linamh/app-admin/mmc-agent/files/mmc-agent-2.3.1-kerberos-1.patch

Submitted By: Mario Fetka (mario-fetka at gmx dot at)
Date: 2008-06-14
Initial Package Version: 2.2.0
Origin: Ticket #144
Upstream Status: Accepted
Description: Kerberized accounts in ou=People

 
diff -Naur mmc-agent-2.3.1.orig/conf/plugins/kerberos.ini mmc-agent-2.3.1/conf/plugins/kerberos.ini
--- mmc-agent-2.3.1.orig/conf/plugins/kerberos.ini	1970-01-01 00:00:00.000000000 +0000
+++ mmc-agent-2.3.1/conf/plugins/kerberos.ini	2008-05-17 13:04:35.000000000 +0000
@@ -0,0 +1,5 @@
+[main]
+disable = 0
+
+[kerberos]
+realm = EXAMPLE.COM
diff -Naur mmc-agent-2.3.1.orig/mmc/plugins/base/__init__.py mmc-agent-2.3.1/mmc/plugins/base/__init__.py
--- mmc-agent-2.3.1.orig/mmc/plugins/base/__init__.py	2008-04-29 15:15:48.000000000 +0000
+++ mmc-agent-2.3.1/mmc/plugins/base/__init__.py	2008-06-14 09:22:59.000000000 +0000
@@ -1229,6 +1229,10 @@
         attrs = []
         attrib = self.l.search_s(dn, ldap.SCOPE_BASE)
         c, attrs = attrib[0]
+        # kerberos -> remove binary key from attrs    
+        try: attrs.pop('krb5Key')
+        except: pass
+        #
         newattrs = copy.deepcopy(attrs)
         return newattrs
 
@@ -1249,6 +1253,10 @@
         attrib = self.l.search_s(cn, ldap.SCOPE_BASE)
 
         c,attrs=attrib[0]
+        # kerberos -> remove binary key from attrs    
+        try: attrs.pop('krb5Key')
+        except: pass
+        #
 
         newattrs = copy.deepcopy(attrs)
 
@@ -1402,8 +1410,13 @@
         @rtype: list
         """
         if not base: base = self.baseUsersDN
-        if (pattern==''): searchFilter = "uid=*"
-        else: searchFilter = pattern
+        # kerberos -> search only PosixAccount
+        if (pattern==''): searchFilter = "(&(objectClass=posixAccount)(uid=*))"
+        elif pattern[0] == '(':
+            searchFilter = "(&(objectClass=posixAccount)%s)" % (pattern)
+        else:
+            searchFilter = "(&(objectClass=posixAccount)(%s))" % (pattern)
+        #
         monoattrs = ["uid", "sn", "givenName", "mail"]
         result_set = self.search(searchFilter, base, monoattrs + ["telephoneNumber", "loginShell", "objectClass"], ldap.SCOPE_ONELEVEL)
 
