Petr Viktorin wrote:
On 04/09/2014 11:29 PM, Rob Crittenden wrote:
Rob Crittenden wrote:
Petr Viktorin wrote:
On 03/14/2014 07:58 PM, Rob Crittenden wrote:
Petr Viktorin wrote:
On 03/12/2014 07:48 PM, Rob Crittenden wrote:
[...]


Here are a couple more enhancements I'm considering, this seems
simpler
than inter-diff since it is so small.

Not really. Having a patch file with a sequence+revision number you
can
refer to has its merits. Especially in a hairy thread like this one.
Also one of our MUAs wrapped the lines, I had to undo that manually.

Here is why I made the changes, in order:

I doubled the calls to create the connection but one isn't in a
try/except!? Remove the obvious one.

We currently completely eat GSSAPI errors, I figure we should log
failures.

IPA stores the principal in the request context so using that will
save
a GSSAPI call (and as we learned, a lock in gssproxy).

I included your content-type change.

These changes look good.
I'm almost done testing but I need to call it a week.

Awesome, thanks.

ACK on the functionality.

Sorry for not catching that last time, but your patch doesn't add a
*versioned* BuildRequres on python-kerberos, instead it adds a
duplicate
unversioned one. So lint (and thus the build) will fail if the old
python-kerberos version is installed.

A possible a solution to the build trouble would be to just add a
lint
exception now, and open a ticket to remove it later. That way the
build
succeeds despite the older version, and the new python-kerberos is
only
needed when installing freeipa-server-foreman-smartproxy.
That should make everyone happy, including Martin.
Unfortunately our lint exception mechanism doesn't work on
modules, so
this needs a somewhat nastier hack.
The attaching a patch that does this (and I'm pasting a simple diff
below). Does that look okay to push?

I'm trying to find a better solution to all this. I may end up taking
Martin's suggestion of rawhide-only to avoid this sort of thing.

Looks like you'll still need to silence pylint on f20 in that case.

The deal with the smartproxy is that you can/should be able to run
it on
any IPA-enrolled client, so you can run it directly on the Foreman
box,
with the IPA server somewhere else. What this means is that someone
could probably fairly easily package this up for other distributions
and
if we end up with a Fedora-only python-kerberos patch then
smartproxy is
Fedora-only as well.

So I'm trying to get some movement out of upstream on this but it's
been
crickets for weeks. I think in the context of the calendar server
PyKerberos is small potatoes so doesn't get much lovin'. I'll amp up
the
nagging to get some sort of response, even if it is "stop nagging us!"

rob

Good luck!

Ok, taking a different tack on this. Rather than running it as a
separate server process, run it as a WSGI app inside Apache. This
required a fair bit of re-tooling and complicates the set up a little
bit. I think I've got it all covered in the man page.

On the python-kerberos front I've got bugs opened in Ubuntu and Debian
to see if we can get the patch accepted their until (if) upstream ever
takes a look.

I decided to run the new WSGI app in a different process group, using
the smartproxy we use for delegation. This simplifies the connection
code, rather than using ldap2 like I was using, we use the RPC
interface. And it provides to process separation. As a side-effect it
will make running this code on platforms without GSSProxy a bit easier.

rob


Works great here!


The python-kerberos dependency issue still needs to be solved.

Build is on the way to updates-testing if you can give it a go.


The man page says:
    Copy ipa-smartproxy-apache.conf to
/etc/httpd/conf.d/ipa-smartproxy.conf.
It would be nice to put the whole path here so people don't have to
search for the file.

Done.


The "Configure Apache to use smartproxy" line looks like a step to be
performed. It could use some emphasis to make it look like a header.

I combined it with the subsequent sentence so hopefully it is a bit clearer.

I also added a bit on testing so you can confirm that things are working.


Side note, cherrypy's routing makes requests like this possible:
     http POST
:8090/ipa/smartproxy/host/testhost.idm.lab.eng.brq.redhat.com/some_description/True/06-00-00-00-00-00/some_userclass


Should that be allowed?

It is definitely ugly but AFAICT it isn't illegal. The zero content-length bothers me more than this horrible-looking URI. It definitely requires some understanding of the ordering of parameters to get this call right.

rob
>From 5ada61118d8e1c27aac3892fb844e770f9bbc9de Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcrit...@redhat.com>
Date: Tue, 3 Dec 2013 09:14:00 -0700
Subject: [PATCH] Implement an IPA Foreman smartproxy server

This currently server supports only host and hostgroup commands for
retrieving, adding and deleting entries.

The incoming requests are completely unauthenticated and by default
requests must be local.

Utilize GSS-Proxy to manage the TGT.

Configuration information is in the ipa-smartproxy man page.

Design: http://www.freeipa.org/page/V3/Smart_Proxy

https://fedorahosted.org/freeipa/ticket/4128
---
 Makefile                                   |   5 +-
 freeipa.spec.in                            |  43 +++-
 ipalib/util.py                             |  13 +-
 ipatests/test_smartproxy/resttest.py       | 170 ++++++++++++++++
 ipatests/test_smartproxy/test_features.py  |  35 ++++
 ipatests/test_smartproxy/test_host.py      | 145 ++++++++++++++
 ipatests/test_smartproxy/test_hostgroup.py |  97 +++++++++
 smartproxy/Makefile.am                     |  45 +++++
 smartproxy/configure.ac                    |  75 +++++++
 smartproxy/ipa-smartproxy-apache.conf      |  30 +++
 smartproxy/ipa-smartproxy.conf             |  15 ++
 smartproxy/ipa-smartproxy.logrotate        |  11 ++
 smartproxy/ipa-smartproxy.py               | 303 +++++++++++++++++++++++++++++
 smartproxy/ipa-smartproxy.service          |  12 ++
 smartproxy/man/Makefile.am                 |  19 ++
 smartproxy/man/ipa-smartproxy.1            | 101 ++++++++++
 smartproxy/man/ipa-smartproxy.conf.5       |  69 +++++++
 17 files changed, 1181 insertions(+), 7 deletions(-)
 create mode 100644 ipatests/test_smartproxy/resttest.py
 create mode 100644 ipatests/test_smartproxy/test_features.py
 create mode 100644 ipatests/test_smartproxy/test_host.py
 create mode 100644 ipatests/test_smartproxy/test_hostgroup.py
 create mode 100644 smartproxy/Makefile.am
 create mode 100644 smartproxy/configure.ac
 create mode 100644 smartproxy/ipa-smartproxy-apache.conf
 create mode 100644 smartproxy/ipa-smartproxy.conf
 create mode 100644 smartproxy/ipa-smartproxy.logrotate
 create mode 100644 smartproxy/ipa-smartproxy.py
 create mode 100644 smartproxy/ipa-smartproxy.service
 create mode 100644 smartproxy/man/Makefile.am
 create mode 100644 smartproxy/man/ipa-smartproxy.1
 create mode 100644 smartproxy/man/ipa-smartproxy.conf.5

diff --git a/Makefile b/Makefile
index 2808f6153c1920f66dc7729f9ae6ef8798cb0e19..ee10e3aa7c5fb03e76986e8eddb96be5c5a418ce 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 include VERSION
 
