March 2011 - YaST Commits - openSUSE Mailing Lists

[yast-commit] r63620 - /tags/branch-Code-11-SP2-2_17_24/
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:34:51 2011 New Revision: 63620 URL: http://svn.opensuse.org/viewcvs/yast?rev=63620&view=rev Log: Created tag branch-Code-11-SP2-2_17_24 Added: tags/branch-Code-11-SP2-2_17_24/ -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63619 - in /branches/SuSE-Code-11-SP2-Branch/ldap-client: VERSION package/yast2-ldap-client.changes src/Ldap.ycp
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:34:46 2011 New Revision: 63619 URL: http://svn.opensuse.org/viewcvs/yast?rev=63619&view=rev Log: - backport sssd from 11.4 to SP2 - architecture dependent packages for sssd - 2.17.24 Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/VERSION branches/SuSE-Code-11-SP2-Branch/ldap-client/package/yast2-ldap-client.changes branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/VERSION URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/VERSION (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/VERSION Fri Mar 18 17:34:46 2011 @@ -1 +1 @@ -2.17.23 +2.17.24 Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/package/yast2-ldap-client.changes URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/package/yast2-ldap-client.changes (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/package/yast2-ldap-client.changes Fri Mar 18 17:34:46 2011 @@ -1,4 +1,36 @@ ------------------------------------------------------------------- +Fri Mar 18 17:33:17 CET 2011 - jsuchome(a)suse.cz + +- architecture dependent packages for sssd +- 2.17.24 + +------------------------------------------------------------------- +Fri Mar 18 15:58:31 CET 2011 - jsuchome(a)suse.cz + +- added command line options for SSSD (bnc#680848) +- if sssd is removed in GUI, remove also the pam module (bnc#680184) +- reset connection when TLS status has been changed (bnc#662949) +- do not add +-lines when configuring sssd (bnc#668565) +- install correct package for Kerberos (krb5-client) +- read cache_credentials value from sssd.conf +- look for 'sss' in nsswitch.conf, not for 'sssd' (bnc#666184) +- explicitely ask for kerberos+sssd enablement +- if sssd is active, ask for basic Kerberos settings (fate#308902) +- write default_realm as realm +- remove pam_krb5 when sssd is configured (fate#308902) +- pass certificate data to .ldap agent (bnc#662949) +- write uri instead of just host name to ldap.conf and sssd.conf + (bnc#663012) +- call c_rehash after downloading certificate (bnc#662937) +- do not write into sssd.conf when it does not exist (bnc#662963) +- ensure that sssd config file is written before starting service +- added support for SSSD (fate#308902) +- save certificate info to /etc/openldap/ldap.conf (bnc#629549) +- added UI for downloading CA certificates, enable editing of + certificate directory (bnc#574704) +- use crypt for pam_password if exop is not supported (bnc#546398) + +------------------------------------------------------------------- Tue Mar 8 14:58:01 CET 2011 - jsuchome(a)suse.cz - check if OES is there during autoinstallation (bnc#670288) Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Fri Mar 18 17:34:46 2011 @@ -303,8 +303,13 @@ "ppc64" : [ "nss_ldap-32bit" ], "s390_64" : [ "nss_ldap-32bit" ], "x86_64" : [ "nss_ldap-32bit" ], - - ] + ], + "sssd" : $[ + "ia64" : [ "sssd-x86" ], + "ppc64" : [ "sssd-32bit" ], + "s390_64" : [ "sssd-32bit" ], + "x86_64" : [ "sssd-32bit" ], + ], ]; /** -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63618 - /branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ldap.ycp
