Enrollment for a host in an IPA domain

This will create a host service principal and may create a host entry (for
admins).  A keytab will be generated, by default in /etc/krb5.keytab
If no kerberos credentails are available then enrollment over LDAPS is used
if a password is provided.

This change requires that openldap be used as our C LDAP client. It is much
easier to do SSL using openldap than mozldap (no certdb required). Otherwise
we'd have to write a slew of extra code to create a temporary cert database,
import the CA cert, ...

2 files changed, 26 insertions, 152 deletions

diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py
index 809ec319b..bf720abbc 100644
--- a/ipalib/plugins/host.py
+++ b/ipalib/plugins/host.py
@@ -21,13 +21,9 @@
 Hosts/Machines (Identity)
 """
 
-import platform
-import os
-import sys
-
 from ipalib import api, crud, errors, util
 from ipalib import Object
-from ipalib import Str, Flag
+from ipalib import Str, Flag, List
 from ipalib.plugins.service import split_principal
 from ipalib import uuid
 
@@ -59,25 +55,6 @@ def validate_host(ugettext, fqdn):
         return 'Fully-qualified hostname required'
     return None
 
-def determine_os():
-    """
-    Return OS name (e.g. redhat 10 Cambridge).
-    """
-    (sysname, nodename, release, version, machine) = os.uname()
-    if sys.platform == 'linux2':
-        # something like 'fedora 9 Sulpher'
-        return unicode(' '.join(platform.dist()))
-    else:
-        # on Solaris this will be: 'SunOS 5.10'
-        return unicode(sysname + ' ' + release)
-
-def determine_platform():
-    """
-    Return platform name (e.g. i686).
-    """
-    (sysname, nodename, release, version, machine) = os.uname()
-    return unicode(machine)
-
 
 class host(Object):
     """
@@ -106,14 +83,10 @@ class host(Object):
         Str('nshardwareplatform?',
             cli_name='platform',
             doc='Hardware platform of the host (e.g. Lenovo T61)',
-            default=determine_platform(),
-            autofill=True,
         ),
         Str('nsosversion?',
             cli_name='os',
             doc='Operating System and version of the host (e.g. Fedora 9)',
-            default=determine_os(),
-            autofill=True,
         ),
         Str('userpassword?',
             cli_name='password',
@@ -157,13 +130,6 @@ class host_add(crud.Create):
 
         # FIXME: do a DNS lookup to ensure host exists
 
-        current = util.get_current_principal()
-        if not current:
-            raise errors.NotFound(reason='Unable to determine current user')
-        entry_attrs['enrolledby'] = ldap.find_entry_by_attr(
-            'krbprincipalname', current, 'posixAccount'
-        )[0]
-
         # FIXME: add this attribute to cn=ipaconfig
         # config = ldap.get_ipa_config()[1]
         # kw['objectclass'] =  config.get('ipahostobjectclasses')
@@ -242,6 +208,15 @@ class host_mod(crud.Update):
     """
     Modify host.
     """
+
+    takes_options = (
+        Str('krbprincipalname?',
+            cli_name='principalname',
+            doc='Kerberos principal name for this host',
+            attribute=True
+        ),
+    )
+
     def execute(self, hostname, **kw):
         """
         Execute the host-mod operation.
@@ -261,6 +236,14 @@ class host_mod(crud.Update):
 
         entry_attrs = self.args_options_2_entry(**kw)
 
