Submitted By: Mario Fetka (mario-fetka at gmx dot at) Date: 2008-06-14 Initial Package Version: 2.2.0 Origin: Ticket #144 Upstream Status: Accepted Description: Kerberized accounts in ou=People diff -Naur mmc-agent-2.3.1.orig/conf/plugins/kerberos.ini mmc-agent-2.3.1/conf/plugins/kerberos.ini --- mmc-agent-2.3.1.orig/conf/plugins/kerberos.ini 1970-01-01 00:00:00.000000000 +0000 +++ mmc-agent-2.3.1/conf/plugins/kerberos.ini 2008-05-17 13:04:35.000000000 +0000 @@ -0,0 +1,5 @@ +[main] +disable = 0 + +[kerberos] +realm = EXAMPLE.COM diff -Naur mmc-agent-2.3.1.orig/mmc/plugins/base/__init__.py mmc-agent-2.3.1/mmc/plugins/base/__init__.py --- mmc-agent-2.3.1.orig/mmc/plugins/base/__init__.py 2008-04-29 15:15:48.000000000 +0000 +++ mmc-agent-2.3.1/mmc/plugins/base/__init__.py 2008-06-14 09:22:59.000000000 +0000 @@ -1229,6 +1229,10 @@ attrs = [] attrib = self.l.search_s(dn, ldap.SCOPE_BASE) c, attrs = attrib[0] + # kerberos -> remove binary key from attrs + try: attrs.pop('krb5Key') + except: pass + # newattrs = copy.deepcopy(attrs) return newattrs @@ -1249,6 +1253,10 @@ attrib = self.l.search_s(cn, ldap.SCOPE_BASE) c,attrs=attrib[0] + # kerberos -> remove binary key from attrs + try: attrs.pop('krb5Key') + except: pass + # newattrs = copy.deepcopy(attrs) @@ -1402,8 +1410,13 @@ @rtype: list """ if not base: base = self.baseUsersDN - if (pattern==''): searchFilter = "uid=*" - else: searchFilter = pattern + # kerberos -> search only PosixAccount + if (pattern==''): searchFilter = "(&(objectClass=posixAccount)(uid=*))" + elif pattern[0] == '(': + searchFilter = "(&(objectClass=posixAccount)%s)" % (pattern) + else: + searchFilter = "(&(objectClass=posixAccount)(%s))" % (pattern) + # monoattrs = ["uid", "sn", "givenName", "mail"] result_set = self.search(searchFilter, base, monoattrs + ["telephoneNumber", "loginShell", "objectClass"], ldap.SCOPE_ONELEVEL) diff -Naur mmc-agent-2.3.1.orig/mmc/plugins/kerberos/__init__.py mmc-agent-2.3.1/mmc/plugins/kerberos/__init__.py --- mmc-agent-2.3.1.orig/mmc/plugins/kerberos/__init__.py 1970-01-01 00:00:00.000000000 +0000 +++ mmc-agent-2.3.1/mmc/plugins/kerberos/__init__.py 2007-11-21 09:56:21.000000000 +0000 @@ -0,0 +1,180 @@ +# -*- coding: utf-8; -*- +# +# (c) 2004-2007 Linbox / Free&ALter Soft, http://linbox.com +# (c) 2007 Mandriva, http://www.mandriva.com/ +# (c) 2007 Kids-und-Co g.e.V http://www.kids-und-co.de +# +# $Id: __init__.py 108 2007-11-21 09:56:21Z iosifb $ +# +# This file is part of Mandriva Management Console (MMC). +# +# MMC is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# MMC is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with MMC; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + +import logging +import ldap.modlist +import copy +from mmc.plugins.base import ldapUserGroupControl +import xmlrpclib +from mmc.support.errorObj import errorMessage +from mmc.support.mmcException import * +from mmc.support import mmctools +import mmc.plugins.base +from mmc.support.config import * +from mmc.plugins.base import ldapUserGroupControl + +VERSION = "2.3.1" +APIVERSION = "4:2:0" +REVISION = int("$Rev: 108 $".split(':')[1].strip(' $')) + +def getVersion(): return VERSION +def getApiVersion(): return APIVERSION +def getRevision(): return