Rob Crittenden wrote:
Dmitri Pal wrote:
On 02/17/2014 04:57 PM, Rob Crittenden wrote:
Dmitri Pal wrote:
On 02/17/2014 04:13 PM, Rob Crittenden wrote:
Dmitri Pal wrote:
On 02/17/2014 02:33 PM, Rob Crittenden wrote:
Dmitri Pal wrote:
On 02/17/2014 01:21 PM, Rob Crittenden wrote:
Martin Kosek wrote:
On 02/14/2014 11:26 PM, Dmitri Pal wrote:
+1, this was exactly my goal. It is easy to name and organize
things
now,
difficult to do when it is live upstream and/or integrated with
Foreman.
I think the key for the right naming is a fact if this is really
specific to
Foreman or it is a truly general design usable also in other use
cases. If
Foreman-specific, I would go with
freeipa-server-smartproxy-host or
similar.
If general, we can go with
freeipa-server-proxy-host
freeipa-server-proxy-user
freeipa-server-proxy-dhcp
The proxies may share the framework and only expose the requested
part of the
tree - which in advance gives you an option for an API
separation, as
compared
to general freeipa-server-smartproxy.
I still don't get the point of this. Are you proposing having 3
different servers, each providing a unique service? Or one service
that one can turn on/off features, or something else? Do you
envision
this as 3 separate subpackages?
There is no "framework" in my current patch, it is a cherrypy
server
that exposes parts of IPA on a given URI. It is the thinnest of
layers.
Then it seems to make sense to have 3 different packages that
can be
optionally coninstalled and would probably share the same
principal,
keytab and local REST API socket/port.
Well, what you are designing is a central framework with plugins.
What
I designed is a quick-and-dirty get something up quickly. We need to
pick one. The plugable method is going to require a fair bit of
rework, though it will potentially pay dividends in the future.
I think that we can start where you are but drive towards this
architecture via refactoring. But we need to pick the right name now.
Even if the architecture is not there yet we should name the
package in
such way that it does not preclude us from moving towards a clean
architecture I described during the next iteration.
Just having a hard time seeing the value. This would be like making
each of the IPA plugins a separate package and somehow installing them
individually.
To do this you'd need at least 2 packages, a high level one with the
"framework" and then a separate one for each data type.
This could also be achieved, and likely more cleanly, without all
these extra packages, as a simple configuration file. Once a package,
always a package.
Maybe I'm too close to the problem, but to me this is a
Foreman-specific solution. The "smartproxy" is a Foreman creation, I
don't know that anything else is using it. If you want a RESTful
server, then we enable REST in IPA directly, but selectively enabling
and disabling APIs is not something we've done before. It has been
controlled by ACIs instead.
rob
We are trying to predict future here. Say we release it as you suggest.
Tomorrow we point someone upstream who wants to add users to IPA from a
similar proxy to this implementation and say use this as a model.
And then Rich needs the same but for DNS for Designate.
What would be the best? Rob if you knew that tomorrow two other
developers will create similar proxies for users and DNS would you
change anything? Would you provide some guidelines to them?
If you are close to the problem you should be able to at least tell
them: "copy and paste" vs. "add more APIs to the same proxy".
If your recommendation is copy and paste then I suspect there will be
challenges of running these proxies on the same machine - they will
collide on ports and sockets. If we say "extend" shouldn't we use a
more
generic name?
I'd say "use the existing IPA API". The only reason we have to write
the smartproxy at all is to interoperate with another service that
already has a well-defined remote server API which uses REST.
rob
OK, so you think that proxy is one off. OK I am fine with it.
I was under assumption that it would be a beginning of a trend but I
might be wrong as I do not have valid arguments to prove or disprove one
way or another.
I guess time would show.
Any objections to Rob's approach?
Ok, so try to summarize this long-running thread, I'll rename the
subpackage to freeipa-server-foreman-smartproxy to make it clearer what
it is/does. Right now it requires manual configuration so having the
package installed should have no negative impacts (other than
potentially pulling in additional dependencies).
I'll leave it in smartproxy for now, it's just cleaner and better
integrates with ipatests IMHO.
Foreman supports SSL client auth which is great, by cherrypy does not
yet. There is a pull request to add this,
https://bitbucket.org/cherrypy/cherrypy/pull-request/15/added-support-for-client-certificate/activity
. Foreman otherwise supports no other authentication method, so we're
blocked with this. The certs for this would initially come out of
Foreman/puppet.
I'll submit a new patch with an updated spec but I think otherwise I've
addressed the isuses Petr has raised. This thread has taken a lot of
turns so it is very possible I missed something though :-)
Updated patch based on feedback from Foreman team. I added a new URI,
/features, which Foreman uses to determine what capabilities a proxy has.
rob
>From 4facb9d8ceea6ffe07297f375bf05d9c72bc6125 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcrit...@redhat.com>
Date: Tue, 3 Dec 2013 09:14:00 -0700
Subject: [PATCH] Implement an IPA Foreman smartproxy server
This currently server supports only host and hostgroup commands for
retrieving, adding and deleting entries.
The incoming requests are completely unauthenticated and by default
requests must be local.
Utilize GSS-Proxy to manage the TGT.
Configuration information is in the ipa-smartproxy man page.
