw-r--r-- | ipalib/plugins/service.py | 22 |
3 files changed, 19 insertions, 7 deletions
diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py index 9562ff98..92540d8a 100644 --- a/ipalib/plugins/baseldap.py +++ b/ipalib/plugins/baseldap.py @@ -396,7 +396,7 @@ def host_is_master(ldap, fqdn): master_dn = str(DN('cn=%s' % fqdn, 'cn=masters,cn=ipa,cn=etc', api.env.basedn)) try: (dn, entry_attrs) = ldap.get_entry(master_dn, ['objectclass']) - raise errors.ValidationError(name='hostname', error=_('An IPA master host cannot be deleted')) + raise errors.ValidationError(name='hostname', error=_('An IPA master host cannot be deleted or disabled')) except errors.NotFound: # Good, not a master return diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py index 9db98e71..662cff31 100644 --- a/ipalib/plugins/host.py +++ b/ipalib/plugins/host.py @@ -850,6 +850,8 @@ class host_disable(LDAPQuery): else: fqdn = keys[-1] + host_is_master(ldap, fqdn) + # See if we actually do anthing here, and if not raise an exception done_work = False diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py index e75d71f0..7c563b30 100644 --- a/ipalib/plugins/service.py +++ b/ipalib/plugins/service.py @@ -200,6 +200,18 @@ def set_certificate_attrs(entry_attrs): entry_attrs['md5_fingerprint'] = unicode(nss.data_to_hex(nss.md5_digest(cert.der_data), 64)[0]) entry_attrs['sha1_fingerprint'] = unicode(nss.data_to_hex(nss.sha1_digest(cert.der_data), 64)[0]) +def check_required_principal(ldap, hostname, service): + """ + Raise an error if the host of this prinicipal is an IPA master and one + of the principals required for proper execution. + """ + try: + host_is_master(ldap, hostname) + except errors.ValidationError, e: + service_types = ['HTTP', 'ldap', 'DNS' 'dogtagldap'] + if service in service_types: + raise errors.ValidationError(name='principal', error=_('This principal is required by the IPA master')) + class service(LDAPObject): """ Service object. @@ -296,12 +308,7 @@ class service_del(LDAPDelete): # deleted. This is a limited few though. If the user has their own # custom services allow them to manage them. (service, hostname, realm) = split_principal(keys[-1]) - try: - host_is_master(ldap, hostname) - except errors.ValidationError, e: - service_types = ['HTTP', 'ldap', 'DNS' 'dogtagldap'] - if service in service_types: - raise errors.ValidationError(name='principal', error=_('This principal is required by the IPA master')) + check_required_principal(ldap, hostname, service) if self.api.env.enable_ra: (dn, entry_attrs) = ldap.get_entry(dn, ['usercertificate']) cert = entry_attrs.get('usercertificate') @@ -465,6 +472,9 @@ class service_disable(LDAPQuery): dn = self.obj.get_dn(*keys, **options) (dn, entry_attrs) = ldap.get_entry(dn, ['usercertificate']) + (service, hostname, realm) = split_principal(keys[-1]) + check_required_principal(ldap, hostname, service) + # See if we do any work at all here and if not raise an exception done_work = False |