diff -Naur mmc-agent-2.3.1.orig/mmc/plugins/kerberos/__init__.py mmc-agent-2.3.1/mmc/plugins/kerberos/__init__.py
--- mmc-agent-2.3.1.orig/mmc/plugins/kerberos/__init__.py	1970-01-01 00:00:00.000000000 +0000
+++ mmc-agent-2.3.1/mmc/plugins/kerberos/__init__.py	2007-11-21 09:56:21.000000000 +0000
@@ -0,0 +1,180 @@
+# -*- coding: utf-8; -*-                                                                                                   
+#                                                                                                                          
+# (c) 2004-2007 Linbox / Free&ALter Soft, http://linbox.com                                                                
+# (c) 2007 Mandriva, http://www.mandriva.com/                                                                              
+# (c) 2007 Kids-und-Co g.e.V http://www.kids-und-co.de 
+#              
+# $Id: __init__.py 108 2007-11-21 09:56:21Z iosifb $
+#                                                                                                       
+# This file is part of Mandriva Management Console (MMC).                                                                  
+#                                                                                                                          
+# MMC is free software; you can redistribute it and/or modify                                                              
+# it under the terms of the GNU General Public License as published by                                                     
+# the Free Software Foundation; either version 2 of the License, or                                                        
+# (at your option) any later version.                                                                                      
+#                                                                                                                          
+# MMC is distributed in the hope that it will be useful,                                                                   
+# but WITHOUT ANY WARRANTY; without even the implied warranty of                                                           
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the                                                            
+# GNU General Public License for more details.                                                                             
+#                                                                                                                          
+# You should have received a copy of the GNU General Public License                                                        
+# along with MMC; if not, write to the Free Software                                                                       
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA                                               
+
+import logging
+import ldap.modlist
+import copy
+from mmc.plugins.base import ldapUserGroupControl
+import xmlrpclib
+from mmc.support.errorObj import errorMessage
+from mmc.support.mmcException import *
+from mmc.support import mmctools
+import mmc.plugins.base
+from mmc.support.config import *
+from mmc.plugins.base import ldapUserGroupControl
+                                                                                                                         
+VERSION = "2.3.1"                                                                                                          
+APIVERSION = "4:2:0"                                                                                                       
+REVISION = int("$Rev: 108 $".split(':')[1].strip(' $'))                                                                      
+                                                                                                                           
+def getVersion(): return VERSION                                                                                           
+def getApiVersion(): return APIVERSION                                                                                     
+def getRevision(): return REVISION                                                                                         
+                                                                                                                       
+def activate(): 
+    """
+    this function define if the module "base" can be activated.
+    @return: return True if this module can be activate
+    @rtype: boolean
+    """
+    config = KerberosConfig("kerberos")
+    logger = logging.getLogger()
+
+    if config.disabled:
+        logger.info("Kerberos plugin disabled by configuration.")
+        return False
+    
+    try:
+        ldapObj = ldapUserGroupControl()
+    except ldap.INVALID_CREDENTIALS:
+        logger.error("Can't bind to LDAP: invalid credentials.")
+        return False
+
+    # Test if the Kerberos LDAP schema is available in the directory
+    try:
+         schema = ldapObj.getSchema("krb5KDCEntry")
+         if len(schema) <= 0:
+             logger.error("Kerberos schema is not included in LDAP directory");
+             return False
+    except:
+        logger.exception("invalid schema")
+        return False
+    try:
+         schema = ldapObj.getSchema("krb5Principal")
+         if len(schema) <= 0:
+             logger.error("Kerberos schema is not included in LDAP directory");
+             return False
+    except:
+        logger.exception("invalid schema")
+        return False
+    """
+    TODO: Check kerberos database
+    """                                                                                        
+    return True 
+
+def isKrbUser(uid):
+    return kerberosLdapControl().isKerberosUser(uid)
+
+def addKrbAttr(uid,password):
+    return kerberosLdapControl().addKerberosAttr(uid,password)
+
+def delKrbAttr(uid,password):
+    return kerberosLdapControl().delKerberosAttr(uid,password)
+
+def changePassword(uid,password):
