From c34c1da3291b722e21fec0875e0bf9c771423f96 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Dec 08 2017 14:45:33 +0000 Subject: trust: detect and error out when non-AD trust with IPA domain name exists Quite often users choose wrong type of trust on Active Directory side when setting up a trust to freeIPA. The trust type supported by freeIPA is just a normal forest trust to another Active Directory. However, some people follow old internet recipes that force using a trust to MIT Kerberos realm. This is a wrong type of trust. Unfortunately, when someone used MIT Kerberos realm trust, there is no way to programmatically remote the trust from freeIPA side. As result, we have to detect such situation and report an error. To do proper reporting, we need reuse some constants and trust type names we use in IPA CLI/Web UI. These common components were moved to a separate ipaserver/dcerpc_common.py module that is imported by both ipaserver/plugins/trust.py and ipaserver/dcerpc.py. Fixes https://pagure.io/freeipa/issue/7264 Reviewed-By: Christian Heimes Reviewed-By: Thierry Bordaz --- diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py index 5a8dc55..8b8e84a 100644 --- a/ipaserver/dcerpc.py +++ b/ipaserver/dcerpc.py @@ -31,6 +31,10 @@ from ipalib import errors from ipapython import ipautil from ipapython.dn import DN from ipaserver.install import installutils +from ipaserver.dcerpc_common import (TRUST_BIDIRECTIONAL, + TRUST_JOIN_EXTERNAL, + trust_type_string) + from ipalib.util import normalize_name import os @@ -76,15 +80,6 @@ and Samba4 python bindings. logger = logging.getLogger(__name__) -# Both constants can be used as masks against trust direction -# because bi-directional has two lower bits set. -TRUST_ONEWAY = 1 -TRUST_BIDIRECTIONAL = 3 - -# Trust join behavior -# External trust -- allow creating trust to a non-root domain in the forest -TRUST_JOIN_EXTERNAL = 1 - def is_sid_valid(sid): try: @@ -150,6 +145,7 @@ pysss_type_key_translation_dict = { pysss_nss_idmap.ID_BOTH: 'both', } + class TrustTopologyConflictSolved(Exception): """ Internal trust error: raised when previously detected @@ -1263,9 +1259,26 @@ class TrustDomainInstance(object): dname = lsa.String() dname.string = another_domain.info['dns_domain'] res = self._pipe.QueryTrustedDomainInfoByName( - self._policy_handle, - dname, - lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) + self._policy_handle, + dname, + lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO + ) + if res.info_ex.trust_type != lsa.LSA_TRUST_TYPE_UPLEVEL: + msg = _('There is already a trust to {ipa_domain} with ' + 'unsupported type {trust_type}. Please remove ' + 'it manually on AD DC side.') + ttype = trust_type_string( + res.info_ex.trust_type, res.info_ex.trust_attributes + ) + err = unicode(msg).format( + ipa_domain=another_domain.info['dns_domain'], + trust_type=ttype) + + raise errors.ValidationError( + name=_('AD domain controller'), + error=err + ) + self._pipe.DeleteTrustedDomain(self._policy_handle, res.info_ex.sid) except RuntimeError as e: diff --git a/ipaserver/dcerpc_common.py b/ipaserver/dcerpc_common.py new file mode 100644 index 0000000..526b025 --- /dev/null +++ b/ipaserver/dcerpc_common.py @@ -0,0 +1,73 @@ +import six +from ipalib import _ +if six.PY3: + unicode = six.text_type + +# Both constants can be used as masks against trust direction +# because bi-directional has two lower bits set. +TRUST_ONEWAY = 1 +TRUST_BIDIRECTIONAL = 3 + +# Trust join behavior +# External trust -- allow creating trust to a non-root domain in the forest +TRUST_JOIN_EXTERNAL = 1 + +# We don't want to import any of Samba Python code here just for constants +# Since these constants set in MS-ADTS, we can rely on their stability +LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE = 0x00000001 + +_trust_direction_dict = { + 1: _('Trusting forest'), + 2: _('Trusted forest'), + 3: _('Two-way trust') +} + +_trust_status_dict = { + True: _('Established and verified'), + False: _('Waiting for confirmation by remote side') +} + +_trust_type_dict_unknown = _('Unknown') + +# Trust type is a combination of ipanttrusttype and ipanttrustattributes +# We shift trust attributes by 3 bits to left so bit 0 becomes bit 3 and +# 2+(1 << 3) becomes 10. +_trust_type_dict = { + 1: _('Non-Active Directory domain'), + 2: _('Active Directory domain'), + 3: _('RFC4120-compliant Kerberos realm'), + 10: _('Non-transitive external trust to a domain in ' + 'another Active Directory forest'), + 11: _('Non-transitive external trust to an RFC4120-' + 'compliant Kerberos realm') +} + + +def trust_type_string(level, attrs): + """ + Returns a string representing a type of the trust. + The original field is an enum: + LSA_TRUST_TYPE_DOWNLEVEL = 0x00000001, + LSA_TRUST_TYPE_UPLEVEL = 0x00000002, + LSA_TRUST_TYPE_MIT = 0x00000003 + """ + transitive = int(attrs) & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE + string = _trust_type_dict.get(int(level) | (transitive << 3), + _trust_type_dict_unknown) + return unicode(string) + + +def trust_direction_string(level): + """ + Returns a string representing a direction of the trust. + The original field is a bitmask taking two bits in use + LSA_TRUST_DIRECTION_INBOUND = 0x00000001, + LSA_TRUST_DIRECTION_OUTBOUND = 0x00000002 + """ + string = _trust_direction_dict.get(int(level), _trust_type_dict_unknown) + return unicode(string) + + +def trust_status_string(level): + string = _trust_status_dict.get(level, _trust_type_dict_unknown) + return unicode(string) diff --git a/ipaserver/plugins/trust.py b/ipaserver/plugins/trust.py index a75f3a0..8453853 100644 --- a/ipaserver/plugins/trust.py +++ b/ipaserver/plugins/trust.py @@ -45,6 +45,13 @@ from ipalib import errors from ipalib import output from ldap import SCOPE_SUBTREE from time import sleep +from ipaserver.dcerpc_common import (TRUST_ONEWAY, + TRUST_BIDIRECTIONAL, + TRUST_JOIN_EXTERNAL, + LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE, + trust_type_string, + trust_direction_string, + trust_status_string) if six.PY3: unicode = str @@ -64,9 +71,6 @@ except Exception as e: if api.env.in_server and api.env.context in ['lite', 'server']: try: import ipaserver.dcerpc - from ipaserver.dcerpc import (TRUST_ONEWAY, - TRUST_BIDIRECTIONAL, - TRUST_JOIN_EXTERNAL) import dbus import dbus.mainloop.glib _bindings_installed = True @@ -160,28 +164,14 @@ logger = logging.getLogger(__name__) register = Registry() -# Trust type is a combination of ipanttrusttype and ipanttrustattributes -# We shift trust attributes by 3 bits to left so bit 0 becomes bit 3 and -# 2+(1 << 3) becomes 10. -_trust_type_dict = {1 : _('Non-Active Directory domain'), - 2 : _('Active Directory domain'), - 3 : _('RFC4120-compliant Kerberos realm'), - 10: _('Non-transitive external trust to a domain in another Active Directory forest')} - -_trust_direction_dict = {1 : _('Trusting forest'), - 2 : _('Trusted forest'), - 3 : _('Two-way trust')} -_trust_status_dict = {True : _('Established and verified'), - False : _('Waiting for confirmation by remote side')} -_trust_type_dict_unknown = _('Unknown') - -_trust_type_option = StrEnum('trust_type', - cli_name='type', - label=_('Trust type (ad for Active Directory, default)'), - values=(u'ad',), - default=u'ad', - autofill=True, - ) +_trust_type_option = StrEnum( + 'trust_type', + cli_name='type', + label=_('Trust type (ad for Active Directory, default)'), + values=(u'ad',), + default=u'ad', + autofill=True, + ) DEFAULT_RANGE_SIZE = 200000 @@ -190,31 +180,6 @@ DBUS_IFACE_TRUST = 'com.redhat.idm.trust' CRED_STYLE_SAMBA = 1 CRED_STYLE_KERBEROS = 2 -LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE = 0x00000001 - -def trust_type_string(level, attrs): - """ - Returns a string representing a type of the trust. The original field is an enum: - LSA_TRUST_TYPE_DOWNLEVEL = 0x00000001, - LSA_TRUST_TYPE_UPLEVEL = 0x00000002, - LSA_TRUST_TYPE_MIT = 0x00000003 - """ - transitive = int(attrs) & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE - string = _trust_type_dict.get(int(level) | (transitive << 3), _trust_type_dict_unknown) - return unicode(string) - -def trust_direction_string(level): - """ - Returns a string representing a direction of the trust. The original field is a bitmask taking two bits in use - LSA_TRUST_DIRECTION_INBOUND = 0x00000001, - LSA_TRUST_DIRECTION_OUTBOUND = 0x00000002 - """ - string = _trust_direction_dict.get(int(level), _trust_type_dict_unknown) - return unicode(string) - -def trust_status_string(level): - string = _trust_status_dict.get(level, _trust_type_dict_unknown) - return unicode(string) def make_trust_dn(env, trust_type, dn): assert isinstance(dn, DN)