Attachment 74605 Details for Bug 55041 – Use ipa-client-install to provide join functionality for IPA domains

[patch] Use ipa-client-install to provide join functionality for IPA domains

Use-ipa-client-install-to-provide-join-functionali.patch (text/plain), 25.64 KB, created by Stef Walter on 2013-02-11 12:35:02 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stef Walter

Created: 2013-02-11 12:35:02 UTC

Size: 25.64 KB

patch

obsolete

>From e083441d1f85c22abaf3601a4e5ceb5d940c2fb2 Mon Sep 17 00:00:00 2001
>From: Stef Walter <stefw@gnome.org>
>Date: Mon, 11 Feb 2013 12:49:16 +0100
>Subject: [PATCH] Use ipa-client-install to provide join functionality for IPA
> domains
>
> * Currently we just pass the password, and don't use a ccache
> * In order to use a ccache ipa-client-install needs to be modified
> * One time password support is present
> * Deconfigure and Leave support is present
> * Update documentation
>
>https://bugs.freedesktop.org/show_bug.cgi?id=55041
>---
> doc/internals/realmd-internals.xml  |   7 +-
> doc/manual/realmd-guide-freeipa.xml | 108 +++++++-
> po/POTFILES.in                      |   1 +
> service/realm-sssd-ipa.c            | 489 +++++++++++++++++++++++++++++++++++-
> service/realmd-defaults.conf        |   1 +
> service/realmd-redhat.conf          |   3 +
> 6 files changed, 603 insertions(+), 6 deletions(-)
>
>diff --git a/doc/internals/realmd-internals.xml b/doc/internals/realmd-internals.xml
>index 40f7aa2..46a6544 100644
>--- a/doc/internals/realmd-internals.xml
>+++ b/doc/internals/realmd-internals.xml
>@@ -55,7 +55,7 @@
> 
> 	<para>For freeipa server software, realmd supports:</para>
> 	<itemizedlist>
>-		<listitem><para>sssd client software (joins/leaves supported soon).</para></listitem>
>+		<listitem><para>sssd client software (with 'freeipa' membership software).</para></listitem>
> 	</itemizedlist>
> </section>
> 
>@@ -280,7 +280,10 @@
> 
> 	<itemizedlist>
> 		<title>RealmSssdIpa</title>
>-		<listitem><para>has a dynamically generated object path upon realm creation, but does not support joins yet.</para></listitem>
>+		<listitem><para>has a dynamically generated object path upon realm creation.</para></listitem>
>+		<listitem><para>membership software supported: freeipa</para></listitem>
>+		<listitem><para>config file modified: sssd.conf</para></listitem>
>+		<listitem><para>required_packages: sssd, freeipa-client</para></listitem>
> 	</itemizedlist>
> 
> </section>
>diff --git a/doc/manual/realmd-guide-freeipa.xml b/doc/manual/realmd-guide-freeipa.xml
>index 6e772c8..44571cb 100644
>--- a/doc/manual/realmd-guide-freeipa.xml
>+++ b/doc/manual/realmd-guide-freeipa.xml
>@@ -8,8 +8,10 @@
> <chapter id="guide-freeipa">
> 	<title>Using with FreeIPA</title>
> 
>-	<para><command>realmd</command> can discover FreeIPA domains. It is not
>-	yet possible to join the computer to the domain.</para>
>+	<para><command>realmd</command> can discover FreeIPA domains and join
>+	the current computer as an account on a domain. This allows using domain
>+	users locally, and log into the local machine with FreeIPA domain
>+	credentials.</para>
> 
> 	<section>
> 		<title>Discovering FreeIPA domains</title>