-SUBDIRS=daemons install ipapython ipa-client
+SUBDIRS=daemons install ipapython ipa-client smartproxy
 CLIENTDIRS=ipapython ipa-client
 
 PRJ_PREFIX=freeipa
@@ -74,6 +74,7 @@ bootstrap-autogen: version-update client-autogen
 	@echo "Building IPA $(IPA_VERSION)"
 	cd daemons; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR) --with-openldap; fi
 	cd install; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
+	cd smartproxy; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
 
 client-autogen: version-update
 	cd ipa-client; if [ ! -e Makefile ]; then ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); fi
@@ -193,6 +194,7 @@ tarballs: local-archive
 	cd dist/$(TARBALL_PREFIX)/ipa-client; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
 	cd dist/$(TARBALL_PREFIX)/daemons; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
 	cd dist/$(TARBALL_PREFIX)/install; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
+	cd dist/$(TARBALL_PREFIX)/smartproxy; ../autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libdir=$(LIBDIR); make distclean
 	cd dist; tar cfz sources/$(TARBALL) $(TARBALL_PREFIX)
 	rm -rf dist/$(TARBALL_PREFIX)
 
@@ -259,5 +261,6 @@ maintainer-clean: clean
 	cd install && $(MAKE) maintainer-clean
 	cd ipa-client && $(MAKE) maintainer-clean
 	cd ipapython && $(MAKE) maintainer-clean
+	cd smartproxy && $(MAKE) maintainer-clean
 	rm -f version.m4
 	rm -f freeipa.spec
diff --git a/freeipa.spec.in b/freeipa.spec.in
index 52817cd4d74a71df1ad98300628a73bc3e434bb7..4e3fd7351757be773fae0b02c55549910c5b37ad 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -57,7 +57,7 @@ BuildRequires:  python-setuptools
 BuildRequires:  python-krbV
 BuildRequires:  python-nss
 BuildRequires:  python-netaddr
-BuildRequires:  python-kerberos
+BuildRequires:  python-kerberos >= 1.1-14
 BuildRequires:  python-rhsm
 BuildRequires:  pyOpenSSL
 BuildRequires:  pylint
@@ -79,6 +79,9 @@ BuildRequires:  libverto-devel
 BuildRequires:  systemd
 BuildRequires:  libunistring-devel
 BuildRequires:  python-lesscpy
+BuildRequires:  python-kerberos
+BuildRequires:  python-cherrypy
+BuildRequires:  python-requests
 
 # Find out Kerberos middle version to infer ABI changes in DAL driver
 # We cannot load DAL driver into KDC with wrong ABI.
@@ -219,6 +222,19 @@ Cross-realm trusts with Active Directory in IPA require working Samba 4
 installation. This package is provided for convenience to install all required
 dependencies at once.
 
+
+%package server-foreman-smartproxy
+Summary: Foreman-compatible REST API for IPA
+Group: System Environment/Base
+Requires: %{name}-client = %version-%release
+Requires: python-cherrypy
+Requires: gssproxy >= 0.3.1
+Requires: python-requests
+Requires: python-kerberos >= 1.1-14
+
+%description server-foreman-smartproxy
+A Foreman-compatible REST API for managing hosts and hostgroups.
+
 %endif # ONLY_CLIENT
 
 
@@ -459,6 +475,7 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
 mkdir -p %{buildroot}%{_unitdir}
 install -m 644 init/systemd/ipa.service %{buildroot}%{_unitdir}/ipa.service
 install -m 644 init/systemd/ipa_memcached.service %{buildroot}%{_unitdir}/ipa_memcached.service
+install -m 644 smartproxy/ipa-smartproxy.service %{buildroot}%{_unitdir}/ipa-smartproxy.service
 # END
 mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa/backup
 %endif # ONLY_CLIENT
@@ -515,6 +532,8 @@ if [ $1 = 0 ]; then
 # NOTE: systemd specific section
     /bin/systemctl --quiet stop ipa.service || :
     /bin/systemctl --quiet disable ipa.service || :
+    /bin/systemctl --quiet stop ipa-smartproxy.service || :
+    /bin/systemctl --quiet disable ipa-smartproxy.service || :
 # END
 fi
 
@@ -550,6 +569,17 @@ fi
 if [ $1 -eq 0 ]; then
     %{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
 fi
+
+%preun server-foreman-smartproxy
+if [ $1 = 0 ]; then
+    /bin/systemctl --quiet disable ipa-smartproxy.service || :
+fi
+
+%post server-foreman-smartproxy
+if [ $1 -gt 1 ] ; then
+    /bin/systemctl --system daemon-reload 2>&1 || :
+    /bin/systemctl condrestart ipa-smartproxy.service 2>&1 || :
+fi
 %endif # ONLY_CLIENT
 
 %post client
@@ -784,6 +814,17 @@ fi
 %{python_sitelib}/ipaserver/dcerpc*
 %{python_sitelib}/ipaserver/install/adtrustinstance*
 %ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
+
+%files server-foreman-smartproxy
+%doc COPYING README smartproxy/ipa-smartproxy-apache.conf
+%dir %{_usr}/share/ipa/smartproxy
+%{_usr}/share/ipa/smartproxy/ipa-smartproxy.py*
+%{_mandir}/man1/ipa-smartproxy.1.gz
+%{_mandir}/man5/ipa-smartproxy.conf.5.gz
+%attr(644,root,root) %{_unitdir}/ipa-smartproxy.service
+%config(noreplace) %{_sysconfdir}/ipa/ipa-smartproxy.conf
+%config(noreplace)%{_sysconfdir}/logrotate.d/ipa-smartproxy
+
 %endif # ONLY_CLIENT
 
