URL: https://github.com/freeipa/freeipa/pull/214
Author: tomaskrizek
 Title: #214: ipaldap: remove do_bind from LDAPClient
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/214/head:pr214
git checkout pr214
From b84b17f9be13fd3b4bda99892d9da32b15493547 Mon Sep 17 00:00:00 2001
From: Tomas Krizek <tkri...@redhat.com>
Date: Fri, 11 Nov 2016 12:45:11 +0100
Subject: [PATCH] dns: check if container exists using ldapi

Previously an adhoc connection was established for checking if
dns(sec) container exists. A simple or external bind was used.
Instead, always connect with ldapi through api.Backend.ldap2.

https://fedorahosted.org/freeipa/ticket/6461
---
 install/tools/ipa-csreplica-manage         |  3 +--
 install/tools/ipa-replica-manage           |  3 +--
 ipaserver/install/bindinstance.py          | 23 ++++-------------------
 ipaserver/install/ca.py                    |  3 +--
 ipaserver/install/dnskeysyncinstance.py    | 28 +++++-----------------------
 ipaserver/install/ipa_replica_prepare.py   |  9 ++-------
 ipaserver/install/server/replicainstall.py |  4 +---
 7 files changed, 15 insertions(+), 58 deletions(-)

diff --git a/install/tools/ipa-csreplica-manage b/install/tools/ipa-csreplica-manage
index fd384d6..532e353 100755
--- a/install/tools/ipa-csreplica-manage
+++ b/install/tools/ipa-csreplica-manage
@@ -281,8 +281,7 @@ def del_master(realm, hostname, options):
 
     # 7. And clean up the removed replica DNS entries if any.
     try:
-        if bindinstance.dns_container_exists(options.host, api.env.basedn,
-                                             dm_password=options.dirman_passwd):
+        if bindinstance.dns_container_exists(api.env.basedn):
             bind = bindinstance.BindInstance()
             bind.update_system_records()
     except Exception as e:
diff --git a/install/tools/ipa-replica-manage b/install/tools/ipa-replica-manage
index 48a28bd..68d9a92 100755
--- a/install/tools/ipa-replica-manage
+++ b/install/tools/ipa-replica-manage
@@ -903,8 +903,7 @@ def ensure_last_services(conn, hostname, masters, options):
 
 def cleanup_server_dns_entries(realm, hostname, suffix, options):
     try:
-        if bindinstance.dns_container_exists(options.host, suffix,
-                                             dm_password=options.dirman_passwd):
+        if bindinstance.dns_container_exists(suffix):
             bindinstance.remove_master_dns_records(hostname, realm)
             dnskeysyncinstance.remove_replica_public_keys(hostname)
     except Exception as e:
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index d32ced7..179eb68 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -39,7 +39,7 @@
 from ipaserver.install import installutils
 from ipaserver.install import service
 from ipaserver.install import sysupgrade
-from ipapython import ipautil, ipaldap
+from ipapython import ipautil
 from ipapython import dnsutil
 from ipapython.dnsutil import DNSName
 from ipapython.ipa_log_manager import root_logger
@@ -58,7 +58,6 @@
                          zone_is_reverse, validate_dnssec_global_forwarder,
                          DNSSECSignatureMissingError, EDNS0UnsupportedError,
                          UnresolvableRecordError)
-from ipalib.constants import CACERT
 
 if six.PY3:
     unicode = str
@@ -229,26 +228,13 @@ def named_conf_add_include(path):
         f.write(named_conf_include_template % {'path': path})
 
 
-def dns_container_exists(fqdn, suffix, dm_password=None, ldapi=False,
-                         realm=None):
+def dns_container_exists(suffix):
     """
     Test whether the dns container exists.
     """
     assert isinstance(suffix, DN)
-    try:
-        # At install time we may need to use LDAPI to avoid chicken/egg
-        # issues with SSL certs and truting CAs
-        ldap_uri = ipaldap.get_ldap_uri(fqdn, 636, ldapi=ldapi, realm=realm,
-                                        cacert=CACERT)
-        conn = ipaldap.LDAPClient(ldap_uri, cacert=CACERT)
-        conn.simple_bind(ipaldap.DIRMAN_DN, dm_password)
-    except ldap.SERVER_DOWN:
-        raise RuntimeError('LDAP server on %s is not responding. Is IPA installed?' % fqdn)
-
-    ret = conn.entry_exists(DN(('cn', 'dns'), suffix))
-    conn.unbind()
+    return api.Backend.ldap2.entry_exists(DN(('cn', 'dns'), suffix))
 
-    return ret
 
 def dns_zone_exists(name, api=api):
     try:
@@ -656,8 +642,7 @@ def setup(self, fqdn, ip_addresses, realm_name, domain_name, forwarders,
         else:
             self.zonemgr = normalize_zonemgr(zonemgr)
 
-        self.first_instance = not dns_container_exists(
-            self.fqdn, self.suffix, realm=self.realm, ldapi=True)
+        self.first_instance = not dns_container_exists(self.suffix)
 
         self.__setup_sub_dict()
 
diff --git a/ipaserver/install/ca.py b/ipaserver/install/ca.py
index 0d80a3f..4bbcb12 100644
--- a/ipaserver/install/ca.py
+++ b/ipaserver/install/ca.py
@@ -223,7 +223,6 @@ def install_step_1(standalone, replica_config, options):
         return
 
     realm_name = options.realm_name
-    dm_password = options.dm_password
     host_name = options.host_name
     subject_base = options.subject
 
