summaryrefslogtreecommitdiffstats
path: root/ipaserver/dcerpc.py
Commit message (Collapse)AuthorAgeFilesLines
* session: move the session module from ipalib to ipaserverJan Cholasta2016-06-301-1/+1
| | | | | | | | | The module is used only on the server, so there's no need to have it in ipalib, which is shared by client and server. https://fedorahosted.org/freeipa/ticket/5988 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-111-11/+29
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Add support for an external trust to Active Directory domainAlexander Bokovoy2016-06-091-13/+37
| | | | | | | | | | | | | | | External trust is a trust that can be created between Active Directory domains that are in different forests or between an Active Directory domain. Since FreeIPA does not support non-Kerberos means of communication, external trust to Windows NT 4.0 or earlier domains is not supported. The external trust is not transitive and can be established to any domain in another forest. This means no access beyond the external domain is possible via the trust link. Resolves: https://fedorahosted.org/freeipa/ticket/5743 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Pylint: import max one module per lineMartin Basti2016-03-221-1/+2
| | | | | Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: use list comprehension instead of iterationMartin Basti2016-03-221-4/+1
| | | | | | | | | Iteration over indexes without calling enumeration fuction is not pythonic and should not be used. In this case iteration can be replaced by list comprehension. Fixing this allows to enable pylint consider-using-enumerate check. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* logger: Use warning instead of warnTomas Babej2016-01-181-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Enable pylint unpacking-non-sequence checkMartin Basti2016-01-141-6/+6
| | | | | | | Enables check and marks occurences of runtime error in dcerpc.py as false positive. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Enable pylint unnecessary-pass checkMartin Basti2015-12-231-1/+1
| | | | | | Enables check and removes extra pass statement from code. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint lost exception checkMartin Basti2015-12-231-2/+2
| | | | | | | | | Commit enables check and also fixes: ipaserver/dcerpc.py:718: [W0150(lost-exception), DomainValidator.__search_in_dc] return statement in finally block may swallow exception) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove wildcard importsMartin Basti2015-12-231-2/+4
| | | | | | | | | | | Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-231-5/+2
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor ipautil.runPetr Viktorin2015-12-141-10/+6
| | | | | | | | | | | | | | | | | | | | | The ipautil.run function now returns an object with returncode and output are accessible as attributes. The stdout and stderr of all commands are logged (unless skip_output is given). The stdout/stderr contents must be explicitly requested with a keyword argument, otherwise they are None. This is because in Python 3, the output needs to be decoded, and that can fail if it's not decodable (human-readable) text. The raw (bytes) output is always available from the result object, as is "leniently" decoded output suitable for logging. All calls are changed to reflect this. A use of Popen in cainstance is changed to ipautil.run. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Alias long to int under Python 3Petr Viktorin2015-10-131-0/+1
| | | | | | In py3, the two types are unified under the name "int". Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Alias "unicode" to "str" under Python 3Jan Cholasta2015-09-171-0/+4
| | | | | | | | | The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-121-17/+17
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* dcerpc: Simplify generation of LSA-RPC binding stringsTomas Babej2015-08-071-2/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5183 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix selector of protocol for LSA RPC binding stringAlexander Bokovoy2015-08-071-2/+2
| | | | | | | | | | | | | For Windows Server 2012R2 and others which force SMB2 protocol use we have to specify right DCE RPC binding options. For using SMB1 protocol we have to omit specifying SMB2 protocol and anything else or otherwise SMB1 would be considered a pipe to connect to. This is by design of a binding string format. https://fedorahosted.org/freeipa/ticket/5183 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Replace M2Crypto RC4 with python-cryptography ARC4Christian Heimes2015-07-311-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch removes the dependency on M2Crypto in favor for cryptography. Cryptography is more strict about the key size and doesn't support non-standard key sizes: >>> from M2Crypto import RC4 >>> from ipaserver.dcerpc import arcfour_encrypt >>> RC4.RC4(b'key').update(b'data') 'o\r@\x8c' >>> arcfour_encrypt(b'key', b'data') Traceback (most recent call last): ... ValueError: Invalid key size (24) for RC4. Standard key sizes 40, 56, 64, 80, 128, 192 and 256 are supported: >>> arcfour_encrypt(b'key12', b'data') '\xcd\xf80d' >>> RC4.RC4(b'key12').update(b'data') '\xcd\xf80d' http://cryptography.readthedocs.org/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.ARC4 https://fedorahosted.org/freeipa/ticket/5148 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dcerpc: Add get_trusted_domain_object_type methodTomas Babej2015-07-231-0/+29
