diff options
Diffstat (limited to 'ipa-client/ipa-join.c')
| -rw-r--r-- | ipa-client/ipa-join.c | 256 |
1 files changed, 229 insertions, 27 deletions
diff --git a/ipa-client/ipa-join.c b/ipa-client/ipa-join.c index d18461f6a..c8bf421a2 100644 --- a/ipa-client/ipa-join.c +++ b/ipa-client/ipa-join.c @@ -288,8 +288,7 @@ get_subject(const char *ipaserver, char *ldap_base, const char **subject) NULL, NULL, NULL, 0, &res); if (ret != LDAP_SUCCESS) { - fprintf(stderr, "Search for ipaCertificateSubjectBase failed with error %d", - attrs[0], ret); + fprintf(stderr, "Search for ipaCertificateSubjectBase failed with error %d", ret); rval = 14; goto done; } @@ -334,7 +333,7 @@ done: * the state of the entry. */ static int -join_ldap(const char *ipaserver, const char *hostname, const char ** binddn, const char *bindpw, const char **princ, const char **subject, int quiet) +join_ldap(const char *ipaserver, char *hostname, const char ** binddn, const char *bindpw, const char **princ, const char **subject, int quiet) { LDAP *ld; char *filter = NULL; @@ -353,19 +352,22 @@ join_ldap(const char *ipaserver, const char *hostname, const char ** binddn, con *binddn = NULL; if (get_root_dn(ipaserver, &ldap_base) != 0) { - fprintf(stderr, "Unable to determine root DN of %s\n", ipaserver); + if (!quiet) + fprintf(stderr, "Unable to determine root DN of %s\n", ipaserver); rval = 14; goto done; } if (get_subject(ipaserver, ldap_base, subject) != 0) { - fprintf(stderr, "Unable to determine certificate subject of %s\n", ipaserver); + if (!quiet) + fprintf(stderr, "Unable to determine certificate subject of %s\n", ipaserver); /* Not a critical failure */ } ld = connect_ldap(ipaserver, NULL, NULL); if (!ld) { - fprintf(stderr, "Unable to make an LDAP connection to %s\n", ipaserver); + if (!quiet) + fprintf(stderr, "Unable to make an LDAP connection to %s\n", ipaserver); rval = 14; goto done; } @@ -378,18 +380,21 @@ join_ldap(const char *ipaserver, const char *hostname, const char ** binddn, con if ((ret = ldap_search_ext_s(ld, ldap_base, LDAP_SCOPE_SUB, filter, attrs, 0, NULL, NULL, LDAP_NO_LIMIT, LDAP_NO_LIMIT, &result)) != LDAP_SUCCESS) { - fprintf(stderr, "ldap_search_ext_s: %s\n", ldap_err2string(ret)); + if (!quiet) + fprintf(stderr, "ldap_search_ext_s: %s\n", ldap_err2string(ret)); rval = 14; goto ldap_done; } e = ldap_first_entry(ld, result); if (!e) { - fprintf(stderr, "Unable to find host '%s'\n", hostname); + if (!quiet) + fprintf(stderr, "Unable to find host '%s'\n", hostname); rval = 14; goto ldap_done; } if ((*binddn = ldap_get_dn(ld, e)) == NULL) { - fprintf(stderr, "Unable to get binddn for host '%s'\n", hostname); + if (!quiet) + fprintf(stderr, "Unable to get binddn for host '%s'\n", hostname); rval = 14; goto ldap_done; } @@ -414,10 +419,12 @@ join_ldap(const char *ipaserver, const char *hostname, const char ** binddn, con ld = connect_ldap(ipaserver, *binddn, bindpw); if (!ld) { if (has_principal) { - fprintf(stderr, "Host is already joined.\n"); + if (!quiet) + fprintf(stderr, "Host is already joined.\n"); rval = 13; } else { - fprintf(stderr, "Incorrect password.\n"); + if (!quiet) + fprintf(stderr, "Incorrect password.