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:25:37 2011 New Revision: 63618 URL: http://svn.opensuse.org/viewcvs/yast?rev=63618&view=rev Log: added command line options for SSSD (bnc#680848) Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ldap.ycp Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ldap.ycp Fri Mar 18 17:25:37 2011 @@ -93,6 +93,50 @@ } } + if (options["sssd"]:"" != "") + { + boolean sssd = (options["sssd"]:"" == "yes"); + if (Ldap::sssd != sssd) + { + Ldap::sssd = sssd; + Ldap::modified = true; + } + } + + if (options["cache_credentials"]:"" != "") + { + boolean cache_credentials = (options["cache_credentials"]:"" == "yes"); + if (Ldap::sssd_cache_credentials!= cache_credentials) + { + Ldap::sssd_cache_credentials= cache_credentials; + Ldap::modified = true; + } + } + + if (options["realm"]:"" != "") + { + string realm = options["realm"]:""; + if (Ldap::krb5_realm != realm) + { + Ldap::krb5_realm = realm; + Ldap::modified = true; + } + } + if (options["kdc"]:"" != "") + { + string kdc = options["kdc"]:""; + if (Ldap::krb5_kdcip != kdc) + { + Ldap::krb5_kdcip = kdc; + Ldap::modified = true; + } + } + + if (Ldap::krb5_kdcip != "" && Ldap::krb5_realm != "") + { + Ldap::sssd_with_krb = true; + } + if (haskey (options, "createconfig")) { if (Ldap::bind_pass == nil) @@ -202,14 +246,38 @@ "type" : "enum", "typespec" : [ "yes", "no" ], ], + "sssd" : $[ + // help text for the 'sssd' option + "help" : _("Use System Security Services Daemon (SSSD)"), + "type" : "enum", + "typespec" : [ "yes", "no" ], + ], + "cache_credentials" : $[ + // help text for the 'cache_credentials' option + "help" : _("SSSD Offline Authentication"), + "type" : "enum", + "typespec" : [ "yes", "no" ], + ], + "realm" :$[ + // command line help text for the 'realm' option + "help" : _("Kerberos Realm"), + "type" : "string" + ], + "kdc" :$[ + // command line help text for the 'kdc' option + "help" : _("KDC Server Address"), + "type" : "string" + ], ], "mappings" : $[ "pam" : [ "enable", "disable", "server", "base", - "createconfig", "ldappw", "automounter", "mkhomedir", "tls" + "createconfig", "ldappw", "automounter", "mkhomedir", "tls", + "sssd", "realm", "kdc", "cache_credentials" ], "summary" : [], "configure" : [ "server", "base", "createconfig", "ldappw", - "automounter", "mkhomedir", "tls" + "automounter", "mkhomedir", "tls", + "sssd", "realm", "kdc", "cache_credentials" ], ] ]; -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63617 - /branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:24:50 2011 New Revision: 63617 URL: http://svn.opensuse.org/viewcvs/yast?rev=63617&view=rev Log: if sssd is removed in GUI, remove also the pam module (bnc#680184) Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Fri Mar 18 17:24:50 2011 @@ -2698,6 +2698,11 @@ { Pam::Add ("ldap"); } + // sss was removed, using pam_ldap (bnc#680184) + if (Pam::Enabled ("sss")) + { + Pam::Remove ("sss"); + } // modify sources in /etc/nsswitch.conf Nsswitch::WriteDb ("passwd", ["compat"]); -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63616 - in /branches/SuSE-Code-11-SP2-Branch/ldap-client: src/Ldap.ycp src/ui.ycp yast2-ldap-client.spec.in