Design: http://www.freeipa.org/page/V3/Smart_Proxy
---
Makefile | 5 +-
freeipa.spec.in | 37 +++-
ipalib/util.py | 13 +-
ipatests/test_smartproxy/resttest.py | 170 +++++++++++++++
ipatests/test_smartproxy/test_features.py | 35 +++
ipatests/test_smartproxy/test_host.py | 145 +++++++++++++
ipatests/test_smartproxy/test_hostgroup.py | 97 +++++++++
smartproxy/Makefile.am | 43 ++++
smartproxy/configure.ac | 75 +++++++
smartproxy/ipa-smartproxy | 336 +++++++++++++++++++++++++++++
smartproxy/ipa-smartproxy.conf | 15 ++
smartproxy/ipa-smartproxy.logrotate | 11 +
smartproxy/ipa-smartproxy.service | 12 ++
smartproxy/man/Makefile.am | 19 ++
smartproxy/man/ipa-smartproxy.1 | 78 +++++++
smartproxy/man/ipa-smartproxy.conf.5 | 72 +++++++
16 files changed, 1156 insertions(+), 7 deletions(-)
create mode 100644 ipatests/test_smartproxy/resttest.py
create mode 100644 ipatests/test_smartproxy/test_features.py
create mode 100644 ipatests/test_smartproxy/test_host.py
create mode 100644 ipatests/test_smartproxy/test_hostgroup.py
create mode 100644 smartproxy/Makefile.am
create mode 100644 smartproxy/configure.ac
create mode 100755 smartproxy/ipa-smartproxy
create mode 100644 smartproxy/ipa-smartproxy.conf
create mode 100644 smartproxy/ipa-smartproxy.logrotate
create mode 100644 smartproxy/ipa-smartproxy.service
create mode 100644 smartproxy/man/Makefile.am
create mode 100644 smartproxy/man/ipa-smartproxy.1
create mode 100644 smartproxy/man/ipa-smartproxy.conf.5
diff --git a/Makefile b/Makefile
index af68e42b71ad12ff86cc5a0c8752e1246e565e7f..38b3e929a55b8daed10848789c96a09298cd586e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
include VERSION
-SUBDIRS=daemons install ipapython ipa-client
+SUBDIRS=daemons install ipapython ipa-client smartproxy
CLIENTDIRS=ipapython ipa-client
PRJ_PREFIX=freeipa
@@ -74,6 +74,7 @@ bootstrap-autogen: version-update client-autogen
@echo "Building IPA $(IPA_VERSION)"
cd daemons; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR) --with-openldap; fi
cd install; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
+ cd smartproxy; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
client-autogen: version-update
cd ipa-client; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
@@ -194,6 +195,7 @@ tarballs: local-archive
cd dist/$(TARBALL_PREFIX)/ipa-client; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
cd dist/$(TARBALL_PREFIX)/daemons; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
cd dist/$(TARBALL_PREFIX)/install; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
+ cd dist/$(TARBALL_PREFIX)/smartproxy; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
cd dist; tar cfz sources/$(TARBALL) $(TARBALL_PREFIX)
rm -rf dist/$(TARBALL_PREFIX)
@@ -260,5 +262,6 @@ maintainer-clean: clean
cd install && $(MAKE) maintainer-clean
cd ipa-client && $(MAKE) maintainer-clean
cd ipapython && $(MAKE) maintainer-clean
+ cd smartproxy && $(MAKE) maintainer-clean
rm -f version.m4
rm -f freeipa.spec
diff --git a/freeipa.spec.in b/freeipa.spec.in
index e851313f8121d05a8774d89687c2f7c855ea6950..d48fb5a5e0e82214fdac05d511cf9ad7dd2147f6 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -107,7 +107,7 @@ Requires: nss >= 3.14.3-12.0
Requires: nss-tools >= 3.14.3-12.0
%endif
%if 0%{?krb5_dal_version} >= 4
-Requires: krb5-server >= 1.11.5-3
+Requires: krb5-server >= 1.11.5-2
%else
%if 0%{krb5_dal_version} == 3
# krb5 1.11 bumped DAL interface major version, a rebuild is needed
@@ -218,6 +218,19 @@ Cross-realm trusts with Active Directory in IPA require working Samba 4
installation. This package is provided for convenience to install all required
dependencies at once.
+
+%package server-foreman-smartproxy
+Summary: Foreman-compatible REST API for IPA
+Group: System Environment/Base
+Requires: %{name}-client = %version-%release
+Requires: python-cherrypy
+Requires: gssproxy >= 0.3.1
+Requires: python-requests
+Requires: python-kerberos >= 1.1-14
+
+%description server-foreman-smartproxy
+A Foreman-compatible REST API for managing hosts and hostgroups.
+
%endif # ONLY_CLIENT
@@ -456,6 +469,7 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
mkdir -p %{buildroot}%{_unitdir}
install -m 644 init/systemd/ipa.service %{buildroot}%{_unitdir}/ipa.service
install -m 644 init/systemd/ipa_memcached.service %{buildroot}%{_unitdir}/ipa_memcached.service
+install -m 644 smartproxy/ipa-smartproxy.service %{buildroot}%{_unitdir}/ipa-smartproxy.service
# END
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa/backup
%endif # ONLY_CLIENT
@@ -512,6 +526,7 @@ if [ $1 = 0 ]; then
# NOTE: systemd specific section
/bin/systemctl --quiet stop ipa.service || :
/bin/systemctl --quiet disable ipa.service || :
+ /bin/systemctl --quiet stop ipa-smartproxy.service || :
# END
fi
@@ -547,6 +562,17 @@ fi
if [ $1 -eq 0 ]; then
%{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
fi
+
+%preun server-foreman-smartproxy
+if [ $1 = 0 ]; then
+ /bin/systemctl --quiet disable ipa-smartproxy.service || :
+fi
+
+%post server-foreman-smartproxy
+if [ $1 -gt 1 ] ; then
+ /bin/systemctl --system daemon-reload 2>&1 || :
+ /bin/systemctl condrestart ipa-smartproxy.service 2>&1 || :
+fi
%endif # ONLY_CLIENT
%post client
@@ -781,6 +807,15 @@ fi
%{python_sitelib}/ipaserver/dcerpc*
%{python_sitelib}/ipaserver/install/adtrustinstance*
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
+
+%files server-foreman-smartproxy
+%{_sbindir}/ipa-smartproxy
+%{_mandir}/man1/ipa-smartproxy.1.gz
+%{_mandir}/man5/ipa-smartproxy.conf.5.gz
+%attr(644,root,root) %{_unitdir}/ipa-smartproxy.service
+%config(noreplace) %{_sysconfdir}/ipa/ipa-smartproxy.conf
+%config(noreplace)%{_sysconfdir}/logrotate.d/ipa-smartproxy
+
%endif # ONLY_CLIENT
%files client
diff --git a/ipalib/util.py b/ipalib/util.py
index fcc4b1591e11365a98094019e8e9f5b87d214f75..89c0680087f840e90c0449d80b304fe3dcafe4a3 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -57,12 +57,15 @@ def json_serialize(obj):
def get_current_principal():
try:
- # krbV isn't necessarily available on client machines, fail gracefully
- import krbV
- return unicode(krbV.default_context().default_ccache().principal().name)
+ import kerberos
+ rc, vc = kerberos.authGSSClientInit("notempty")
+ rc = kerberos.authGSSClientInquireCred(vc)
+ username = kerberos.authGSSClientUserName(vc)
+ kerberos.authGSSClientClean(vc)
+ return unicode(username)
except ImportError:
- raise RuntimeError('python-krbV is not available.')