REVISION + +def activate(): + """ + this function define if the module "base" can be activated. + @return: return True if this module can be activate + @rtype: boolean + """ + config = KerberosConfig("kerberos") + logger = logging.getLogger() + + if config.disabled: + logger.info("Kerberos plugin disabled by configuration.") + return False + + try: + ldapObj = ldapUserGroupControl() + except ldap.INVALID_CREDENTIALS: + logger.error("Can't bind to LDAP: invalid credentials.") + return False + + # Test if the Kerberos LDAP schema is available in the directory + try: + schema = ldapObj.getSchema("krb5KDCEntry") + if len(schema) <= 0: + logger.error("Kerberos schema is not included in LDAP directory"); + return False + except: + logger.exception("invalid schema") + return False + try: + schema = ldapObj.getSchema("krb5Principal") + if len(schema) <= 0: + logger.error("Kerberos schema is not included in LDAP directory"); + return False + except: + logger.exception("invalid schema") + return False + """ + TODO: Check kerberos database + """ + return True + +def isKrbUser(uid): + return kerberosLdapControl().isKerberosUser(uid) + +def addKrbAttr(uid,password): + return kerberosLdapControl().addKerberosAttr(uid,password) + +def delKrbAttr(uid,password): + return kerberosLdapControl().delKerberosAttr(uid,password) + +def changePassword(uid,password): + return kerberosLdapControl().changePassword(uid, password) + +class KerberosConfig(PluginConfig): + def __init__(self,name, conffile = None): + PluginConfig.__init__(self,name, conffile = None) + self.setDefault() + self.readConfig() + + def readConfig(self): + PluginConfig.readConf(self) + self.realm = self.get("kerberos", "realm") + +class kerberosLdapControl(mmc.plugins.base.ldapUserGroupControl): + + def __init__(self, conffile = None, conffilebase = None): + mmc.plugins.base.ldapUserGroupControl.__init__(self, conffilebase) + self.configKerberos = KerberosConfig("kerberos", conffile) + self.realm = self.configKerberos.realm + + def delKerberosAttr(self,uid,password): + # If the password has been encoded in the XML-RPC stream, decode it + if isinstance(password, xmlrpclib.Binary): + password = str(password) + dn = 'uid=' + uid + ',' + self.baseUsersDN + s = self.l.search_s(dn, ldap.SCOPE_BASE) + c, attr = s[0] + old = {} + new = {} + for key in attr.keys(): old[key.lower()] = attr[key] + new = copy.deepcopy(old) + # remove krb attributes + new.pop('krb5kdcflags') + new.pop('krb5principalname') + new.pop('krb5keyversionnumber') + try: new.pop('krb5key') + except KeyError: pass + newobjclasses = () + for s in new.pop('objectclass'): + if s[0:4] == 'krb5': pass + else: newobjclasses = newobjclasses + (s,) + new['objectclass'] = newobjclasses + modlist = ldap.modlist.modifyModlist(old, new) + #logger = logging.getLogger() + #logger.debug(newobjclasses) + #logger.debug(modlist) + self.l.modify_s(dn, modlist) + mmc.plugins.base.ldapUserGroupControl.changeUserPasswd(self,uid,password) + return True + + def addKerberosAttr(self,uid,password): + # If the password has been encoded in the XML-RPC stream, decode it + if isinstance(password, xmlrpclib.Binary): + password = str(password) + dn = 'uid=' + uid + ',' + self.baseUsersDN + s = self.l.search_s(dn, ldap.SCOPE_BASE) + c, attr = s[0] + old = {} + new = {} + for key in attr.keys(): old[key.lower()] = attr[key] + new = copy.deepcopy(old) + new['objectclass'] = new['objectclass'] + ['krb5Principal','krb5KDCEntry'] + new['userpassword'] = ['{K5Key}'] + new['krb5kdcflags'] = ['126'] + new['krb5keyversionnumber'] = ['0'] + new['krb5principalname'] = [uid+'@' +self.realm] + modlist = ldap.modlist.modifyModlist(old, new) + self.l.modify_s(dn, modlist) + self.l.passwd_s(dn, None, password) + return True + + def isKerberosUser(self,uid): + ret = False + if self.existUser(uid): ret = "krb5Principal" in self.getDetailedUser(uid)["objectClass"] + return ret + + def changePassword(self,uid,password): + # If the password has been encoded in the XML-RPC stream, decode it + if isinstance(password, xmlrpclib.Binary): + password = str(password) + dn = 'uid=' + uid + ',' + self.baseUsersDN + self.l.modify_s(dn, [(ldap.MOD_REPLACE,'userPassWord','{K5KEY}')]) + self.l.passwd_s(dn, None, password) + return True + + diff -Naur mmc-agent-2.3.1.orig/plugins_base.diff mmc-agent-2.3.1/plugins_base.diff --- mmc-agent-2.3.1.orig/plugins_base.diff 1970-01-01 00:00:00.000000000 +0000 +++ mmc-agent-2.3.1/plugins_base.diff 2008-05-17 13:04:04.000000000 +0000 @@ -0,0 +1,40 @@ +--- mds-orig/mmc-agent/mmc/plugins/base/__init__.py 2007-11-21 10:57:03.000000000 +0100 ++++ kerberos_plugin/trunk/mmc-agent/mmc/plugins/base/__init__.py 2007-11-21 11:34:36.000000000 +0100 +@@ -1207,6 +1207,10 @@ + attrs = [] + attrib = self.l.search_s(dn, ldap.SCOPE_BASE) + c, attrs = attrib[0] ++ # kerberos -> remove binary key from attrs ++ try: attrs.pop('krb5Key') ++ except: pass ++ # + newattrs = copy.deepcopy(attrs) + return newattrs + +@@ -1227,6 +1231,10 @@ + attrib = self.l.search_s(cn, ldap.SCOPE_BASE) + + c,attrs=attrib[0] ++ # kerberos -> remove binary key from attrs ++ try: attrs.pop('krb5Key') ++ except: pass ++ # + + newattrs = copy.deepcopy(attrs) + +@@ -1380,8 +1388,13 @@ + @rtype: list + """ + if not base: base = self.baseUsersDN +- if (pattern==''): searchFilter = "uid=*" +- else: searchFilter = pattern ++ # kerberos -> search only PosixAccount ++ if (pattern==''): searchFilter = "(&(objectClass=posixAccount)(uid=*))" ++ elif pattern[0] == '(': ++ searchFilter = "(&(objectClass=posixAccount)%s)" % (pattern) ++ else: ++ searchFilter = "(&(objectClass=posixAccount)(%s))" % (pattern) ++ # + monoattrs = ["uid", "sn", "givenName", "mail"] + result_set = self.search(searchFilter, base, monoattrs + ["telephoneNumber", "loginShell", "objectClass"], ldap.SCOPE_ONELEVEL) + diff -Naur mmc-agent-2.3.1.orig/setup.py mmc-agent-2.3.1/setup.py --- mmc-agent-2.3.1.orig/setup.py 2007-09-10 08:20:59.000000000 +0000 +++ mmc-agent-2.3.1/setup.py 2008-06-14 09:24:15.000000000 +0000 @@ -8,5 +8,5 @@ author_email = "cdelfosse@mandriva.com", maintainer = "Cedric Delfosse", maintainer_email = "cdelfosse@mandriva.com", - packages = ["mmc", "mmc.support", "mmc.plugins", "mmc.plugins.base", "mmc.plugins.samba", "mmc.plugins.proxy", "mmc.plugins.mail", "mmc.plugins.network"], + packages = ["mmc", "mmc.support", "mmc.plugins", "mmc.plugins.base", "mmc.plugins.samba", "mmc.plugins.proxy", "mmc.plugins.mail", "mmc.plugins.network", "mmc.plugins.kerberos"], )