>@@ -59,4 +61,106 @@ $ <command>realm --verbose discover domain.example.com</command>
> 
> 	</section>
> 
>+	<section id="guide-freeipa-client">
>+		<title>FreeIPA client software</title>
>+		<para>As part of configuring an FreeIPA  domain for use
>+		on the local computer, <command>realmd</command> will install and
>+		configure client software to enable domain accounts to be used on
>+		the local computer.</para>
>+
>+		<para>For a FreeIPA domain this is
>+		<ulink url="https://fedorahosted.org/sssd/">SSSD</ulink>.</para>
>+
>+	</section>
>+
>+	<section id="guide-freeipa-join">
>+		<title>Joining a FreeIPA domain</title>
>+
>+		<para>To join a FreeIPA domain with <command>realmd</command>
>+		you can use the <link linkend="realm"><command>realm</command></link>
>+		command line tool:</para>
>+
>+		<informalexample>
>+<screen>
>+$ <command>realm join --verbose ipa.example.com</command>
>+</screen>
>+		</informalexample>
>+
>+		<para>By specifying the <option>--verbose</option> it's easier
>+		to see what went wrong if the join fails.</para>
>+
>+		<para>Other tools also use <command>realmd</command> which can
>+		be used to perform the join operation, for example: GNOME
>+		Control Center.</para>
>+
>+		<para>The join operation does the following:</para>
>+		<itemizedlist>
>+			<listitem><para>Discovers information about the domain.</para></listitem>
>+			<listitem><para>Installs the necessary software to join the domain, such as SSSD.</para></listitem>
>+			<listitem><para>Prompts for administrative credentials.</para></listitem>
>+			<listitem><para>A computer account in the domain will be created, and or updated.</para></listitem>
>+			<listitem><para>A host keytab file at <filename>/etc/krb5.keytab</filename> is created.</para></listitem>
>+			<listitem><para>Configures the SSSD service, and restarts and enables it as appropriate.</para></listitem>
>+			<listitem><para>Enables domain users in <filename>/etc/nsswitch.conf</filename></para></listitem>
>+		</itemizedlist>
>+
>+		<para>After the join operation is complete, domain accounts should
>+		be usable locally, although logins using domain accounts are
>+		not necessarily enabled.</para>
>+
>+		<para>You verify that domain accounts are working with with a
>+		command like this:</para>
>+
>+		<informalexample>
>+<screen>
>+$ <command>getent passwd admin@ipa.example.com</command>
>+</screen>
>+		</informalexample>
>+
>+		<para>The join operation will create or update a computer account
>+		in the domain. It is possible to </para>
>+
>+	</section>
>+
>+	<section id="guide-freeipa-permit">
>+		<title>Logins using Domain Accounts</title>
>+
>+		<para>Once the
>+		<link linkend="guide-freeipa-join">computer is joined</link>
>+		to a FreeIPA domain, the machine will automatically follow the
>+		domain settings for whether users are able to log into the
>+		machine or not.</para>
>+
>+		<para>To override this behavior and permit any domain account
>+		to log in, use the following command.</para>
>+
>+		<informalexample>
>+<screen>
>+$ <command>realm permit --realm domain.example.com --all</command>
>+</screen>
>+		</informalexample>
>+
>+		<para>To permit only specific accounts from the domain to log in