 %files client
diff --git a/ipalib/util.py b/ipalib/util.py
index fcc4b1591e11365a98094019e8e9f5b87d214f75..89c0680087f840e90c0449d80b304fe3dcafe4a3 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -57,12 +57,15 @@ def json_serialize(obj):
 
 def get_current_principal():
     try:
-        # krbV isn't necessarily available on client machines, fail gracefully
-        import krbV
-        return unicode(krbV.default_context().default_ccache().principal().name)
+        import kerberos
+        rc, vc = kerberos.authGSSClientInit("notempty")
+        rc = kerberos.authGSSClientInquireCred(vc)
+        username = kerberos.authGSSClientUserName(vc)
+        kerberos.authGSSClientClean(vc)
+        return unicode(username)
     except ImportError:
-        raise RuntimeError('python-krbV is not available.')
-    except krbV.Krb5Error:
+        raise RuntimeError('python-kerberos is not available.')
+    except kerberos.GSSError, e:
         #TODO: do a kinit?
         raise errors.CCacheError()
 
diff --git a/ipatests/test_smartproxy/resttest.py b/ipatests/test_smartproxy/resttest.py
new file mode 100644
index 0000000000000000000000000000000000000000..dc355471fc356da10fdcc2df2b6624dd0ddfb6a8
--- /dev/null
+++ b/ipatests/test_smartproxy/resttest.py
@@ -0,0 +1,170 @@
+# Authors:
+#   Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+Base class for all REST tests
+"""
+
+import requests
+import json
+import nose
+from ipatests.util import assert_deepequal, Fuzzy
+from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_uuid, fuzzy_password
+
+FQDN = 'localhost'
+PORT = 8090
+
+EXPECTED = """Expected %r to raise %s.
+  options = %r
+  output = %r"""
+
+UNEXPECTED = """Expected %r to raise %s, but caught different.
+  options = %r
+  %s: %s"""
+
+try:
+    response = requests.get(
+        'http://%s:%d/ipa/smartproxy/host/host.example.com' % (FQDN, PORT),
+        data={})
+    server_available = True
+except requests.ConnectionError:
+    server_available = False
+
+
+class REST_test(object):
+    """
+    Base class for all REST tests
+
+    A Declarative test suite is controlled by the ``tests`` and
+    ``cleanup`` class variables.
+
+    The ``tests`` is a list of dictionaries with the following keys:
+
+    ``desc``
+        A name/description of the test
+    ``command``
+        A (command, args, kwargs) triple specifying the command to run
+    ``expected``
+        Can be either an ``errors.PublicError`` instance, in which case
+        the command must fail with the given error; or the
+        expected result.
+        The result is checked with ``tests.util.assert_deepequal``.
+    ``extra_check`` (optional)
+        A checking function that is called with the response. It must
+        return true for the test to pass.
+
+    The ``cleanup`` is a list of (command, args, kwargs)
+    triples. These are commands get run both before and after tests,
+    and must not fail.
+    """
+
+    cleanup = tuple()
+    tests = tuple()
+
+    @classmethod
+    def setUpClass(cls):
+        if not server_available:
+            raise nose.SkipTest('%r: Server not available' %
+                                cls.__module__)
+
+    def cleanup_generate(self, stage):
+        for (i, request) in enumerate(self.cleanup):
+            func = lambda: self.run_cleanup(request)
+            func.description = '%s %s-cleanup[%d]: %r' % (
+                self.__class__.__name__, stage, i, request
+            )
+            yield (func,)
+
+    def make_request(self, method, uri, data=None):
+        request = method('http://%s:%d%s' % (FQDN, PORT, uri), data=data)
+        return request
+
+    def run_cleanup(self, request):
+        (uri, data) = request
+        try:
+            result = self.make_request(requests.delete, uri, data)
+            assert request.status_code in [401, 201, 200]
+        except Exception:
+            pass
+
+    def test_generator(self):
+        """
+        Iterate through tests.
+
+        nose reports each one as a separate test.
+        """
+
+        # Iterate through pre-cleanup:
+        for tup in self.cleanup_generate('pre'):
+            yield tup
+
+        # Iterate through the tests:
+        name = self.__class__.__name__
+        for (i, test) in enumerate(self.tests):
+            nice = '%s[%d]: %s: %s' % (
+                name, i, test['request'][0], test.get('desc', '')
+            )
+            func = lambda: self.check(nice, **test)
+            func.description = nice
+            yield (func,)
+
+        # Iterate through post-cleanup:
+        for tup in self.cleanup_generate('post'):
+            yield tup
+
+    def check(self, nice, desc, request, method, expected_status, expected):
+        (uri, data) = request
+        if isinstance(expected, Exception):
+            self.check_exception(nice, method, uri, data, expected)
+        else:
+            self.check_result(nice,
+                              method,
+                              uri,
+                              data,
+                              expected_status,
+                              expected)
+
+    def check_exception(self, nice, method, uri, data, expected):
+        klass = expected.__class__
+        name = klass.__name__
+        try:
+            output = self.make_request(method, uri, data)
+        except StandardError, e:
+            pass
+        else:
+            raise AssertionError(
+                EXPECTED % (uri, name, method, data, output)
+            )
+        if not isinstance(e, klass):
+            raise AssertionError(
+                UNEXPECTED % (uri, name, method, data, e.__class__.__name__, e)
+            )
+
+    def check_result(self, nice, method, uri, data, expected_status, expected):
+        request = self.make_request(method, uri, data)
+        assert expected_status == request.status_code
+
+        if request.status_code in [200, 201]:
+            try:
+                data = json.loads(request.text)
+            except ValueError, e:
+                raise AssertionError(
+                    'Could not parse JSON: %s' % e
