Martin Kosek wrote:
On Wed, 2012-06-20 at 13:23 -0400, Rob Crittenden wrote:
Rob Crittenden wrote:
Rob Crittenden wrote:
Here is a tool that can be used to configure automount in an IPA client.
It can use either SSSD or autofs for automount. It also configures NFSv4
on the client so secure maps will work.


rebased patch

rebase again

rob

I finally managed to look on this patch. This is generally a good work
and make things a lot easier, but still I found few issues:

1) The patch does not apply cleanly+it needs to be rebased:

# git apply freeipa-rcrit-1023-3-automount.patch
freeipa-rcrit-1023-3-automount.patch:210: trailing whitespace.

freeipa-rcrit-1023-3-automount.patch:264: trailing whitespace.

freeipa-rcrit-1023-3-automount.patch:273: trailing whitespace.

freeipa-rcrit-1023-3-automount.patch:542: trailing whitespace.
.\"
freeipa-rcrit-1023-3-automount.patch:547: trailing whitespace.
.\"
error: patch failed: ipapython/platform/base.py:24
error: ipapython/platform/base.py: patch does not apply

Fixed whitespace and rebased.

2) This is just an idea, but would it be better to call the new script
"ipa-client-automount" so that it is more visible that it is from
ipa-client binary family (along with ipa-client-install)?

Sure, I wasn't completely happy with the name I came up with.


3) KeyboardInterrupt is not caught properly:

4) Neither is EOFError (CTRL+d):

Fixed.


5) Would it make sense to check if the given automount location exists?
Currently there is no check for that:

# ipa-configure-automount --server vm-091.idm.lab.bos.redhat.com
--location foo
Searching for IPA server...
IPA server: DNS discovery
Location: foo
Continue to configure the system with these values? [no]: y
Configured /etc/nsswitch.conf
Configured /etc/sysconfig/nfs
Configured /etc/idmapd.conf
Started nfs-server.service
Started nfs-secure.service
Restarting sssd, waiting for it to become available.
Started autofs.service

Automount then obviously not work:

There was even a TODO in the code for this. I went ahead and did it. I had punted originally because it wasn't really a big deal to unconfigure and reconfigure with the right location.

Jun 21 04:05:06 localhost automount[1401]: lookup_read_map: lookup(sss):
getautomntent_r: No such file or directory

This is an sssd issue I've been told isn't fatal.

6) In /etc/sssd/sssd.conf we configure ipa_automount_location and
autofs_provider options. But in uninstall, we remove only
ipa_automount_location and leave autofs_provider configured

It is a bug in sssd, https://fedorahosted.org/sssd/ticket/1388

7) This is related to ipa-client-install, but even when I disable
autodiscovery and add --server option it still disregards it and tries
to search SRV records:

# ipa-configure-automount --server=vm-091.idm.lab.bos.redhat.com
<after some time and SRV searches>
Unable to confirm that<some-ldap-server>.redhat.com is an IPA v2 server

Yeah, I think a separate ticket should be opened up, I call the same code as ipa-client-install.


8) When discovery is on, we are not really verbose:

# ipa-configure-automount
Searching for IPA server...
IPA server: DNS discovery
Location: default
Continue to configure the system with these values? [no]:

We just write "IPA server: DNS discovery", but I would at least like to
now what servers it detected so that I know it does the right thing.

This should be better with Petr^3's patches. Is it not? Perhaps only with --debug?

9) autofs via LDAP (no SSSD )is broken when autodiscovery is used. After
some investigation I found this line is causing it:

+    if not autodiscover:
+        ldap_uri = "ldap://%s"; % server
+    else:
+        ldap_uri = "ldap:///%s"; % api.env.basedn<<<

There should be an IPA server, not basedn. When I fixed it, autofs via
LDAP worked.

I'm not sure why it didn't work, this is correct. ldap:///dc=example,dc=com tells the autofs client to use DNS discovery to find the right server. It works for me.


9) Shouldn't configure_nfs be made optional? I don't think every IPA
client with autofs configured will want to have nfs-server running...

I hate systemd. I couldn't find a service other than nfs-server that would start idmapd. I found one, fixed in this patch.