| | | | | | https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dcerpc: Fix UnboundLocalError for ccache_nameTomas Babej2015-07-221-0/+2
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dcerpc: Expand explanation for WERR_ACCESS_DENIEDTomas Babej2015-07-211-7/+29
| | | | | | | | | | | It's possible for AD to contact a wrong IPA server in case the DNS SRV records on the AD sides are not properly configured. Mention this case in the error message as well. https://fedorahosted.org/freeipa/ticket/5013 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Py3: replace tab with spaceMartin Basti2015-07-171-1/+1
| | | | | | python3 does not allow to mix spaces and tabs Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Remove tuple unpacking from except clause ipaserver/dcerpc.pyChristian Heimes2015-07-141-6/+12
| | | | | | | | | | Python 3 doesn't support tuple unpacking in except clauses. All implicit tuple unpackings have been replaced with explicit unpacking of e.args. https://fedorahosted.org/freeipa/ticket/5120 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* trust: support retrieving POSIX IDs with one-way trust during trust-addAlexander Bokovoy2015-07-081-18/+65
| | | | | | | | | | | | With one-way trust we cannot rely on cross-realm TGT as there will be none. Thus, if we have AD administrator credentials we should reuse them. Additionally, such use should be done over Kerberos. Fixes: https://fedorahosted.org/freeipa/ticket/4960 https://fedorahosted.org/freeipa/ticket/4959 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: add support for one-way trust and switch to it by defaultAlexander Bokovoy2015-07-081-12/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: pass AD DC hostname if specified explicitlyAlexander Bokovoy2015-07-081-3/+7
| | | | | | Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1222047 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* dcerpc: Raise ACIError correctlyTomas Babej2015-07-081-3/+5
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* idviews: Fallback to AD DC LDAP only if specifically allowedTomas Babej2015-07-021-1/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4524 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dcerpc: Add debugging message to failing kinit as httpTomas Babej2015-07-021-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4524 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dcerpc: Change logging level for debug informationTomas Babej2015-07-021-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4524 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipalib: Load ipaserver plugins when api.env.in_server is TrueJan Cholasta2015-07-011-1/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/3090 https://fedorahosted.org/freeipa/ticket/5073 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* install: Move private_ccache from ipaserver to ipapythonJan Cholasta2015-06-081-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver/dcerpc: Ensure LSA pipe has session key before using itAlexander Bokovoy2015-05-251-5/+14
| | | | | | | | | | | | | | | | | | With Samba 4.2 there is a bug that prevents Samba to consider Kerberos credentials used by IPA httpd process when talking to smbd. As result, LSA RPC connection is seen as anonymous by Samba client code and we cannot derive session key to use for encrypting trust secrets before transmitting them. Additionally, rewrite of the SMB protocol support in Samba caused previously working logic of choosing DCE RPC binding string to fail. We need to try a different set of priorities until they fail or succeed. Requires Samba fixes from https://bugzilla.redhat.com/show_bug.cgi?id=1219832 Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1219834 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* AD trust: improve trust validationAlexander Bokovoy2014-11-251-3/+16
| | | | | | | | | | | | | | | Trust validation requires AD DC to contact IPA server to verify that trust account actually works. It can fail due to DNS or firewall issue or if AD DC was able to resolve IPA master(s) via SRV records, it still may contact a replica that has no trust data replicated yet. In case AD DC still returns 'access denied', wait 5 seconds and try validation again. Repeat validation until we hit a limit of 10 attempts, at which point raise exception telling what's happening. https://fedorahosted.org/freeipa/ticket/4764 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: Add conversion from SID to object nameTomas Babej2014-09-301-0/+49