+                )
+            assert_deepequal(expected, data, nice)
diff --git a/ipatests/test_smartproxy/test_features.py b/ipatests/test_smartproxy/test_features.py
new file mode 100644
index 0000000000000000000000000000000000000000..9c32c0c332763c6b28d8b08e1b8b635bcf88696e
--- /dev/null
+++ b/ipatests/test_smartproxy/test_features.py
@@ -0,0 +1,35 @@
+# Authors:
+#   Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from resttest import REST_test
+import requests
+
+class test_feature(REST_test):
+
+    tests = [
+
+        dict(
+            desc='Get supported features',
+            request=('/features', {}),
+            method=requests.get,
+            expected_status=200,
+            expected=[u'realm'],
+        ),
+
+    ]
diff --git a/ipatests/test_smartproxy/test_host.py b/ipatests/test_smartproxy/test_host.py
new file mode 100644
index 0000000000000000000000000000000000000000..6dc90de535ba2f22fcd2529006659818b9d49226
--- /dev/null
+++ b/ipatests/test_smartproxy/test_host.py
@@ -0,0 +1,145 @@
+# Authors:
+#   Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from ipalib import api
+from ipapython.dn import DN
+from resttest import REST_test, fuzzy_uuid, fuzzy_password
+from ipatests.test_xmlrpc import objectclasses
+import requests
+
+fqdn1 = u'testhost.example.com'
+dn1 = DN(('fqdn',fqdn1),('cn','computers'),('cn','accounts'),
+         api.env.basedn)
+fqdn2 = u'testhost2.example.com'
+dn2 = DN(('fqdn',fqdn2),('cn','computers'),('cn','accounts'),
+         api.env.basedn)
+
+class test_host(REST_test):
+
+    cleanup = [
+        ('/ipa/smartproxy/host/%s' % fqdn1, {}),
+        ('/ipa/smartproxy/host/%s' % fqdn2, {}),
+    ]
+
+    tests = [
+
+        dict(
+            desc='Get a non-existent host',
+            request=('/ipa/smartproxy/host/notfound', {}),
+            method=requests.get,
+            expected_status=404,
+            expected={},
+        ),
+
+        dict(
+            desc='Create a host',
+            request=('/ipa/smartproxy/host', {'hostname': fqdn1}),
+            method=requests.post,
+            expected_status=201,
+            expected=dict(
+                dn=dn1,
+                has_keytab=False,
+                krbprincipalname= [u'host/%s@%s' % (fqdn1, api.env.realm)],
+                objectclass=objectclasses.host,
+                fqdn=[fqdn1],
+                has_password=False,
+                ipauniqueid=[fuzzy_uuid],
+                managedby_host=[fqdn1],
+            ),
+        ),
+
+        dict(
+            desc='Get the host',
+            request=('/ipa/smartproxy/host/%s' % fqdn1, {}),
+            method=requests.get,
+            expected_status=200,
+            expected=dict(
+                dn=dn1,
+                has_keytab=False,
+                fqdn=[u'testhost.example.com'],
+                has_password=False,
+                managedby_host=[fqdn1],
+                krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
+            ),
+        ),
+
+        dict(
+            desc='Add a duplicate host',
+            request=('/ipa/smartproxy/host', {'hostname': fqdn1}),
+            method=requests.post,
+            expected_status=400,
+            expected={},
+        ),
+
+        dict(
+            desc='Remove the host',
+            request=('/ipa/smartproxy/host/%s' % fqdn1, {}),
+            method=requests.delete,
+            expected_status=200,
+            expected=dict(failed=u''),
+        ),
+
+        dict(
+            desc='Create a host with a random password',
+            request=('/ipa/smartproxy/host', {'hostname': fqdn1, 'random': True}),
+            method=requests.post,
+            expected_status=201,
+            expected=dict(
+                dn=dn1,
+                has_keytab=False,
+                objectclass=[u'ipasshhost', u'ipaSshGroupOfPubKeys',
+                             u'ieee802device', u'ipaobject',
+                             u'nshost', u'ipahost', u'pkiuser',
+                             u'ipaservice', u'top',],
+                fqdn=[fqdn1],
+                has_password=True,
+                ipauniqueid=[fuzzy_uuid],
+                randompassword=fuzzy_password,
+                managedby_host=[fqdn1],
+            ),
+        ),
+
+        dict(
+            desc='Create a host with a fixed password',
+            request=('/ipa/smartproxy/host', {'hostname': fqdn2, 'password': 'Secret123'}),
+            method=requests.post,
+            expected_status=201,
+            expected=dict(
+                dn=dn2,
+                has_keytab=False,
+                objectclass=[u'ipasshhost', u'ipaSshGroupOfPubKeys',
+                             u'ieee802device', u'ipaobject',
+                             u'nshost', u'ipahost', u'pkiuser',
+                             u'ipaservice', u'top',],
+                fqdn=[fqdn2],
+                has_password=True,
+                ipauniqueid=[fuzzy_uuid],
+                managedby_host=[fqdn2],
+            ),
+        ),
+
+        dict(
+            desc='Remove a non-existent host',
+            request=('/ipa/smartproxy/host/notfound', {}),
+            method=requests.delete,
+            expected_status=404,
+            expected={},
+        ),
+
+    ]
diff --git a/ipatests/test_smartproxy/test_hostgroup.py b/ipatests/test_smartproxy/test_hostgroup.py
new file mode 100644
index 0000000000000000000000000000000000000000..ec2daab5c2eb012768c49e14b5d8375b42ca6ac7
--- /dev/null
+++ b/ipatests/test_smartproxy/test_hostgroup.py
@@ -0,0 +1,97 @@
+# Authors:
+#   Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from ipalib import api
+from ipapython.dn import DN
+from resttest import REST_test, fuzzy_uuid
+from ipatests.test_xmlrpc import objectclasses
+import requests
+
+hostgroup1 = u'testhostgroup'
+dn1 = DN(('cn', hostgroup1),('cn','hostgroups'),('cn','accounts'),
+         api.env.basedn)
+
+class test_hostgroup(REST_test):
+
+    cleanup = [
+        ('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+    ]
+
+    tests = [
+
+        dict(
