PR#377: Make the AWS mapping configurable - ipsilon

ipsilon

#377 Make the AWS mapping configurable

Merged 2 years ago by abompard. Opened 2 years ago by abompard.

abompard/ipsilon infofas-aws-conf into master

Fix the logging in infosssd

Aurélien Bompard • 2 years ago

f91173d

Adjust defaults when using IPA

Aurélien Bompard • 2 years ago

17227b5

Don't hardcode the AWS mapping, make it configurable instead

Aurélien Bompard • 2 years ago

41cff54

devel/ansible/roles/dev/tasks/main.yml

file modified

+1 -1

		`@@ -115,7 +115,7 @@`
		`shell: 'echo "password" \| kinit admin@{{ipa_realm}}'`

		`- name: install ipsilon`
		`- shell: "/usr/local/bin/ipsilon-server-install --ipa yes --openidc yes --form no --pam yes --admin-user admin"`
		`+ shell: "/usr/local/bin/ipsilon-server-install --ipa yes --openidc yes --admin-user admin"`
		`args:`
		`creates: /etc/ipsilon/idp/ipsilon.conf`

ipsilon/helpers/ipa.py

file modified

+12 -2

		`@@ -150,7 +150,17 @@`
		`opts['gssapi'] = 'yes'`
		`if 'gssapi' not in opts['lm_order']:`
		`opts['lm_order'].insert(0, 'gssapi')`
		`- opts['form'] = 'yes'`
		`+ opts['pam'] = 'yes'`
		`opts['info_sssd'] = 'yes'`
		`if not any(lm in opts['lm_order'] for lm in ('form', 'pam')):`
		`- opts['lm_order'].append('form')`
		`+ opts['lm_order'].append('pam')`
		`+ if opts['openidc'] == 'yes':`
		`+ opts['openidc_default_attribute_mapping'] = [`
		`+ ["", ""],`
		`+ ["_groups", "groups"],`
		`+ ["fullname", "name"],`
		`+ ["_username", "nickname"],`
		`+ ["_username", "preferred_username"],`
		`+ ["ipaSshPubKey", "ssh_key"],`
		`+ ["fullname", "human_name"]`
		`+ ]`

ipsilon/info/infofas.py

file modified

+26 -24

		`@@ -1,27 +1,8 @@`
		`from ipsilon.util import config as pconfig`
		`+ from ipsilon.info.common import InfoProviderBase`
		`from ipsilon.info.infosssd import InfoProvider as SSSDInfoProvider`


		`- AWS_IDP_ARN = "arn:aws:iam::125523088429:saml-provider/id.fedoraproject.org"`
		`- AWS_GROUPS = {`
		`- "aws-master": "arn:aws:iam::125523088429:role/aws-master",`
		`- "aws-iam": "arn:aws:iam::125523088429:role/aws-iam",`
		`- "aws-billing": "arn:aws:iam::125523088429:role/aws-billing",`
		`- "aws-atomic": "arn:aws:iam::125523088429:role/aws-atomic",`
		`- "aws-s3-readonly": "arn:aws:iam::125523088429:role/aws-s3-readonly",`
		`- "aws-fedoramirror": "arn:aws:iam::125523088429:role/aws-fedoramirror",`
		`- "aws-s3": "arn:aws:iam::125523088429:role/aws-s3",`
		`- "aws-cloud-poc": "arn:aws:iam::125523088429:role/aws-cloud-poc",`
		`- "aws-infra": "arn:aws:iam::125523088429:role/aws-infra",`
		`- "aws-docs": "arn:aws:iam::125523088429:role/aws-docs",`
		`- "aws-copr": "arn:aws:iam::125523088429:role/aws-copr",`
		`- "aws-centos": "arn:aws:iam::125523088429:role/aws-centos",`
		`- "aws-min": "arn:aws:iam::125523088429:role/aws-min",`
		`- "aws-fedora-ci": "arn:aws:iam::125523088429:role/aws-fedora-ci",`
		`- "aws-fcos-mgmt": "arn:aws:iam::125523088429:role/aws-fcos-mgmt",`
		`- }`
		`-`
		`-`
		`class InfoProvider(SSSDInfoProvider):`
		`def __init__(self, *kwargs):`
		`super().__init__(*kwargs)`
		`@@ -32,16 +13,37 @@`
		`self.new_config(`
		`self.name,`
		`pconfig.Condition(`
		`- "preconfigured", "SSSD can only be used when pre-configured", False`
		`- ),`
		`+ 'preconfigured',`
		`+ 'FAS can only be used when SSSd is pre-configured',`
		`+ False),`
		`+ pconfig.String(`
		`+ 'aws idp arn',`
		`+ 'The AWS IDP ARN.',`
		`+ ''),`
		`+ pconfig.MappingList(`
		`+ 'aws groups',`
		`+ 'AWS groups mapping',`
		`+ []),`
		`)`