| | | | | | | | | | | Since SID is often used as a unique identifier for AD objects, we need to convert a SID to actual object name in the AD. Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipaserver/dcerpc.py: Make sure trust is established only to forest root domainAlexander Bokovoy2014-09-011-0/+6
| | | | | | Part of https://fedorahosted.org/freeipa/ticket/4463 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaserver/dcerpc.py: be more open to what domains can be seen through the ↵Alexander Bokovoy2014-09-011-1/+1
| | | | | | | | forest trust https://fedorahosted.org/freeipa/ticket/4463 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaserver/dcerpc.py: Avoid hitting issue with transitive trusts on Windows ↵Alexander Bokovoy2014-09-011-3/+10
| | | | | | | | Server prior to 2012 http://msdn.microsoft.com/en-us/library/2a769a08-e023-459f-aebe-4fb3f595c0b7#id83 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaserver/dcerpc.py: make PDC discovery more robustAlexander Bokovoy2014-09-011-5/+16
| | | | | | | | | | Certain operations against AD domain controller can only be done if its FSMO role is primary domain controller. We need to use writable DC and PDC when creating trust and updating name suffix routing information. https://fedorahosted.org/freeipa/ticket/4479 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaserver/dcerpc.py: if search of a closest GC failed, try to find any GCAlexander Bokovoy2014-09-011-1/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4458 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaplatform: Move all filesystem paths to ipaplatform.paths moduleTomas Babej2014-06-161-3/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Trust add datetime fixAdam Misnyovszki2014-05-061-1/+1
| | | | | | | Fixes trust add, since now datetime object is returned for 'modifytimestamp', which cannot be split like a string. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipaserver/dcerpc: make sure to always return unicode SID of the trust domainAlexander Bokovoy2014-03-121-1/+1
| | | | | | | | | | Trusted domain SID could be obtained through different means. When it is fetched from the AD DC via LDAP, it needs to be extracted from a default context and explicitly converted to unicode. https://fedorahosted.org/freeipa/ticket/4246 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipaserver/dcerpc: catch the case of insuffient permissions when establishing ↵Alexander Bokovoy2014-02-271-2/+5
| | | | | | | | | | | | | | trust We attempt to delete the trust that might exist already. If there are not enough privileges to do so, we wouldn't be able to create trust at the next step and it will fail. However, failure to create trust will be due to the name collision as we already had the trust with the same name before. Thus, raise access denied exception here to properly indicate wrong access level instead of returning NT_STATUS_OBJECT_NAME_COLLISION. https://fedorahosted.org/freeipa/ticket/4202 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* trusts: Remove usage of deprecated LDAP APITomas Babej2014-02-271-2/+2
| | | | | | | | | Remove a reference to the old deprecated LDAP API invoked by the usage of trust_add method. https://fedorahosted.org/freeipa/ticket/4204 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Convert remaining frontend code to LDAPEntry API.Jan Cholasta2014-01-241-9/+9
|
* subdomains: Use AD admin credentials when trust is being establishedAlexander Bokovoy2013-11-291-14/+28
| | | | | | | | | | | | | | | | | | | | When AD administrator credentials passed, they stored in realm_passwd, not realm_password in the options. When passing credentials to ipaserver.dcerpc.fetch_domains(), make sure to normalize them. Additionally, force Samba auth module to use NTLMSSP in case we have credentials because at the point when trust is established, KDC is not yet ready to issue tickets to a service in the other realm due to MS-PAC information caching effects. The logic is a bit fuzzy because credentials code makes decisions on what to use based on the smb.conf parameters and Python bindings to set parameters to smb.conf make it so that auth module believes these parameters were overidden by the user through the command line and ignore some of options. We have to do calls in the right order to force NTLMSSP use instead of Kerberos. Fixes https://fedorahosted.org/freeipa/ticket/4046
* Map NT_STATUS_INVALID_PARAMETER to most likely error cause: clock skewAlexander Bokovoy2013-11-131-0/+3
| | | | | | | | When we get NT_STATUS_INVALID_PARAMETER in response to establish DCE RPC pipe with Kerberos, the most likely reason is clock skew. Suggest that it is so in the error message. https://fedorahosted.org/freeipa/ticket/4024
* trust: integrate subdomains support into trust-addAlexander Bokovoy2013-10-041-33/+47
|
* ipaserver/dcerpc: remove use of trust account authenticationAlexander Bokovoy2013-10-041-70/+6
| | | | | | | | Since FreeIPA KDC supports adding MS-PAC to HTTP/ipa.server principal, it is possible to use it when talking to the trusted AD DC. Remove support for authenticating as trust account because it should not really be used other than within Samba.
generated by cgit (git 2.34.1) at 2024-06-07 12:44:42 +0000