2019 03 19 update ds create #49

Firstyear · 2019-03-28T00:51:43Z

This is a major update to the yast DS integration. This changes from the legacy perl setup, to the new python setup. It also is a large code cleanup and improvements to the process in general.

jreidinger · 2019-03-28T07:07:20Z

README.md

+
+/home/admin/local_ca/
+```


really nice howto. BTW what mean that last line with path? You can add some # comments there, so it is still executable.

There are some fixes on the certificate inclusion for the ds configuration in an other PR, are these included in this PR or are they irrelevant? #48

Those fixes will partially work, and will partially break. The Server-Cert change will break (basically, 389 expects it to be Server-Cert), but the "pkpass" change would work. So that PR will need a refactor I think in light of this change.

So thinking about it, a possible solution is to ask for the ca, cert and key all as .pem, then we do the pkcs12 generation on your behalf to guarantee it's named correctly?

jreidinger · 2019-03-28T07:09:29Z

README.md

+
+```
+rake test:unit


one trick to also check if package builds is local run of osc with rake osc:build

jreidinger · 2019-03-28T07:09:58Z

README.md

+```
+~/.y2log
+/var/log/YaST2/y2log


the first one is when you run as user and second when run as root.

jreidinger · 2019-03-28T07:10:46Z

README.md

+```
+
+For example logging you can execute YaST with debugging environment variables.


I do not get much this sentece. If you want to mention that you can enable debug logging with Y2DEBUG=1 I would write it more explicitely.

jreidinger · 2019-03-28T07:13:02Z

src/lib/authserver/dir/ds389.rb

@@ -9,20 +9,20 @@
 # this program; if not, contact SUSE LINUX GmbH.

 # Authors:      Howard Guo <hguo@suse.com>
+#               William Brown <wbrown@suse.de>


btw we are slightly moving away from this practice as git blame or git log or github contributors already provide this info.

jreidinger · 2019-03-28T07:17:36Z

src/lib/authserver/dir/ds389.rb

+
+[backend-userroot]
+sample_entries = yes
+suffix = #{suffix}


just hint, you can use e.g. ERB files https://www.stuartellis.name/articles/erb/ to have it as separate file.

This is too complex for me at the moment, as I don't know that much. I'd rather do a change like that in a follow up.

jreidinger · 2019-03-28T08:03:41Z

src/lib/authserver/dir/ds389.rb

+    stdin, stdouterr, result = Open3.popen2e('/usr/sbin/dscreate', '-v', 'from-file', '-n', DS_SETUP_INI_PATH)
+    stdouterr.readlines.map { |l| append_to_log(l) }
+
+    if result.value.exitstatus != 0


above your append to log do only debug logging. So in case of failure. I really suggest here to log to info or warn when customers report a bug, it is useful.

jreidinger · 2019-03-28T08:26:30Z

src/lib/authserver/ui/new_dir_inst.rb

-      if !ok
-        Popup.Error(_('Failed to enable TLS! Log output may be found in %s') % [DS_SETUP_LOG_PATH])
-        raise
+        Popup.Error(_('Failed to set up new instance! Log output may be found in ~/.y2log or /var/log/YaST/y2log'))


it is message for user. So I would mention only /var/log/YaST/y2log as in production this module runs as root.

Firstyear · 2019-03-29T03:17:15Z

Updated based on feedback.

pzirnik · 2019-03-29T11:12:49Z

I am ok with it and drop my changes, however i do miss following:

looks like ldap and kerberos services are not enabled, should not YaST take care of it ?
run of kdb5_util requires krb5.conf and kdc.conf in place
debug output for kdb5_ldap_util is still active ?
the user is not asked for the password to import his pk12 file
how is the "pwdfile.txt" created ?
should the CA not be installed into Systems CA store and a ldap.conf be created, that commandline ldap tools do work with TLS ? (for example YaST2 Users will try to use TLS if possible and will fail because of no trust)
If the cert is required to be named "Server-Cert" either we need to take care to name it this way or let the user know this requirement ?

Firstyear · 2019-04-01T00:20:37Z

I am ok with it and drop my changes, however i do miss following:
* looks like ldap and kerberos services are not enabled, should not YaST take care of it ?

dscreate does the systemctl enable for 389, I am not aware of what kerberos is doing ...

* run of kdb5_util requires krb5.conf and kdc.conf in place

I'm not really sure about the kerberos parts here, my goal in this PR is to make 389 work correctly.

* debug output for kdb5_ldap_util is still active ?

See above, only interest in this PR is making 389 work. If there are krb issues, we should open new issues.

* the user is not asked for the password to import his pk12 file

No, the current assumption is there is no p12 password (as has been for a long time). There was a seperate pr that allowed requesting the p12 password, and I'd like to integrate that in the future as an option.

* how is the "pwdfile.txt" created ?

dscreate generates it as part of the installation process.