+    return kerberosLdapControl().changePassword(uid, password)
+
+class KerberosConfig(PluginConfig):
+    def __init__(self,name, conffile = None):
+       PluginConfig.__init__(self,name, conffile = None)
+       self.setDefault()
+       self.readConfig()
+        
+    def readConfig(self):
+        PluginConfig.readConf(self)
+        self.realm = self.get("kerberos", "realm")
+
+class kerberosLdapControl(mmc.plugins.base.ldapUserGroupControl):
+
+    def __init__(self, conffile = None, conffilebase = None):
+        mmc.plugins.base.ldapUserGroupControl.__init__(self, conffilebase)
+        self.configKerberos = KerberosConfig("kerberos", conffile)
+        self.realm = self.configKerberos.realm
+    
+    def delKerberosAttr(self,uid,password):
+        # If the password has been encoded in the XML-RPC stream, decode it
+        if isinstance(password, xmlrpclib.Binary):
+            password = str(password)
+        dn = 'uid=' + uid + ',' + self.baseUsersDN
+        s = self.l.search_s(dn, ldap.SCOPE_BASE)
+        c, attr = s[0]
+        old = {}
+        new = {}
+        for key in attr.keys(): old[key.lower()] = attr[key]
+        new = copy.deepcopy(old)
+        # remove krb attributes
+        new.pop('krb5kdcflags')
+        new.pop('krb5principalname')
+        new.pop('krb5keyversionnumber')
+        try: new.pop('krb5key')
+        except KeyError: pass
+        newobjclasses = ()
+        for s in new.pop('objectclass'):
+            if s[0:4] == 'krb5': pass
+            else: newobjclasses = newobjclasses + (s,)
+        new['objectclass'] = newobjclasses
+        modlist = ldap.modlist.modifyModlist(old, new)
+        #logger = logging.getLogger()
+        #logger.debug(newobjclasses)
+        #logger.debug(modlist)
+        self.l.modify_s(dn, modlist)
+        mmc.plugins.base.ldapUserGroupControl.changeUserPasswd(self,uid,password)
+        return True 
+    
+    def addKerberosAttr(self,uid,password):
+        # If the password has been encoded in the XML-RPC stream, decode it
+        if isinstance(password, xmlrpclib.Binary):
+            password = str(password)
+        dn = 'uid=' + uid + ',' + self.baseUsersDN
+        s = self.l.search_s(dn, ldap.SCOPE_BASE)
+        c, attr = s[0]
+        old = {}
+        new = {}
+        for key in attr.keys(): old[key.lower()] = attr[key]
+        new = copy.deepcopy(old)
+        new['objectclass'] = new['objectclass'] + ['krb5Principal','krb5KDCEntry']
+        new['userpassword'] = ['{K5Key}']
+        new['krb5kdcflags'] = ['126']
+        new['krb5keyversionnumber'] = ['0']
+        new['krb5principalname'] = [uid+'@' +self.realm]
+        modlist = ldap.modlist.modifyModlist(old, new)
+        self.l.modify_s(dn, modlist)
+        self.l.passwd_s(dn, None, password)
+        return True
+    
+    def isKerberosUser(self,uid):
+        ret = False
+        if self.existUser(uid): ret = "krb5Principal" in self.getDetailedUser(uid)["objectClass"]
+        return ret        
+    
+    def changePassword(self,uid,password):
+        # If the password has been encoded in the XML-RPC stream, decode it
+        if isinstance(password, xmlrpclib.Binary):
+            password = str(password)
+        dn = 'uid=' + uid + ',' + self.baseUsersDN
+        self.l.modify_s(dn, [(ldap.MOD_REPLACE,'userPassWord','{K5KEY}')])
+        self.l.passwd_s(dn, None, password)
+        return True
+     
+                                                                                                            
diff -Naur mmc-agent-2.3.1.orig/plugins_base.diff mmc-agent-2.3.1/plugins_base.diff
--- mmc-agent-2.3.1.orig/plugins_base.diff	1970-01-01 00:00:00.000000000 +0000
+++ mmc-agent-2.3.1/plugins_base.diff	2008-05-17 13:04:04.000000000 +0000
@@ -0,0 +1,40 @@
+--- mds-orig/mmc-agent/mmc/plugins/base/__init__.py	2007-11-21 10:57:03.000000000 +0100
++++ kerberos_plugin/trunk/mmc-agent/mmc/plugins/base/__init__.py	2007-11-21 11:34:36.000000000 +0100
+@@ -1207,6 +1207,10 @@
+         attrs = []
+         attrib = self.l.search_s(dn, ldap.SCOPE_BASE)
+         c, attrs = attrib[0]
++        # kerberos -> remove binary key from attrs    
++        try: attrs.pop('krb5Key')
++        except: pass
++        #
+         newattrs = copy.deepcopy(attrs)
+         return newattrs
+ 
+@@ -1227,6 +1231,10 @@
+         attrib = self.l.search_s(cn, ldap.SCOPE_BASE)
+ 
+         c,attrs=attrib[0]
++        # kerberos -> remove binary key from attrs    
++        try: attrs.pop('krb5Key')
++        except: pass
++        #
+ 
+         newattrs = copy.deepcopy(attrs)
+ 
+@@ -1380,8 +1388,13 @@
+         @rtype: list
+         """
+         if not base: base = self.baseUsersDN
+-        if (pattern==''): searchFilter = "uid=*"
+-        else: searchFilter = pattern
++        # kerberos -> search only PosixAccount
++        if (pattern==''): searchFilter = "(&(objectClass=posixAccount)(uid=*))"
++        elif pattern[0] == '(':
++            searchFilter = "(&(objectClass=posixAccount)%s)" % (pattern)
++        else:
++            searchFilter = "(&(objectClass=posixAccount)(%s))" % (pattern)
++        #
+         monoattrs = ["uid", "sn", "givenName", "mail"]
+         result_set = self.search(searchFilter, base, monoattrs + ["telephoneNumber", "loginShell", "objectClass"], ldap.SCOPE_ONELEVEL)
+ 
diff -Naur mmc-agent-2.3.1.orig/setup.py mmc-agent-2.3.1/setup.py
--- mmc-agent-2.3.1.orig/setup.py	2007-09-10 08:20:59.000000000 +0000
+++ mmc-agent-2.3.1/setup.py	2008-06-14 09:24:15.000000000 +0000
@@ -8,5 +8,5 @@
     author_email = "cdelfosse@mandriva.com",
     maintainer = "Cedric Delfosse",
     maintainer_email = "cdelfosse@mandriva.com",
-    packages = ["mmc", "mmc.support", "mmc.plugins", "mmc.plugins.base", "mmc.plugins.samba", "mmc.plugins.proxy", "mmc.plugins.mail", "mmc.plugins.network"],
+    packages = ["mmc", "mmc.support", "mmc.plugins", "mmc.plugins.base", "mmc.plugins.samba", "mmc.plugins.proxy", "mmc.plugins.mail", "mmc.plugins.network", "mmc.plugins.kerberos"],
 )