>+		use the following command. The first time this command is run
>+		it will change the mode to only allow logins by specific accounts,
>+		and then add the specified accounts to the list of accounts
>+		to permit.</para>
>+
>+		<informalexample>
>+<screen>
>+$ <command>realm permit --realm domain.example.com user1@ipa.example.com user2@ipa.example.com</command>
>+</screen>
>+		</informalexample>
>+
>+		<para>To deny logins from any domain account, use the following
>+		command.</para>
>+
>+		<informalexample>
>+<screen>
>+$ <command>realm deny --realm domain.example.com --all</command>
>+</screen>
>+		</informalexample>
>+
>+	</section>
>+
> </chapter>
>diff --git a/po/POTFILES.in b/po/POTFILES.in
>index b0d6a8a..8053421 100644
>--- a/po/POTFILES.in
>+++ b/po/POTFILES.in
>@@ -7,6 +7,7 @@ service/realm-provider.c
> service/realm-samba.c
> service/realm-sssd-ad.c
> service/realm-sssd-config.c
>+service/realm-sssd-ipa.c
> tools/realm.c
> tools/realm-client.c
> tools/realm-discover.c
>diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c
>index ed9dee8..17329a9 100644
>--- a/service/realm-sssd-ipa.c
>+++ b/service/realm-sssd-ipa.c
>@@ -14,20 +14,24 @@
> 
> #include "config.h"
> 
>-#include "realm-ipa-discover.h"
> #include "realm-command.h"
> #include "realm-daemon.h"
> #include "realm-dbus-constants.h"
> #include "realm-diagnostics.h"
> #include "realm-discovery.h"
> #include "realm-errors.h"
>+#include "realm-ipa-discover.h"
>+#include "realm-kerberos.h"
>+#include "realm-kerberos-membership.h"
> #include "realm-packages.h"
> #include "realm-provider.h"
> #include "realm-service.h"
>+#include "realm-settings.h"
> #include "realm-sssd.h"
> #include "realm-sssd-ipa.h"
> #include "realm-sssd-config.h"
> 
>+#include <glib/gi18n.h>
> #include <glib/gstdio.h>
> 
> #include <errno.h>
>@@ -41,7 +45,21 @@ typedef struct {
> 	RealmSssdClass parent_class;
> } RealmSssdIpaClass;
> 
>-G_DEFINE_TYPE (RealmSssdIpa, realm_sssd_ipa, REALM_TYPE_SSSD);
>+static const gchar *NO_PACKAGES[] = {
>+	NULL,
>+};
>+
>+static const gchar *IPA_PACKAGES[] = {
>+	REALM_DBUS_IDENTIFIER_FREEIPA,
>+	REALM_DBUS_IDENTIFIER_SSSD,
>+	NULL
>+};
>+
>+static void realm_sssd_ipa_kerberos_membership_iface (RealmKerberosMembershipIface *iface);
>+
>+G_DEFINE_TYPE_WITH_CODE (RealmSssdIpa, realm_sssd_ipa, REALM_TYPE_SSSD,
>+                         G_IMPLEMENT_INTERFACE (REALM_TYPE_KERBEROS_MEMBERSHIP, realm_sssd_ipa_kerberos_membership_iface);
>+);
> 
> static void
> realm_sssd_ipa_init (RealmSssdIpa *self)
>@@ -53,6 +71,7 @@ static void
> realm_sssd_ipa_constructed (GObject *obj)
> {
> 	RealmKerberos *kerberos = REALM_KERBEROS (obj);
>+	GVariant *supported;
> 
> 	G_OBJECT_CLASS (realm_sssd_ipa_parent_class)->constructed (obj);
> 
>@@ -60,6 +79,27 @@ realm_sssd_ipa_constructed (GObject *obj)
> 	                            REALM_DBUS_OPTION_SERVER_SOFTWARE, REALM_DBUS_IDENTIFIER_FREEIPA,
> 	                            REALM_DBUS_OPTION_CLIENT_SOFTWARE, REALM_DBUS_IDENTIFIER_SSSD,
> 	                            NULL);
>+
>+	/*
>+	 * NOTE: The ipa-client-install service requires that we pass a password directly
>+	 * to the process, and not a ccache. It also accepts a one time password.