- except krbV.Krb5Error:
+ raise RuntimeError('python-kerberos is not available.')
+ except kerberos.GSSError, e:
#TODO: do a kinit?
raise errors.CCacheError()
diff --git a/ipatests/test_smartproxy/resttest.py b/ipatests/test_smartproxy/resttest.py
new file mode 100644
index 0000000000000000000000000000000000000000..dc355471fc356da10fdcc2df2b6624dd0ddfb6a8
--- /dev/null
+++ b/ipatests/test_smartproxy/resttest.py
@@ -0,0 +1,170 @@
+# Authors:
+# Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014 Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+"""
+Base class for all REST tests
+"""
+
+import requests
+import json
+import nose
+from ipatests.util import assert_deepequal, Fuzzy
+from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_uuid, fuzzy_password
+
+FQDN = 'localhost'
+PORT = 8090
+
+EXPECTED = """Expected %r to raise %s.
+ options = %r
+ output = %r"""
+
+UNEXPECTED = """Expected %r to raise %s, but caught different.
+ options = %r
+ %s: %s"""
+
+try:
+ response = requests.get(
+ 'http://%s:%d/ipa/smartproxy/host/host.example.com' % (FQDN, PORT),
+ data={})
+ server_available = True
+except requests.ConnectionError:
+ server_available = False
+
+
+class REST_test(object):
+ """
+ Base class for all REST tests
+
+ A Declarative test suite is controlled by the ``tests`` and
+ ``cleanup`` class variables.
+
+ The ``tests`` is a list of dictionaries with the following keys:
+
+ ``desc``
+ A name/description of the test
+ ``command``
+ A (command, args, kwargs) triple specifying the command to run
+ ``expected``
+ Can be either an ``errors.PublicError`` instance, in which case
+ the command must fail with the given error; or the
+ expected result.
+ The result is checked with ``tests.util.assert_deepequal``.
+ ``extra_check`` (optional)
+ A checking function that is called with the response. It must
+ return true for the test to pass.
+
+ The ``cleanup`` is a list of (command, args, kwargs)
+ triples. These are commands get run both before and after tests,
+ and must not fail.
+ """
+
+ cleanup = tuple()
+ tests = tuple()
+
+ @classmethod
+ def setUpClass(cls):
+ if not server_available:
+ raise nose.SkipTest('%r: Server not available' %
+ cls.__module__)
+
+ def cleanup_generate(self, stage):
+ for (i, request) in enumerate(self.cleanup):
+ func = lambda: self.run_cleanup(request)
+ func.description = '%s %s-cleanup[%d]: %r' % (
+ self.__class__.__name__, stage, i, request
+ )
+ yield (func,)
+
+ def make_request(self, method, uri, data=None):
+ request = method('http://%s:%d%s' % (FQDN, PORT, uri), data=data)
+ return request
+
+ def run_cleanup(self, request):
+ (uri, data) = request
+ try:
+ result = self.make_request(requests.delete, uri, data)
+ assert request.status_code in [401, 201, 200]
+ except Exception:
+ pass
+
+ def test_generator(self):
+ """
+ Iterate through tests.
+
+ nose reports each one as a separate test.
+ """
+
+ # Iterate through pre-cleanup:
+ for tup in self.cleanup_generate('pre'):
+ yield tup
+
+ # Iterate through the tests:
+ name = self.__class__.__name__
+ for (i, test) in enumerate(self.tests):
+ nice = '%s[%d]: %s: %s' % (
+ name, i, test['request'][0], test.get('desc', '')
+ )
+ func = lambda: self.check(nice, **test)
+ func.description = nice
+ yield (func,)
+
+ # Iterate through post-cleanup:
+ for tup in self.cleanup_generate('post'):
+ yield tup
+
+ def check(self, nice, desc, request, method, expected_status, expected):
+ (uri, data) = request
+ if isinstance(expected, Exception):
+ self.check_exception(nice, method, uri, data, expected)
+ else:
+ self.check_result(nice,
+ method,
+ uri,
+ data,
+ expected_status,
+ expected)
+
+ def check_exception(self, nice, method, uri, data, expected):
+ klass = expected.__class__
+ name = klass.__name__
+ try:
+ output = self.make_request(method, uri, data)
+ except StandardError, e:
+ pass
+ else:
+ raise AssertionError(
+ EXPECTED % (uri, name, method, data, output)
+ )
+ if not isinstance(e, klass):
+ raise AssertionError(
+ UNEXPECTED % (uri, name, method, data, e.__class__.__name__, e)
+ )
+
+ def check_result(self, nice, method, uri, data, expected_status, expected):
+ request = self.make_request(method, uri, data)
+ assert expected_status == request.status_code
+
+ if request.status_code in [200, 201]:
+ try:
+ data = json.loads(request.text)
+ except ValueError, e:
+ raise AssertionError(
+ 'Could not parse JSON: %s' % e
+ )
+ assert_deepequal(expected, data, nice)
diff --git a/ipatests/test_smartproxy/test_features.py b/ipatests/test_smartproxy/test_features.py
new file mode 100644
index 0000000000000000000000000000000000000000..9c32c0c332763c6b28d8b08e1b8b635bcf88696e
--- /dev/null
+++ b/ipatests/test_smartproxy/test_features.py
@@ -0,0 +1,35 @@
+# Authors:
+# Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014 Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from resttest import REST_test
+import requests
+
+class test_feature(REST_test):
+
+ tests = [
+
+ dict(
