/usr/lib/python2.7/dist-packages/ipaserver/plugins/join.py is in python-ipaserver 4.7.0~pre1+git20180411-2ubuntu2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 | # Authors:
# Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2009 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
Joining an IPA domain
"""
import logging
import six
from ipalib import Registry, api
from ipalib import Command, Str
from ipalib import errors
from ipalib import _
from ipaserver.install import installutils
if six.PY3:
unicode = str
logger = logging.getLogger(__name__)
register = Registry()
def validate_host(ugettext, cn):
"""
Require at least one dot in the hostname (to support localhost.localdomain)
"""
dots = len(cn.split('.'))
if dots < 2:
return 'Fully-qualified hostname required'
return None
@register()
class join(Command):
"""Join an IPA domain"""
NO_CLI = True
takes_args = (
Str('cn',
validate_host,
cli_name='hostname',
doc=_("The hostname to register as"),
default_from=lambda: unicode(installutils.get_fqdn()),
autofill=True,
#normalizer=lamda value: value.lower(),
),
)
takes_options = (
Str('realm',
doc=_("The IPA realm"),
default_from=lambda: api.env.realm,
autofill=True,
),
Str('nshardwareplatform?',
cli_name='platform',
doc=_('Hardware platform of the host (e.g. Lenovo T61)'),
),
Str('nsosversion?',
cli_name='os',
doc=_('Operating System and version of the host (e.g. Fedora 9)'),
),
)
has_output = tuple()
use_output_validation = False
def execute(self, hostname, **kw):
"""
Execute the machine join operation.
Returns the entry as it will be created in LDAP.
:param hostname: The name of the host joined
:param kw: Keyword arguments for the other attributes.
"""
assert 'cn' not in kw
ldap = self.api.Backend.ldap2
try:
# First see if the host exists
kw = {'fqdn': hostname, 'all': True}
attrs_list = api.Command['host_show'](**kw)['result']
dn = attrs_list['dn']
# No error raised so far means that host entry exists
logger.info('Host entry for %s already exists, '
'joining may fail on the client side '
'if not forced', hostname)
# If no principal name is set yet we need to try to add
# one.
if 'krbprincipalname' not in attrs_list:
service = "host/%s@%s" % (hostname, api.env.realm)
api.Command['host_mod'](hostname, krbprincipalname=service)
logger.info('No principal set, setting to %s', service)
# It exists, can we write the password attributes?
allowed = ldap.can_write(dn, 'krblastpwdchange')
if not allowed:
raise errors.ACIError(info=_("Insufficient 'write' privilege "
"to the 'krbLastPwdChange' attribute of entry '%s'.") % dn)
# Reload the attrs_list and dn so that we return update values
kw = {'fqdn': hostname, 'all': True}
attrs_list = api.Command['host_show'](**kw)['result']
dn = attrs_list['dn']
except errors.NotFound:
attrs_list = api.Command['host_add'](hostname,
force=True)['result']
dn = attrs_list['dn']
config = api.Command['config_show']()['result']
attrs_list['ipacertificatesubjectbase'] =\
config['ipacertificatesubjectbase']
return (dn, attrs_list)
|