>+	 */
>+	supported = realm_kerberos_membership_build_supported (
>+			REALM_KERBEROS_CREDENTIAL_PASSWORD, REALM_KERBEROS_OWNER_ADMIN,
>+			REALM_KERBEROS_CREDENTIAL_SECRET, REALM_KERBEROS_OWNER_NONE,
>+			0);
>+
>+	realm_kerberos_set_supported_join_creds (kerberos, supported);
>+
>+	supported = realm_kerberos_membership_build_supported (
>+			REALM_KERBEROS_CREDENTIAL_PASSWORD, REALM_KERBEROS_OWNER_ADMIN,
>+			REALM_KERBEROS_CREDENTIAL_AUTOMATIC, REALM_KERBEROS_OWNER_NONE,
>+			0);
>+
>+	realm_kerberos_set_supported_leave_creds (kerberos, supported);
>+
>+	realm_kerberos_set_suggested_admin (kerberos, "admin");
>+	realm_kerberos_set_required_package_sets (kerberos, IPA_PACKAGES);
> }
> 
> void
>@@ -68,3 +108,448 @@ realm_sssd_ipa_class_init (RealmSssdIpaClass *klass)
> 	GObjectClass *object_class = G_OBJECT_CLASS (klass);
> 	object_class->constructed = realm_sssd_ipa_constructed;
> }
>+
>+typedef struct {
>+	GDBusMethodInvocation *invocation;
>+	gchar **argv;
>+	GBytes *input;
>+} EnrollClosure;
>+
>+static void
>+enroll_closure_free (gpointer data)
>+{
>+	EnrollClosure *enroll = data;
>+	g_object_unref (enroll->invocation);
>+	g_strfreev (enroll->argv);
>+	g_bytes_unref (enroll->input);
>+	g_slice_free (EnrollClosure, enroll);
>+}
>+
>+static void
>+on_enable_nss_done (GObject *source,
>+                    GAsyncResult *result,
>+                    gpointer user_data)
>+{
>+	GSimpleAsyncResult *async = G_SIMPLE_ASYNC_RESULT (user_data);
>+	GError *error = NULL;
>+	gint status;
>+
>+	status = realm_command_run_finish (result, NULL, &error);
>+	if (error == NULL && status != 0)
>+		g_set_error (&error, REALM_ERROR, REALM_ERROR_INTERNAL,
>+		             _("Enabling SSSD in nsswitch.conf and PAM failed."));
>+	if (error != NULL)
>+		g_simple_async_result_take_error (async, error);
>+
>+	g_simple_async_result_complete (async);
>+	g_object_unref (async);
>+}
>+
>+static void
>+on_restart_done (GObject *source,
>+                 GAsyncResult *result,
>+                 gpointer user_data)
>+{
>+	GSimpleAsyncResult *async = G_SIMPLE_ASYNC_RESULT (user_data);
>+	EnrollClosure *enroll = g_simple_async_result_get_op_res_gpointer (async);
>+	RealmSssd *sssd = REALM_SSSD (g_async_result_get_source_object (user_data));
>+	GError *error = NULL;
>+
>+	realm_service_enable_and_restart_finish (result, &error);
>+	if (error == NULL) {
>+		realm_sssd_update_properties (sssd);
>+		realm_command_run_known_async ("sssd-enable-logins", NULL, enroll->invocation,
>+		                               on_enable_nss_done, g_object_ref (async));
>+	} else {
>+		g_simple_async_result_take_error (async, error);
>+		g_simple_async_result_complete (async);
>+	}
>+
>+	g_object_unref (sssd);
>+	g_object_unref (async);
>+}
>+
>+static void
>+on_ipa_client_do_restart (GObject *source,
>+                          GAsyncResult *result,
>+                          gpointer user_data)
>+{
>+	GSimpleAsyncResult *async = G_SIMPLE_ASYNC_RESULT (user_data);
>+	EnrollClosure *enroll = g_simple_async_result_get_op_res_gpointer (async);
>+	RealmSssd *sssd = REALM_SSSD (g_async_result_get_source_object (user_data));
>+	RealmKerberos *realm = REALM_KERBEROS (sssd);
>+	GError *error = NULL;
>+	GString *output = NULL;
>+	gchar *home;
>+	gint status;
>+
>+	status = realm_command_run_finish (result, &output, &error);
>+
>+	if (error == NULL && status != 0) {
>+
>+		/*
>+		 * TODO: We need to update ipa-client-install to accept a
>+		 * ccache so we can get better feedback on invalid passwords.
>+		 * We run the process with LC_ALL=C so at least we know these
>+		 * messages will be in english.