+            desc='Get a non-existent hostgroup',
+            request=('/ipa/smartproxy/hostgroup/notfound', {}),
+            method=requests.get,
+            expected_status=404,
+            expected={},
+        ),
+
+        dict(
+            desc='Create a hostgroup',
+            request=('/ipa/smartproxy/hostgroup', {'name': hostgroup1, 'description': u'test'}),
+            method=requests.post,
+            expected_status=201,
+            expected=dict(
+                dn=dn1,
+                cn=[hostgroup1],
+                objectclass=objectclasses.hostgroup,
+                description=[u'test'],
+                mepmanagedentry=[DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),
+                                        api.env.basedn)],
+                ipauniqueid=[fuzzy_uuid],
+            ),
+        ),
+
+        dict(
+            desc='Get the hostgroup',
+            request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+            method=requests.get,
+            expected_status=200,
+            expected=dict(
+                dn=dn1,
+                cn=[u'testhostgroup'],
+                description=[u'test'],
+            ),
+        ),
+
+        dict(
+            desc='Add a duplicate hostgroup',
+            request=('/ipa/smartproxy/hostgroup', {'name': hostgroup1, 'description': u'test'}),
+            method=requests.post,
+            expected_status=400,
+            expected={},
+        ),
+
+        dict(
+            desc='Remove the hostgroup',
+            request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+            method=requests.delete,
+            expected_status=200,
+            expected=dict(failed=u''),
+        ),
+
+        dict(
+            desc='Remove a non-existent hostgroup',
+            request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+            method=requests.delete,
+            expected_status=404,
+            expected={},
+        ),
+    ]
diff --git a/smartproxy/Makefile.am b/smartproxy/Makefile.am
new file mode 100644
index 0000000000000000000000000000000000000000..f79aecfc303aac12d771170badea1eaf952b7ecf
--- /dev/null
+++ b/smartproxy/Makefile.am
@@ -0,0 +1,45 @@
+# This file will be processed with automake-1.7 to create Makefile.in
+
+AUTOMAKE_OPTIONS = 1.7
+
+NULL =
+
+etcdir = $(IPA_SYSCONF_DIR)
+etc_DATA =			\
+	ipa-smartproxy.conf	\
+	$(NULL)
+
+appdir = $(IPA_DATA_DIR)/smartproxy
+app_DATA =			\
+	ipa-smartproxy.py	\
+	$(NULL)
+
+rotatedir = $(LOGROTATE_DIR)
+rotate_DATA =			\
+	ipa-smartproxy.logrotate	\
+	$(NULL)
+
+SUBDIRS =			\
+	man			\
+	$(NULL)
+
+EXTRA_DIST =			\
+	$(app_DATA)		\
+	$(etc_DATA)		\
+	$(rotate_DATA)		\
+	$(NULL)
+
+DISTCLEANFILES =		\
+	$(NULL)
+
+MAINTAINERCLEANFILES =		\
+	*~			\
+	aclocal.m4		\
+	configure		\
+	install-sh		\
+	missing			\
+	Makefile.in		\
+	$(NULL)
+
+install-data-hook:
+	mv $(DESTDIR)/$(LOGROTATE_DIR)/ipa-smartproxy.logrotate $(DESTDIR)/$(LOGROTATE_DIR)/ipa-smartproxy
diff --git a/smartproxy/configure.ac b/smartproxy/configure.ac
new file mode 100644
index 0000000000000000000000000000000000000000..5908a7f13bc7d19df4e3086b42a176167b5c2546
--- /dev/null
+++ b/smartproxy/configure.ac
@@ -0,0 +1,75 @@
+AC_PREREQ(2.59)
+m4_include(../version.m4)
+AC_INIT([ipa-server],
+        IPA_VERSION,
+        [https://hosted.fedoraproject.org/projects/freeipa/newticket])
+
+AM_INIT_AUTOMAKE([foreign])
+
+AM_MAINTAINER_MODE
+
+AC_SUBST(VERSION)
+AC_SUBST([INSTALL_DATA], ['$(INSTALL) -m 644 -p'])
+
+AC_PROG_MKDIR_P
+AC_PROG_AWK
+AC_PROG_SED
+
+AC_PATH_PROG(XGETTEXT, xgettext, [no])
+if test "x$XGETTEXT" = "xno"; then
+    AC_MSG_ERROR([xgettext not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGFMT, msgfmt, [no])
+if test "x$MSGFMT" = "xno"; then
+    AC_MSG_ERROR([msgfmt not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGINIT, msginit, [no])
+if test "x$MSGINIT" = "xno"; then
+    AC_MSG_ERROR([msginit not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGMERGE, msgmerge, [no])
+if test "x$MSGMERGE" = "xno"; then
+    AC_MSG_ERROR([msgmerge not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGCMP, msgcmp, [no])
+if test "x$MSGCMP" = "xno"; then
+    AC_MSG_ERROR([msgcmp not found, install gettext])
+fi
+
+AC_PATH_PROG(MSGATTRIB, msgattrib, [no])
+if test "x$MSGATTRIB" = "xno"; then
+    AC_MSG_ERROR([msgattrib not found, install gettext])
+fi
+
+AC_PATH_PROG(TX, tx, [/usr/bin/tx])
+
+AC_ARG_WITH([gettext_domain],
+  [AS_HELP_STRING([--with-gettext-domain=name],
+    [set the name of the i18n message catalog])],
+  [],
+  [with_gettext_domain=ipa])
+AC_SUBST(GETTEXT_DOMAIN, $with_gettext_domain)
+
+dnl ---------------------------------------------------------------------------
+dnl - Set the data install directory since we don't use pkgdatadir
+dnl ---------------------------------------------------------------------------
+
+IPA_DATA_DIR="$datadir/ipa"
+IPA_SYSCONF_DIR="$sysconfdir/ipa"
+LOGROTATE_DIR="$sysconfdir/logrotate.d"
+AC_SUBST(IPA_DATA_DIR)
+AC_SUBST(IPA_SYSCONF_DIR)
+AC_SUBST(LOGROTATE_DIR)
+
+# Files
+
+AC_CONFIG_FILES([
+    Makefile
+    man/Makefile
+])
+
+AC_OUTPUT
diff --git a/smartproxy/ipa-smartproxy-apache.conf b/smartproxy/ipa-smartproxy-apache.conf
new file mode 100644
index 0000000000000000000000000000000000000000..53a62691fce3c96006f0af86f0e6e6d86faac478
--- /dev/null
+++ b/smartproxy/ipa-smartproxy-apache.conf
@@ -0,0 +1,30 @@
+Listen 8090
+
+<VirtualHost *:8090>
+
+    WSGIDaemonProcess smartproxy user=smartproxy processes=2 threads=1
+    WSGIProcessGroup smartproxy
+
+    WSGIScriptAlias /realm /usr/share/ipa/smartproxy/ipa-smartproxy.py
+    WSGIScriptAlias /features /usr/share/ipa/smartproxy/ipa-smartproxy.py
+    WSGIScriptAlias /ipa/smartproxy /usr/share/ipa/smartproxy/ipa-smartproxy.py
+
+    <Location "/realm">
+      Satisfy Any
+      Order Deny,Allow
+      Allow from all
+    </Location>
+
+    <Location "/features">
+      Satisfy Any
+      Order Deny,Allow
+      Allow from all
+    </Location>
+
+    <Location "/ipa/smartproxy">
+      Satisfy Any
+      Order Deny,Allow