10) There are some artifacts in the man page:
+.TP
+Files that will be always be configured:
+
+/etc/nsswitch.conf
+
+Files that will be configured when SSSD is the automount client
(default):
+
+/etc/sssd/sssd.conf
+
+Files that will be configured when using the ldap automount client:
+
+/etc/sysconfig/autofs
+
+/etc/autofs_ldap_auth.conf

.TP is missing for the latter 2 file lists thus causing a bad indent.

Fixed.

rob

>From 72822267e7603dedb279d463f2569b30a725cff6 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcrit...@redhat.com>
Date: Tue, 29 May 2012 14:20:38 -0400
Subject: [PATCH] Configure automount using autofs or sssd.

This script edits nsswitch.conf to use either ldap (autofs) or
sss (sssd) to find automount maps.

NFSv4 services are started so Kerberos encryption and/or integrity can
be used on the maps.

https://fedorahosted.org/freeipa/ticket/1233
---
 freeipa.spec.in                             |   10 +
 ipa-client/ipa-install/Makefile.am          |    1 +
 ipa-client/ipa-install/ipa-client-automount |  464 +++++++++++++++++++++++++++
 ipa-client/ipa-install/ipa-client-install   |   25 +-
 ipa-client/man/Makefile.am                  |    1 +
 ipa-client/man/ipa-client-automount.1       |   89 +++++
 ipapython/platform/base.py                  |    4 +-
 ipapython/platform/fedora16.py              |    3 +
 8 files changed, 595 insertions(+), 2 deletions(-)
 create mode 100755 ipa-client/ipa-install/ipa-client-automount
 create mode 100644 ipa-client/man/ipa-client-automount.1

diff --git a/freeipa.spec.in b/freeipa.spec.in
index 38e3536723ec81bc13dc55c0459cfe61b7956a83..6d63a1526608639960dea40450318ca854fac009 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -242,6 +242,10 @@ Requires: bind-utils
 Requires: oddjob-mkhomedir
 Requires: python-krbV
 Requires: python-dns
+Requires: libsss_autofs
+Requires: autofs
+Requires: libnfsidmap
+Requires: nfs-utils
 
 Obsoletes: ipa-client >= 1.0
 
@@ -673,6 +677,7 @@ fi
 %defattr(-,root,root,-)
 %doc COPYING README Contributors.txt
 %{_sbindir}/ipa-client-install
+%{_sbindir}/ipa-client-automount
 %{_sbindir}/ipa-getkeytab
 %{_sbindir}/ipa-rmkeytab
 %{_sbindir}/ipa-join
@@ -687,6 +692,7 @@ fi
 %{_mandir}/man1/ipa-getkeytab.1.gz
 %{_mandir}/man1/ipa-rmkeytab.1.gz
 %{_mandir}/man1/ipa-client-install.1.gz
+%{_mandir}/man1/ipa-client-automount.1.gz
 %{_mandir}/man1/ipa-join.1.gz
 %{_mandir}/man5/default.conf.5.gz
 
@@ -718,6 +724,10 @@ fi
 %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
 
 %changelog
+* Fri Jun 21 2012 Rob Crittenden <rcrit...@redhat.com> - 2.99.0-35
+- Add client requires on libsss-autofs, autofs, libnfsidmap and nfs-utils
+  for configuring automount and NFS.
+
 * Fri Jun 21 2012 Petr Vobornik <pvobo...@redhat.com> - 2.99.0-34
 - Add Web UI reset password pages
 
diff --git a/ipa-client/ipa-install/Makefile.am b/ipa-client/ipa-install/Makefile.am
index ad0c4e0cadb39d30824ea176eefd5201985bd462..2e9a04d10864ffc465b327f6e5767eccc1eb99e4 100644
--- a/ipa-client/ipa-install/Makefile.am
+++ b/ipa-client/ipa-install/Makefile.am
@@ -2,6 +2,7 @@ NULL =
 
 sbin_SCRIPTS =			\
 	ipa-client-install	\
+	ipa-client-automount	\
 	$(NULL)
 
