fixes #8278 - update foreman-prepare-realm for freeipa 4 #231

stbenjam · 2014-11-05T11:47:50Z

No description provided.

stbenjam · 2014-11-10T10:19:15Z

Updated according to @encukou's feedback on 78af1f7. Thanks!

stbenjam · 2014-11-13T12:13:19Z

To test this:

Install FreeIPA 4.x -- currently, only available on Fedora 21 beta (coming w/ CentOS 7.1)
1. yum install -y freeipa-server
2. ipa-server-install (answer questions, defaults are fine)
Checkout the smart-proxy git repo and bundle install and all that
Run foreman-prepare-realm admin realm-proxy
1. Give it the admin password you chose for FreeIPA
2. Ensure this completes without errors, and gives you a keytab path
Configure smart proxy realm.yml, giving it the path to the keytab
Start the Smart Proxy and add it to Foreman
Create the 'Realm' under the Infrastructure menu
Build a new foreman host, select a Realm
1. When it's done, ensure it's registered to FreeIPA
  1. Login to the FreeIPA web UI, and go to the hosts Tab
    1. FreeIPA will show Kerberos Key Present, Host Provisioned in the details page
Delete the host from foreman, ensure deleted from FreeIPA as well

stbenjam · 2014-11-13T12:15:22Z

I also always run into this on fresh vm's, while ipa-server-install is running, you may want to wget a large ISO in the background to generate some entropy so it can create the kerberos container, otherwise it will take ages

encukou · 2014-11-13T12:22:56Z

Or if it's just for testing purposes: https://copr.fedoraproject.org/coprs/pviktori/breakmycryptod/

lzap · 2014-11-14T16:04:43Z

I am setting up to test this patch, will get back to that next week.

lzap · 2014-11-20T12:59:21Z

sbin/foreman-prepare-realm

- --permissions='modify services' --permissions='manage service keytab' --permission="read dns entries" \
- --permission="remove dns entries" --permission="add dns entries" --permission="update dns entries"
+
+if [ "$PERMISSION_SYSTEM" -eq "v1"];


Missing space which is a shell parsing error. Also I don't understand numeric comparison of string. Can you ellaborate?

I think you need to have

if [ "$PERMISSION_SYSTEM" == "v1" ]; then

What do you mean numeric comparison?

Yeah, I know this is /bin/bash, but a single "=" is POSIX compatible, "==" is a bash-ism. I'll get my coat...

Ah I see, I didn't realize -eq was different than ==, nor did I get this error when I ran it, strange. Thanks!

lzap · 2014-11-20T12:59:31Z

Ok finally I get to this, sorry for the delay. Was testing against F21 server on RHEL7 client which I added via --server and --domain options.

[root@hp-sl2x160zg6-01 ~]# bash foreman-prepare-realm admin realm-proxy
Password for admin@LAB.BOS.REDHAT.COM: 
---------------------------------------------
Added privilege "Smart Proxy Host Management"
---------------------------------------------
  Privilege name: Smart Proxy Host Management
  Description: Smart Proxy Host Management
foreman-prepare-realm: line 43: [: missing `]'
Usage: ipa [global-options] permission-add NAME [options]

ipa: error: no such option: --right
  Privilege name: Smart Proxy Host Management
  Description: Smart Proxy Host Management
  Permissions: System: Manage Host Enrollment Password, System: Remove DNS Entries, System: Modify Hosts, System: Manage
               Service Keytab, System: Manage Host Certificates, System: Add DNS Entries, System: Modify Services, System:
               Manage Host Keytab, Retrieve Certificates from the CA, System: Update DNS Entries, System: Remove Hosts
  Failed members: 
    permission: Add Host Enrollment Password: permission not found
------------------------------
Number of permissions added 11
------------------------------
-------------------------------------
Added role "Smart Proxy Host Manager"
-------------------------------------
  Role name: Smart Proxy Host Manager
  Description: Smart Proxy management
  Role name: Smart Proxy Host Manager
  Description: Smart Proxy management
  Privileges: Smart Proxy Host Management
----------------------------
Number of privileges added 1
----------------------------
------------------------
Added user "realm-proxy"
------------------------
  User login: realm-proxy
  First name: Smart
  Last name: Proxy
  Full name: Smart Proxy
  Display name: Smart Proxy
  Initials: SP
  Home directory: /home/realm-proxy
  GECOS: Smart Proxy
  Login shell: /bin/sh
  Kerberos principal: realm-proxy@LAB.BOS.REDHAT.COM
  Email address: realm-proxy@lab.bos.redhat.com
  UID: 21000001
  GID: 21000001
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False
  Role name: Smart Proxy Host Manager
  Description: Smart Proxy management
  Member users: realm-proxy
  Privileges: Smart Proxy Host Management
-------------------------
Number of members added 1
-------------------------
Keytab successfully retrieved and stored in: freeipa.keytab
Realm Proxy User:    realm-proxy
Realm Proxy Keytab:  /root/freeipa.keytab