+ desc='Get supported features',
+ request=('/features', {}),
+ method=requests.get,
+ expected_status=200,
+ expected=[u'realm'],
+ ),
+
+ ]
diff --git a/ipatests/test_smartproxy/test_host.py b/ipatests/test_smartproxy/test_host.py
new file mode 100644
index 0000000000000000000000000000000000000000..6dc90de535ba2f22fcd2529006659818b9d49226
--- /dev/null
+++ b/ipatests/test_smartproxy/test_host.py
@@ -0,0 +1,145 @@
+# Authors:
+# Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014 Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from ipalib import api
+from ipapython.dn import DN
+from resttest import REST_test, fuzzy_uuid, fuzzy_password
+from ipatests.test_xmlrpc import objectclasses
+import requests
+
+fqdn1 = u'testhost.example.com'
+dn1 = DN(('fqdn',fqdn1),('cn','computers'),('cn','accounts'),
+ api.env.basedn)
+fqdn2 = u'testhost2.example.com'
+dn2 = DN(('fqdn',fqdn2),('cn','computers'),('cn','accounts'),
+ api.env.basedn)
+
+class test_host(REST_test):
+
+ cleanup = [
+ ('/ipa/smartproxy/host/%s' % fqdn1, {}),
+ ('/ipa/smartproxy/host/%s' % fqdn2, {}),
+ ]
+
+ tests = [
+
+ dict(
+ desc='Get a non-existent host',
+ request=('/ipa/smartproxy/host/notfound', {}),
+ method=requests.get,
+ expected_status=404,
+ expected={},
+ ),
+
+ dict(
+ desc='Create a host',
+ request=('/ipa/smartproxy/host', {'hostname': fqdn1}),
+ method=requests.post,
+ expected_status=201,
+ expected=dict(
+ dn=dn1,
+ has_keytab=False,
+ krbprincipalname= [u'host/%s@%s' % (fqdn1, api.env.realm)],
+ objectclass=objectclasses.host,
+ fqdn=[fqdn1],
+ has_password=False,
+ ipauniqueid=[fuzzy_uuid],
+ managedby_host=[fqdn1],
+ ),
+ ),
+
+ dict(
+ desc='Get the host',
+ request=('/ipa/smartproxy/host/%s' % fqdn1, {}),
+ method=requests.get,
+ expected_status=200,
+ expected=dict(
+ dn=dn1,
+ has_keytab=False,
+ fqdn=[u'testhost.example.com'],
+ has_password=False,
+ managedby_host=[fqdn1],
+ krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
+ ),
+ ),
+
+ dict(
+ desc='Add a duplicate host',
+ request=('/ipa/smartproxy/host', {'hostname': fqdn1}),
+ method=requests.post,
+ expected_status=400,
+ expected={},
+ ),
+
+ dict(
+ desc='Remove the host',
+ request=('/ipa/smartproxy/host/%s' % fqdn1, {}),
+ method=requests.delete,
+ expected_status=200,
+ expected=dict(failed=u''),
+ ),
+
+ dict(
+ desc='Create a host with a random password',
+ request=('/ipa/smartproxy/host', {'hostname': fqdn1, 'random': True}),
+ method=requests.post,
+ expected_status=201,
+ expected=dict(
+ dn=dn1,
+ has_keytab=False,
+ objectclass=[u'ipasshhost', u'ipaSshGroupOfPubKeys',
+ u'ieee802device', u'ipaobject',
+ u'nshost', u'ipahost', u'pkiuser',
+ u'ipaservice', u'top',],
+ fqdn=[fqdn1],
+ has_password=True,
+ ipauniqueid=[fuzzy_uuid],
+ randompassword=fuzzy_password,
+ managedby_host=[fqdn1],
+ ),
+ ),
+
+ dict(
+ desc='Create a host with a fixed password',
+ request=('/ipa/smartproxy/host', {'hostname': fqdn2, 'password': 'Secret123'}),
+ method=requests.post,
+ expected_status=201,
+ expected=dict(
+ dn=dn2,
+ has_keytab=False,
+ objectclass=[u'ipasshhost', u'ipaSshGroupOfPubKeys',
+ u'ieee802device', u'ipaobject',
+ u'nshost', u'ipahost', u'pkiuser',
+ u'ipaservice', u'top',],
+ fqdn=[fqdn2],
+ has_password=True,
+ ipauniqueid=[fuzzy_uuid],
+ managedby_host=[fqdn2],
+ ),
+ ),
+
+ dict(
+ desc='Remove a non-existent host',
+ request=('/ipa/smartproxy/host/notfound', {}),
+ method=requests.delete,
+ expected_status=404,
+ expected={},
+ ),
+
+ ]
diff --git a/ipatests/test_smartproxy/test_hostgroup.py b/ipatests/test_smartproxy/test_hostgroup.py
new file mode 100644
index 0000000000000000000000000000000000000000..ec2daab5c2eb012768c49e14b5d8375b42ca6ac7
--- /dev/null
+++ b/ipatests/test_smartproxy/test_hostgroup.py
@@ -0,0 +1,97 @@
+# Authors:
+# Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014 Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from ipalib import api
+from ipapython.dn import DN
+from resttest import REST_test, fuzzy_uuid
+from ipatests.test_xmlrpc import objectclasses
+import requests
+
+hostgroup1 = u'testhostgroup'
+dn1 = DN(('cn', hostgroup1),('cn','hostgroups'),('cn','accounts'),
+ api.env.basedn)
+
+class test_hostgroup(REST_test):
+
+ cleanup = [
+ ('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+ ]
+
+ tests = [
+
+ dict(
+ desc='Get a non-existent hostgroup',
+ request=('/ipa/smartproxy/hostgroup/notfound', {}),
+ method=requests.get,
+ expected_status=404,
+ expected={},
+ ),
+
+ dict(
+ desc='Create a hostgroup',
+ request=('/ipa/smartproxy/hostgroup', {'name': hostgroup1, 'description': u'test'}),
+ method=requests.post,
+ expected_status=201,
+ expected=dict(
+ dn=dn1,
+ cn=[hostgroup1],
+ objectclass=objectclasses.hostgroup,
+ description=[u'test'],
+ mepmanagedentry=[DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),
+ api.env.basedn)],
+ ipauniqueid=[fuzzy_uuid],
+ ),
+ ),
+
+ dict(
+ desc='Get the hostgroup',
+ request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+ method=requests.get,