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:23:19 2011 New Revision: 63616 URL: http://svn.opensuse.org/viewcvs/yast?rev=63616&view=rev Log: reset connection when TLS status has been changed (bnc#662949) Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp branches/SuSE-Code-11-SP2-Branch/ldap-client/yast2-ldap-client.spec.in Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Fri Mar 18 17:23:19 2011 @@ -273,6 +273,9 @@ global boolean ldap_initialized = false; + // was LDAP connection initialized with TLS? + global boolean tls_when_initialized = false; + /** * If false, do not read settings already set from outside * used e.g. for Users YaPI. see bug #60898 @@ -1125,6 +1128,14 @@ } /** + * Shut down existing LDAP connection + */ + global define boolean LDAPClose () { + ldap_initialized = false; + return (boolean) SCR::Execute (.ldap.close); + } + + /** * Initializes LDAP agent */ global define string LDAPInit () ``{ @@ -1148,6 +1159,7 @@ else { ldap_initialized = init; + tls_when_initialized= ldap_tls; if (!init) { ret = LDAPError(); @@ -1162,6 +1174,10 @@ */ global define boolean ConnectWithoutTLS (map errmap) { + string details = errmap["msg"]:""; + if (errmap["server_msg"]:"" != "") + details = sformat ("%1\n%2", details, errmap["server_msg"]:""); + UI::OpenDialog (`HBox(`HSpacing (0.5), `VBox( `VSpacing (0.5), @@ -1196,8 +1212,10 @@ if (ret == `details) { if ((boolean)UI::QueryWidget (`id(`details), `Value)) - UI::ReplaceWidget (`id(`rp), `VBox ( - `Label (errmap["msg"]:""))); + { + + UI::ReplaceWidget (`id(`rp), `VBox (`Label (details))); + } else UI::ReplaceWidget (`id(`rp), `Empty()); } @@ -1258,6 +1276,7 @@ } } ldap_initialized = init; + tls_when_initialized= args["use_tls"]:"no" == "yes"; } return ret; } Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp Fri Mar 18 17:23:19 2011 @@ -368,6 +368,10 @@ if (result == `fetch) { Ldap::tls_switched_off = false; + if (Ldap::ldap_initialized && Ldap::tls_when_initialized != ldap_tls) + { + Ldap::LDAPClose (); + } string dn = Ldap::ldap_initialized ? LdapPopup::BrowseTree ("") : LdapPopup::InitAndBrowseTree ("", $[ @@ -763,15 +767,12 @@ if (base_dn == "") return; - if (Ldap::ldap_initialized || true == SCR::Execute (.ldap, $[ - "hostname" : Ldap::GetFirstServer (Ldap::server), - "port" : Ldap::GetFirstPort (Ldap::server), - "version" : Ldap::ldap_v2 ? 2 : 3, - "use_tls" : Ldap::ldap_tls ? "yes" : "no", - "cacertdir" : Ldap::tls_cacertdir, - "cacertfile": Ldap::tls_cacertfile - ]) - ) + if (Ldap::ldap_initialized && Ldap::tls_when_initialized != Ldap::ldap_tls) + { + Ldap::LDAPClose (); + } + + if (Ldap::ldap_initialized || Ldap::LDAPInit () == "") { ppolicies_enabled = (boolean) SCR::Execute (.ldap.ppolicy, $[ "hostname" : Ldap::GetFirstServer (Ldap::server), @@ -1091,6 +1092,10 @@ if (is (result, symbol) && contains ([`br, `br_passwd, `br_shadow, `br_group ], (symbol)result)) { + if (Ldap::ldap_initialized && Ldap::tls_when_initialized != Ldap::ldap_tls) + { + Ldap::LDAPClose (); + } string dn = Ldap::ldap_initialized ? LdapPopup::BrowseTree (base_dn) : LdapPopup::InitAndBrowseTree (base_dn, $[ Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/yast2-ldap-client.spec.in URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/yast2-ldap-client.spec.in (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/yast2-ldap-client.spec.in Fri Mar 18 17:23:19 2011 @@ -11,8 +11,8 @@ Requires: yast2-network -# removed lowercasing of LDAP object names -Requires: yast2-ldap >= 2.17.1 +# .close +Requires: yast2-ldap >= 2.17.4 # new API of Pam.ycp Requires: yast2-pam >= 2.14.0 -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63615 - /branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:20:35 2011 New Revision: 63615 URL: http://svn.opensuse.org/viewcvs/yast?rev=63615&view=rev Log: do not add +-lines when configuring sssd (bnc#668565) Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Fri Mar 18 17:20:35 2011 @@ -2782,7 +2782,7 @@ } } - if (start) + if (start && !sssd) WritePlusLine (login_enabled); // -------------------- start services -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63614 - /branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:19:14 2011 New Revision: 63614 URL: http://svn.opensuse.org/viewcvs/yast?rev=63614&view=rev Log: - install correct package for Kerberos (krb5-client) - read cache_credentials value from sssd.conf Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Fri Mar 18 17:19:14 2011 @@ -319,7 +319,7 @@ global list<string> sssd_packages = [ "sssd" ]; // packages needed for sssd + kerberos configuration - global list<string> kerberos_packages = [ "kerberos-client" ]; + global list<string> kerberos_packages = [ "krb5-client" ]; // if sssd is used instead of pam_ldap/nss_ldap (fate#308902) global boolean sssd = true; @@ -935,6 +935,8 @@ string kdc = (string) SCR::Read (add (domain, "krb5_kdcip")); if (kdc != nil) krb5_kdcip = kdc; + + sssd_cache_credentials = SCR::Read (add (domain, "cache_credentials")) == "True"; } if (krb5_realm != "" && krb5_kdcip != "") { -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63613 - /branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:16:48 2011 New Revision: 63613 URL: http://svn.opensuse.org/viewcvs/yast?rev=63613&view=rev Log: look for 'sss' in nsswitch.conf, not for 'sssd' (bnc#666184) Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Fri Mar 18 17:16:48 2011 @@ -779,7 +779,7 @@ else { // ... or as 'sssd' - start = contains (nsswitch["passwd"]:[], "sssd"); + start = contains (nsswitch["passwd"]:[], "sss"); } // nothing is configured, but some packages are installed -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63612 - in /branches/SuSE-Code-11-SP2-Branch/ldap-client: src/Ldap.ycp src/ui.ycp testsuite/tests/Read.out
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:15:48 2011 New Revision: 63612 URL: http://svn.opensuse.org/viewcvs/yast?rev=63612&view=rev Log: explicitely ask for kerberos+sssd enablement Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.out Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Fri Mar 18 17:15:48 2011 @@ -318,12 +318,18 @@ // packages needed for sssd configuration global list<string> sssd_packages = [ "sssd" ]; + // packages needed for sssd + kerberos configuration + global list<string> kerberos_packages = [ "kerberos-client" ]; + // if sssd is used instead of pam_ldap/nss_ldap (fate#308902) global boolean sssd = true; // enable/disable offline authentication ('cache_credentials' key) global boolean sssd_cache_credentials = false; + // if kerberos should be set up for sssd + global boolean sssd_with_krb = false; + // Kerberos default realm (for sssd) global string krb5_realm = ""; @@ -418,8 +424,12 @@ global define map AutoPackages() ``{ if (start) + { required_packages = (list<string>) union (required_packages, sssd ? sssd_packages : pam_nss_packages); + if (sssd_with_krb) + required_packages = (list<string>) union (required_packages, kerberos_packages); + } list<string> install_pkgs = UpdatedArchPackages (required_packages); list remove_pkgs = []; @@ -911,7 +921,7 @@ Autologin::Read (); - if (true || Pam::Enabled("krb5")) + if (Pam::Enabled ("krb5")) { ReadKrb5Conf (); } @@ -926,6 +936,10 @@ if (kdc != nil) krb5_kdcip = kdc; } + if (krb5_realm != "" && krb5_kdcip != "") + { + sssd_with_krb = true; + } // Now check if previous configuration of LDAP server didn't proposed // some better values: @@ -2121,7 +2135,7 @@ } // In a mixed Kerberos/LDAP setup the following changes are needed in the [domain/default] section: - if (krb5_realm != "" && krb5_kdcip != "") + if (sssd_with_krb) { SCR::Write (add (domain, "auth_provider"), "krb5"); SCR::Write (add (domain, "chpass_provider"), "krb5"); @@ -2913,6 +2927,9 @@ list<string> needed_packages = sssd? UpdatedArchPackages (sssd_packages) : UpdatedArchPackages (pam_nss_packages); + if (sssd_with_krb) + needed_packages = (list<string>) union ( + needed_packages, UpdatedArchPackages (kerberos_packages)); if (_start_autofs && !Package::Installed("autofs")) { Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp Fri Mar 18 17:15:48 2011 @@ -514,6 +514,9 @@ list<string> needed_packages = Ldap::sssd ? Ldap::UpdatedArchPackages (Ldap::sssd_packages) : Ldap::UpdatedArchPackages (Ldap::pam_nss_packages); + if (Ldap::sssd_with_krb) + needed_packages = (list<string>) union ( + needed_packages, Ldap::UpdatedArchPackages (Ldap::kerberos_packages)); if (start && !Package::InstalledAll (needed_packages)) { @@ -715,6 +718,7 @@ boolean sssd = Ldap::sssd; string krb5_realm = Ldap::krb5_realm; string krb5_kdcip = Ldap::krb5_kdcip; + boolean sssd_with_krb = Ldap::sssd_with_krb; list<term>member_attributes = [ `item (`id("member"), "member", member_attribute == "member"), @@ -879,6 +883,9 @@ return // frame label `Frame (_("Basic Kerberos Settings"), `HBox (`HSpacing (1), `VBox ( + // checkbox label + `Left (`CheckBox (`id (`sssd_with_krb), `opt (`notify), _("&Use Kerberos"), sssd_with_krb)), + `VSpacing(0.4), // textentry label `TextEntry (`id (`krb5_realm), _("Default Real&m"), krb5_realm), // textentry label @@ -932,6 +939,11 @@ UI::ReplaceWidget (`tabContents, cont); if (has_tabs) UI::ChangeWidget (`id (`tabs), `CurrentItem, `client); + if (sssd) + { + UI::ChangeWidget (`id (`krb5_realm), `Enabled, sssd_with_krb); + UI::ChangeWidget (`id (`krb5_kdcip), `Enabled, sssd_with_krb); + } } define void set_admin_term () { @@ -1105,6 +1117,12 @@ sssd = (boolean) UI::QueryWidget (`id (`sssd), `Value); UI::ReplaceWidget (`id (`rp_frame), sssd ? get_frame_krb () : get_frame_nss ()); } + if (result == `sssd_with_krb) + { + sssd_with_krb = (boolean) UI::QueryWidget (`id (`sssd_with_krb), `Value); + UI::ChangeWidget (`id (`krb5_realm), `Enabled, sssd_with_krb); + UI::ChangeWidget (`id (`krb5_kdcip), `Enabled, sssd_with_krb); + } if (result == `br_tls_cacertdir) { string dir = UI::AskForExistingDirectory (tls_cacertdir, _("Choose the directory with certificates")); @@ -1279,6 +1297,8 @@ Ldap::ppolicies[dn] = pp; } }); + if (krb5_realm == "" || krb5_kdcip == "" || !sssd) + sssd_with_krb = false; if (Ldap::GetMainConfigDN() != base_config_dn || Ldap::bind_dn != bind_dn || @@ -1312,6 +1332,7 @@ Ldap::sssd = sssd; Ldap::krb5_realm = krb5_realm; Ldap::krb5_kdcip = krb5_kdcip; + Ldap::sssd_with_krb = sssd_with_krb; Ldap::modified = true; } break; Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.out URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.out (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.out Fri Mar 18 17:15:48 2011 @@ -16,8 +16,6 @@ Read .etc.ldap_conf.v."/etc/ldap.conf"."nss_map_attribute" 0 Execute .passwd.init $["base_directory":"/etc"] true Read .passwd.passwd.pluslines ["+"] -Read .etc.krb5_conf.v.libdefaults.default_realm ["SUSE.CZ"] -Read .etc.krb5_conf.v."SUSE.CZ"."kdc" ["kdc.suse.cz"] Return true Dump ============================================ Dump ldap used: -true- -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] r63611 - in /branches/SuSE-Code-11-SP2-Branch/ldap-client: src/Ldap.ycp src/ui.ycp testsuite/tests/Export.out testsuite/tests/Export.ycp testsuite/tests/Read.out testsuite/tests/Read.ycp
by jsuchome＠svn2.opensuse.org 18 Mar '11

18 Mar '11