+      Allow from all
+    </Location>
+
+</VirtualHost>
diff --git a/smartproxy/ipa-smartproxy.conf b/smartproxy/ipa-smartproxy.conf
new file mode 100644
index 0000000000000000000000000000000000000000..a5f81433bf7c3ee9934691fef6f6fddf9c5c853d
--- /dev/null
+++ b/smartproxy/ipa-smartproxy.conf
@@ -0,0 +1,15 @@
+[global]
+server.socket_port: 8090
+#server.socket_host: 'server.example.com'
+
+log.access_file: '/var/log/ipa-smartproxy.access'
+log.error_file: '/var/log/ipa-smartproxy.errors'
+
+request.show_tracebacks: False
+
+# Only handle requests on 127.0.0.1 or ::1
+local_only: True
+
+use_gssproxy: True
+
+user: 'apache'
diff --git a/smartproxy/ipa-smartproxy.logrotate b/smartproxy/ipa-smartproxy.logrotate
new file mode 100644
index 0000000000000000000000000000000000000000..12e25164cd5dea23a219422e20ea07c03a6c9a8e
--- /dev/null
+++ b/smartproxy/ipa-smartproxy.logrotate
@@ -0,0 +1,11 @@
+/var/log/ipa-smartproxy.access /var/log/ipa-smartproxy.errors {
+    weekly
+    missingok
+    notifempty
+    sharedscripts
+    rotate 52
+    compress
+    postrotate
+        /bin/systemctl reload ipa-smartproxy.service > /dev/null 2>/dev/null || true
+    endscript
+}
diff --git a/smartproxy/ipa-smartproxy.py b/smartproxy/ipa-smartproxy.py
new file mode 100644
index 0000000000000000000000000000000000000000..174f2f46fae189d2b0eac210e05c5f2491e64c62
--- /dev/null
+++ b/smartproxy/ipa-smartproxy.py
@@ -0,0 +1,303 @@
+#!/usr/bin/python2 -E
+#
+# Authors:
+#   Rob Crittenden <rcrit...@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+sys.stdout = sys.stderr
+
+import cherrypy
+import os
+import json
+from functools import wraps
+import traceback as tb_internal
+from cherrypy import response
+from ipalib import api
+from ipalib import errors
+from ipalib import util
+from ipalib.request import context
+from ipaserver.rpcserver import json_encode_binary
+from ipapython.version import VERSION
+from ipapython.ipa_log_manager import root_logger
+from ipapython.ipaldap import SASL_GSSAPI
+
+
+def jsonout(func):
+    '''JSON output decorator'''
+    @wraps(func)
+    def wrapper(*args, **kw):
+        value = func(*args, **kw)
+        response.headers["Content-Type"] = "application/json;charset=utf-8"
+        data = json_encode_binary(value)
+        return json.dumps(data, sort_keys=True, indent=2)
+
+    return wrapper
+
+
+def handle_error(status, message, traceback, version):
+    """
+    Return basic messages to user and log backtrace in case of 500
+    error.
+    """
+    if status.startswith('500'):
+        root_logger.error(message)
+        root_logger.error(tb_internal.format_exc())
+
+    resp = cherrypy.response
+    resp.headers['Content-Type'] = 'application/json'
+    return json.dumps({'status': status, 'message': message})
+
+
+def convert_unicode(value):
+    """
+    IPA requires all incoming values to be unicode. Recursively
+    convert the values.
+    """
+    if not isinstance(value, basestring):
+        return value
+
+    if value is not None:
+        return unicode(value)
+    else:
+        return None
+
+
+def Command(command, *args, **options):
+    if (cherrypy.request.config.get('local_only', False) and
+       cherrypy.request.remote.ip not in ['::1', '127.0.0.1']):
+        raise IPAError(
+            status=401,
+            message="Not a local request"
+        )
+
+    try:
+        if not api.Backend.rpcclient.isconnected():
+            api.Backend.rpcclient.connect()
+    except errors.CCacheError, e:
+        root_logger.info('Connection failed: %s', e)
+        raise IPAError(
+            status=401,
+            message=e
+        )
+
+    # IPA wants all its strings as unicode
+    args = map(lambda v: convert_unicode(v), args)
+    options = dict(zip(options, map(convert_unicode, options.values())))
+
+    params = api.Command[command].args_options_2_params(*args, **options)
+    try:
+        return api.Command[command](*args, **options)['result']
+    except (errors.DuplicateEntry, errors.DNSNotARecordError,
+            errors.ValidationError, errors.ConversionError,) as e:
+        raise IPAError(
+            status=400,
+            message=e
+        )
+    except errors.ACIError, e:
+        raise IPAError(
+            status=401,
+            message=e
+        )
+    except errors.NotFound, e:
+        raise IPAError(
+            status=404,
+            message=e
+        )
+    except Exception, e:
+        raise IPAError(
+            status=500,
+            message=e
+        )
+
+
+@jsonout
+def GET(command, *args, **options):
+    return Command(command, *args, **options)
+
+
+@jsonout
+def POST(command, *args, **options):
+    cherrypy.response.status = 201
+    return Command(command, *args, **options)
+
+
+@jsonout
+def DELETE(command, *args, **options):
+    return Command(command, *args, **options)
+
+
+class IPAError(cherrypy.HTTPError):
+    """
+    Return errors in IPA-style json.
+
+    Local errors are treated as strings so do not include the code and
+    name attributes within the error dict.
+
+    This is not padded for IE.
+    """
+
+    def set_response(self):
+        response = cherrypy.serving.response
+
+        cherrypy._cperror.clean_headers(self.code)
+
+        # In all cases, finalize will be called after this method,
+        # so don't bother cleaning up response values here.
+        response.status = self.status
+
+        if isinstance(self._message, Exception):
+            try:
+                code = self._message.errno
+            except AttributeError:
+                code = 0
+            error = {'code': code,
+                     'message': self._message.message,
+                     'name': self._message.__class__.__name__}
+        elif isinstance(self._message, basestring):
+            error = {'message': self._message}
+        else:
+            error = {'message':
+                     'Unable to handle error message type %s' % type(self._message)}
+
+        principal = getattr(context, 'principal', None)
+        response.headers["Content-Type"] = "application/json;charset=utf-8"