>+		 */
>+		if (g_pattern_match_simple ("*kinit: Password incorrect*", output->str)) {
>+			g_set_error (&error, REALM_ERROR, REALM_ERROR_AUTH_FAILED,
>+			             "Password is incorrect");
>+		} else {
>+			g_set_error (&error, REALM_ERROR, REALM_ERROR_INTERNAL,
>+			             "Running ipa-client-install failed");
>+		}
>+	}
>+
>+	if (error == NULL) {
>+		home = realm_sssd_build_default_home (realm_settings_string ("users", "default-home"));
>+
>+		realm_sssd_config_update_domain (realm_sssd_get_config (sssd),
>+		                                 realm_kerberos_get_name (realm), &error,
>+		                                 "re_expression", "(?P<name>[^@]+)@(?P<domain>.+$)",
>+		                                 "full_name_format", "%1$s@%2$s",
>+		                                 "cache_credentials", "True",
>+		                                 "use_fully_qualified_names", "True",
>+		                                 "simple_allow_users", ",",
>+		                                 "krb5_store_password_if_offline", "True",
>+		                                 "fallback_homedir", home,
>+		                                 NULL);
>+
>+		g_free (home);
>+	}
>+
>+	if (error == NULL) {
>+		realm_service_enable_and_restart ("sssd", enroll->invocation,
>+		                                  on_restart_done, g_object_ref (async));
>+
>+	} else {
>+		g_simple_async_result_take_error (async, error);
>+		g_simple_async_result_complete (async);
>+	}
>+
>+	g_object_unref (sssd);
>+	g_object_unref (async);
>+}
>+
>+static void
>+on_install_do_join (GObject *source,
>+                    GAsyncResult *result,
>+                    gpointer user_data)
>+{
>+	GSimpleAsyncResult *async = G_SIMPLE_ASYNC_RESULT (user_data);
>+	EnrollClosure *enroll = g_simple_async_result_get_op_res_gpointer (async);
>+	GError *error = NULL;
>+
>+	const gchar *env[] = {
>+		"LANG=C",
>+		NULL,
>+	};
>+
>+	realm_packages_install_finish (result, &error);
>+	if (error == NULL) {
>+		realm_command_runv_async (enroll->argv, (gchar **)env,
>+		                          enroll->input, enroll->invocation,
>+		                          on_ipa_client_do_restart, g_object_ref (async));
>+	} else {
>+		g_simple_async_result_take_error (async, error);
>+		g_simple_async_result_complete (async);
>+	}
>+
>+	g_object_unref (async);
>+}
>+
>+static void
>+join_ipa_async (RealmKerberosMembership *membership,
>+                const gchar **argv,
>+                GBytes *input,
>+                RealmKerberosFlags flags,
>+                GVariant *options,
>+                GDBusMethodInvocation *invocation,
>+                GAsyncReadyCallback callback,
>+                gpointer user_data)
>+{
>+	RealmKerberos *realm = REALM_KERBEROS (membership);
>+	RealmSssd *sssd = REALM_SSSD (realm);
>+	GSimpleAsyncResult *async;
>+	EnrollClosure *enroll;
>+	const gchar *domain_name;
>+	const gchar *computer_ou;
>+	const gchar *software;
>+	const gchar **packages;
>+
>+	domain_name = realm_kerberos_get_name (realm);
>+
>+	async = g_simple_async_result_new (G_OBJECT (realm), callback, user_data, NULL);
>+	enroll = g_slice_new0 (EnrollClosure);
>+	enroll->input = input ? g_bytes_ref (input) : NULL;
>+	enroll->argv = g_strdupv ((gchar **)argv);
>+	enroll->invocation = g_object_ref (invocation);
>+	g_simple_async_result_set_op_res_gpointer (async, enroll, enroll_closure_free);
>+
>+	if (g_variant_lookup (options, REALM_DBUS_OPTION_COMPUTER_OU, "&s", &computer_ou)) {
>+		g_simple_async_result_set_error (async, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS,
>+		                                 _("The computer-ou argument is not supported when joining an IPA domain."));
>+		g_simple_async_result_complete_in_idle (async);
>+
>+	} else if (g_variant_lookup (options, REALM_DBUS_OPTION_MEMBERSHIP_SOFTWARE, "&s", &software) &&
