80 lines
2.6 KiB
Python
80 lines
2.6 KiB
Python
#
|
|
# Copyright (C) 2025 FreeIPA Contributors see COPYING for license
|
|
#
|
|
|
|
from __future__ import absolute_import
|
|
|
|
import logging
|
|
|
|
from ipalib import errors
|
|
from ipalib import Registry
|
|
from ipalib import Updater
|
|
from ipapython.dn import DN
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
register = Registry()
|
|
|
|
|
|
@register()
|
|
class add_admin_krbcanonicalname(Updater):
|
|
"""
|
|
Ensures that only the admin user has the krbCanonicalName of
|
|
admin@$REALM.
|
|
"""
|
|
|
|
def execute(self, **options):
|
|
ldap = self.api.Backend.ldap2
|
|
|
|
search_filter = (
|
|
"(krbcanonicalname=admin@{})".format(self.api.env.realm))
|
|
try:
|
|
(entries, _truncated) = ldap.find_entries(
|
|
filter=search_filter, base_dn=self.api.env.basedn,
|
|
time_limit=0, size_limit=0)
|
|
except errors.EmptyResult:
|
|
logger.debug("add_admin_krbcanonicalname: No user set with "
|
|
"admin krbcanonicalname")
|
|
entries = []
|
|
# fall through
|
|
except errors.ExecutionError as e:
|
|
logger.error("add_admin_krbcanonicalname: Can not get list "
|
|
"of krbcanonicalname: %s", e)
|
|
return False, []
|
|
|
|
admin_set = False
|
|
# admin should be only user with admin@ as krbcanonicalname
|
|
# It has a uniquness setting so there can be only one, we
|
|
# just didn't automatically set it for admin.
|
|
for entry in entries:
|
|
if entry.single_value.get('uid') != 'admin':
|
|
logger.critical(
|
|
"add_admin_krbcanonicalname: "
|
|
"entry %s has a krbcanonicalname of admin. Removing.",
|
|
entry.dn)
|
|
del entry['krbcanonicalname']
|
|
ldap.update_entry(entry)
|
|
else:
|
|
admin_set = True
|
|
|
|
if not admin_set:
|
|
dn = DN(
|
|
('uid', 'admin'),
|
|
self.api.env.container_user,
|
|
self.api.env.basedn)
|
|
entry = ldap.get_entry(dn)
|
|
entry['krbcanonicalname'] = 'admin@%s' % self.api.env.realm
|
|
try:
|
|
ldap.update_entry(entry)
|
|
except errors.DuplicateEntry:
|
|
logger.critical(
|
|
"add_admin_krbcanonicalname: "
|
|
"Failed to set krbcanonicalname on admin. It is set "
|
|
"on another entry.")
|
|
except errors.ExecutionError as e:
|
|
logger.critical(
|
|
"add_admin_krbcanonicalname: "
|
|
"Failed to set krbcanonicalname on admin: %s", e)
|
|
|
|
return False, []
|