+        response.body = json.dumps({'error': error,
+                                    'id': 0,
+                                    'principal': principal,
+                                    'result': None,
+                                    'version': VERSION},
+                                    sort_keys=True, indent=2)
+
+
+class Host(object):
+
+    exposed = True
+
+    def GET(self, fqdn=None):
+
+        if fqdn is None:
+            command = 'host_find'
+        else:
+            command = 'host_show'
+
+        return GET(command, fqdn)
+
+    def POST(self, hostname, description=None, random=False,
+             macaddress=None, userclass=None, ip_address=None,
+             password=None):
+        return POST('host_add', hostname,
+                    description=description, random=random,
+                    force=True, macaddress=macaddress,
+                    userclass=userclass, ip_address=ip_address,
+                    userpassword=password)
+
+    def DELETE(self, fqdn):
+        return DELETE('host_del', fqdn)
+
+
+class Hostgroup(object):
+
+    exposed = True
+
+    def GET(self, name=None):
+
+        if name is None:
+            command = 'hostgroup_find'
+        else:
+            command = 'hostgroup_show'
+
+        return GET(command, name)
+
+    def POST(self, name=None, description=None):
+        cherrypy.response.status = 201
+        return POST('hostgroup_add', name,
+                    description=description,)
+
+    def DELETE(self, name):
+        return DELETE('hostgroup_del', name)
+
+
+class Features(object):
+    exposed = True
+
+    def GET(self):
+        return '["realm"]'
+
+
+def start(config=None):
+    # Set the umask so only the owner can read the log files
+    old_umask = os.umask(077)
+
+    cherrypy.tree.mount(
+        Features(), '/features',
+        {'/':
+            {'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
+        }
+    )
+    cherrypy.tree.mount(
+        Host(), '/ipa/smartproxy/host',
+        {'/':
+            {'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
+        }
+    )
+    cherrypy.tree.mount(
+        Hostgroup(), '/ipa/smartproxy/hostgroup',
+        {'/':
+            {'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
+        }
+    )
+
+    # Register the realm for requests from Foreman
+    root_logger.info("Mounting /realm/%s" % api.env.realm)
+    cherrypy.tree.mount(
+        Host(), '/realm/%s' % api.env.realm,
+        {'/':
+            {'request.dispatch': cherrypy.dispatch.MethodDispatcher()}
+        }
+    )
+
+    for c in config or []:
+        try:
+            cherrypy.config.update(c)
+        except (IOError, OSError), e:
+            root_logger.error("Exception trying to load %s: %s", c, e)
+            return 1
+
+    # Log files are created, reset umask
+    os.umask(old_umask)
+
+    cherrypy.config.update({'error_page.500': handle_error})
+
+    return 0
+
+def application(environ, start_response):
+    root_logger.info("IPA smartproxy WSGI start")
+    return cherrypy.tree(environ, start_response)
+
+wsgi_config = {'environment': 'embedded',
+               'log.screen': False,
+               'show_tracebacks': False,
+               'engine.autoreload_on': False
+}
+
+api.bootstrap(context='ipasmartproxy')
+api.finalize()
+
+cherrypy.config.update(wsgi_config)
+start(['/etc/ipa/ipa-smartproxy.conf'])
diff --git a/smartproxy/ipa-smartproxy.service b/smartproxy/ipa-smartproxy.service
new file mode 100644
index 0000000000000000000000000000000000000000..544f55b1369943c3919f5cb61a9f3bc2d784043d
--- /dev/null
+++ b/smartproxy/ipa-smartproxy.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=IPA smartproxy for Foreman
+After=ipa.target
+
+[Service]
+ExecStart=/usr/sbin/ipa-smartproxy -c /etc/ipa/ipa-smartproxy.conf -d -p /var/run/ipa-smartproxy.pid
+ExecReload=/bin/kill -USR1 $MAINPID
+Type=forking
+PIDFile=/var/run/ipa-smartproxy.pid
+
+[Install]
+WantedBy=multi-user.target
diff --git a/smartproxy/man/Makefile.am b/smartproxy/man/Makefile.am
new file mode 100644
index 0000000000000000000000000000000000000000..6626b3cb23ab2520543ef496ec32a939d310ae66
--- /dev/null
+++ b/smartproxy/man/Makefile.am
@@ -0,0 +1,19 @@
+# This file will be processed with automake-1.7 to create Makefile.in
+
+AUTOMAKE_OPTIONS = 1.7
+
+NULL =
+
+man1_MANS = 				\
+		ipa-smartproxy.1
+
+man5_MANS =				\
+		ipa-smartproxy.conf.5
+
+install-data-hook:
+	@for i in $(man1_MANS) ; do gzip -f $(DESTDIR)$(man1dir)/$$i ; done
+	@for i in $(man5_MANS) ; do gzip -f $(DESTDIR)$(man5dir)/$$i ; done
+
+MAINTAINERCLEANFILES =          \
+	Makefile.in		\
+	$(NULL)
diff --git a/smartproxy/man/ipa-smartproxy.1 b/smartproxy/man/ipa-smartproxy.1
new file mode 100644
index 0000000000000000000000000000000000000000..296cd489f3b1d89bb677313be0776a38b17fa686
--- /dev/null
+++ b/smartproxy/man/ipa-smartproxy.1
@@ -0,0 +1,101 @@
+.\" A man page for ipa-smartproxy
+.\" Copyright (C) 2014 Red Hat, Inc.
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of the GNU General Public License as published by
+.\" the Free Software Foundation, either version 3 of the License, or
+.\" (at your option) any later version.
+.\"
+.\" This program is distributed in the hope that it will be useful, but
+.\" WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+.\" General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program.  If not, see <http://www.gnu.org/licenses/>.
+.\"
+.\" Author: Rob Crittenden <rcrit...@redhat.com>
+.TH "ipa-smartproxy" "1" "Jan 8 2014" "FreeIPA" "FreeIPA Manual Pages"
+.SH "NAME"
+ipa\-smartproxy \- IPA Foreman Smartproxy server
+.SH "SYNOPSIS"
+ipa\-smartproxy [\fIOPTION\fR]...
+.SH "DESCRIPTION"
+A WSGI service that provides a RESTful API for a use as a Foreman smart proxy. It is run in the context of the Apache web server.
+
+The RESTful interface is not authenticated so it is expected that the server is not generally accessible. By default it listens only on the localhost interface.
+
+The server needs access to an principal that is granted permission to perform host and hostgroup operations on an IPA master.
