From be7de56e5d403fb97bcb583f6b7b5dd7e3fb914c Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Mon, 22 Aug 2011 16:24:07 -0400 Subject: Change the way has_keytab is determined, also check for password. We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538 --- tests/test_xmlrpc/test_attr.py | 16 ++++++++++++++++ tests/test_xmlrpc/test_group_plugin.py | 4 ++++ tests/test_xmlrpc/test_host_plugin.py | 22 ++++++++++++++++++++-- tests/test_xmlrpc/test_hostgroup_plugin.py | 2 ++ tests/test_xmlrpc/test_krbtpolicy.py | 2 ++ tests/test_xmlrpc/test_nesting.py | 11 +++++++++++ tests/test_xmlrpc/test_netgroup_plugin.py | 6 ++++++ tests/test_xmlrpc/test_replace.py | 14 ++++++++++++++ tests/test_xmlrpc/test_service_plugin.py | 8 +++++++- tests/test_xmlrpc/test_user_plugin.py | 30 ++++++++++++++++++++++++++++++ 10 files changed, 112 insertions(+), 3 deletions(-) (limited to 'tests') diff --git a/tests/test_xmlrpc/test_attr.py b/tests/test_xmlrpc/test_attr.py index 3f78a678..11aaa01e 100644 --- a/tests/test_xmlrpc/test_attr.py +++ b/tests/test_xmlrpc/test_attr.py @@ -69,6 +69,8 @@ class test_attr(Declarative): dn=lambda x: DN(x) == \ DN(('uid','tuser1'),('cn','users'),('cn','accounts'), api.env.basedn), + has_keytab=False, + has_password=False, ), ), ), @@ -91,6 +93,8 @@ class test_attr(Declarative): mail=[u'test@example.com'], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -115,6 +119,8 @@ class test_attr(Declarative): mail=[u'test@example.com', u'test2@example.com'], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -140,6 +146,8 @@ class test_attr(Declarative): memberof_group=[u'ipausers'], telephonenumber=[u'410-555-1212', u'301-555-1212'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -165,6 +173,8 @@ class test_attr(Declarative): memberof_group=[u'ipausers'], telephonenumber=[u'301-555-1212'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -190,6 +200,8 @@ class test_attr(Declarative): memberof_group=[u'ipausers'], telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -233,6 +245,8 @@ class test_attr(Declarative): memberof_group=[u'ipausers'], telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -258,6 +272,8 @@ class test_attr(Declarative): memberof_group=[u'ipausers'], telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, diff --git a/tests/test_xmlrpc/test_group_plugin.py b/tests/test_xmlrpc/test_group_plugin.py index 096bab2d..6403251e 100644 --- a/tests/test_xmlrpc/test_group_plugin.py +++ b/tests/test_xmlrpc/test_group_plugin.py @@ -637,6 +637,8 @@ class test_group(Declarative): dn=lambda x: DN(x) == \ DN(('uid',user1),('cn','users'),('cn','accounts'), api.env.basedn), + has_keytab=False, + has_password=False, ), ), ), @@ -753,6 +755,8 @@ class test_group(Declarative): dn=lambda x: DN(x) == \ DN(('uid','tuser1'),('cn','users'),('cn','accounts'), api.env.basedn), + has_keytab=False, + has_password=False, ), ), ), diff --git a/tests/test_xmlrpc/test_host_plugin.py b/tests/test_xmlrpc/test_host_plugin.py index 87eb9376..f7746407 100644 --- a/tests/test_xmlrpc/test_host_plugin.py +++ b/tests/test_xmlrpc/test_host_plugin.py @@ -109,6 +109,8 @@ class test_host(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[fqdn1], + has_keytab=False, + has_password=False, ), ), ), @@ -140,6 +142,7 @@ class test_host(Declarative): l=[u'Undisclosed location 1'], krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)], has_keytab=False, + has_password=False, managedby_host=[fqdn1], ), ), @@ -168,7 +171,8 @@ class test_host(Declarative): managedby_host=[fqdn1], managing_host=[fqdn1], ipauniqueid=[fuzzy_uuid], - has_keytab=False + has_keytab=False, + has_password=False, ), ), ), @@ -189,6 +193,8 @@ class test_host(Declarative): l=[u'Undisclosed location 1'], krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)], managedby_host=[u'%s' % fqdn1], + has_keytab=False, + has_password=False, ), ], ), @@ -219,6 +225,8 @@ class test_host(Declarative): ipauniqueid=[fuzzy_uuid], managedby_host=[u'%s' % fqdn1], managing_host=[u'%s' % fqdn1], + has_keytab=False, + has_password=False, ), ], ), @@ -265,6 +273,7 @@ class test_host(Declarative): l=[u'Undisclosed location 1'], krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)], has_keytab=False, + has_password=False, managedby_host=[u'%s' % fqdn1], usercertificate=[base64.b64decode(servercert)], valid_not_before=fuzzy_date, @@ -300,6 +309,8 @@ class test_host(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[u'%s' % fqdn3], + has_keytab=False, + has_password=False, ), ), ), @@ -326,6 +337,8 @@ class test_host(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[u'%s' % fqdn4], + has_keytab=False, + has_password=False, ), ), ), @@ -369,6 +382,7 @@ class test_host(Declarative): l=[u'Undisclosed location 2'], krbprincipalname=[u'host/%s@%s' % (fqdn3, api.env.realm)], has_keytab=False, + has_password=False, managedby_host=[u'%s' % fqdn3, u'%s' % fqdn1], ), ), @@ -468,6 +482,8 @@ class test_host(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[u'%s' % fqdn1], + has_keytab=False, + has_password=False, ), ), ), @@ -479,7 +495,7 @@ class test_host(Declarative): value=service1, summary=u'Added service "%s"' % service1, result=dict( - dn=service1dn, + dn=lambda x: DN(x) == service1dn, krbprincipalname=[service1], objectclass=objectclasses.service, managedby_host=[fqdn1], @@ -539,6 +555,8 @@ class test_host(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[u'%s' % fqdn2], + has_keytab=False, + has_password=False, ), ), ), diff --git a/tests/test_xmlrpc/test_hostgroup_plugin.py b/tests/test_xmlrpc/test_hostgroup_plugin.py index 1bfbae43..e0d11585 100644 --- a/tests/test_xmlrpc/test_hostgroup_plugin.py +++ b/tests/test_xmlrpc/test_hostgroup_plugin.py @@ -121,6 +121,8 @@ class test_hostgroup(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[fqdn1], + has_keytab=False, + has_password=False, ), ), ), diff --git a/tests/test_xmlrpc/test_krbtpolicy.py b/tests/test_xmlrpc/test_krbtpolicy.py index 3db743d5..3ef603b3 100644 --- a/tests/test_xmlrpc/test_krbtpolicy.py +++ b/tests/test_xmlrpc/test_krbtpolicy.py @@ -116,6 +116,8 @@ class test_krbtpolicy(Declarative): [DN(('cn',user1),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid',user1),('cn','users'),('cn','accounts'), api.env.basedn) diff --git a/tests/test_xmlrpc/test_nesting.py b/tests/test_xmlrpc/test_nesting.py index f28d4793..cb2d1d0b 100644 --- a/tests/test_xmlrpc/test_nesting.py +++ b/tests/test_xmlrpc/test_nesting.py @@ -186,6 +186,8 @@ class test_nesting(Declarative): [DN(('cn',user1),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid',user1),('cn','users'),('cn','accounts'), api.env.basedn) @@ -224,6 +226,8 @@ class test_nesting(Declarative): [DN(('cn',user2),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid',user2),('cn','users'),('cn','accounts'), api.env.basedn) @@ -262,6 +266,8 @@ class test_nesting(Declarative): [DN(('cn',user3),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid',user3),('cn','users'),('cn','accounts'), api.env.basedn) @@ -300,6 +306,8 @@ class test_nesting(Declarative): [DN(('cn',user4),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid',user4),('cn','users'),('cn','accounts'), api.env.basedn) @@ -676,6 +684,8 @@ class