+        # Once a principal name is set it cannot be changed
+        if 'krbprincipalname' in entry_attrs:
+            (d, e) = api.Command['host_show'](hostname, all=True)
+            if 'krbprincipalname' in e:
+                raise errors.ACIError(info='Principal name already set, it is unchangeable.')
+            entry_attrs['objectclass'] = e['objectclass']
+            entry_attrs['objectclass'].append('krbprincipalaux')
+
         try:
             ldap.update_entry(dn, entry_attrs)
         except errors.EmptyModlist:
@@ -349,8 +332,12 @@ class host_show(crud.Retrieve):
     """
     takes_options = (
         Flag('all',
+            cli_short_name='a',
             doc='Retrieve all attributes'
         ),
+        List('attrs?',
+            doc='comma-separated list of attributes to display'
+        ),
     )
 
     def execute(self, hostname, **kw):
@@ -371,7 +358,10 @@ class host_show(crud.Retrieve):
         if kw['all']:
             attrs_list = ['*']
         else:
-            attrs_list = _default_attributes
+            if 'attrs' in kw:
+                attrs_list = kw['attrs']
+            else:
+                attrs_list = _default_attributes
 
         return ldap.get_entry(dn, attrs_list)
 
@@ -383,4 +373,3 @@ class host_show(crud.Retrieve):
         textui.print_entry(entry_attrs)
 
 api.register(host_show)
-
diff --git a/ipalib/plugins/join.py b/ipalib/plugins/join.py
deleted file mode 100644
index ab029e43c..000000000
--- a/ipalib/plugins/join.py
+++ /dev/null
@@ -1,115 +0,0 @@
-# Authors:
-#   Rob Crittenden <rcritten@redhat.com>
-#
-# Copyright (C) 2009  Red Hat
-# see file 'COPYING' for use and warranty information
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License as
-# published by the Free Software Foundation; version 2 only
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-
-"""
-Joining an IPA domain
-"""
-
-from ipalib import api, util
-from ipalib import Command, Str, Int
-from ipalib import errors
-import krbV
-import os, subprocess
-from ipapython import ipautil
-import tempfile
-import sha
-import stat
-import shutil
-
-def get_realm():
-    krbctx = krbV.default_context()
-
-    return unicode(krbctx.default_realm)
-
-def validate_host(ugettext, cn):
-    """
-    Require at least one dot in the hostname (to support localhost.localdomain)
-    """
-    dots = len(cn.split('.'))
-    if dots < 2:
-        return 'Fully-qualified hostname required'
-    return None
-
-class join(Command):
-    """Join an IPA domain"""
-
-    requires_root = True
-
-    takes_args = (
-        Str('cn',
-            validate_host,
-            cli_name='hostname',
-            doc="The hostname to register as",
-            create_default=lambda **kw: unicode(util.get_fqdn()),
-            autofill=True,
-            #normalizer=lamda value: value.lower(),
-        ),
-    )
-    takes_options= (
-        Str('realm',
-            doc="The IPA realm",
-            create_default=lambda **kw: get_realm(),
-            autofill=True,
-        ),
-    )
-
-    def execute(self, hostname, **kw):
-        """
-        Execute the machine join operation.
-
-        Returns the entry as it will be created in LDAP.
-
-        :param hostname: The name of the host joined
-        :param kw: Keyword arguments for the other attributes.
-        """
-        assert 'cn' not in kw
-
-        try:
-            host = api.Command['host_show'](hostname)
-        except errors.NotFound:
-            pass
-        else:
-            raise errors.DuplicateEntry
-
-        return api.Command['host_add'](hostname)
-
-    def output_for_cli(self, textui, result, args, **options):
-        textui.print_plain("Welcome to the %s realm" % options['realm'])
-        textui.print_plain("Your keytab is in %s" % result.get('keytab'))
-
-    def run(self, *args, **options):
-        """
-        Dispatch to forward() and execute() to do work locally and on the
-        server.
-        """
-        if self.env.in_server:
-            return self.execute(*args, **options)
-
-        # This forward will call the server-side portion of join
-        result = self.forward(*args, **options)
-
-        self._get_keytab(result['krbprincipalname'])
-        result['keytab'] = '/etc/krb5.keytab'
-        return result
-
-    def _get_keytab(self, principal, stdin=None):
-        args = ["/usr/sbin/ipa-getkeytab", "-s", self.env.host, "-p", principal,"-k", "/etc/krb5.keytab"]
-        return ipautil.run(args, stdin)
-
-api.register(join)