>+	           !g_str_equal (software, REALM_DBUS_IDENTIFIER_FREEIPA)) {
>+		g_simple_async_result_set_error (async, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS,
>+		                                 _("Unsupported or unknown membership software '%s'"), software);
>+		g_simple_async_result_complete_in_idle (async);
>+
>+	} else if (realm_sssd_get_config_section (sssd) != NULL) {
>+		g_simple_async_result_set_error (async, REALM_ERROR, REALM_ERROR_ALREADY_CONFIGURED,
>+		                                 _("Already joined to this domain"));
>+		g_simple_async_result_complete_in_idle (async);
>+
>+	} else if (realm_sssd_config_have_domain (realm_sssd_get_config (sssd), domain_name)) {
>+		g_simple_async_result_set_error (async, REALM_ERROR, REALM_ERROR_ALREADY_CONFIGURED,
>+		                                 _("A domain with this name is already configured"));
>+		g_simple_async_result_complete_in_idle (async);
>+
>+	} else {
>+		packages = IPA_PACKAGES;
>+		if (flags & REALM_KERBEROS_ASSUME_PACKAGES)
>+			packages = NO_PACKAGES;
>+		realm_packages_install_async (packages, invocation,
>+		                              on_install_do_join, g_object_ref (async));
>+	}
>+
>+	g_object_unref (async);
>+}
>+
>+static void
>+realm_sssd_ipa_enroll_password_async (RealmKerberosMembership *membership,
>+                                      const gchar *name,
>+                                      GBytes *password,
>+                                      RealmKerberosFlags flags,
>+                                      GVariant *options,
>+                                      GDBusMethodInvocation *invocation,
>+                                      GAsyncReadyCallback callback,
>+                                      gpointer user_data)
>+{
>+	RealmKerberos *realm = REALM_KERBEROS (membership);
>+	GBytes *input;
>+
>+	const gchar *argv[] = {
>+		realm_settings_string ("paths", "ipa-client-install"),
>+		"--domain", realm_kerberos_get_name (realm),
>+		"--realm", realm_kerberos_get_realm_name (realm),
>+		"--principal", name,
>+		"-W",
>+		"--mkhomedir",
>+		"--no-ntp",
>+		"--enable-dns-updates",
>+		"--unattended",
>+		NULL,
>+	};
>+
>+	input = realm_command_build_password_line (password);
>+
>+	join_ipa_async (membership, argv, input, flags, options,
>+	                invocation, callback, user_data);
>+
>+	g_bytes_unref (input);
>+}
>+
>+static const char *
>+secret_to_password (GBytes *secret,
>+                    gchar **password)
>+{
>+	gconstpointer data;
>+	gsize length;
>+
>+	/*
>+	 * In theory the password could be binary with embedded nulls.
>+	 * We don't support that. And we assume that we don't need to
>+	 * check for that here, because such a password will be wrong,
>+	 * and ipa-client-install will simply fail to join the domain.
>+	 */
>+
>+	data = g_bytes_get_data (secret, &length);
>+	*password = g_strndup (data, length);
>+	return *password;
>+}
>+
>+static void
>+realm_sssd_ipa_enroll_secret_async (RealmKerberosMembership *membership,
>+                                    GBytes *secret,
>+                                    RealmKerberosFlags flags,
>+                                    GVariant *options,
>+                                    GDBusMethodInvocation *invocation,
>+                                    GAsyncReadyCallback callback,
>+                                    gpointer user_data)
>+{
>+	RealmKerberos *realm = REALM_KERBEROS (membership);
>+	char *password;
>+
>+	const gchar *argv[] = {
>+		realm_settings_string ("paths", "ipa-client-install"),
>+		"--domain", realm_kerberos_get_name (realm),
>+		"--realm", realm_kerberos_get_realm_name (realm),
>+		"--password", secret_to_password (secret, &password),
>+		"--mkhomedir",
>+		"--no-ntp",
>+		"--enable-dns-updates",
>+		"--unattended",
>+		NULL,
>+	};
>+
>+	/*
>+	 * TODO: Allow passing the password other than command line.