lzap · 2014-11-20T13:04:18Z

sbin/foreman-prepare-realm

+    --permission='modify services' --permission='manage service keytab' --permission='read dns entries' \
+    --permission='remove dns entries' --permission='add dns entries' --permission='update dns entries'
+else
+  ipa permission-add 'Add Host Enrollment Password' --right='add' --type='host' --attrs='userpassword'


The ipa client from RHEL7 does not understand the --right option.

Thanks, good catch, reverted back to permission then

stbenjam · 2014-11-20T13:11:39Z

Thanks @lzap, updated!

stbenjam · 2014-11-20T13:14:09Z

You will also run into this on RHEL 7.0: https://bugzilla.redhat.com/show_bug.cgi?id=1122140

lzap · 2014-11-20T13:23:57Z

Ok this works fine on both RHEL6 and 7.

lzap · 2014-11-20T14:21:48Z

Thank you for your contribution, merged as 2bd70b7.

theforeman-bot added Needs testing Not yet reviewed labels Nov 5, 2014

stbenjam force-pushed the 8278 branch from 78af1f7 to 073993b Compare November 10, 2014 10:16

lzap reviewed Nov 20, 2014
View reviewed changes

fixes #8278 - update foreman-prepare-realm for freeipa 4

9e95fec

stbenjam force-pushed the 8278 branch from 073993b to 9e95fec Compare November 20, 2014 13:10

lzap closed this Nov 20, 2014

lzap mentioned this pull request Nov 20, 2014

fixes #7197 - add man page for foreman-prepare-realm #230

Closed

fixes #8278 - update foreman-prepare-realm for freeipa 4 #231

fixes #8278 - update foreman-prepare-realm for freeipa 4 #231

stbenjam commented Nov 5, 2014

stbenjam commented Nov 10, 2014

stbenjam commented Nov 13, 2014

stbenjam commented Nov 13, 2014

encukou commented Nov 13, 2014

lzap commented Nov 14, 2014

lzap Nov 20, 2014

lzap Nov 20, 2014

stbenjam Nov 20, 2014

domcleal Nov 20, 2014

stbenjam Nov 20, 2014

lzap commented Nov 20, 2014

lzap Nov 20, 2014

stbenjam Nov 20, 2014

stbenjam commented Nov 20, 2014

stbenjam commented Nov 20, 2014

lzap commented Nov 20, 2014

lzap commented Nov 20, 2014

fixes #8278 - update foreman-prepare-realm for freeipa 4 #231

fixes #8278 - update foreman-prepare-realm for freeipa 4 #231

Conversation

stbenjam commented Nov 5, 2014

stbenjam commented Nov 10, 2014

stbenjam commented Nov 13, 2014

stbenjam commented Nov 13, 2014

encukou commented Nov 13, 2014

lzap commented Nov 14, 2014

lzap Nov 20, 2014

Choose a reason for hiding this comment

lzap Nov 20, 2014

Choose a reason for hiding this comment

stbenjam Nov 20, 2014

Choose a reason for hiding this comment

domcleal Nov 20, 2014

Choose a reason for hiding this comment

stbenjam Nov 20, 2014

Choose a reason for hiding this comment

lzap commented Nov 20, 2014

lzap Nov 20, 2014

Choose a reason for hiding this comment

stbenjam Nov 20, 2014

Choose a reason for hiding this comment

stbenjam commented Nov 20, 2014

stbenjam commented Nov 20, 2014

lzap commented Nov 20, 2014

lzap commented Nov 20, 2014