Hi,

the attached patches add the directory the SSSD writes domain-realm
mappings as includedir to krb5.conf when installing the client.

[PATCH 1/3] ipachangeconf: allow specifying non-default delimeter for options
ipachangeconf only allows one delimeter between keys and values. This
patch adds the possibility of also specifying "delim" in the option
dictionary to override the default delimeter.

On a slightly-unrelated note, we really should think about adopting
Augeas. Changing configuration with home-grown scripts is getting
tricky.

[PATCH 2/3] Specify includedir in krb5.conf on new installs
This patch utilizes the new functionality from the previous patch to add
the includedir on top of the krb5.conf file

[PATCH 3/3] Add the includedir to krb5.conf on upgrades
This patch is completely untested and I'm only posting it to get
opinions. At first I was going to use an upgrade script in %post but
then I thought it would be overengineering when all we want to do is
prepend one line.. Would a simple munging like this be acceptable or
shall I write a full script?
>From 507dad241486258348153bedb06011e0f884c88f Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhro...@redhat.com>
Date: Fri, 17 Aug 2012 11:19:03 +0200
Subject: [PATCH 1/3] ipachangeconf: allow specifying non-default delimeter
 for options

---
 ipa-client/ipaclient/ipachangeconf.py | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/ipa-client/ipaclient/ipachangeconf.py 
b/ipa-client/ipaclient/ipachangeconf.py
index 
f6288062be5c5d1b29341ed90814e1fa1431019c..f5ec227fee6a46eb666a1bfe9a3349e40f80b7e9
 100644
--- a/ipa-client/ipaclient/ipachangeconf.py
+++ b/ipa-client/ipaclient/ipachangeconf.py
@@ -161,7 +161,10 @@ class IPAChangeConf:
                 output += self.indent[level]+self.subsectdel[1]+self.deol
                 continue
             if o['type'] == "option":
-                output += 
self.indent[level]+o['name']+self.dassign+o['value']+self.deol
+                delim = o.get('delim', self.dassign)
+                if delim not in self.assign:
+                    raise ValueError('Unknown delim "%s" must be one of "%s"' 
% (delim, " ".join([d for d in self.assign])))
+                output += 
self.indent[level]+o['name']+delim+o['value']+self.deol
                 continue
             if o['type'] == "comment":
                 output += self.dcomment+o['value']+self.deol
@@ -182,11 +185,21 @@ class IPAChangeConf:
         if value:
             return {'name':'comment', 'type':'comment', 
'value':value.rstrip()} #pylint: disable=E1103
 
+        o = dict()
         parts = line.split(self.dassign, 1)
         if len(parts) < 2:
-            raise SyntaxError, 'Syntax Error: Unknown line format'
+            # The default assign didn't match, try the non-default
+            for d in self.assign[1:]:
+                parts = line.split(d, 1)
+                if len(parts) >= 2:
+                    o['delim'] = d
+                    break
 
-        return {'name':parts[0].strip(), 'type':'option', 
'value':parts[1].rstrip()}
+            if 'delim' not in o:
+                raise SyntaxError, 'Syntax Error: Unknown line format'
+
+        o.update({'name':parts[0].strip(), 'type':'option', 
'value':parts[1].rstrip()})
+        return o
 
     def findOpts(self, opts, type, name, exclude_sections=False):
 
@@ -224,7 +237,9 @@ class IPAChangeConf:
                 opts.append({'name':'comment', 'type':'comment', 'value':val})
                 continue
             if o['type'] == 'option':
-                val = self.indent[level]+o['name']+self.dassign+o['value']
+                delim = o.get('delim', self.dassign)
+                if delim not in self.assign:
+                    val = self.indent[level]+o['name']+delim+o['value']
                 opts.append({'name':'comment', 'type':'comment', 'value':val})
                 continue
             if o['type'] == 'comment':
-- 
1.7.11.2

>From 74091875ec511b1b271f723eb17918544258a957 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhro...@redhat.com>
Date: Sun, 5 Aug 2012 20:47:12 +0200
Subject: [PATCH 2/3] Specify includedir in krb5.conf on new installs

---
 ipa-client/ipa-install/ipa-client-install | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ipa-client/ipa-install/ipa-client-install 
b/ipa-client/ipa-install/ipa-client-install
index 
2e65921e8de2dfe68443f5b5875954d71dd48ed2..a4c1b6fbdfefc26f9be8297b6e60ac4d0da42876
 100755
--- a/ipa-client/ipa-install/ipa-client-install
+++ b/ipa-client/ipa-install/ipa-client-install
@@ -642,7 +642,7 @@ def hardcode_ldap_server(cli_server):
 def configure_krb5_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, 
cli_kdc, dnsok, options, filename, client_domain):
 
     krbconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
-    krbconf.setOptionAssignment(" = ")
+    krbconf.setOptionAssignment((" = ", " "))
     krbconf.setSectionNameDelimiters(("[","]"))
     krbconf.setSubSectionDelimiters(("{","}"))
     krbconf.setIndent(("","  ","    "))
@@ -650,6 +650,10 @@ def configure_krb5_conf(fstore, cli_basedn, cli_realm, 
cli_domain, cli_server, c
     opts = [{'name':'comment', 'type':'comment', 'value':'File modified by 
ipa-client-install'},
             {'name':'empty', 'type':'empty'}]
 
+    # SSSD include dir
+    opts.append({'name':'includedir', 'type':'option', 
'value':'/var/lib/sss/pubconf/krb5.include.d/', 'delim':' '})
+    opts.append({'name':'empty', 'type':'empty'})
+
     #[libdefaults]
     libopts = [{'name':'default_realm', 'type':'option', 'value':cli_realm}]
     if not dnsok or not cli_kdc or options.force:
-- 
1.7.11.2

>From c163d4dac69243195e2d95f3a71cb31c61a1f43a Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhro...@redhat.com>
Date: Fri, 17 Aug 2012 13:34:06 +0200
Subject: [PATCH 3/3] Add the includedir to krb5.conf on upgrades

---
 ipa-client/ipa-client.spec.in | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/ipa-client/ipa-client.spec.in b/ipa-client/ipa-client.spec.in
index 
686259ad24b241c232dce83b695a05f6fd6c3849..4cd6ee66aa384c1181bcaca1c2c755cf235e79b9
 100644
--- a/ipa-client/ipa-client.spec.in
+++ b/ipa-client/ipa-client.spec.in
@@ -36,6 +36,15 @@ mkdir -p 
%{buildroot}/%{_localstatedir}/lib/ipa-client/sysrestore
 %clean
 rm -rf %{buildroot}
 
+%post
+if egrep -q 'File modified by ipa-client-install' /etc/krb5.conf 2>/dev/null ; 
then
+    if ! egrep -q '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf  
2>/dev/null ; then
+        cp /etc/krb5.conf{,.ipaclientupgrade}
+        echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf
+        cat /etc/krb5.conf.ipaclientupgrade >> /etc/krb5.conf
+    fi
+fi
+
 
 %files
 %defattr(-,root,root,-)
-- 
1.7.11.2

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to