+ expected_status=200,
+ expected=dict(
+ dn=dn1,
+ cn=[u'testhostgroup'],
+ description=[u'test'],
+ ),
+ ),
+
+ dict(
+ desc='Add a duplicate hostgroup',
+ request=('/ipa/smartproxy/hostgroup', {'name': hostgroup1, 'description': u'test'}),
+ method=requests.post,
+ expected_status=400,
+ expected={},
+ ),
+
+ dict(
+ desc='Remove the hostgroup',
+ request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+ method=requests.delete,
+ expected_status=200,
+ expected=dict(failed=u''),
+ ),
+
+ dict(
+ desc='Remove a non-existent hostgroup',
+ request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+ method=requests.delete,
+ expected_status=404,
+ expected={},
+ ),
+ ]
diff --git a/smartproxy/Makefile.am b/smartproxy/Makefile.am
new file mode 100644
index 0000000000000000000000000000000000000000..8d680625fd7e943ac6f61f406e9fc4fe9eb13f3f
--- /dev/null
+++ b/smartproxy/Makefile.am
@@ -0,0 +1,43 @@
+# This file will be processed with automake-1.7 to create Makefile.in
+
+AUTOMAKE_OPTIONS = 1.7
+
+NULL =
+
+etcdir = $(IPA_SYSCONF_DIR)
+etc_DATA = \
+ ipa-smartproxy.conf \
+ $(NULL)
+
+sbin_SCRIPTS = \
+ ipa-smartproxy \
+ $(NULL)
+
+rotatedir = $(LOGROTATE_DIR)
+rotate_DATA = \
+ ipa-smartproxy.logrotate \
+ $(NULL)
+
+SUBDIRS = \
+ man \
+ $(NULL)
+
+EXTRA_DIST = \
+ $(etc_DATA) \
+ $(rotate_DATA) \
+ $(NULL)
+
+DISTCLEANFILES = \
+ $(NULL)
+
+MAINTAINERCLEANFILES = \
+ *~ \
+ aclocal.m4 \
+ configure \
+ install-sh \
+ missing \
+ Makefile.in \
+ $(NULL)
+
+install-data-hook:
+ mv $(DESTDIR)/$(LOGROTATE_DIR)/ipa-smartproxy.logrotate $(DESTDIR)/$(LOGROTATE_DIR)/ipa-smartproxy
diff --git a/smartproxy/configure.ac b/smartproxy/configure.ac
new file mode 100644
index 0000000000000000000000000000000000000000..5908a7f13bc7d19df4e3086b42a176167b5c2546
--- /dev/null
+++ b/smartproxy/configure.ac
@@ -0,0 +1,75 @@
+AC_PREREQ(2.59)
+m4_include(../version.m4)
+AC_INIT([ipa-server],
+ IPA_VERSION,
+ [https://hosted.fedoraproject.org/projects/freeipa/newticket])
+
+AM_INIT_AUTOMAKE([foreign])
+
+AM_MAINTAINER_MODE
+
+AC_SUBST(VERSION)
+AC_SUBST([INSTALL_DATA], ['$(INSTALL) -m 644 -p'])
+
+AC_PROG_MKDIR_P
+AC_PROG_AWK
+AC_PROG_SED
+
+AC_PATH_PROG(XGETTEXT, xgettext, [no])
+if test "x$XGETTEXT" = "xno"; then
+ AC_MSG_ERROR([xgettext not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGFMT, msgfmt, [no])
+if test "x$MSGFMT" = "xno"; then
+ AC_MSG_ERROR([msgfmt not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGINIT, msginit, [no])
+if test "x$MSGINIT" = "xno"; then
+ AC_MSG_ERROR([msginit not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGMERGE, msgmerge, [no])
+if test "x$MSGMERGE" = "xno"; then
+ AC_MSG_ERROR([msgmerge not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGCMP, msgcmp, [no])
+if test "x$MSGCMP" = "xno"; then
+ AC_MSG_ERROR([msgcmp not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGATTRIB, msgattrib, [no])
+if test "x$MSGATTRIB" = "xno"; then
+ AC_MSG_ERROR([msgattrib not found, install gettext])
+fi
+
+AC_PATH_PROG(TX, tx, [/usr/bin/tx])
+
+AC_ARG_WITH([gettext_domain],
+ [AS_HELP_STRING([--with-gettext-domain=name],
+ [set the name of the i18n message catalog])],
+ [],
+ [with_gettext_domain=ipa])
+AC_SUBST(GETTEXT_DOMAIN, $with_gettext_domain)
+
+dnl ---------------------------------------------------------------------------
+dnl - Set the data install directory since we don't use pkgdatadir
+dnl ---------------------------------------------------------------------------
+
+IPA_DATA_DIR="$datadir/ipa"
+IPA_SYSCONF_DIR="$sysconfdir/ipa"
+LOGROTATE_DIR="$sysconfdir/logrotate.d"
+AC_SUBST(IPA_DATA_DIR)
+AC_SUBST(IPA_SYSCONF_DIR)
+AC_SUBST(LOGROTATE_DIR)
+
+# Files
+
+AC_CONFIG_FILES([
+ Makefile
+ man/Makefile
+])
+
+AC_OUTPUT
diff --git a/smartproxy/ipa-smartproxy b/smartproxy/ipa-smartproxy
new file mode 100755
index 0000000000000000000000000000000000000000..d5e8f227a2199d789b804188f353d3293cd7d662
--- /dev/null
+++ b/smartproxy/ipa-smartproxy
@@ -0,0 +1,336 @@
+#!/usr/bin/python2 -E
+#
+# Authors:
+# Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014 Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+import os
+import cherrypy
+import json
+import syslog
+import pwd
+from optparse import OptionParser
+from functools import wraps
+from cherrypy import response
+from cherrypy.process import plugins
+from ipalib import api
+from ipalib import errors
+from ipalib import util
+from ipaserver.rpcserver import json_encode_binary
+from ipapython.version import VERSION
+
+
+def jsonout(func):
+ '''JSON output decorator'''
+ @wraps(func)
+ def wrapper(*args, **kw):
+ value = func(*args, **kw)
+ response.headers["Content-Type"] = "application/json;charset=utf-8"
+ data = json_encode_binary(value)
+ return json.dumps(data, sort_keys=True, indent=2)
+
+ return wrapper
+
+
+def handle_error(status, message, traceback, version):
+ """
+ Return basic messages to user and log backtrace in case of 500
+ error.
