Ask interactively for user name and password if Kerberos credentials missing

[abbra]

cli: add acquire_cred callback support to the Kerberos transport

This allows applications to specify their own acquire_cred callback. The callback should be put into the environment under 'acquire_cred' name as a tuple of a (callable, pass-in object).

The callable should accept (pass-in object, principal, ccache, service) and ideally should acquire a Kerberos credential into the ccache. Both principal and the ccache name might be None, signifying that a default name and a default credentials cache would need to be used.

Example usage:

import os
from ipalib import api
from ipalib.install.kinit import kinit_password

username = 'admin'
password = '<some-value>'

def acquire_cred(api, principal, ccache, service):
    if ccache is None:
        ccache = os.environ.get('KRB5CCNAME', 'KCM:')
    if principal is None:
        principal = username

    kinit_password(principal, password, ccache)

api.bootstrap(acquire_cred=(acquire_cred, api))
api.finalize()
api.Backend.rpcclient.connect()
print(api.Command.ping())

cli: Ask for user name and password if Kerberos credentials missing

Ask interactively for credentials in case they are missing in the default credentials cache in the environment:

	$ ipa ping
	Username: testuser
	Password: <some-password>
	--------------------------------------------
	IPA server version 4.11.1. API version 2.253
	--------------------------------------------

Initial implementation only supports password-based credential.

[tiran]

I find it confusing how the API object is passed around. How about you include the api in the transport instance and get the callback from self.api instead?

class MultiProtocolTransport(Transport):
    """Transport that handles both XML-RPC and JSON"""
    def __init__(self, *args, **kwargs):
        Transport.__init__(self)
        self.protocol = kwargs.get('protocol', None)
        self.api = kwargs.get('api', api)

and pass the api object along later:

                proxy_kw['transport'] = transport_class(
                    protocol=self.protocol, service='HTTP', ccache=ccache,
                    api=self.api)

then you can replace the complicated checks with if self.api.env.acquire_cred is not None.

The single_request method does not pass service to _handle_exception().

I think the acquire_cred_interactively function won't work for users with 2FA, hardened, or OIDC login. It's not using a FAST tunnel.

How do you feel about a different set of parameters for the callback to make it future-proof?

• require passing of keyword arguments instead of positional arguments
• pass context and transport in case we need it in the future. We could drop principal, ccache, and service arguments. The information is available on context and transport.
• require **kwargs so we can extend the API later without breaking code

import threading
import typing
from ipalib import plugable
from ipalib.rpc import MultiProtocolTransport


def acquire_cred_cb(
    *,
    api: plugable.API,
    transport: MultiProtocolTransport,
    context: threading.local,
    principal: typing.Optional[str] = None,
    ccache: typing.Optional[str] = None,
    service=typing.Optional[str] = None,
    **kwargs
) -> None:
    """Acquire credential callback

    :param api: ipalib API object
    :param transport: RPC transport instance
    :param context: threading local context with additional data
    :param principal: Kerberos principal name (str, None)
    :param ccache: credential cache with ccache type (str, None)
    :param service: service service prefix (e.g. 'HTTP' or None)
    """
    pass

[abbra]

Please note that I explicitly point in the commit message that current implementation will not work for passwordless methods and that is intended -- I am working on an addition to support those but they'll come in a separate PR. This one lays a foundation to enable callbacks that abstract out credentials acquisition at the time when this change happens.

[tiran]

One place does not pass service to _handle_exception:

freeipa/ipalib/rpc.py

Lines 736 to 737 in 64861a0

	except gssapi.exceptions.GSSError as e:
	self._handle_exception(e)

[abbra]

One place does not pass service to _handle_exception:

freeipa/ipalib/rpc.py

Lines 736 to 737 in 64861a0

	except gssapi.exceptions.GSSError as e:
	self._handle_exception(e)

Addressed this via a separate commit.

[abbra]

Filed a ticket to this specific change: https://pagure.io/freeipa/issue/9561

[rcritten]

This is a pretty big change from previous behavior. I wonder if in order to retain previous behavior without having to always pass in -n a new config option be added.

[tiran]

I see another potential problem with api.env.interactive. It's always set to True unless ipa CLI is called with ipa --no-prompt. This may cause issues with scenarios like systemd services or Ansible playbooks that run ipa non-interactively. I haven't tested it, but I think that the new code is going to block on stdin read indefinitely.

Suggestions:

For password prompt, only use the interactive flag if stdin is a tty:

interactive = (self.api.env.interactive and sys.stdin.isatty()) or self.api.env.prompt_all

then pass interactive to the acquire_cred callback. This would let each callback implementation detect if interaction with a user is possible. The reference implementation of acquire_cred_interactively does nothing, but a callback with a password from a config file would work.

[tiran]

The function should never receive positional arguments and always the keyword arguments api, principal, and ccache, I recommend this syntax:

Suggested change

	def acquire_cred_interactively(*args, **kw):
	def acquire_cred_interactively(*, api, principal, ccache, **kwargs):

the * without argument name means that all following args must be passed as keywords.

>>> def acquire_cred_interactively(*, api, principal, ccache, **kwargs): pass
... 
>>> acquire_cred_interactively(1, 2, 3)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: acquire_cred_interactively() takes 0 positional arguments but 3 were given
>>> acquire_cred_interactively(api=1, principal=2, ccache=3)
>>>

[abbra]

Thanks, makes sense. It is a nice feature.
I updated the code and also decided to pass in an exception class to raise in case the callback decides it cannot acquire credentials. This helps against loops within self.get_auth_info(): self._handle_exception() -> self._try_acquire_cred() -> raise errors.NonFatalError() -> self.get_auth_info().

[abbra]

I am turning this back to draft mode. I have made some progress with interactive prompter to get rid of calling out to kinit, but haven't yet integrated it into the helpers for automatic use.