On 11.12.2015 17:24, Martin Basti wrote:
On 11.12.2015 15:00, Jan Cholasta wrote:
On 10.12.2015 09:51, Jan Cholasta wrote:
Hi,
the attached patches fix <https://fedorahosted.org/freeipa/ticket/5399>.
My patches 523-525 are required for this:
<https://www.redhat.com/archives/freeipa-devel/2015-December/msg00312.html>.
Honza
Rebased patches attached.
Patch works for me, but can you provide explanations (and update commit
message) why the ACI change is needed:
* why it is moved three ACIs from 'cn="$SUFFIX",cn=mapping
tree,cn=config' to 'cn=mapping tree,cn=config'
So that they apply to all replication agreements.
* why you removed completely 'dn: cn=o\3Dipaca,cn=mapping tree,cn=config'
I didn't, they were moved to cn=mapping tree,cn=config as well.
Updated patches attached.
--
Jan Cholasta
From 730b9c2f5693020272a7458b9540366bca56b430 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jchol...@redhat.com>
Date: Wed, 9 Dec 2015 10:31:18 +0100
Subject: [PATCH 1/2] aci: merge domain and CA suffix replication agreement
ACIs
Merge the two identical sets of replication agreement permission ACIs for
the domain and CA suffixes into a single set suitable for replication
agreements for both suffixes. This makes the replication agreement
permissions behave correctly during CA replica install, so that any
non-admin user with the proper permissions (such as members of the
ipaservers host group) can set up replication for the CA suffix.
https://fedorahosted.org/freeipa/ticket/5399
---
install/share/ca-topology.uldif | 6 ------
install/share/replica-acis.ldif | 6 +++---
install/updates/20-aci.update | 10 ++++++++++
3 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/install/share/ca-topology.uldif b/install/share/ca-topology.uldif
index 7ce3cb1..fea591b 100644
--- a/install/share/ca-topology.uldif
+++ b/install/share/ca-topology.uldif
@@ -10,11 +10,5 @@ default: objectclass: iparepltopoconf
default: ipaReplTopoConfRoot: o=ipaca
default: cn: ca
-# Update CA replication settings
-dn: cn=o\3Dipaca,cn=mapping tree,cn=config
-add: aci: (targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
-add: aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
-add: aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
-
dn: cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config
onlyifexist: nsds5replicabinddngroup: cn=replication managers,cn=sysaccounts,cn=etc,$SUFFIX
diff --git a/install/share/replica-acis.ldif b/install/share/replica-acis.ldif
index 8c0bc8e..6735130 100644
--- a/install/share/replica-acis.ldif
+++ b/install/share/replica-acis.ldif
@@ -1,16 +1,16 @@
# Replica administration
-dn: cn="$SUFFIX",cn=mapping tree,cn=config
+dn: cn=mapping tree,cn=config
changetype: modify
add: aci
aci: (targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
-dn: cn="$SUFFIX",cn=mapping tree,cn=config
+dn: cn=mapping tree,cn=config
changetype: modify
add: aci
aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
-dn: cn="$SUFFIX",cn=mapping tree,cn=config
+dn: cn=mapping tree,cn=config
changetype: modify
add: aci
aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update
index 5b9741d..cef842b 100644
--- a/install/updates/20-aci.update
+++ b/install/updates/20-aci.update
@@ -66,6 +66,16 @@ add:aci:(targetattr="*")(version 3.0; acl "Admin can read all tasks"; allow (rea
dn: cn=mapping tree,cn=config
add:aci: (target = "ldap:///cn=meTo($$dn),cn=*,cn=mapping tree,cn=config")(targetattr = "objectclass || cn")(version 3.0; acl "Allow hosts to read their replication agreements"; allow(read, search, compare) userdn = "ldap:///fqdn=($$dn),cn=computers,cn=accounts,$SUFFIX";)
+dn: cn="$SUFFIX",cn=mapping tree,cn=config
+remove:aci: (targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
+remove:aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
+remove:aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "
+
+dn: cn=o\3Dipaca,cn=mapping tree,cn=config
+remove:aci: (targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
+remove:aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