test_nesting(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[fqdn1], + has_keytab=False, + has_password=False, ), ), ), @@ -801,6 +811,7 @@ class test_nesting(Declarative): l=[u'Undisclosed location 1'], krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)], has_keytab=False, + has_password=False, managedby_host=[fqdn1], memberof_hostgroup = [u'testhostgroup2'], memberofindirect_hostgroup = [u'testhostgroup1'], diff --git a/tests/test_xmlrpc/test_netgroup_plugin.py b/tests/test_xmlrpc/test_netgroup_plugin.py index fc3bb545..9194b549 100644 --- a/tests/test_xmlrpc/test_netgroup_plugin.py +++ b/tests/test_xmlrpc/test_netgroup_plugin.py @@ -168,6 +168,8 @@ class test_netgroup(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[host1], + has_keytab=False, + has_password=False, ), ), ), @@ -225,6 +227,8 @@ class test_netgroup(Declarative): [DN(('cn',user1),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid',user1),('cn','users'),('cn','accounts'), api.env.basedn), @@ -262,6 +266,8 @@ class test_netgroup(Declarative): [DN(('cn',user2),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid',user2),('cn','users'),('cn','accounts'), api.env.basedn), diff --git a/tests/test_xmlrpc/test_replace.py b/tests/test_xmlrpc/test_replace.py index a1fd5d28..f5203607 100644 --- a/tests/test_xmlrpc/test_replace.py +++ b/tests/test_xmlrpc/test_replace.py @@ -73,6 +73,8 @@ class test_replace(Declarative): [DN(('cn',user1),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid','tuser1'),('cn','users'),('cn','accounts'), api.env.basedn), @@ -98,6 +100,8 @@ class test_replace(Declarative): mail=[u'test1@example.com', u'test3@example.com'], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -122,6 +126,8 @@ class test_replace(Declarative): mail=[u'test4@example.com'], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -146,6 +152,8 @@ class test_replace(Declarative): mail=[u'test6@example.com', u'test7@example.com', u'test5@example.com'], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -169,6 +177,8 @@ class test_replace(Declarative): gidnumber=[fuzzy_digits], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -193,6 +203,8 @@ class test_replace(Declarative): initials=[u'ABC'], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -216,6 +228,8 @@ class test_replace(Declarative): gidnumber=[fuzzy_digits], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, diff --git a/tests/test_xmlrpc/test_service_plugin.py b/tests/test_xmlrpc/test_service_plugin.py index d424eeed..d36dac98 100644 --- a/tests/test_xmlrpc/test_service_plugin.py +++ b/tests/test_xmlrpc/test_service_plugin.py @@ -47,7 +47,7 @@ fd.close() badservercert = 'MIICbzCCAdigAwIBAgICA/4wDQYJKoZIhvcNAQEFBQAwKTEnMCUGA1UEAxMeSVBBIFRlc3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTEwMDgwOTE1MDIyN1oXDTIwMDgwOTE1MDIyN1owKTEMMAoGA1UEChMDSVBBMRkwFwYDVQQDExBwdW1hLmdyZXlvYWsuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwYbfEOQPgGenPn9vt1JFKvWm/Je3y2tawGWA3LXDuqfFJyYtZ8ib3TcBUOnLk9WK5g2qCwHaNlei7bj8ggIfr5hegAVe10cun+wYErjnYo7hsHYd+57VZezeipWrXu+7NoNd4+c4A5lk4A/xJay9j3bYx2oOM8BEox4xWYoWge1ljPrc5JK46f0X7AGW4F2VhnKPnf8rwSuzI1U8VGjutyM9TWNy3m9KMWeScjyG/ggIpOjUDMV7HkJL0Di61lznR9jXubpiEC7gWGbTp84eGl/Nn9bgK1AwHfJ2lHwfoY4uiL7ge1gyP6EvuUlHoBzdb7pekiX28iePjW3iEG9IawIDAQABoyIwIDARBglghkgBhvhCAQEEBAMCBkAwCwYDVR0PBAQDAgUgMA0GCSqGSIb3DQEBBQUAA4GBACRESLemRV9BPxfEgbALuxH5oE8jQm8WZ3pm2pALbpDlAd9wQc3yVf6RtkfVthyDnM18bg7IhxKpd77/p3H8eCnS8w5MLVRda6ktUC6tGhFTS4QKAf0WyDGTcIgkXbeDw0OPAoNHivoXbIXIIRxlw/XgaSaMzJQDBG8iROsN4kCv' -class test_host(Declarative): +class test_service(Declarative): cleanup_commands = [ ('host_del', [fqdn1], {}), @@ -99,6 +99,8 @@ class