+ """
+ if status.startswith('500'):
+ cherrypy.log(msg=message + '\n', context='IPA', traceback=True)
+
+ resp = cherrypy.response
+ resp.headers['Content-Type'] = 'application/json'
+ return json.dumps({'status': status, 'message': message})
+
+
+def convert_unicode(value):
+ """
+ IPA requires all incoming values to be unicode. Recursively
+ convert the values.
+ """
+ if not isinstance(value, basestring):
+ return value
+
+ if value is not None:
+ return unicode(value)
+ else:
+ return None
+
+
+def Command(command, *args, **options):
+ if (cherrypy.request.config.get('local_only', False) and
+ cherrypy.request.remote.ip not in ['::1', '127.0.0.1']):
+ raise IPAError(
+ status=401,
+ message="Not a local request"
+ )
+
+ if not api.Backend.rpcclient.isconnected():
+ api.Backend.rpcclient.connect()
+ try:
+ if not api.Backend.rpcclient.isconnected():
+ api.Backend.rpcclient.connect()
+ except errors.CCacheError, e:
+ raise IPAError(
+ status=401,
+ message=e
+ )
+
+ # IPA wants all its strings as unicode
+ args = map(lambda v: convert_unicode(v), args)
+ options = dict(zip(options, map(convert_unicode, options.values())))
+
+ params = api.Command[command].args_options_2_params(*args, **options)
+ cherrypy.log(context='IPA', msg='%s(%s)' %
+ (command, ', '.join(api.Command[command]._repr_iter(**params))))
+ try:
+ return api.Command[command](*args, **options)['result']
+ except (errors.DuplicateEntry, errors.DNSNotARecordError,
+ errors.ValidationError, errors.ConversionError,) as e:
+ raise IPAError(
+ status=400,
+ message=e
+ )
+ except errors.ACIError, e:
+ raise IPAError(
+ status=401,
+ message=e
+ )
+ except errors.NotFound, e:
+ raise IPAError(
+ status=404,
+ message=e
+ )
+ except Exception, e:
+ raise IPAError(
+ status=500,
+ message=e
+ )
+
+
+@jsonout
+def GET(command, *args, **options):
+ return Command(command, *args, **options)
+
+
+@jsonout
+def POST(command, *args, **options):
+ cherrypy.response.status = 201
+ return Command(command, *args, **options)
+
+
+@jsonout
+def DELETE(command, *args, **options):
+ return Command(command, *args, **options)
+
+
+class IPAError(cherrypy.HTTPError):
+ """
+ Return errors in IPA-style json.
+
+ Local errors are treated as strings so do not include the code and
+ name attributes within the error dict.
+
+ This is not padded for IE.
+ """
+
+ def set_response(self):
+ response = cherrypy.serving.response
+
+ cherrypy._cperror.clean_headers(self.code)
+
+ # In all cases, finalize will be called after this method,
+ # so don't bother cleaning up response values here.
+ response.status = self.status
+
+ if isinstance(self._message, Exception):
+ error = {'code': self._message.errno,
+ 'message': self._message.message,
+ 'name': self._message.__class__.__name__}
+ elif isinstance(self._message, basestring):
+ error = {'message': self._message}
+ else:
+ error = {'message':
+ 'Unable to handle error message type %s' % type(self._message)}
+
+ response.body = json.dumps({'error': error,
+ 'id': 0,
+ 'principal': util.get_current_principal(),
+ 'result': None,
+ 'version': VERSION},
+ sort_keys=True, indent=2)
+
+
+class Host(object):
+
+ exposed = True
+
+ def GET(self, fqdn=None):
+
+ if fqdn is None:
+ command = 'host_find'
+ else:
+ command = 'host_show'
+
+ return GET(command, fqdn)
+
+ def POST(self, hostname, description=None, random=False,
+ macaddress=None, userclass=None, ip_address=None,
+ password=None):
+ return POST('host_add', hostname,
+ description=description, random=random,
+ force=True, macaddress=macaddress,
+ userclass=userclass, ip_address=ip_address,
+ userpassword=password)
+
+ def DELETE(self, fqdn):
+ return DELETE('host_del', fqdn)
+
+
+class Hostgroup(object):
+
+ exposed = True
+
+ def GET(self, name=None):
+
+ if name is None:
+ command = 'hostgroup_find'
+ else:
+ command = 'hostgroup_show'
+
+ return GET(command, name)
+
+ def POST(self, name=None, description=None):
+ cherrypy.response.status = 201
+ return POST('hostgroup_add', name,
+ description=description,)
+
+ def DELETE(self, name):
+ return DELETE('hostgroup_del', name)
+
+class Features(object):
+ exposed = True
+
+ def GET(self):
+ return '["realm"]'
+
+
+def start(config=None, daemonize=False, pidfile=None):
+ # Set the umask so only the owner can read the log files
+ old_umask = os.umask(077)
+
+ cherrypy.tree.mount(
+ Features(), '/features',
+ {'/':
+ {'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
+ }
+ )
+ cherrypy.tree.mount(
+ Host(), '/ipa/smartproxy/host',
+ {'/':
+ {'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
+ }
+ )
+ cherrypy.tree.mount(
+ Hostgroup(), '/ipa/smartproxy/hostgroup',
+ {'/':
+ {'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
+ }
+ )
+
+ api.bootstrap(context='ipasmartproxy')
+ api.finalize()
+
+ # Register the domain for requests from Foreman
+ cherrypy.tree.mount(
+ Host(), '/realm/%s' % api.env.domain,
+ {'/':
+ {'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
+ }
+ )
+
+ for c in config or []:
+ try:
+ cherrypy.config.update(c)
+ except (IOError, OSError), e:
+ cherrypy.log(msg="Exception trying to load %s: %s" % (c, e),
+ context='IPA', traceback=False)
+ return 1
+
+ # Log files are created, reset umask
+ os.umask(old_umask)
+
+ user = cherrypy.config.get('user', None)
+ if user is None:
+ cherrypy.log(msg="User is required", context='IPA', traceback=False)
+ return 1
+ pent = pwd.getpwnam(user)
+
+ if daemonize:
+ cherrypy.config.update({'log.screen': False})
+ plugins.Daemonizer(cherrypy.engine).subscribe()
+
+ if pidfile:
+ plugins.PIDFile(cherrypy.engine, pidfile).subscribe()
+
+ cherrypy.engine.signal_handler.subscribe()
+
+ cherrypy.config.update({'error_page.500': handle_error})
+
+ # If you don't use GSS-Proxy you're on your own in ensuring that
+ # there is always a valid ticket for the smartproxy to use.