Author: jsuchome Date: Fri Mar 18 17:09:18 2011 New Revision: 63611 URL: http://svn.opensuse.org/viewcvs/yast?rev=63611&view=rev Log: if sssd is active, ask for basic Kerberos settings (fate#308902) Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Export.out branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Export.ycp branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.out branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.ycp Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/Ldap.ycp Fri Mar 18 17:09:18 2011 @@ -324,6 +324,12 @@ // enable/disable offline authentication ('cache_credentials' key) global boolean sssd_cache_credentials = false; + // Kerberos default realm (for sssd) + global string krb5_realm = ""; + + // adress of KDC (key distribution centre) server for default realm + global string krb5_kdcip = ""; + //---------------------------------------------------------------- /** @@ -450,6 +456,8 @@ tls_checkpeer = settings ["tls_checkpeer"]:"yes"; mkhomedir = settings ["mkhomedir"]:mkhomedir; sssd = settings ["sssd"]:sssd; + krb5_realm = settings ["krb5_realm"]:krb5_realm; + krb5_kdcip = settings ["krb5_kdcip"]:krb5_kdcip; if (_start_autofs) required_packages = (list<string>) union (required_packages, ["autofs"]); @@ -492,7 +500,7 @@ "create_ldap" : create_ldap, "login_enabled" : login_enabled, "mkhomedir" : mkhomedir, - "sssd" : sssd + "sssd" : sssd, ]; if (tls_checkpeer != "yes") e["tls_checkpeer"] = tls_checkpeer; @@ -508,6 +516,10 @@ e["nss_base_group"] = nss_base_group; if (_autofs_allowed) e["start_autofs"] = _start_autofs; + if (krb5_realm != "") + e["krb5_realm"] = krb5_realm; + if (krb5_kdcip != "") + e["krb5_kdcip"] = krb5_kdcip; return e; } @@ -578,6 +590,26 @@ /* ------------- read/write functions ------------------------------- */ /** + * For sssd, some kerberos values are needed + */ + global boolean ReadKrb5Conf () + { + + list<string> realm = (list<string>) SCR::Read (.etc.krb5_conf.v.libdefaults.default_realm); + if (realm == nil) + realm = []; + krb5_realm = realm[0]:""; + + list<string> kdcs = (list<string>) SCR::Read (add (add (.etc.krb5_conf.v, krb5_realm), "kdc")); + if (kdcs == nil) + kdcs = []; + krb5_kdcip = mergestring (kdcs, " "); + + return true; + } + + + /** * Read single entry from /etc/ldap.conf file * @param entry entry name * @param defvalue default value if entry is not present @@ -879,6 +911,21 @@ Autologin::Read (); + if (true || Pam::Enabled("krb5")) + { + ReadKrb5Conf (); + } + if (FileUtils::Exists ("/etc/sssd/sssd.conf")) + { + // read realm and kdc from sssd.conf if available + path domain = add (.etc.sssd_conf.v, "domain/default"); + string realm = (string) SCR::Read (add (domain, "krb5_realm")); + if (realm != nil) + krb5_realm = realm; + string kdc = (string) SCR::Read (add (domain, "krb5_kdcip")); + if (kdc != nil) + krb5_kdcip = kdc; + } // Now check if previous configuration of LDAP server didn't proposed // some better values: @@ -2074,31 +2121,13 @@ } // In a mixed Kerberos/LDAP setup the following changes are needed in the [domain/default] section: - if (Pam::Enabled("krb5")) + if (krb5_realm != "" && krb5_kdcip != "") { -// FIXME: do not test for pam, it may be already off... SCR::Write (add (domain, "auth_provider"), "krb5"); SCR::Write (add (domain, "chpass_provider"), "krb5"); - /* - FIXME how to read krb settings: - a) use agent directly (moved out from yast2-kerberos-client) - b) use Read + Export of Kerberos.ycp - - * Set "krb5_kdcip" to the hostname of the kerberos kdc - * Set "krb5_realm" to kerberos realm - */ - if (Package::Installed ("yast2-kerberos-client")) - { - WFM::CallFunction ("kerberos-client_auto", ["Read"]); - any e = WFM::CallFunction ("kerberos-client_auto",["Export"]); - if (is (e,map) && e != $[]) - { - map