\n"); rval = 15; } goto done; @@ -427,9 +434,10 @@ join_ldap(const char *ipaserver, const char *hostname, const char ** binddn, con valrequest.bv_len = strlen(hostname); if ((rc = ldap_extended_operation_s(ld, JOIN_OID, &valrequest, NULL, NULL, &oidresult, &valresult)) != LDAP_SUCCESS) { - fprintf(stderr, "principal not found in host entry\n"); + if (!quiet) + fprintf(stderr, "principal not found in host entry\n"); if (debug) ldap_perror(ld, "ldap_extended_operation_s"); - rval = 12; + rval = 18; goto ldap_done; } @@ -452,7 +460,7 @@ done: } static int -join_krb5(const char *ipaserver, const char *hostname, const char **hostdn, const char **princ, const char **subject, int quiet) { +join_krb5(const char *ipaserver, char *hostname, const char **hostdn, const char **princ, const char **subject, int quiet) { xmlrpc_env env; xmlrpc_value * argArrayP = NULL; xmlrpc_value * paramArrayP = NULL; @@ -509,7 +517,7 @@ join_krb5(const char *ipaserver, const char *hostname, const char **hostdn, cons callRPC(&env, serverInfoP, "join", paramArrayP, &resultP); if (handle_fault(&env)) { - rval = 1; + rval = 17; goto cleanup_xmlrpc; } @@ -533,7 +541,8 @@ join_krb5(const char *ipaserver, const char *hostname, const char **hostdn, cons xmlrpc_DECREF(princP); xmlrpc_DECREF(singleprincP); } else { - fprintf(stderr, "principal not found in XML-RPC response\n"); + if (!quiet) + fprintf(stderr, "principal not found in XML-RPC response\n"); rval = 12; goto cleanup; } @@ -547,7 +556,8 @@ join_krb5(const char *ipaserver, const char *hostname, const char **hostdn, cons xmlrpc_array_read_item(&env, krblastpwdchangeP, 0, &singleprincP); xmlrpc_read_string(&env, singleprincP, &krblastpwdchange); xmlrpc_DECREF(krblastpwdchangeP); - fprintf(stderr, "Host is already joined.\n"); + if (!quiet) + fprintf(stderr, "Host is already joined.\n"); rval = 13; goto cleanup; } @@ -581,13 +591,196 @@ cleanup_xmlrpc: } static int +unenroll_host(const char *server, const char *hostname, const char *ktname, int quiet) +{ + int rval = 0; + char *ipaserver = NULL; + char *host = NULL; + struct utsname uinfo; + char *principal = NULL; + char *realm = NULL; + + krb5_context krbctx = NULL; + krb5_keytab keytab; + krb5_ccache ccache = NULL; + krb5_principal princ = NULL; + krb5_error_code krberr; + krb5_creds creds; + krb5_get_init_creds_opt gicopts; + char tgs[LINE_MAX]; + + xmlrpc_env env; + xmlrpc_value * argArrayP = NULL; + xmlrpc_value * paramArrayP = NULL; + xmlrpc_value * paramP = NULL; + xmlrpc_value * resultP = NULL; + xmlrpc_server_info * serverInfoP = NULL; + xmlrpc_value *princP = NULL; + char * url = NULL; + + if (server) { + ipaserver = strdup(server); + } else { + char * conf_data = read_config_file(IPA_CONFIG); + if ((ipaserver = getIPAserver(conf_data)) == NULL) { + if (!quiet) + fprintf(stderr, "Unable to determine IPA server from %s\n", IPA_CONFIG); + exit(1); + } + free(conf_data); + } + + if (NULL == hostname) { + uname(&uinfo); + host = strdup(uinfo.nodename); + } else { + host = strdup(hostname); + } + + if (NULL == strstr(host, ".")) { + if (!quiet) + fprintf(stderr, "The hostname must be fully-qualified: %s\n", host); + rval = 16; + goto cleanup; + } + + krberr = krb5_init_context(&krbctx); + if (krberr) { + if (!quiet) + fprintf(stderr, "Unable to join host: Kerberos context initialization failed\n"); + rval = 1; + goto cleanup; + } + krberr = krb5_kt_resolve(krbctx, ktname, &keytab); + if (krberr != 0) { + if (!quiet) + fprintf(stderr, "Error resolving keytab: %s.