 EXTRA_DIST =			\
diff --git a/ipa-client/ipa-install/ipa-client-automount b/ipa-client/ipa-install/ipa-client-automount
new file mode 100755
index 0000000000000000000000000000000000000000..a6877622fb9369426ae11be1008bf24c6c5d1d6e
--- /dev/null
+++ b/ipa-client/ipa-install/ipa-client-automount
@@ -0,0 +1,464 @@
+#!/usr/bin/env python
+#
+# Authors:
+#   Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2012  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# Configure the automount client for ldap.
+
+import sys
+import os
+import urlparse
+import time
+import tempfile
+
+import SSSDConfig
+
+from optparse import OptionParser
+from ipalib import api, errors
+from ipalib.dn import DN
+from ipapython import sysrestore
+from ipapython import ipautil
+from ipaclient import ipadiscovery
+from ipaclient import ipachangeconf
+from ipapython.ipa_log_manager import *
+from ipapython import services as ipaservices
+
+AUTOFS_CONF = '/etc/sysconfig/autofs'
+NSSWITCH_CONF = '/etc/nsswitch.conf'
+AUTOFS_LDAP_AUTH = '/etc/autofs_ldap_auth.conf'
+NFS_CONF = '/etc/sysconfig/nfs'
+IDMAPD_CONF = '/etc/idmapd.conf'
+
+def parse_options():
+    usage = "%prog [options]\n"
+    parser = OptionParser(usage=usage)
+    parser.add_option("--server", dest="server", help="IPA server")
+    parser.add_option("--location", dest="location", help="Automount location",
+        default="default")
+    parser.add_option("-S", "--no-sssd", dest="sssd",
+                      action="store_false", default=True,
+                      help="Do not configure the client to use SSSD for automount")
+    parser.add_option("--debug", dest="debug", action="store_true",
+        default=False, help="enable debugging")
+    parser.add_option("-U", "--unattended", dest="unattended",
+        action="store_true", default=False,
+        help="unattended installation never prompts the user")
+    parser.add_option("--uninstall", dest="uninstall", action="store_true",
+        default=False, help="Unconfigure automount")
+
+    options, args = parser.parse_args()
+    return options, args
+
+def wait_for_sssd():
+    """
+    It takes a bit for sssd to get going, lets loop until it is
+    serving data.
+
+    This function returns nothing.
+    """
+    n = 0
+    found = False
+    time.sleep(1)
+    while n < 10 and not found:
+        try:
+            ipautil.run(["getent", "passwd", "admin"])
+            found = True
+        except Exception, e:
+            time.sleep(1)
+            n = n + 1
+
+    # This should never happen but if it does, may as well warn the user
+    if not found:
+        root_logger.debug("Unable to find 'admin' user with 'getent passwd admin'!")
+        print "Unable to find 'admin' user with 'getent passwd admin'!"
+        print "This may mean that sssd didn't re-start properly after the configuration changes."
+
+def configure_xml(fstore):
+    from lxml import etree
+
+    fstore.backup_file(AUTOFS_LDAP_AUTH)
+
+    try:
+        f = open(AUTOFS_LDAP_AUTH, 'r')
+        lines = f.read()
+        f.close()
+
+        saslconf = etree.fromstring(lines)
+        element = saslconf.xpath('//autofs_ldap_sasl_conf')
+        root = saslconf.getroottree()
+    except IOError, e:
+        root_logger.debug('Unable to open file %s' % e)
+        root_logger.debug('Creating new from template')
+        element = [etree.Element('autofs_ldap_sasl_conf')]
+        root = element[0].getroottree()
+
+    if len(element) != 1:
+        raise RuntimeError('Unable to parse %s' % AUTOFS_LDAP_AUTH)
+
+    element[0].set('usetls', 'no')
+    element[0].set('tlsrequired', 'no')
+    element[0].set('authrequired', 'yes')
+    element[0].set('authtype', 'GSSAPI')
+    element[0].set('clientprinc', 'host/%s@%s' % (api.env.host, api.env.realm))
+
+    newconf = open(AUTOFS_LDAP_AUTH, 'w')
+    try:
+        root.write(newconf, pretty_print=True, xml_declaration=True, encoding='UTF-8')
+        newconf.close()
+    except IOError, e:
+        print "Unable to write %s: %s" % (AUTOFS_LDAP_AUTH, e)
+    print "Configured %s" % AUTOFS_LDAP_AUTH
+
+def configure_nsswitch(fstore, options):
+    """
+    Point automount to ldap in nsswitch.conf
+    """
+    fstore.backup_file(NSSWITCH_CONF)
+
+    conf = ipachangeconf.IPAChangeConf("IPA Installer")
