From f94ccca6761f7dbe3f99855d181fe2cec380d476 Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Fri, 8 Apr 2016 15:21:19 +1000 Subject: Allow CustodiaClient to be used by arbitrary principals Currently CustodiaClient assumes that the client is the host principal, and it is hard-coded to read the host keytab and server keys. For the Lightweight CAs feature, Dogtag on CA replicas will use CustodiaClient to retrieve signing keys from the originating replica. Because this process runs as 'pkiuser', the host keys cannot be used; instead, each Dogtag replica will have a service principal to use for Custodia authentication. Update CustodiaClient to require specifying the client keytab and Custodia keyfile to use, and change the client argument to be a full GSS service name (instead of hard-coding host service) to load from the keytab. Update call sites accordingly. Also pass the given 'ldap_uri' argument through to IPAKEMKeys because without it, the client tries to use LDAPI, but may not have access. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta --- ipapython/secrets/client.py | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) (limited to 'ipapython/secrets') diff --git a/ipapython/secrets/client.py b/ipapython/secrets/client.py index 5b671988d..56ed6f794 100644 --- a/ipapython/secrets/client.py +++ b/ipapython/secrets/client.py @@ -41,16 +41,22 @@ class CustodiaClient(object): return iSecStore(config) - def __init__(self, client, server, realm, ldap_uri=None, auth_type=None): - self.client = client - self.creds = None + def __init__( + self, client_service, keyfile, keytab, server, realm, + ldap_uri=None, auth_type=None): + self.client_service = client_service + self.keytab = keytab + + # Init creds immediately to make sure they are valid. Creds + # can also be re-inited by _auth_header to avoid expiry. + # + self.creds = self.init_creds() self.service_name = gssapi.Name('HTTP@%s' % (server,), gssapi.NameType.hostbased_service) self.server = server - keyfile = os.path.join(paths.IPA_CUSTODIA_CONF_DIR, 'server.keys') - self.ikk = IPAKEMKeys({'server_keys': keyfile}) + self.ikk = IPAKEMKeys({'server_keys': keyfile, 'ldap_uri': ldap_uri}) self.kemcli = KEMClient(self._server_keys(server, realm), self._client_keys()) @@ -61,9 +67,9 @@ class CustodiaClient(object): requests.packages.urllib3.disable_warnings() def init_creds(self): - name = gssapi.Name('host@%s' % (self.client,), + name = gssapi.Name(self.client_service, gssapi.NameType.hostbased_service) - store = {'client_keytab': paths.KRB5_KEYTAB, + store = {'client_keytab': self.keytab, 'ccache': 'MEMORY:Custodia_%s' % b64encode(os.urandom(8))} return gssapi.Credentials(name=name, store=store, usage='initiate') -- cgit