\n", + error_message(krberr)); + rval = 7; + goto cleanup; + } + krb5_get_default_realm(krbctx, &realm); + asprintf(&principal, "host/%s@%s", host, realm); + krberr = krb5_parse_name(krbctx, principal, &princ); + if (krberr != 0) { + if (!quiet) + fprintf(stderr, "Error parsing \"%s\": %s.\n", principal, + error_message(krberr)); + return krberr; + } + strcpy(tgs, KRB5_TGS_NAME); + snprintf(tgs + strlen(tgs), sizeof(tgs) - strlen(tgs), "/%.*s", + (krb5_princ_realm(krbctx, princ))->length, + (krb5_princ_realm(krbctx, princ))->data); + snprintf(tgs + strlen(tgs), sizeof(tgs) - strlen(tgs), "@%.*s", + (krb5_princ_realm(krbctx, princ))->length, + (krb5_princ_realm(krbctx, princ))->data); + memset(&creds, 0, sizeof(creds)); + krb5_get_init_creds_opt_init(&gicopts); + krb5_get_init_creds_opt_set_forwardable(&gicopts, 1); + krberr = krb5_get_init_creds_keytab(krbctx, &creds, princ, keytab, + 0, tgs, &gicopts); + if (krberr != 0) { + if (!quiet) + fprintf(stderr, "Error obtaining initial credentials: %s.\n", + error_message(krberr)); + return krberr; + } + + krberr = krb5_cc_resolve(krbctx, "MEMORY:ipa-join", &ccache); + if (krberr == 0) { + krberr = krb5_cc_initialize(krbctx, ccache, creds.client); + } else { + if (!quiet) + fprintf(stderr, "Unable to generate Kerberos Credential Cache\n"); + rval = 19; + goto cleanup; + } + krberr = krb5_cc_store_cred(krbctx, ccache, &creds); + if (krberr != 0) { + if (!quiet) + fprintf(stderr, "Error storing creds in credential cache: %s.\n", + error_message(krberr)); + return krberr; + } + krb5_cc_close(krbctx, ccache); + ccache = NULL; + putenv("KRB5CCNAME=MEMORY:ipa-join"); + + /* Start up our XML-RPC client library. */ + xmlrpc_client_init(XMLRPC_CLIENT_NO_FLAGS, NAME, VERSION); + + xmlrpc_env_init(&env); + + xmlrpc_client_setup_global_const(&env); + +#if 1 + asprintf(&url, "https://%s:443/ipa/xml", ipaserver); +#else + asprintf(&url, "http://%s:8888/", ipaserver); +#endif + serverInfoP = xmlrpc_server_info_new(&env, url); + + argArrayP = xmlrpc_array_new(&env); + paramArrayP = xmlrpc_array_new(&env); + + paramP = xmlrpc_string_new(&env, host); + xmlrpc_array_append_item(&env, argArrayP, paramP); + xmlrpc_array_append_item(&env, paramArrayP, argArrayP); + xmlrpc_DECREF(paramP); + + callRPC(&env, serverInfoP, "host_disable", paramArrayP, &resultP); + if (handle_fault(&env)) { + rval = 17; + goto cleanup; + } + + xmlrpc_struct_find_value(&env, resultP, "result", &princP); + if (princP) { + xmlrpc_bool result; + + xmlrpc_read_bool(&env, princP, &result); + if (result == 1) { + if (!quiet) + fprintf(stderr, "Unenrollment successful.\n"); + } else { + if (!quiet) + fprintf(stderr, "Unenrollment failed.