+    conf.setOptionAssignment(':')
+
+    if options.sssd:
+        nss_value = ' sss files'
+    else:
+        nss_value = ' ldap files'
+
+    opts = [{'name':'automount', 'type':'option', 'action':'set', 'value':nss_value},
+            {'name':'empty', 'type':'empty'}]
+
+    conf.changeConf(NSSWITCH_CONF, opts)
+
+    print "Configured %s" % NSSWITCH_CONF
+
+def configure_autofs_sssd(fstore, statestore, autodiscover, options):
+    try:
+        sssdconfig = SSSDConfig.SSSDConfig()
+        sssdconfig.import_config()
+        domains = sssdconfig.list_active_domains()
+    except Exception, e:
+        sys.exit(e)
+
+    try:
+        sssdconfig.activate_service('autofs')
+    except SSSDConfig.NoServiceError:
+        print "Unable to activate the autofs service in SSSD config."
+        root_logger.debug("Unable to activate the autofs service in SSSD config.")
+
+    domain = None
+    for name in domains:
+        domain = sssdconfig.get_domain(name)
+        try:
+            provider = domain.get_option('id_provider')
+        except SSSDConfig.NoOptionError:
+            continue
+        if provider == "ipa":
+            domain.add_provider('ipa', 'autofs')
+            try:
+                location = domain.get_option('ipa_automount_location')
+                sys.exit('An automount location is already configured')
+            except SSSDConfig.NoOptionError:
+                domain.set_option('ipa_automount_location', options.location)
+                break
+
+    if domain is None:
+        sys.exit('SSSD is not configured.')
+
+    sssdconfig.save_domain(domain)
+    sssdconfig.write("/etc/sssd/sssd.conf")
+    statestore.backup_state('autofs', 'sssd', True)
+
+    sssd = ipaservices.service('sssd')
+    sssd.restart()
+    print "Restarting sssd, waiting for it to become available."
+    wait_for_sssd()
+
+def configure_autofs(fstore, statestore, autodiscover, server, options):
+    """
+    fstore: the FileStore to back up files in
+    options.server: the IPA server to use
+    options.location: the Automount location to use
+    """
+    if not autodiscover:
+        ldap_uri = "ldap://%s"; % server
+    else:
+        ldap_uri = "ldap:///%s"; % api.env.basedn
+
+    search_base = str(DN(('cn', options.location), api.env.container_automount, api.env.basedn))
+    replacevars = {
+        'MAP_OBJECT_CLASS': 'automountMap',
+        'ENTRY_OBJECT_CLASS': 'automount',
+        'MAP_ATTRIBUTE': 'automountMapName',
+        'ENTRY_ATTRIBUTE': 'automountKey',
+        'VALUE_ATTRIBUTE': 'automountInformation',
+        'SEARCH_BASE': search_base,
+        'LDAP_URI': ldap_uri,
+    }
+
+    ipautil.backup_config_and_replace_variables(fstore,
+        AUTOFS_CONF, replacevars=replacevars)
+    ipaservices.restore_context(AUTOFS_CONF)
+    statestore.backup_state('autofs', 'sssd', False)
+
+    print "Configured %s" % AUTOFS_CONF
+
+def configure_autofs_common(fstore, statestore, options):
+    autofs = ipaservices.knownservices.autofs
+    statestore.backup_state('autofs', 'enabled', autofs.is_enabled())
+    statestore.backup_state('autofs', 'running', autofs.is_running())
+    try:
+        autofs.restart()
+        print "Started %s" % autofs.service_name
+    except Exception, e:
+        root_logger.error("%s failed to restart: %s", autofs.service_name, e)
+    try:
+        autofs.enable()
+    except Exception, e:
+        print "Failed to configure automatic startup of the %s daemon" % (autofs.service_name)
+        root_logger.error("Failed to enable automatic startup of the %s daemon: %s" % (autofs.service_name, str(e)))
+
+def uninstall(fstore, statestore):
+    print "Restoring configuration"
+    if fstore.has_file(AUTOFS_CONF):
+        fstore.restore_file(AUTOFS_CONF)
+    if fstore.has_file(NSSWITCH_CONF):
+        fstore.restore_file(NSSWITCH_CONF)
+    if fstore.has_file(AUTOFS_LDAP_AUTH):
+        fstore.restore_file(AUTOFS_LDAP_AUTH)
+    if fstore.has_file(NFS_CONF):
+        fstore.restore_file(NFS_CONF)
+    if fstore.has_file(IDMAPD_CONF):
+        fstore.restore_file(IDMAPD_CONF)
+    if statestore.has_state('autofs'):
+        enabled = statestore.restore_state('autofs', 'enabled')
+        running = statestore.restore_state('autofs', 'running')