@@ -285,7 +284,7 @@ def install_step_1(standalone, replica_config, options):
 
     if standalone:
         # Install CA DNS records
-        if bindinstance.dns_container_exists(host_name, basedn, dm_password):
+        if bindinstance.dns_container_exists(basedn):
             bind = bindinstance.BindInstance()
             bind.update_system_records()
 
diff --git a/ipaserver/install/dnskeysyncinstance.py b/ipaserver/install/dnskeysyncinstance.py
index 656242b..74a657d 100644
--- a/ipaserver/install/dnskeysyncinstance.py
+++ b/ipaserver/install/dnskeysyncinstance.py
@@ -19,12 +19,10 @@
 from ipaserver.install import installutils
 from ipapython.ipa_log_manager import root_logger
 from ipapython.dn import DN
-from ipapython import ipaldap
 from ipapython import ipautil
 from ipaplatform.constants import constants
 from ipaplatform.paths import paths
 from ipalib import errors, api
-from ipalib.constants import CACERT
 from ipaserver.install.bindinstance import dns_container_exists
 
 softhsm_token_label = u'ipaDNSSEC'
@@ -32,26 +30,13 @@
 replica_keylabel_template = u"dnssec-replica:%s"
 
 
-def dnssec_container_exists(fqdn, suffix, dm_password=None, ldapi=False,
-                            realm=None):
+def dnssec_container_exists(suffix):
     """
     Test whether the dns container exists.
     """
     assert isinstance(suffix, DN)
-    try:
-        # At install time we may need to use LDAPI to avoid chicken/egg
-        # issues with SSL certs and truting CAs
-        ldap_uri = ipaldap.get_ldap_uri(fqdn, 636, ldapi=ldapi, realm=realm,
-                                        cacert=CACERT)
-        conn = ipaldap.LDAPClient(ldap_uri, cacert=CACERT)
-        conn.simple_bind(ipaldap.DIRMAN_DN, dm_password)
-    except ldap.SERVER_DOWN:
-        raise RuntimeError('LDAP server on %s is not responding. Is IPA installed?' % fqdn)
-
-    ret = conn.entry_exists(DN(('cn', 'sec'), ('cn', 'dns'), suffix))
-    conn.unbind()
-
-    return ret
+    return api.Backend.ldap2.entry_exists(
+        DN(('cn', 'sec'), ('cn', 'dns'), suffix))
 
 
 def remove_replica_public_keys(hostname):
@@ -161,9 +146,7 @@ def __check_dnssec_status(self):
         except KeyError:
             raise RuntimeError("OpenDNSSEC GID not found")
 
-        if not dns_container_exists(
-            self.fqdn, self.suffix, realm=self.realm, ldapi=True
-        ):
+        if not dns_container_exists(self.suffix):
             raise RuntimeError("DNS container does not exist")
 
         # ready to be installed, storing a state is required to run uninstall
@@ -173,8 +156,7 @@ def __setup_dnssec_containers(self):
         """
         Setup LDAP containers for DNSSEC
         """
-        if dnssec_container_exists(self.fqdn, self.suffix, ldapi=True,
-                                   realm=self.realm):
+        if dnssec_container_exists(self.suffix):
 
             self.logger.info("DNSSEC container exists (step skipped)")
             return
diff --git a/ipaserver/install/ipa_replica_prepare.py b/ipaserver/install/ipa_replica_prepare.py
index e6699d8..227d296 100644
--- a/ipaserver/install/ipa_replica_prepare.py
+++ b/ipaserver/install/ipa_replica_prepare.py
@@ -253,10 +253,7 @@ def ask_for_options(self):
         except installutils.BadHostError as e:
             if isinstance(e, installutils.HostLookupError):
                 if not options.ip_addresses:
-                    if dns_container_exists(
-                            api.env.host, api.env.basedn,
-                            dm_password=self.dirman_password,
-                            ldapi=True, realm=api.env.realm):
+                    if dns_container_exists(api.env.basedn):
                         self.log.info('You might use the --ip-address option '
                                       'to create a DNS entry if the DNS zone '
                                       'is managed by IPA.')
@@ -268,9 +265,7 @@ def ask_for_options(self):
                 raise
 
         if options.ip_addresses:
-            if not dns_container_exists(api.env.host, api.env.basedn,
-                                        dm_password=self.dirman_password,
-                                        ldapi=True, realm=api.env.realm):
+            if not dns_container_exists(api.env.basedn):
                 self.log.error(
                     "It is not possible to add a DNS record automatically "
                     "because DNS is not managed by IPA. Please create DNS "
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
index 6d618b6..a7b333c 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
@@ -171,9 +171,7 @@ def install_http(config, auto_redirect, ca_is_configured, ca_file,
 def install_dns_records(config, options, remote_api):
 
     if not bindinstance.dns_container_exists(
-            config.host_name,
-            ipautil.realm_to_suffix(config.realm_name),
-            realm=config.realm_name, ldapi=True):
+            ipautil.realm_to_suffix(config.realm_name)):
         return
 
     try:
-- 
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to