\n"); + } + + xmlrpc_DECREF(princP); + } else { + fprintf(stderr, "result not found in XML-RPC response\n"); + rval = 20; + goto cleanup; + } + +cleanup: + + krb5_kt_close(krbctx, keytab); + free((char *)principal); + free((char *)ipaserver); + if (princ) krb5_free_principal(krbctx, princ); + if (ccache) krb5_cc_close(krbctx, ccache); + if (krbctx) krb5_free_context(krbctx); + + free(url); + xmlrpc_env_clean(&env); + xmlrpc_client_cleanup(); + + return rval; +} + + +static int join(const char *server, const char *hostname, const char *bindpw, const char *keytab, int quiet) { - int rval; + int rval = 0; pid_t childpid = 0; int status = 0; char *ipaserver = NULL; char *iparealm = NULL; + char * host = NULL; const char * princ = NULL; const char * subject = NULL; const char * hostdn = NULL; @@ -611,17 +804,19 @@ join(const char *server, const char *hostname, const char *bindpw, const char *k if (NULL == hostname) { uname(&uinfo); - hostname = strdup(uinfo.nodename); + host = strdup(uinfo.nodename); + } else { + host = strdup(hostname); } - if (NULL == strstr(hostname, ".")) { - fprintf(stderr, "The hostname must be fully-qualified: %s\n", hostname); + if (NULL == strstr(host, ".")) { + fprintf(stderr, "The hostname must be fully-qualified: %s\n", host); rval = 16; goto cleanup; } if (bindpw) - rval = join_ldap(ipaserver, hostname, &hostdn, bindpw, &princ, &subject, quiet); + rval = join_ldap(ipaserver, host, &hostdn, bindpw, &princ, &subject, quiet); else { krberr = krb5_init_context(&krbctx); if (krberr) { @@ -635,14 +830,14 @@ join(const char *server, const char *hostname, const char *bindpw, const char *k rval = 5; goto cleanup; } - + krberr = krb5_cc_get_principal(krbctx, ccache, &uprinc); if (krberr) { fprintf(stderr, "Unable to join host: Kerberos User Principal not found and host password not provided.\n"); rval = 6; goto cleanup; } - rval = join_krb5(ipaserver, hostname, &hostdn, &princ, &subject, quiet); + rval = join_krb5(ipaserver, host, &hostdn, &princ, &subject, quiet); } if (rval) goto cleanup; @@ -733,9 +928,11 @@ main(int argc, char **argv) { static const char *keytab = NULL; static const char *bindpw = NULL; int quiet = 0; + int unenroll = 0; struct poptOption options[] = { { "debug", 'd', POPT_ARG_NONE, &debug, 0, "Print the raw XML-RPC output", "XML-RPC debugging Output"}, { "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Print as little as possible", "Output only on errors"}, + { "unenroll", 'u', POPT_ARG_NONE, &unenroll, 0, "Unenroll this host", "Unenroll this host from IPA server" }, { "hostname", 'h', POPT_ARG_STRING, &hostname, 0, "Use this hostname instead of the node name", "Host Name" }, { "server", 's', POPT_ARG_STRING, &server, 0, "IPA Server to use", "IPA Server Name" }, { "keytab", 'k', POPT_ARG_STRING, &keytab, 0, "File were to store the keytab information", "Keytab File Name" }, @@ -758,12 +955,17 @@ main(int argc, char **argv) { if (debug) setenv("XMLRPC_TRACE_XML", "1", 1); + if (!keytab) keytab = "/etc/krb5.keytab"; - ret = check_perms(keytab); - if (ret == 0) - ret = join(server, hostname, bindpw, keytab, quiet); + if (unenroll) { + ret = unenroll_host(server, hostname, keytab, quiet); + } else { + ret = check_perms(keytab); + if (ret == 0) + ret = join(server, hostname, bindpw, keytab, quiet); + } exit(ret); } |