+        sssd = statestore.restore_state('autofs', 'sssd')
+        autofs = ipaservices.knownservices.autofs
+        if not enabled:
+            autofs.disable()
+        if not running:
+            autofs.stop()
+        if sssd:
+            try:
+                sssdconfig = SSSDConfig.SSSDConfig()
+                sssdconfig.import_config()
+                sssdconfig.deactivate_service('autofs')
+                domains = sssdconfig.list_active_domains()
+                for name in domains:
+                    domain = sssdconfig.get_domain(name)
+                    try:
+                        provider = domain.get_option('id_provider')
+                    except SSSDConfig.NoOptionError:
+                        continue
+                    if provider == "ipa":
+                        domain.remove_option('ipa_automount_location')
+                        domain.remove_provider('autofs')
+                        break
+                sssdconfig.save_domain(domain)
+                sssdconfig.write("/etc/sssd/sssd.conf")
+                sssd = ipaservices.service('sssd')
+                sssd.restart()
+                wait_for_sssd()
+            except Exception, e:
+                print 'Unable to restore SSSD configuration: %s' % str(e)
+                root_logger.debug('Unable to restore SSSD configuration: %s' % str(e))
+    if statestore.has_state('rpcidmapd'):
+        enabled = statestore.restore_state('rpcidmapd', 'enabled')
+        running = statestore.restore_state('rpcidmapd', 'running')
+        rpcidmapd = ipaservices.knownservices.rpcidmapd
+        if not enabled:
+            rpcidmapd.disable()
+        if not running:
+            rpcidmapd.stop()
+    if statestore.has_state('rpcgssd'):
+        enabled = statestore.restore_state('rpcgssd', 'enabled')
+        running = statestore.restore_state('rpcgssd', 'running')
+        rpcgssd = ipaservices.knownservices.rpcgssd
+        if not enabled:
+            rpcgssd.disable()
+        if not running:
+            rpcgssd.stop()
+
+    return 0
+
+def configure_nfs(fstore, statestore):
+    """
+    Configure secure NFS
+    """
+    replacevars = {
+        'SECURE_NFS': 'YES',
+    }
+    ipautil.backup_config_and_replace_variables(fstore,
+        NFS_CONF, replacevars=replacevars)
+    ipaservices.restore_context(NFS_CONF)
+
+    print "Configured %s" % NFS_CONF
+
+    replacevars = {
+        'Domain': api.env.domain,
+    }
+    ipautil.backup_config_and_replace_variables(fstore,
+        IDMAPD_CONF, replacevars=replacevars)
+    ipaservices.restore_context(IDMAPD_CONF)
+
+    print "Configured %s" % IDMAPD_CONF
+
+    rpcidmapd = ipaservices.knownservices.rpcidmapd
+    statestore.backup_state('rpcidmapd', 'enabled', rpcidmapd.is_enabled())
+    statestore.backup_state('rpcidmapd', 'running', rpcidmapd.is_running())
+    try:
+        rpcidmapd.restart()
+        print "Started %s" % rpcidmapd.service_name
+    except Exception, e:
+        root_logger.error("%s failed to restart: %s", rpcidmapd.service_name, e)
+    try:
+        rpcidmapd.enable()
+    except Exception, e:
+        print "Failed to configure automatic startup of the %s daemon" % (rpcidmapd.service_name)
+        root_logger.error("Failed to enable automatic startup of the %s daemon: %s" % (rpcidmapd.service_name, str(e)))
+
+    rpcgssd = ipaservices.knownservices.rpcgssd
+    statestore.backup_state('rpcgssd', 'enabled', rpcgssd.is_enabled())
+    statestore.backup_state('rpcgssd', 'running', rpcgssd.is_running())
+    try:
+        rpcgssd.restart()
+        print "Started %s" % rpcgssd.service_name
+    except Exception, e:
+        root_logger.error("%s failed to restart: %s", rpcgssd.service_name, e)
+    try:
+        rpcgssd.enable()
+    except Exception, e:
+        print "Failed to configure automatic startup of the %s daemon" % (rpcgssd.service_name)
+        root_logger.error("Failed to enable automatic startup of the %s daemon: %s" % (rpcgssd.service_name, str(e)))
+
+def main():
+
+    fstore = sysrestore.FileStore('/var/lib/ipa-client/sysrestore')
+    statestore = sysrestore.StateFile('/var/lib/ipa-client/sysrestore')
+    if not fstore.has_files():
+        sys.exit('IPA client is not configured on this system.\n')