test_host(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[u'%s' % fqdn1], + has_keytab=False, + has_password=False, ), ), ), @@ -125,6 +127,8 @@ class test_host(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[u'%s' % fqdn2], + has_keytab=False, + has_password=False, ), ), ), @@ -151,6 +155,8 @@ class test_host(Declarative): objectclass=objectclasses.host, ipauniqueid=[fuzzy_uuid], managedby_host=[u'%s' % fqdn3.lower()], + has_keytab=False, + has_password=False, ), ), ), diff --git a/tests/test_xmlrpc/test_user_plugin.py b/tests/test_xmlrpc/test_user_plugin.py index 12aec153..9392742e 100644 --- a/tests/test_xmlrpc/test_user_plugin.py +++ b/tests/test_xmlrpc/test_user_plugin.py @@ -104,6 +104,8 @@ class test_user(Declarative): [DN(('cn',user1),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid','tuser1'),('cn','users'),('cn','accounts'), api.env.basedn), @@ -140,6 +142,8 @@ class test_user(Declarative): gidnumber=[fuzzy_digits], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), value=user1, summary=None, @@ -178,6 +182,8 @@ class test_user(Declarative): [DN(('cn','global_policy'),('cn',api.env.realm), ('cn','kerberos'),api.env.basedn)], 'nsaccountlock': False, + 'has_keytab': False, + 'has_password': False, 'displayname': [u'Test User1'], 'cn': [u'Test User1'], 'initials': [u'TU'], @@ -206,6 +212,8 @@ class test_user(Declarative): sn=[u'User1'], uid=[user1], nsaccountlock=False, + has_keytab=False, + has_password=False, uidnumber=[fuzzy_digits], gidnumber=[fuzzy_digits], ), @@ -233,6 +241,8 @@ class test_user(Declarative): sn=[u'Administrator'], uid=[u'admin'], nsaccountlock=False, + has_keytab=True, + has_password=True, uidnumber=[fuzzy_digits], gidnumber=[fuzzy_digits], ), @@ -246,6 +256,8 @@ class test_user(Declarative): sn=[u'User1'], uid=[user1], nsaccountlock=False, + has_keytab=False, + has_password=False, uidnumber=[fuzzy_digits], gidnumber=[fuzzy_digits], ), @@ -273,6 +285,8 @@ class test_user(Declarative): sn=[u'Administrator'], uid=[u'admin'], nsaccountlock=False, + has_keytab=True, + has_password=True, uidnumber=[fuzzy_digits], gidnumber=[fuzzy_digits], ), @@ -326,6 +340,8 @@ class test_user(Declarative): gidnumber=[fuzzy_digits], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "tuser1"', value=user1, @@ -359,6 +375,8 @@ class test_user(Declarative): gidnumber=[fuzzy_digits], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=None, value=user1, @@ -381,6 +399,8 @@ class test_user(Declarative): gidnumber=[fuzzy_digits], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "%s"' % user1, value=user1, @@ -409,6 +429,8 @@ class test_user(Declarative): gidnumber=[fuzzy_digits], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, ), summary=u'Modified user "%s"' % renameduser1, value=renameduser1, @@ -475,6 +497,8 @@ class test_user(Declarative): [DN(('cn',user1),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid','tuser1'),('cn','users'),('cn','accounts'), api.env.basedn), @@ -513,6 +537,8 @@ class test_user(Declarative): [DN(('cn',user2),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid','tuser2'),('cn','users'),('cn','accounts'), api.env.basedn), @@ -542,6 +568,8 @@ class test_user(Declarative): gidnumber=[fuzzy_digits], memberof_group=[u'ipausers'], nsaccountlock=False, + has_keytab=False, + has_password=False, manager=[user1], ), summary=u'Modified user "%s"' % user2, @@ -655,6 +683,8 @@ class test_user(Declarative): [DN(('cn',user1),('cn','groups'),('cn','accounts'), api.env.basedn)], memberof_group=[u'ipausers'], + has_keytab=False, + has_password=False, dn=lambda x: DN(x) == \ DN(('uid','tuser1'),('cn','users'),('cn','accounts'), api.env.basedn), -- cgit