On 12/01/2015 02:38 PM, Simo Sorce wrote:
> On Tue, 2015-12-01 at 10:11 +0200, Alexander Bokovoy wrote:
>> On Mon, 30 Nov 2015, Simo Sorce wrote:
>>> On Wed, 2015-11-25 at 09:47 -0500, Simo Sorce wrote:
>>>> On Wed, 2015-11-25 at 09:02 -0500, Rob Crittenden wrote:
>>>>> Jan Cholasta wrote:
>>>>>> On 24.11.2015 22:17, Simo Sorce wrote:
>>>>>>> On Tue, 2015-11-24 at 14:57 -0500, Simo Sorce wrote:
>>>>>>>> On Tue, 2015-11-24 at 14:42 -0500, Simo Sorce wrote:
>>>>>>>>> Since some time we use the getkeytab operation to fetch keytabs on
>>>>>>>>> newer
>>>>>>>>> clients. According to bug #232 setkeytab can be used to circumvent
>>>>>>>>> password quality controls so it needs to be slowly retired.
>>>>>>>>> The attached patches implement #5485 in 2 parts.
>>>>>>>>> The first introduces the option DisableSetKeytab which globally
>>>>>>>>> disables
>>>>>>>>> the setkeytab extended operation. This is set to false by default for
>>>>>>>>> backwards compatibility.
>>>>>>>>> The second introduces an option called DisableUserSetKeytab, which is
>>>>>>>>> active by default in new installs (but not in upgraded ones), and only
>>>>>>>>> disables the use of setkeytab for ipa suers, but not for
>>>>>>>>> hosts/services.
>>>>>>>>> This is because user's are the ones that may abuse the interface to
>>>>>>>>> escape password policies and users also normally do not acquire
>>>>>>>>> keytabs,
>>>>>>>>> so it is a safe bet to disable just them by default in new installs.
>>>>>>>>> (Testing in progress)
>>>>>>>> Tested and working as expected.
>>>>>>> I realized that adding options to ipaConfig require to add them in the
>>>>>>> UI as well, attached patches add options in API.txt and config.py
>>>>>>> Make now complain I should change API Major or Minor, but it is not
>>>>>>> clear to me why given this are additional values and no real change or
>>>>>>> new function is introduced. What's the recommendation ?
>>>>>> When does make complain? It is supposed to complain only when API.txt
>>>>>> does not match code.
>>>>>> Anyway, we usually bump minor version even for backward compatible
>>>>>> changes, see e.g. commit 9549a59.
>>>>> The point of API.txt (and the heavy client) was to save a round-trip.
>>>>> Being able to pass in an invalid option would void that rule hence
>>>>> having to update the API when new values are added.
>>>>> rob
>>>> Ok added version change to the second patch (so we bump it only once
>>>> given these are basically related changes.
>>> Bump, is this ok ?
>> This patch is fine but please fix setkeytab use in ipa-sam before
>> committing this patch.
> This patch does not disable setkeytab yet, so it can go in right away
> (it blocks other patches already). We have a bug to change ipa-sam,
> should we mark it blocker for 4.4 ?

We also have to fix the permission to change keytab, so that it uses the new
style (https://fedorahosted.org/freeipa/ticket/5487). I would actually make
this ticket and the ipa-sam ticket a blocker for this patch set.

Otherwise you are actually introducing a switch that breaks FreeIPA as some of
it's core server functions still use the old method.

Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to