+
+    options, args = parse_options()
+
+    standard_logging_setup(
+        None, verbose=False, debug=options.debug,
+        console_format='%(message)s')
+
+    cfg = dict(
+        context='cli_installer',
+        in_server=False,
+        debug=options.debug,
+        verbose=0,
+    )
+
+    api.bootstrap(**cfg)
+    api.finalize()
+
+    if options.uninstall:
+        return uninstall(fstore, statestore)
+
+    if statestore.has_state('autofs'):
+        sys.exit('automount is already configured on this system.\n')
+
+    print "Searching for IPA server..."
+    autodiscover = False
+    server = options.server
+    ds = ipadiscovery.IPADiscovery()
+    ret = ds.search()
+    root_logger.debug('Executing DNS discovery')
+    if ret == ipadiscovery.NO_LDAP_SERVER:
+        root_logger.debug('Autodiscovery did not find LDAP server')
+        if not server:
+            s = urlparse.urlsplit(api.env.xmlrpc_uri)
+            server = s.netloc
+            root_logger.debug('Setting server to %s' % s.netloc)
+    else:
+        autodiscover = True
+        server = ds.getServerName()
+        if not server:
+            sys.exit('Autodiscovery was successful but didn\'t return a server')
+        root_logger.debug('Autodiscovery success, setting server to %s' % server)
+
+    # Now confirm that our server is an IPA server
+    root_logger.debug("Verifying that %s is an IPA server" % server)
+    ldapret = ds.ipacheckldap(server, api.env.realm)
+    if ldapret[0] != 0:
+        sys.exit('Unable to confirm that %s is an IPA v2 server' % server)
+
+    if not autodiscover:
+        print "IPA server: %s" % server
+    else:
+        print "IPA server: DNS discovery"
+
+    search_base = str(DN(('cn', options.location), api.env.container_automount, api.env.basedn))
+    print "Location: %s" % options.location
+
+    # Verify that the location is valid
+    (ccache_fd, ccache_name) = tempfile.mkstemp()
+    os.close(ccache_fd)
+    try:
+        try:
+            os.environ['KRB5CCNAME'] = ccache_name
+            ipautil.run(['/usr/bin/kinit', '-k', '-t', '/etc/krb5.keytab', 'host/%s@%s' % (api.env.host, api.env.realm)])
+        except ipautil.CalledProcessError, e:
+            sys.exit("Failed to obtain host TGT.")
+        # Now we have a TGT, connect to IPA
+        try:
+            api.Backend.xmlclient.connect()
+        except errors.KerberosError, e:
+            sys.exit('Cannot connect to the server due to ' + str(e))
+        try:
+            api.Command['automountlocation_show'](unicode(options.location))
+        except errors.VersionError, e:
+            sys.exit('This client is incompatible: ' + str(e))
+        except errors.NotFound:
+            sys.exit("Automount location '%s' does not exist" % options.location)
+    finally:
+        os.remove(ccache_name)
+
+    if not options.unattended and not ipautil.user_input("Continue to configure the system with these values?", False):
+        sys.exit("Installation aborted")
+
+    try:
+        configure_nsswitch(fstore, options)
+        configure_nfs(fstore, statestore)
+        if options.sssd:
+            configure_autofs_sssd(fstore, statestore, autodiscover, options)
+        else:
+            configure_xml(fstore)
+            configure_autofs(fstore, statestore, autodiscover, server, options)
+        configure_autofs_common(fstore, statestore, options)
+    except Exception, e:
+        root_logger.debug('Raised exception %s' % e)
+        print "Installation failed. Rolling back changes."
+        uninstall(fstore, statestore)
+        return 1
+
+    return 0
+
+try:
+    if not os.geteuid()==0:
+        sys.exit("\nMust be run as root\n")
+
+    sys.exit(main())
+except SystemExit, e:
+    sys.exit(e)
+except RuntimeError, e:
+    sys.exit(e)
+except (KeyboardInterrupt, EOFError):
+    sys.exit(1)
diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install
index 9a8600d554f5e8cd9f247730aa4de945b118c1ad..4b8d826ddad4bdee3b352833225768fa8c5f05b5 100755
--- a/ipa-client/ipa-install/ipa-client-install
+++ b/ipa-client/ipa-install/ipa-client-install
@@ -195,6 +195,16 @@ def uninstall(options, env):
         root_logger.info("Refer to ipa-server-install for uninstallation.")
         return CLIENT_NOT_CONFIGURED
 