kerberos = (map) e; - SCR::Write (add (domain, "krb5_realm"), kerberos["kerberos_client","default_realm"]:nil); - SCR::Write (add (domain, "krb5_kdcip"), kerberos["kerberos_client","kdc_server"]:nil); - } - } + SCR::Write (add (domain, "krb5_realm"), krb5_realm); + SCR::Write (add (domain, "krb5_kdcip"), krb5_kdcip); } else { Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/src/ui.ycp Fri Mar 18 17:09:18 2011 @@ -713,6 +713,8 @@ string tls_cacertdir = Ldap::tls_cacertdir; string tls_cacertfile = Ldap::tls_cacertfile; boolean sssd = Ldap::sssd; + string krb5_realm = Ldap::krb5_realm; + string krb5_kdcip = Ldap::krb5_kdcip; list<term>member_attributes = [ `item (`id("member"), "member", member_attribute == "member"), @@ -831,12 +833,8 @@ ); } - define void set_client_term () { - - term cont = `Top (`HBox(`HSpacing (5), `VBox( - `VSpacing(0.4), - `Left (`CheckBox (`id (`sssd), `opt (`notify), _("Use S&ystem Security Services Daemon (SSSD)"), sssd)), - `VSpacing(0.4), + term get_frame_nss () { + return // frame label `Frame (_("Naming Contexts"), `HBox( `HSpacing (1), `VBox( @@ -874,7 +872,28 @@ `VSpacing(0.4) ), `HSpacing (1) - )), + )); + } + + term get_frame_krb () { + return + // frame label + `Frame (_("Basic Kerberos Settings"), `HBox (`HSpacing (1), `VBox ( + // textentry label + `TextEntry (`id (`krb5_realm), _("Default Real&m"), krb5_realm), + // textentry label + `TextEntry (`id (`krb5_kdcip), _("&KDC Server Address"), krb5_kdcip), + `VSpacing (0.4) + ), `HSpacing (1))); + } + + define void set_client_term () { + + term cont = `Top (`HBox(`HSpacing (5), `VBox( + `VSpacing(0.4), + `Left (`CheckBox (`id (`sssd), `opt (`notify), _("Use S&ystem Security Services Daemon (SSSD)"), sssd)), + `VSpacing(0.4), + `ReplacePoint (`id (`rp_frame), `VBox (sssd ? get_frame_krb () : get_frame_nss ())), `VSpacing (0.4), `ComboBox (`id (`pam_password), `opt(`notify,`hstretch,`editable), // combobox label @@ -913,10 +932,6 @@ UI::ReplaceWidget (`tabContents, cont); if (has_tabs) UI::ChangeWidget (`id (`tabs), `CurrentItem, `client); - - foreach (symbol ui, [ `nss_base_passwd, `nss_base_group, `nss_base_shadow, `br_passwd, `br_shadow, `br_group ], { - UI::ChangeWidget (`id (ui), `Enabled, UI::QueryWidget (`id (`sssd), `Value) == false); - }); } define void set_admin_term () { @@ -1012,12 +1027,23 @@ if (current == `client) { member_attribute =(string)UI::QueryWidget(`id(`group_style),`Value); - nss_base_passwd = (string) - UI::QueryWidget(`id(`nss_base_passwd),`Value); - nss_base_shadow = (string) - UI::QueryWidget(`id(`nss_base_shadow),`Value); - nss_base_group = (string) - UI::QueryWidget(`id(`nss_base_group),`Value); + + if (sssd) + { + krb5_realm = (string) + UI::QueryWidget (`id (`krb5_realm), `Value); + krb5_kdcip = (string) + UI::QueryWidget (`id (`krb5_kdcip), `Value); + } + else + { + nss_base_passwd = (string) + UI::QueryWidget(`id(`nss_base_passwd),`Value); + nss_base_shadow = (string) + UI::QueryWidget(`id(`nss_base_shadow),`Value); + nss_base_group = (string) + UI::QueryWidget(`id(`nss_base_group),`Value); + } pam_password = (string) UI::QueryWidget(`id(`pam_password), `Value); tls_cacertfile = (string) UI::QueryWidget(`id(`tls_cacertfile), `Value); @@ -1077,9 +1103,7 @@ if (result == `sssd) { sssd = (boolean) UI::QueryWidget (`id (`sssd), `Value); - foreach (symbol ui, [ `nss_base_passwd, `nss_base_group, `nss_base_shadow, `br_passwd, `br_shadow, `br_group ], { - UI::ChangeWidget (`id (ui), `Enabled, !sssd); - }); + UI::ReplaceWidget (`id (`rp_frame), sssd ? get_frame_krb () : get_frame_nss ()); } if (result == `br_tls_cacertdir) { @@ -1268,7 +1292,9 @@ Ldap::ldap_v2 != ldap_v2 || Ldap::tls_cacertdir != tls_cacertdir || Ldap::tls_cacertfile != tls_cacertfile || - Ldap::sssd != sssd + Ldap::sssd != sssd || + Ldap::krb5_realm != krb5_realm || + Ldap::krb5_kdcip != krb5_kdcip ) { Ldap::bind_dn = bind_dn; @@ -1284,6 +1310,8 @@ Ldap::tls_cacertdir = tls_cacertdir; Ldap::tls_cacertfile = tls_cacertfile; Ldap::sssd = sssd; + Ldap::krb5_realm = krb5_realm; + Ldap::krb5_kdcip = krb5_kdcip; Ldap::modified = true; } break; Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Export.out URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Export.out (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Export.out Fri Mar 18 17:09:18 2011 @@ -17,6 +17,8 @@ Read .etc.ldap_conf.v."/etc/ldap.conf"."nss_map_attribute" 0 Execute .passwd.init $["base_directory":"/etc"] true Read .passwd.passwd.pluslines ["+"] +Read .etc.krb5_conf.v.libdefaults.default_realm ["SUSE.CZ"] +Read .etc.krb5_conf.v."SUSE.CZ"."kdc" ["kdc.suse.cz"] Return true Dump ============================================ -Return $["base_config_dn":"", "bind_dn":"uid=manager,dc=suse,dc=cz", "create_ldap":false, "file_server":false, "ldap_domain":"dc=suse,dc=cz", "ldap_server":"localhost", "ldap_tls":false, "ldap_v2":false, "login_enabled":true, "member_attribute":"member", "mkhomedir":true, "nss_base_group":"ou=group,dc=suse,dc=cz", "pam_password":"crypt", "sssd":false, "start_autofs":false, "start_ldap":true, "tls_cacertdir":"/etc/openldap/cacerts/"] +Return $["base_config_dn":"", "bind_dn":"uid=manager,dc=suse,dc=cz", "create_ldap":false, "file_server":false, "krb5_kdcip":"kdc.suse.cz", "krb5_realm":"SUSE.CZ", "ldap_domain":"dc=suse,dc=cz", "ldap_server":"localhost", "ldap_tls":false, "ldap_v2":false, "login_enabled":true, "member_attribute":"member", "mkhomedir":true, "nss_base_group":"ou=group,dc=suse,dc=cz", "pam_password":"crypt", "sssd":false, "start_autofs":false, "start_ldap":true, "tls_cacertdir":"/etc/openldap/cacerts/"] Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Export.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Export.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Export.ycp Fri Mar 18 17:09:18 2011 @@ -36,6 +36,16 @@ ] ] ], + "krb5_conf" : $[ + "v" : $[ + "libdefaults": $[ + "default_realm": ["SUSE.CZ"], + ], + "SUSE.CZ": $[ + "kdc": ["kdc.suse.cz"], + ], + ], + ], // /etc/security/pam_* "security": $[ "section": $[ Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.out URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.out (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.out Fri Mar 18 17:09:18 2011 @@ -16,6 +16,8 @@ Read .etc.ldap_conf.v."/etc/ldap.conf"."nss_map_attribute" 0 Execute .passwd.init $["base_directory":"/etc"] true Read .passwd.passwd.pluslines ["+"] +Read .etc.krb5_conf.v.libdefaults.default_realm ["SUSE.CZ"] +Read .etc.krb5_conf.v."SUSE.CZ"."kdc" ["kdc.suse.cz"] Return true Dump ============================================ Dump ldap used: -true- Modified: branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.ycp URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Code-11-SP2-Branch/ldap-… ============================================================================== --- branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.ycp (original) +++ branches/SuSE-Code-11-SP2-Branch/ldap-client/testsuite/tests/Read.ycp Fri Mar 18 17:09:18 2011 @@ -36,6 +36,16 @@ ] ] ], + "krb5_conf" : $[ + "v" : $[ + "libdefaults": $[ + "default_realm": ["SUSE.CZ"], + ], + "SUSE.CZ": $[ + "kdc": ["kdc.suse.cz"], + ], + ], + ], // /etc/security/pam_* "security": $[ "section": $[ -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0