+ if cherrypy.config.get('use_gssproxy', False):
+ cherrypy.log(msg="Enabling GSS-Proxy", context='IPA')
+ os.environ['GSS_USE_PROXY'] = '1'
+
+ if os.geteuid() == 0:
+ cherrypy.log(msg="Dropping root privileges to %s" % user,
+ context='IPA')
+ plugins.DropPrivileges(cherrypy.engine,
+ uid=pent.pw_uid,
+ gid=pent.pw_gid).subscribe()
+
+ try:
+ cherrypy.engine.start()
+ except Exception:
+ return 1
+ else:
+ cherrypy.engine.block()
+
+ return 0
+
+if __name__ == '__main__':
+ p = OptionParser()
+ p.add_option('-c', '--config', action="append", dest='config',
+ help="specify config file(s)")
+ p.add_option('-d', action="store_true", dest='daemonize',
+ help="run the server as a daemon")
+ p.add_option('-p', '--pidfile', dest='pidfile', default=None,
+ help="store the process id in the given file")
+ options, args = p.parse_args()
+
+ try:
+ sys.exit(start(options.config, options.daemonize, options.pidfile))
+ except Exception, e:
+ cherrypy.log(msg="Exception trying to start: %s" % e,
+ context='IPA',
+ traceback=True)
+ syslog.syslog(syslog.LOG_ERR, "Exception trying to start: %s" % e)
diff --git a/smartproxy/ipa-smartproxy.conf b/smartproxy/ipa-smartproxy.conf
new file mode 100644
index 0000000000000000000000000000000000000000..a5f81433bf7c3ee9934691fef6f6fddf9c5c853d
--- /dev/null
+++ b/smartproxy/ipa-smartproxy.conf
@@ -0,0 +1,15 @@
+[global]
+server.socket_port: 8090
+#server.socket_host: 'server.example.com'
+
+log.access_file: '/var/log/ipa-smartproxy.access'
+log.error_file: '/var/log/ipa-smartproxy.errors'
+
+request.show_tracebacks: False
+
+# Only handle requests on 127.0.0.1 or ::1
+local_only: True
+
+use_gssproxy: True
+
+user: 'apache'
diff --git a/smartproxy/ipa-smartproxy.logrotate b/smartproxy/ipa-smartproxy.logrotate
new file mode 100644
index 0000000000000000000000000000000000000000..12e25164cd5dea23a219422e20ea07c03a6c9a8e
--- /dev/null
+++ b/smartproxy/ipa-smartproxy.logrotate
@@ -0,0 +1,11 @@
+/var/log/ipa-smartproxy.access /var/log/ipa-smartproxy.errors {
+ weekly
+ missingok
+ notifempty
+ sharedscripts
+ rotate 52
+ compress
+ postrotate
+ /bin/systemctl reload ipa-smartproxy.service > /dev/null 2>/dev/null || true
+ endscript
+}
diff --git a/smartproxy/ipa-smartproxy.service b/smartproxy/ipa-smartproxy.service
new file mode 100644
index 0000000000000000000000000000000000000000..544f55b1369943c3919f5cb61a9f3bc2d784043d
--- /dev/null
+++ b/smartproxy/ipa-smartproxy.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=IPA smartproxy for Foreman
+After=ipa.target
+
+[Service]
+ExecStart=/usr/sbin/ipa-smartproxy -c /etc/ipa/ipa-smartproxy.conf -d -p /var/run/ipa-smartproxy.pid
+ExecReload=/bin/kill -USR1 $MAINPID
+Type=forking
+PIDFile=/var/run/ipa-smartproxy.pid
+
+[Install]
+WantedBy=multi-user.target
diff --git a/smartproxy/man/Makefile.am b/smartproxy/man/Makefile.am
new file mode 100644
index 0000000000000000000000000000000000000000..6626b3cb23ab2520543ef496ec32a939d310ae66
--- /dev/null
+++ b/smartproxy/man/Makefile.am
@@ -0,0 +1,19 @@
+# This file will be processed with automake-1.7 to create Makefile.in
+
+AUTOMAKE_OPTIONS = 1.7
+
+NULL =
+
+man1_MANS = \
+ ipa-smartproxy.1
+
+man5_MANS = \
+ ipa-smartproxy.conf.5
+
+install-data-hook:
+ @for i in $(man1_MANS) ; do gzip -f $(DESTDIR)$(man1dir)/$$i ; done
+ @for i in $(man5_MANS) ; do gzip -f $(DESTDIR)$(man5dir)/$$i ; done
+
+MAINTAINERCLEANFILES = \
+ Makefile.in \
+ $(NULL)
diff --git a/smartproxy/man/ipa-smartproxy.1 b/smartproxy/man/ipa-smartproxy.1
new file mode 100644
index 0000000000000000000000000000000000000000..beebeb21e6e07dbc30e4409b7db51ddffd997217
--- /dev/null
+++ b/smartproxy/man/ipa-smartproxy.1
@@ -0,0 +1,78 @@
+.\" A man page for ipa-smartproxy
+.\" Copyright (C) 2014 Red Hat, Inc.
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of the GNU General Public License as published by
+.\" the Free Software Foundation, either version 3 of the License, or
+.\" (at your option) any later version.
+.\"
+.\" This program is distributed in the hope that it will be useful, but
+.\" WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+.\" General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
+.\"
+.\" Author: Rob Crittenden <rcrit...@redhat.com>
+.TH "ipa-smartproxy" "1" "Jan 8 2014" "FreeIPA" "FreeIPA Manual Pages"
+.SH "NAME"
+ipa\-smartproxy \- IPA Foreman Smartproxy server
+.SH "SYNOPSIS"
+ipa\-smartproxy [\fIOPTION\fR]...