+    try:
+        run(["ipa-client-automount", "--uninstall", "--debug"])
+    except Exception, e:
+        root_logger.error(
+            "Unconfigured automount client failed: %s", str(e))
+
+    # Reload the state as automount unconfigure may have modified it
+    fstore._load()
+    statestore._load()
+
     hostname = None
     was_sssd_configured = False
     try:
@@ -442,6 +452,19 @@ def uninstall(options, env):
                         "Reboot command failed to exceute: %s", str(e))
                     return CLIENT_UNINSTALL_ERROR
 
+    rv = 0
+
+    if fstore.has_files():
+        root_logger.error('Some files have not been restored, see /var/lib/ipa-client/sysrestore/sysrestore.index')
+    has_state = False
+    for module in statestore.modules.keys():
+            root_logger.error('Some installation state for %s has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state' % module)
+            has_state = True
+            rv = 1
+
+    if has_state:
+        root_logger.warning('Some installation state has not been restored.\nThis may cause re-installation to fail.\nIt should be safe to remove /var/lib/ipa-client/sysrestore.state but it may\nmean your system hasn\'t be restored to its pre-installation state.')
+
     # Remove the IPA configuration file
     try:
         os.remove("/etc/ipa/default.conf")
@@ -450,7 +473,7 @@ def uninstall(options, env):
 
