Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixes #32947 - Use Apache module variables #968

Merged
merged 2 commits into from Jul 9, 2021
Merged

Fixes #32947 - Use Apache module variables #968

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91d6b57
Fixes #32947 - Use Apache module variables
ekohl Jul 6, 2021
f9cafdc
Refs #32947 - add tests for the Debian keytab path
evgeni Jul 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 6 additions & 4 deletions manifests/config.pp
View file
Open in desktop
Expand Up @@ -153,14 +153,16 @@
content => template('foreman/pam_service.erb'),
}

$http_keytab = pick($foreman::http_keytab, "${apache::conf_dir}/http.keytab")

exec { 'ipa-getkeytab':
command => "/bin/echo Get keytab \
&& KRB5CCNAME=KEYRING:session:get-http-service-keytab kinit -k \
&& KRB5CCNAME=KEYRING:session:get-http-service-keytab /usr/sbin/ipa-getkeytab -s ${facts['foreman_ipa']['default_server']} -k ${foreman::http_keytab} -p HTTP/${facts['networking']['fqdn']} \
&& KRB5CCNAME=KEYRING:session:get-http-service-keytab /usr/sbin/ipa-getkeytab -s ${facts['foreman_ipa']['default_server']} -k ${http_keytab} -p HTTP/${facts['networking']['fqdn']} \
&& kdestroy -c KEYRING:session:get-http-service-keytab",
creates => $foreman::http_keytab,
creates => $http_keytab,
}
-> file { $foreman::http_keytab:
-> file { $http_keytab:
ensure => file,
owner => $apache::user,
mode => '0600',
Expand All @@ -183,7 +185,7 @@
$sssd = $facts['foreman_sssd']
$sssd_services = join(unique(pick($sssd['services'], []) + ['ifp']), ', ')
$sssd_ldap_user_extra_attrs = join(unique(pick($sssd['ldap_user_extra_attrs'], []) + ['email:mail', 'lastname:sn', 'firstname:givenname']), ', ')
$sssd_allowed_uids = join(unique(pick($sssd['allowed_uids'], []) + ['apache', 'root']), ', ')
$sssd_allowed_uids = join(unique(pick($sssd['allowed_uids'], []) + [$apache::user, 'root']), ', ')
$sssd_user_attributes = join(unique(pick($sssd['user_attributes'], []) + ['+email', '+firstname', '+lastname']), ', ')

augeas { 'sssd-ifp-extra-attributes':
Expand Down
4 changes: 2 additions & 2 deletions manifests/init.pp
View file
Open in desktop
Expand Up @@ -133,7 +133,7 @@
#
# $oauth_consumer_secret:: OAuth consumer secret
#
# $http_keytab:: Path to keytab to be used for Kerberos authentication on the WebUI
# $http_keytab:: Path to keytab to be used for Kerberos authentication on the WebUI. If left empty, it will be automatically determined.
#
# $pam_service:: PAM service used for host-based access control in IPA
#
Expand Down Expand Up @@ -257,7 +257,7 @@
Optional[String] $initial_organization = $foreman::params::initial_organization,
Optional[String] $initial_location = $foreman::params::initial_location,
Boolean $ipa_authentication = $foreman::params::ipa_authentication,
Stdlib::Absolutepath $http_keytab = $foreman::params::http_keytab,
Optional[Stdlib::Absolutepath] $http_keytab = $foreman::params::http_keytab,
String $pam_service = $foreman::params::pam_service,
Boolean $ipa_manage_sssd = $foreman::params::ipa_manage_sssd,
Boolean $websockets_encrypt = $foreman::params::websockets_encrypt,
Expand Down
2 changes: 1 addition & 1 deletion manifests/params.pp
View file
Open in desktop
Expand Up @@ -165,7 +165,7 @@
$initial_location = undef

$ipa_authentication = false
$http_keytab = '/etc/httpd/conf/http.keytab'
$http_keytab = undef
evgeni marked this conversation as resolved.
Show resolved Hide resolved
$pam_service = 'foreman'
$ipa_manage_sssd = true

Expand Down
6 changes: 4 additions & 2 deletions spec/classes/foreman_config_ipa_spec.rb
View file
Open in desktop
Expand Up @@ -2,10 +2,12 @@

describe 'foreman' do
on_supported_os.each do |os, facts|
context "on #{os}", if: facts[:osfamily] == 'RedHat' do
context "on #{os}" do
let(:facts) { facts.merge(interfaces: '') }
let(:params) { { ipa_authentication: true } }

keytab_path = facts[:osfamily] == 'RedHat' ? '/etc/httpd/conf/http.keytab' : '/etc/apache2/http.keytab'

describe 'without apache' do
let(:params) { super().merge(apache: false) }
it { should raise_error(Puppet::Error, /External authentication via IPA can only be enabled when Apache is used/) }
Expand Down Expand Up @@ -50,7 +52,7 @@
should contain_foreman__config__apache__fragment('lookup_identity')

should contain_foreman__config__apache__fragment('auth_gssapi')
.with_ssl_content(%r{^\s*GssapiCredStore keytab:/etc/httpd/conf/http.keytab$})
.with_ssl_content(%r{^\s*GssapiCredStore keytab:#{keytab_path}$})
.with_ssl_content(/^\s*require pam-account foreman$/)
end

Expand Down
2 changes: 1 addition & 1 deletion templates/auth_gssapi.conf.erb
View file
Open in desktop
Expand Up @@ -3,7 +3,7 @@
SSLRequireSSL
AuthType GSSAPI
AuthName "GSSAPI Single Sign On Login"
GssapiCredStore keytab:<%= scope.lookupvar('foreman::http_keytab') %>
GssapiCredStore keytab:<%= @http_keytab %>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was about to say that this should have broken

puppet-foreman/spec/classes/foreman_config_ipa_spec.rb

Line 53 in 91850a2

.with_ssl_content(%r{^\s*GssapiCredStore keytab:/etc/httpd/conf/http.keytab$})

But we don't test this on Debian at all…

puppet-foreman/spec/classes/foreman_config_ipa_spec.rb

Line 5 in 91850a2

context "on #{os}", if: facts[:osfamily] == 'RedHat' do

Mind adding tests? :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I took the liberty of pushing some simple tests now ;)

GssapiSSLonly On
GssapiLocalName On
# require valid-user
Expand Down