diff options
Diffstat (limited to 'ipalib')
| -rw-r--r-- | ipalib/backend.py | 2 | ||||
| -rw-r--r-- | ipalib/constants.py | 1 | ||||
| -rw-r--r-- | ipalib/plugable.py | 5 | ||||
| -rw-r--r-- | ipalib/rpc.py | 24 |
4 files changed, 23 insertions, 9 deletions
diff --git a/ipalib/backend.py b/ipalib/backend.py index 79f190832..7ed378e88 100644 --- a/ipalib/backend.py +++ b/ipalib/backend.py @@ -110,7 +110,7 @@ class Executioner(Backend): self.Backend.ldap2.connect(ccache=ccache) else: self.Backend.xmlclient.connect(verbose=(self.env.verbose >= 2), - fallback=self.env.fallback) + fallback=self.env.fallback, delegate=self.env.delegate) if client_ip is not None: setattr(context, "client_ip", client_ip) diff --git a/ipalib/constants.py b/ipalib/constants.py index 7a1e3d2ec..899c765fa 100644 --- a/ipalib/constants.py +++ b/ipalib/constants.py @@ -139,6 +139,7 @@ DEFAULT_CONFIG = ( ('prompt_all', False), ('interactive', True), ('fallback', True), + ('delegate', False), # Enable certain optional plugins: ('enable_ra', False), diff --git a/ipalib/plugable.py b/ipalib/plugable.py index e0b6e7f96..4d0011029 100644 --- a/ipalib/plugable.py +++ b/ipalib/plugable.py @@ -530,6 +530,9 @@ class API(DictProxy): parser.add_option('-d', '--debug', action='store_true', help='Produce full debuging output', ) + parser.add_option('--delegate', action='store_true', + help='Delegate the TGT to the IPA server', + ) parser.add_option('-v', '--verbose', action='count', help='Produce more verbose output. A second -v displays the XML-RPC request', ) @@ -570,7 +573,7 @@ class API(DictProxy): pass overrides[str(key.strip())] = value.strip() for key in ('conf', 'debug', 'verbose', 'prompt_all', 'interactive', - 'fallback'): + 'fallback', 'delegate'): value = getattr(options, key, None) if value is not None: overrides[key] = value diff --git a/ipalib/rpc.py b/ipalib/rpc.py index abfa44e89..d8fee5639 100644 --- a/ipalib/rpc.py +++ b/ipalib/rpc.py @@ -232,6 +232,7 @@ class KerbTransport(SSLTransport): """ Handles Kerberos Negotiation authentication to an XML-RPC server. """ + flags = kerberos.GSS_C_MUTUAL_FLAG | kerberos.GSS_C_SEQUENCE_FLAG def _handle_exception(self, e, service=None): (major, minor) = ipautil.get_gsserror(e) @@ -257,10 +258,7 @@ class KerbTransport(SSLTransport): service = "HTTP@" + host.split(':')[0] try: - (rc, vc) = kerberos.authGSSClientInit(service, - kerberos.GSS_C_DELEG_FLAG | - kerberos.GSS_C_MUTUAL_FLAG | - kerberos.GSS_C_SEQUENCE_FLAG) + (rc, vc) = kerberos.authGSSClientInit(service, self.flags) except kerberos.GSSError, e: self._handle_exception(e) @@ -284,6 +282,14 @@ class KerbTransport(SSLTransport): return (host, extra_headers, x509) +class DelegatedKerbTransport(KerbTransport): + """ + Handles Kerberos Negotiation authentication and TGT delegation to an + XML-RPC server. + """ + flags = kerberos.GSS_C_DELEG_FLAG | kerberos.GSS_C_MUTUAL_FLAG | \ + kerberos.GSS_C_SEQUENCE_FLAG + class xmlclient(Connectible): """ Forwarding backend plugin for XML-RPC client. @@ -303,7 +309,7 @@ class xmlclient(Connectible): """ if not hasattr(self.conn, '_ServerProxy__transport'): return None - if isinstance(self.conn._ServerProxy__transport, KerbTransport): + if type(self.conn._ServerProxy__transport) in (KerbTransport, DelegatedKerbTransport): scheme = "https" else: scheme = "http" @@ -337,14 +343,18 @@ class xmlclient(Connectible): return servers - def create_connection(self, ccache=None, verbose=False, fallback=True): + def create_connection(self, ccache=None, verbose=False, fallback=True, + delegate=False): servers = self.get_url_list() serverproxy = None for server in servers: kw = dict(allow_none=True, encoding='UTF-8') kw['verbose'] = verbose if server.startswith('https://'): - kw['transport'] = KerbTransport() + if delegate: + kw['transport'] = DelegatedKerbTransport() + else: + kw['transport'] = KerbTransport() else: kw['transport'] = LanguageAwareTransport() self.log.info('trying %s' % server) |