>+	 *
>+	 * ipa-client-install won't let us pass a password into a prompt
>+	 * when used with --unattended. We need --unattended since we can't
>+	 * handle arbitrary prompts. So pass the one time password on
>+	 * the command line. It's just a one time password, so in the short
>+	 * term this should be okay.
>+	 */
>+
>+	join_ipa_async (membership, argv, NULL, flags, options,
>+	                invocation, callback, user_data);
>+
>+	g_free (password);
>+}
>+
>+static void
>+on_ipa_client_do_disable (GObject *source,
>+                          GAsyncResult *result,
>+                          gpointer user_data)
>+{
>+	GSimpleAsyncResult *async = G_SIMPLE_ASYNC_RESULT (user_data);
>+	EnrollClosure *enroll = g_simple_async_result_get_op_res_gpointer (async);
>+	RealmSssd *sssd = REALM_SSSD (g_async_result_get_source_object (user_data));
>+	GError *error = NULL;
>+	gint status;
>+
>+	status = realm_command_run_finish (result, NULL, &error);
>+
>+	if (error == NULL && status != 0) {
>+		g_set_error (&error, REALM_ERROR, REALM_ERROR_INTERNAL,
>+		             "Running ipa-client-install failed");
>+	}
>+
>+	if (error == NULL) {
>+		realm_sssd_deconfigure_domain_tail (sssd, async, enroll->invocation);
>+
>+	} else {
>+		g_simple_async_result_take_error (async, error);
>+		g_simple_async_result_complete (async);
>+	}
>+
>+	g_object_unref (sssd);
>+	g_object_unref (async);
>+}
>+
>+static void
>+leave_ipa_async (RealmKerberosMembership *membership,
>+                 const gchar **argv,
>+                 GBytes *input,
>+                 RealmKerberosFlags flags,
>+                 GVariant *options,
>+                 GDBusMethodInvocation *invocation,
>+                 GAsyncReadyCallback callback,
>+                 gpointer user_data)
>+{
>+	RealmKerberos *realm = REALM_KERBEROS (membership);
>+	RealmSssd *sssd = REALM_SSSD (realm);
>+	GSimpleAsyncResult *async;
>+	EnrollClosure *enroll;
>+	const gchar *computer_ou;
>+
>+	const gchar *env[] = {
>+		"LANG=C",
>+		NULL,
>+	};
>+
>+	async = g_simple_async_result_new (G_OBJECT (realm), callback, user_data, NULL);
>+	enroll = g_slice_new0 (EnrollClosure);
>+	enroll->invocation = g_object_ref (invocation);
>+	g_simple_async_result_set_op_res_gpointer (async, enroll, enroll_closure_free);
>+
>+	if (realm_sssd_get_config_section (sssd) == NULL) {
>+		g_simple_async_result_set_error (async, REALM_ERROR, REALM_ERROR_NOT_CONFIGURED,
>+		                                 _("Not currently joined to this realm"));
>+		g_simple_async_result_complete_in_idle (async);
>+
>+	} else if (g_variant_lookup (options, REALM_DBUS_OPTION_COMPUTER_OU, "&s", &computer_ou)) {
>+		g_simple_async_result_set_error (async, G_DBUS_ERROR, G_DBUS_ERROR_INVALID_ARGS,
>+		                                 "The computer-ou argument is not supported when leaving an IPA domain.");
>+		g_simple_async_result_complete_in_idle (async);
>+
>+	} else {
>+		realm_command_runv_async ((gchar **)argv, (gchar **)env, NULL, invocation,
>+		                          on_ipa_client_do_disable, g_object_ref (async));
>+	}
>+
>+	g_object_unref (async);
>+}
>+
>+static void
>+realm_sssd_ipa_leave_password_async (RealmKerberosMembership *membership,
>+                                     const char *name,
>+                                     GBytes *password,
>+                                     RealmKerberosFlags flags,