+remove:aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,$SUFFIX";)
+
# Removal of obsolete ACIs
dn: cn=config
# Replaced by 'System: Read Replication Agreements'
--
2.4.3
From ab9244f7c6c37a6873a0bf9dca1bc801cd674fa5 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jchol...@redhat.com>
Date: Thu, 10 Dec 2015 08:17:11 +0100
Subject: [PATCH 2/2] ca install: use host credentials in domain level 1
https://fedorahosted.org/freeipa/ticket/5399
---
install/tools/ipa-ca-install | 76 +++++++++++++++++++++++++++++---------------
1 file changed, 51 insertions(+), 25 deletions(-)
diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install
index 0b8f28c..f2f32bd 100755
--- a/install/tools/ipa-ca-install
+++ b/install/tools/ipa-ca-install
@@ -107,21 +107,19 @@ def get_dirman_password():
def install_replica(safe_options, options, filename):
- domain_level = dsinstance.get_domain_level(api)
- if domain_level > DOMAIN_LEVEL_0:
- options.promote = True
+ if options.promote:
if filename is not None:
sys.exit("Too many parameters provided. "
"No replica file is required")
else:
- options.promote = False
if filename is None:
sys.exit("A replica file is required")
if not ipautil.file_exists(filename):
sys.exit("Replica file %s does not exist" % filename)
- # Check if we have admin creds already, otherwise acquire them
- check_creds(options, api.env.realm)
+ if not options.promote:
+ # Check if we have admin creds already, otherwise acquire them
+ check_creds(options, api.env.realm)
# get the directory manager password
dirman_password = options.password
@@ -135,8 +133,8 @@ def install_replica(safe_options, options, filename):
if dirman_password is None:
sys.exit("Directory Manager password required")
- if not options.admin_password and not options.skip_conncheck and \
- options.unattended:
+ if (not options.promote and not options.admin_password and
+ not options.skip_conncheck and options.unattended):
sys.exit('admin password required')
if options.promote:
@@ -229,6 +227,46 @@ def install_master(safe_options, options):
ca.install(True, None, options)
+def install(safe_options, options, filename):
+ options.promote = False
+
+ try:
+ if filename is None:
+ install_master(safe_options, options)
+ else:
+ install_replica(safe_options, options, filename)
+
+ finally:
+ # Clean up if we created custom credentials
+ created_ccache_file = getattr(options, 'created_ccache_file', None)
+ if created_ccache_file is not None:
+ try:
+ os.unlink(created_ccache_file)
+ except OSError:
+ pass
+
+
+def promote(safe_options, options, filename):
+ options.promote = True
+
+ with ipautil.private_ccache():
+ ccache = os.environ['KRB5CCNAME']
+
+ ipautil.kinit_keytab(
+ 'host/{env.host}@{env.realm}'.format(env=api.env),
+ paths.KRB5_KEYTAB,
+ ccache)
+
+ conn = api.Backend.ldap2
+ conn.connect(ccache=ccache)
+ ca_host = service.find_providing_server('CA', conn)
+ conn.disconnect()
+ if ca_host is None:
+ install_master(safe_options, options)
+ else:
+ install_replica(safe_options, options, filename)
+
+
def main():
safe_options, options, filename = parse_options()
@@ -251,24 +289,12 @@ def main():
api.bootstrap(in_server=True, ra_plugin='dogtag')
api.finalize()
- try:
- conn = api.Backend.ldap2
- conn.connect(autobind=True)
- ca_host = service.find_providing_server('CA', conn)
- conn.disconnect()
- if ca_host is None:
- install_master(safe_options, options)
- else:
- install_replica(safe_options, options, filename)
+ domain_level = dsinstance.get_domain_level(api)
+ if domain_level > DOMAIN_LEVEL_0:
+ promote(safe_options, options, filename)
+ else:
+ install(safe_options, options, filename)
- finally:
- # Clean up if we created custom credentials
- created_ccache_file = getattr(options, 'created_ccache_file', None)
- if created_ccache_file is not None:
- try:
- os.unlink(created_ccache_file)
- except OSError:
- pass
fail_message = '''
Your system may be partly configured.
--
2.4.3
--
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code