+.SH "DESCRIPTION"
+A CherryPy\-based server that provides a RESTful API for a use as a Foreman smart proxy.
+
+The RESTful interface is not authenticated so it is expected that the server is not generally accessible. By default it listens only on the localhost interface.
+
+The server needs access to an principal that is granted permission to perform host and hostgroup operations on an IPA master.
+
+Smartproxy server\-specific privileges and roles can be created with this:
+
+.na
+ $ ipa privilege\-add 'Smartproxy host management' \-\-desc='Smartproxy host management'
+ $ ipa privilege\-add\-permission 'Smartproxy host management' \-\-permission='add hosts' \-\-permission='remove hosts'
+ $ ipa role\-add 'Smartproxy management' \-\-desc='Smartproxy management'
+ $ ipa role\-add\-privilege 'Smartproxy management' \-\-privilege='Smartproxy host management' \-\-privilege='Host Group Administrators'
+
+Create a host or user whose credentials will be used by the server to make requests and add it to the role:
+
+ $ ipa user\-add \-\-first=Smartproxy \-\-last=Serversmartproxy
+ $ ipa role\-add\-member \-\-users=smartproxy 'Smartproxy management'
+
+On the smartproxy server create a keytab for this user:
+
+ # kinit admin
+ # ipa\-getkeytab \-s ipa.example.com \-p smartpr...@example.com \-k /etc/ipa/ipa\-smartproxy.keytab
+ # chown root:root /etc/ipa/ipa\-smartproxy.keytab
+ # chmod 600 /etc/ipa/ipa\-smartproxy.keytab
+
+Configure the GSS\-Proxy to manage the credentials. Add this to the top of the gssproxy configuration file (by default /etc/gssproxy/gssproxy.conf), before any other services:
+
+ [service/smartproxy]
+ mechs = krb5
+ cred_store = client_keytab:/etc/ipa/ipa\-smartproxy.keytab
+ cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
+ cred_usage = initiate
+ euid = 48 (where 48 is the apache user uid)
+
+Some startup and operational errors may also be logged to the syslog.
+.SH "OPTIONS"
+.TP
+\fB\-c\fR \fICONFIG\fR
+The configuration file(s) to be loaded. This option may be passed multiple times to load more than one configuration file.
+.TP
+\fB\-d\fR
+Run the server as a daemon.
+.TP
+\fB\-p\fR \fIPIDFILE\fR
+The location to write the server PID file.
+.TP
+\fB\-h\fR
+Show the help message.
+.SH "EXIT STATUS"
+0 if the server execution was successful
+
+1 if an error occurred
+.SH "SEE ALSO"
+.BR ipa\-smartproxy.conf(5)
diff --git a/smartproxy/man/ipa-smartproxy.conf.5 b/smartproxy/man/ipa-smartproxy.conf.5
new file mode 100644
index 0000000000000000000000000000000000000000..ad87752343df13ca4133662f18abeb342551b956
--- /dev/null
+++ b/smartproxy/man/ipa-smartproxy.conf.5
@@ -0,0 +1,72 @@
+.\" A man page for ipa-smartproxy.conf
+.\" Copyright (C) 2014 Red Hat, Inc.
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of the GNU General Public License as published by
+.\" the Free Software Foundation, either version 3 of the License, or
+.\" (at your option) any later version.
+.\"
+.\" This program is distributed in the hope that it will be useful, but
+.\" WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+.\" General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
+.\"
+.\" Author: Rob Crittenden <rcritten@@redhat.com>
+.\"
+.TH "ipa-smartproxy.conf" "5" "Jan 8 2014" "FreeIPA" "FreeIPA Manual Pages"
+.SH "NAME"
+ipa\-smartproxy.conf \- IPA Smartproxy server configuration file
+.SH "SYNOPSIS"
+/etc/ipa/ipa\-smartproxy.conf
+.SH "DESCRIPTION"
+The \fIipa\-smartproxy.conf \fRconfiguration file is used to set system\-wide defaults to be applied when running the IPA Foreman Smartproxy server.
+.SH "SYNTAX"
+The configuration options are not case sensitive. The values may be case sensitive, depending on the option.
+
+Blank lines are ignored.
+
+Lines beginning with # are comments and are ignored.
+
+Valid lines consist of an option name, an equals sign and a value. Spaces surrounding equals sign are ignored. An option terminates at the end of a line.
+
+The value is a Python object so needs to adhere to Python rules. If the value should be an integer then it needs to be passed as an integer (like port). If the value is a string then it must be quoted.
+
+Options must appear in the section named [global]. There are no other sections defined or used currently.
+
+Options may be defined that are not used by the IPA Foreman Smartproxy server. Be careful of misspellings, they will not be rejected.
+.SH "OPTIONS"
+The server runs using the CherryPy so all the CherryPy configuration options are valid. Here are some common ones.
+
+.TP
+.B server.socket_port\fR <port>
+Port for the server to listen on. The default port is 8090.
+.TP
+.B server.socket_host\fR <host>
+If not specified then the server will listen on localhost. This is the expected mode. Specifiy a hostname or IP address to listen on another address. See also the .B local_only\fR option if setting this to something other than a local address.
+.TP
+.B log.access_file\fR <path>
+Path to the server access log
+.TP
+.B log.error_file\fR <path>
+Path to the server error log
+.TP
+.B request.show_tracebacks\fR <boolean>
+Display tracebacks to the client when errors occur. Errors will always log on the server side. The default is False.
+.TP
+.B local_only\fR <boolean>
+If True then requires that all requests be local. It is not recommended that this be enabled because this server accepts unathenticated requests to manage IPA entries.
+.TP
+.B use_gssproxy\fR <boolean>
+When True uses the gss\-proxy service to manage the Kerberos credentials needed to make IPA requests. If False then the user must ensure that the process has the right Kerberos credentials to make IPA requests.
+.TP
+.B user\fR <user>
+The user to run the server as. Required.
+.SH "FILES"
+.TP
+.I /etc/ipa/ipa\-smartproxy.conf
+IPA Foreman Smartproxy server configuration file
+.SH "SEE ALSO"
+.BR ipa\-smartproxy (1)
--
1.8.5.3
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