+
+Smartproxy server\-specific privileges and roles can be created with this:
+
+.na
+ $ ipa privilege\-add 'Smartproxy host management' \-\-desc='Smartproxy host management'
+ $ ipa privilege\-add\-permission 'Smartproxy host management' \-\-permission='add hosts' \-\-permission='remove hosts'
+ $ ipa role\-add 'Smartproxy management' \-\-desc='Smartproxy management'
+ $ ipa role\-add\-privilege 'Smartproxy management' \-\-privilege='Smartproxy host management' \-\-privilege='Host Group Administrators'
+
+Create a host or user whose credentials will be used by the server to make requests and add it to the role:
+
+ $ ipa user\-add smartproxy \-\-first=Smartproxy \-\-last=Server --shell=/sbin/nologin --homedir=/var/www
+ $ ipa role\-add\-member \-\-users=smartproxy 'Smartproxy management'
+
+On the smartproxy server create a keytab for this user:
+
+ # kinit admin
+ # ipa\-getkeytab \-s ipa.example.com \-p smartpr...@example.com \-k /etc/ipa/ipa\-smartproxy.keytab
+ # chown root:root /etc/ipa/ipa\-smartproxy.keytab
+ # chmod 600 /etc/ipa/ipa\-smartproxy.keytab
+
+Configure the GSS\-Proxy to manage the credentials. Add this to the top of the gssproxy configuration file (by default /etc/gssproxy/gssproxy.conf), before any other services:
+
+  [service/smartproxy]
+    mechs = krb5
+    cred_store = client_keytab:/etc/ipa/ipa\-smartproxy.keytab
+    cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
+    cred_usage = initiate
+    euid = <uid of the smartproxy user>
+
+Restart GSS\-Proxy
+
+ # systemctl restart gssproxy
+
+Configure Apache to enable GSS\-Proxy. Create the directory /etc/systemd/system/httpd.service.d/ and create the file smartproxy.conf in it:
+
+ # mkdir /etc/systemd/system/httpd.service.d/
+ # cat > /etc/systemd/system/httpd.service.d/smartproxy.conf <<EOF
+ [Service]
+ Environment=GSS_USE_PROXY=1
+ EOF
+ # systemctl daemon-reload
+
+Copy /usr/share/doc/freeipa-server-foreman-smartproxy/ipa-smartproxy-apache.conf to /etc/httpd/conf.d/ipa-smartproxy.conf . This will configure the smartproxy WSGI application.
+
+Add a SELinux rule so Apache can use the port
+
+ # semanage port -a -t http_port_t -p tcp 8090
+
+Restart Apache
+
+ # systemctl restart httpd
+
+.SH "TEST"
+
+To do simple verification that the proxy was installed properly and is working first confirm that it is providing the realm feature:
+
+ # curl http://localhost:8090/features
+ ["realm"]
+
+Retrieve information on the current host, using your Kerberos realm in place of EXAMPLE.COM:
+
+ # curl http://localhost:8090/realm/EXAMPLE.COM/`hostname`
+ {
+   "dn": "fqdn=..."
+   "fqdn": [
+      ...
+   ]
+   "has_keytab": true,
+   ...
+ }
+.SH "SEE ALSO"
+.BR ipa\-smartproxy.conf(5)
diff --git a/smartproxy/man/ipa-smartproxy.conf.5 b/smartproxy/man/ipa-smartproxy.conf.5
new file mode 100644
index 0000000000000000000000000000000000000000..5b35416b529aa0022a4b4ac083c90c21e723124d
--- /dev/null
+++ b/smartproxy/man/ipa-smartproxy.conf.5
@@ -0,0 +1,69 @@
+.\" A man page for ipa-smartproxy.conf
+.\" Copyright (C) 2014 Red Hat, Inc.
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of the GNU General Public License as published by
+.\" the Free Software Foundation, either version 3 of the License, or
+.\" (at your option) any later version.
+.\"
+.\" This program is distributed in the hope that it will be useful, but
+.\" WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+.\" General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program.  If not, see <http://www.gnu.org/licenses/>.
+.\"
+.\" Author: Rob Crittenden <rcritten@@redhat.com>
+.\"
+.TH "ipa-smartproxy.conf" "5" "Jan 8 2014" "FreeIPA" "FreeIPA Manual Pages"
+.SH "NAME"
+ipa\-smartproxy.conf \- IPA Smartproxy server configuration file
+.SH "SYNOPSIS"
+/etc/ipa/ipa\-smartproxy.conf
+.SH "DESCRIPTION"
+The \fIipa\-smartproxy.conf \fRconfiguration file is used to set system\-wide defaults to be applied when running the IPA Foreman Smartproxy server.
+.SH "SYNTAX"
+The configuration options are not case sensitive. The values may be case sensitive, depending on the option.
+
+Blank lines are ignored.
+
+Lines beginning with # are comments and are ignored.
+
+Valid lines consist of an option name, an equals sign and a value. Spaces surrounding equals sign are ignored. An option terminates at the end of a line.
+
+The value is a Python object so needs to adhere to Python rules. If the value should be an integer then it needs to be passed as an integer (like port). If the value is a string then it must be quoted.
+
+Options must appear in the section named [global]. There are no other sections defined or used currently.
+
+Options may be defined that are not used by the IPA Foreman Smartproxy server. Be careful of misspellings, they will not be rejected.
+.SH "OPTIONS"
+The server runs using the CherryPy so all the CherryPy configuration options are valid. Here are some common ones.
+
+.TP
+.B server.socket_port\fR <port>
+Port for the server to listen on. The default port is 8090.
+.TP
+.B server.socket_host\fR <host>
+If not specified then the server will listen on localhost. This is the expected mode. Specifiy a hostname or IP address to listen on another address. See also the .B local_only\fR option if setting this to something other than a local address.
+.TP
+.B log.access_file\fR <path>
+Path to the server access log
+.TP
+.B log.error_file\fR <path>
+Path to the server error log
+.TP
+.B request.show_tracebacks\fR <boolean>
+Display tracebacks to the client when errors occur. Errors will always log on the server side. The default is False.
+.TP
+.B local_only\fR <boolean>
+If True then requires that all requests be local. It is not recommended that this be enabled because this server accepts unathenticated requests to manage IPA entries.
+.TP
+.B user\fR <user>
+The user to run the server as. Required.
+.SH "FILES"
+.TP
+.I /etc/ipa/ipa\-smartproxy.conf
+IPA Foreman Smartproxy server configuration file
+.SH "SEE ALSO"
+.BR ipa\-smartproxy (1)
-- 
1.9.0

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to