>+                                     GVariant *options,
>+                                     GDBusMethodInvocation *invocation,
>+                                     GAsyncReadyCallback callback,
>+                                     gpointer user_data)
>+{
>+	GBytes *input;
>+
>+	const gchar *argv[] = {
>+		realm_settings_string ("paths", "ipa-client-install"),
>+		"--uninstall",
>+		"--principal", name,
>+		"-W",
>+		"--unattended",
>+		NULL
>+	};
>+
>+	input = realm_command_build_password_line (password);
>+	leave_ipa_async (membership, argv, input, flags, options,
>+	                 invocation, callback, user_data);
>+	g_bytes_unref (input);
>+}
>+
>+static void
>+realm_sssd_ipa_leave_automatic_async (RealmKerberosMembership *membership,
>+                                      RealmKerberosFlags flags,
>+                                      GVariant *options,
>+                                      GDBusMethodInvocation *invocation,
>+                                      GAsyncReadyCallback callback,
>+                                      gpointer user_data)
>+{
>+	const gchar *argv[] = {
>+		realm_settings_string ("paths", "ipa-client-install"),
>+		"--uninstall",
>+		"--unattended",
>+		NULL
>+	};
>+
>+	leave_ipa_async (membership, argv, NULL, flags, options,
>+	                 invocation, callback, user_data);
>+}
>+
>+static gboolean
>+realm_sssd_ipa_generic_finish (RealmKerberosMembership *realm,
>+                               GAsyncResult *result,
>+                               GError **error)
>+{
>+	if (g_simple_async_result_propagate_error (G_SIMPLE_ASYNC_RESULT (result), error))
>+		return FALSE;
>+
>+	return TRUE;
>+}
>+
>+static void
>+realm_sssd_ipa_kerberos_membership_iface (RealmKerberosMembershipIface *iface)
>+{
>+	iface->enroll_password_async = realm_sssd_ipa_enroll_password_async;
>+	iface->enroll_secret_async = realm_sssd_ipa_enroll_secret_async;
>+	iface->enroll_finish = realm_sssd_ipa_generic_finish;
>+	iface->unenroll_password_async = realm_sssd_ipa_leave_password_async;
>+	iface->unenroll_automatic_async = realm_sssd_ipa_leave_automatic_async;
>+	iface->unenroll_finish = realm_sssd_ipa_generic_finish;
>+}
>diff --git a/service/realmd-defaults.conf b/service/realmd-defaults.conf
>index 6ad6a70..07fa133 100644
>--- a/service/realmd-defaults.conf
>+++ b/service/realmd-defaults.conf
>@@ -6,6 +6,7 @@ winbindd = /usr/sbin/winbindd
> smb.conf = /etc/smb.conf
> sssd.conf = /etc/sssd/sssd.conf
> adcli = /usr/sbin/adcli
>+ipa-client-install = /usr/sbin/ipa-client-install
> 
> [active-directory]
> default-client = sssd
>diff --git a/service/realmd-redhat.conf b/service/realmd-redhat.conf
>index 0fc0cd2..d64d08e 100644
>--- a/service/realmd-redhat.conf
>+++ b/service/realmd-redhat.conf
>@@ -16,6 +16,9 @@ sssd-tools = /usr/sbin/sss_cache
> [adcli-packages]
> adcli = /usr/sbin/adcli
> 
>+[freeipa-packages]
>+freeipa-client = /usr/sbin/ipa-client-install
>+
> [commands]
> winbind-enable-logins = /usr/sbin/authconfig --update --enablewinbind --enablewinbindauth --enablemkhomedir
> winbind-disable-logins = /usr/sbin/authconfig --update --disablewinbind --disablewinbindauth
>-- 
>1.8.1

Actions: View | Splinter Review

Attachments on bug 55041: 70438 | 70439 | 70651 | 70652 | 70653 | 70654 | 74344 | 74345 | 74346 | 74347 | 74587 | 74604 | 74605

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.