     root_logger.info("Client uninstall complete.")
 
-    return 0
+    return rv
 
 def configure_ipa_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server):
     ipaconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
diff --git a/ipa-client/man/Makefile.am b/ipa-client/man/Makefile.am
index 869b7df06c971db8eb648aa28e9a2fcb694e82fa..42772e43c72873613d45a1b01fa9df62838dd908 100644
--- a/ipa-client/man/Makefile.am
+++ b/ipa-client/man/Makefile.am
@@ -8,6 +8,7 @@ man1_MANS = 				\
 		ipa-getkeytab.1		\
 		ipa-rmkeytab.1		\
 		ipa-client-install.1	\
+		ipa-client-automount.1	\
 		ipa-join.1
 
 man5_MANS =				\
diff --git a/ipa-client/man/ipa-client-automount.1 b/ipa-client/man/ipa-client-automount.1
new file mode 100644
index 0000000000000000000000000000000000000000..f04795e75735222954236aa9000e62af29dfe75b
--- /dev/null
+++ b/ipa-client/man/ipa-client-automount.1
@@ -0,0 +1,89 @@
+.\" A man page for ipa-client-automount
+.\" Copyright (C) 2012 Red Hat, Inc.
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of the GNU General Public License as published by
+.\" the Free Software Foundation, either version 3 of the License, or
+.\" (at your option) any later version.
+.\"
+.\" This program is distributed in the hope that it will be useful, but
+.\" WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+.\" General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program.  If not, see <http://www.gnu.org/licenses/>.
+.\"
+.\" Author: Rob Crittenden <rcrit...@redhat.com>
+.\"
+.TH "ipa-client-automount" "1" "May 25 2012" "FreeIPA" "FreeIPA Manual Pages"
+.SH "NAME"
+ipa\-client\-automount \- Configure automount for IPA
+.SH "SYNOPSIS"
+ipa\-client\-automount [\fIOPTION\fR]... <location>
+.SH "DESCRIPTION"
+Configures automount for IPA.
+
+The automount configuration consists of three files:
+.PP
+.IP  o
+/etc/nsswitch.conf
+.IP  o
+/etc/sysconfig/autofs
+.IP  o
+/etc/autofs_ldap_auth.conf
+
+.TP
+By default this will use DNS discovery to attempt to determine the IPA server(s) to use. If IPA servers are discovered then the automount client will be configured to use DNS discovery.
+.TP
+If DNS discovery fails or a specific server is desired, use the \-\-server option.
+.TP
+The default automount location is named default. To specify a different one use the \-\-location option.
+.TP
+The IPA client must already be configured in order to configure automount. The IPA client is configured as part of a server installation.
+.TP
+There are two ways to configure automount. The default is to use sssd to manage the automount maps. Alternatively autofs can configured to bind to LDAP over GSSAPI and authenticate using the machine's host principal.
+.TP
+The nsswitch automount service is configured to use either sss or ldap and files depending on whether SSSD is configured or not.
+.TP
+NFSv4 is also configured. The rpc.gssd and rpci.dmapd are started on clients to support Kerberos\-secured mounts.
+.SH "OPTIONS"
+\fB\-\-server\fR=\fISERVER\fR
+Set the IPA server to connect to
+.TP
+\fB\-\-location\fR=<fl>LOCATION\fR
+Automount location
+.TP
+\fB\-S\fR, \fB\-\-no\-sssd\fR
+Do not configure the client to use SSSD for automount
+.TP
+\fB\-d\fR, \fB\-\-debug\fR
+Print debugging information to stdout
+.TP
+\fB\-U\fR, \fB\-\-unattended\fR
+Unattended installation. The user will not be prompted
+.TP
+\fB\-\-uninstall\fR
+Restore the automount configuration files
+
+.SH "FILES"
+.TP
+Files that will be always be configured:
+
+/etc/nsswitch.conf
+.TP
+Files that will be configured when SSSD is the automount client (default):
+
+/etc/sssd/sssd.conf
+
+.TP
+Files that will be configured when using the ldap automount client:
+
+/etc/sysconfig/autofs
+
+/etc/autofs_ldap_auth.conf
+
+.SH "EXIT STATUS"
+0 if the installation was successful
+
+1 if an error occurred
diff --git a/ipapython/platform/base.py b/ipapython/platform/base.py
index d177cc82ca1e7e55e7f186a9b8b3a79ec49f0561..bf76b76303d221c07c93e7b41e586e06c622696f 100644
--- a/ipapython/platform/base.py
+++ b/ipapython/platform/base.py
@@ -23,7 +23,9 @@ from ipalib.plugable import MagicDict
 # through knownservices.<name> and take care of remapping internally, if needed
 wellknownservices = ['certmonger', 'dirsrv', 'httpd', 'ipa', 'krb5kdc',
                      'messagebus', 'nslcd', 'nscd', 'ntpd', 'portmap',
-                     'rpcbind', 'kadmin', 'sshd']
+                     'rpcbind', 'kadmin', 'sshd', 'autofs', 'rpcgssd',
+                     'rpcidmapd']
+
 
 class AuthConfig(object):
     """
diff --git a/ipapython/platform/fedora16.py b/ipapython/platform/fedora16.py
index 830771d8355b71f432907b65c633d564f0563c8d..985d368f966b0c42222d3af8474e99edbe3477f9 100644
--- a/ipapython/platform/fedora16.py
+++ b/ipapython/platform/fedora16.py
@@ -43,6 +43,9 @@ __all__ = ['authconfig', 'service', 'knownservices', 'backup_and_replace_hostnam
 # mapping will be kept in this dictionary
 system_units = dict(map(lambda x: (x, "%s.service" % (x)), base.wellknownservices))
 
+system_units['rpcgssd'] = 'nfs-secure.service'
+system_units['rpcidmapd'] = 'nfs-idmap.service'
+
 # Rewrite dirsrv and pki-cad services as they support instances via separate
 # service generator. To make this working, one needs to have both foo@.servic
 # and foo.target -- the latter is used when request should be coming for
-- 
1.7.10.2

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to