		`def get_user_attrs(self, user):`
		`reply = super().get_user_attrs(user)`
		`reply["_extras"]["awsroles"] = []`
		`+ aws_idp_arn = self.get_config_value("aws idp arn")`
		`+ if not aws_idp_arn:`
		`+ return reply`
		`+ aws_groups = dict(self.get_config_value("aws groups"))`
		`for group in reply["_groups"]:`
		`- if group in AWS_GROUPS:`
		`+ if group in aws_groups:`
		`reply["_extras"]["awsroles"].append(`
		`- "%s,%s" % (AWS_IDP_ARN, AWS_GROUPS[group])`
		`+ "%s,%s" % (aws_idp_arn, aws_groups[group])`
		`)`
		`return reply`
		`+`
		`+ # SSSD disables the admin UI, but we want it.`
		`+`
		`+ def get_config_obj(self):`
		`+ return InfoProviderBase.get_config_obj(self)`
		`+`
		`+ def save_plugin_config(self, config=None):`
		`+ return InfoProviderBase.save_plugin_config(self, config)`

ipsilon/info/infosssd.py

file modified

+6 -7

		`@@ -10,7 +10,6 @@`
		`import time`
		`import subprocess`
		`import SSSDConfig`
		`- import logging`
		`import dbus`

		`SSSD_CONF = '/etc/sssd/sssd.conf'`
		`@@ -172,7 +171,7 @@`
		`except Exception as e: # pylint: disable=broad-except`
		`# Unable to read existing SSSD config so it is probably not`
		`# configured.`
		`- logging.info('Loading SSSD config failed: %s', e)`
		`+ self.log('Loading SSSD config failed: %s', e)`
		`return False`

		`if not opts['info_sssd_domain']:`
		`@@ -186,7 +185,7 @@`
		`try:`
		`sssd_domain = sssdconfig.get_domain(domain)`
		`except SSSDConfig.NoDomainError:`
		`- logging.info('No SSSD domain %s', domain)`
		`+ self.log('No SSSD domain %s', domain)`
		`continue`
		`else:`
		`try:`
		`@@ -201,10 +200,10 @@`
		`)`
		`sssdconfig.save_domain(sssd_domain)`
		`configured += 1`
		`- logging.info("Configured SSSD domain %s", domain)`
		`+ self.log("Configured SSSD domain %s", domain)`

		`if configured == 0:`
		`- logging.info('No SSSD domains configured')`
		`+ self.log('No SSSD domains configured')`
		`return False`

		`changes['ifp'] = {}`
		`@@ -272,14 +271,14 @@`
		`except Exception as e: # pylint: disable=broad-except`
		`# Unable to read existing SSSD config so it is probably not`
		`# configured.`
		`- logging.info('Loading SSSD config failed: %s', e)`
		`+ self.log('Loading SSSD config failed: %s', e)`
		`return False`

		`for domain in changes['domains']:`
		`try:`
		`sssd_domain = sssdconfig.get_domain(domain.encode('utf-8'))`
		`except SSSDConfig.NoDomainError:`
		`- logging.info('No SSSD domain %s', domain)`
		`+ self.log('No SSSD domain %s', domain)`
		`continue`
		`else:`
		`if 'ldap_user_extra_attrs' in changes['domains'][domain]:`

ipsilon/providers/openidcp.py

file modified

		`@@ -315,6 +315,9 @@`
		`'idp key file': keyfile,`
		`'idp sig key id': '%s-sig' % keyid,`
		`'idp subject salt': subject_salt}`
		`+ opt_dam = opts.get('openidc_default_attribute_mapping')`
		`+ if opt_dam:`
		`+ config['default attribute mapping'] = opt_dam`
		`po.save_plugin_config(config)`

		`# Update global config to add login plugin`