* should the CA not be installed into Systems CA store and a ldap.conf be created, that commandline ldap tools do work with TLS ? (for example YaST2 Users will try to use TLS if possible and will fail because of no trust)

No, that's an "auth client" configuration concern. Not a server install concern.

* If the cert is required to be named "Server-Cert" either we need to take care to name it this way or let the user know this requirement ?

Yes, for the moment the UI now lists that it must be named Server-Cert, however, a current thought is that we should allow the user to submit PEM formatted key/cert, and we generate the p12 for import into certutil.

Firstyear · 2019-04-02T00:06:03Z

Hey there, @jreidinger I think I have addressed all your comments, do you mind reviewing again?

Firstyear · 2019-04-02T22:21:55Z

Thanks for the approval! Do you mind merging this (squash + merge if possible).

jreidinger · 2019-04-03T06:14:37Z

@Firstyear well, you should be able to do it yourself. If not, I will add you as owner to those repos you maintain.

Firstyear · 2019-04-03T23:42:14Z

I can't do it myself, that's why I was asking :) if you could add me as owner, that would be great. I should ask my team also who else may need access as there was some offers of assistance within the samba team at suse labs to help with this.

jreidinger · 2019-04-04T07:16:43Z

@Firstyear done, you should get invitation which will grant you admin right. So you can add also another contributors.

yast-bot · 2019-04-04T23:45:35Z

✔️ Public Jenkins job #6 successfully finished

* Update ds installer based on latest python tooling for ds packages, as supported by upstream.

lslezak and others added 9 commits March 21, 2019 10:02

Merge pull request yast#47 from hellcp/master

4ac0c36

Update ds installer

ee2020d

Updates

1ff486d

Fix tests

8d9ccd8

Fix logging, but process still mystery dies.

e4ff296

Fix something

9db298f

99% working!

eed01a0

Its alive!

75471de

Fix whitespace

b6cc694

jreidinger reviewed Mar 28, 2019

View reviewed changes

README.md

```

rake test:unit

Copy link

Member

jreidinger Mar 28, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one trick to also check if package builds is local run of osc with rake osc:build

jreidinger reviewed Mar 28, 2019

View reviewed changes

README.md

```

~/.y2log

/var/log/YaST2/y2log

Copy link

Member

jreidinger Mar 28, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the first one is when you run as user and second when run as root.

jreidinger reviewed Mar 28, 2019

View reviewed changes

Update based on reviewer feedback

9dcdb54

Firstyear mentioned this pull request Mar 29, 2019

Fixes to make the YaST modules work #48

Closed

jreidinger approved these changes Apr 2, 2019

View reviewed changes

Firstyear merged commit 90458a6 into yast:master Apr 4, 2019

Firstyear deleted the 2019-03-19-update-ds-create branch April 4, 2019 23:44

Firstyear added a commit to Firstyear/yast-auth-server that referenced this pull request Jul 2, 2019

2019 03 19 update ds create (yast#49)

9f9f06c

* Update ds installer based on latest python tooling for ds packages, as supported by upstream.

kobliha mentioned this pull request Jan 30, 2020

Users - LDAP module may not be functional with 389-ds yast/yast-users#222

Closed

jreidinger pushed a commit that referenced this pull request Jan 30, 2020

2019 03 19 update ds create (#49)

47302a5

* Update ds installer based on latest python tooling for ds packages, as supported by upstream.

jreidinger mentioned this pull request Jan 30, 2020

Backport to sp1 #57

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

2019 03 19 update ds create #49

2019 03 19 update ds create #49

Firstyear commented Mar 28, 2019

jreidinger Mar 28, 2019

hcderaad Mar 28, 2019

Firstyear Mar 29, 2019

Firstyear Mar 29, 2019

jreidinger Mar 28, 2019

jreidinger Mar 28, 2019

jreidinger Mar 28, 2019

jreidinger Mar 28, 2019

jreidinger Mar 28, 2019

Firstyear Mar 29, 2019

jreidinger Mar 28, 2019

jreidinger Mar 28, 2019

Firstyear commented Mar 29, 2019

pzirnik commented Mar 29, 2019

Firstyear commented Apr 1, 2019

Firstyear commented Apr 2, 2019

Firstyear commented Apr 2, 2019

jreidinger commented Apr 3, 2019

Firstyear commented Apr 3, 2019

jreidinger commented Apr 4, 2019

yast-bot commented Apr 4, 2019

		```

		For example logging you can execute YaST with debugging environment variables.


		/home/admin/local_ca/
		```

2019 03 19 update ds create #49

2019 03 19 update ds create #49

Conversation

Firstyear commented Mar 28, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Firstyear commented Mar 29, 2019

pzirnik commented Mar 29, 2019

Firstyear commented Apr 1, 2019

Firstyear commented Apr 2, 2019

Firstyear commented Apr 2, 2019

jreidinger commented Apr 3, 2019

Firstyear commented Apr 3, 2019

jreidinger commented Apr 4, 2019

yast-bot commented Apr 4, 2019