From 41cff542bf44e02afd1f08b17389b47af07740f6 Mon Sep 17 00:00:00 2001 From: Aurélien Bompard Date: Jun 24 2022 13:43:30 +0000 Subject: [PATCH 1/3] Don't hardcode the AWS mapping, make it configurable instead Signed-off-by: Aurélien Bompard --- diff --git a/ipsilon/info/infofas.py b/ipsilon/info/infofas.py index 546c4b1..309f1d5 100644 --- a/ipsilon/info/infofas.py +++ b/ipsilon/info/infofas.py @@ -1,27 +1,8 @@ from ipsilon.util import config as pconfig +from ipsilon.info.common import InfoProviderBase from ipsilon.info.infosssd import InfoProvider as SSSDInfoProvider -AWS_IDP_ARN = "arn:aws:iam::125523088429:saml-provider/id.fedoraproject.org" -AWS_GROUPS = { - "aws-master": "arn:aws:iam::125523088429:role/aws-master", - "aws-iam": "arn:aws:iam::125523088429:role/aws-iam", - "aws-billing": "arn:aws:iam::125523088429:role/aws-billing", - "aws-atomic": "arn:aws:iam::125523088429:role/aws-atomic", - "aws-s3-readonly": "arn:aws:iam::125523088429:role/aws-s3-readonly", - "aws-fedoramirror": "arn:aws:iam::125523088429:role/aws-fedoramirror", - "aws-s3": "arn:aws:iam::125523088429:role/aws-s3", - "aws-cloud-poc": "arn:aws:iam::125523088429:role/aws-cloud-poc", - "aws-infra": "arn:aws:iam::125523088429:role/aws-infra", - "aws-docs": "arn:aws:iam::125523088429:role/aws-docs", - "aws-copr": "arn:aws:iam::125523088429:role/aws-copr", - "aws-centos": "arn:aws:iam::125523088429:role/aws-centos", - "aws-min": "arn:aws:iam::125523088429:role/aws-min", - "aws-fedora-ci": "arn:aws:iam::125523088429:role/aws-fedora-ci", - "aws-fcos-mgmt": "arn:aws:iam::125523088429:role/aws-fcos-mgmt", -} - - class InfoProvider(SSSDInfoProvider): def __init__(self, *kwargs): super().__init__(*kwargs) @@ -32,16 +13,37 @@ A Fedora-specific version of the SSSd info plugin. self.new_config( self.name, pconfig.Condition( - "preconfigured", "SSSD can only be used when pre-configured", False - ), + 'preconfigured', + 'FAS can only be used when SSSd is pre-configured', + False), + pconfig.String( + 'aws idp arn', + 'The AWS IDP ARN.', + ''), + pconfig.MappingList( + 'aws groups', + 'AWS groups mapping', + []), ) def get_user_attrs(self, user): reply = super().get_user_attrs(user) reply["_extras"]["awsroles"] = [] + aws_idp_arn = self.get_config_value("aws idp arn") + if not aws_idp_arn: + return reply + aws_groups = dict(self.get_config_value("aws groups")) for group in reply["_groups"]: - if group in AWS_GROUPS: + if group in aws_groups: reply["_extras"]["awsroles"].append( - "%s,%s" % (AWS_IDP_ARN, AWS_GROUPS[group]) + "%s,%s" % (aws_idp_arn, aws_groups[group]) ) return reply + + # SSSD disables the admin UI, but we want it. + + def get_config_obj(self): + return InfoProviderBase.get_config_obj(self) + + def save_plugin_config(self, config=None): + return InfoProviderBase.save_plugin_config(self, config) From 17227b5015f11dd6371f0cf4429cdeaaac79f383 Mon Sep 17 00:00:00 2001 From: Aurélien Bompard Date: Jun 24 2022 13:44:22 +0000 Subject: [PATCH 2/3] Adjust defaults when using IPA We want the PAM login enabled instead of `form`, and we can set some reasonable defaults for the default attribute mapping, knowing which attributes are available in IPA. Signed-off-by: Aurélien Bompard --- diff --git a/devel/ansible/roles/dev/tasks/main.yml b/devel/ansible/roles/dev/tasks/main.yml index d84b807..2b070de 100644 --- a/devel/ansible/roles/dev/tasks/main.yml +++ b/devel/ansible/roles/dev/tasks/main.yml @@ -115,7 +115,7 @@ shell: 'echo "password" | kinit admin@{{ipa_realm}}' - name: install ipsilon - shell: "/usr/local/bin/ipsilon-server-install --ipa yes --openidc yes --form no --pam yes --admin-user admin" + shell: "/usr/local/bin/ipsilon-server-install --ipa yes --openidc yes --admin-user admin" args: creates: /etc/ipsilon/idp/ipsilon.conf diff --git a/ipsilon/helpers/ipa.py b/ipsilon/helpers/ipa.py index 395386a..7f14b1d 100644 --- a/ipsilon/helpers/ipa.py +++ b/ipsilon/helpers/ipa.py @@ -150,7 +150,17 @@ class Installer(EnvHelpersInstaller): opts['gssapi'] = 'yes' if 'gssapi' not in opts['lm_order']: opts['lm_order'].insert(0, 'gssapi') - opts['form'] = 'yes' + opts['pam'] = 'yes' opts['info_sssd'] = 'yes' if not any(lm in opts['lm_order'] for lm in ('form', 'pam')): - opts['lm_order'].append('form') + opts['lm_order'].append('pam') + if opts['openidc'] == 'yes': + opts['openidc_default_attribute_mapping'] = [ + ["*", "*"], + ["_groups", "groups"], + ["fullname", "name"], + ["_username", "nickname"], + ["_username", "preferred_username"], + ["ipaSshPubKey", "ssh_key"], + ["fullname", "human_name"] + ] diff --git a/ipsilon/providers/openidcp.py b/ipsilon/providers/openidcp.py index 7d3ddb3..198d1e9 100644 --- a/ipsilon/providers/openidcp.py +++ b/ipsilon/providers/openidcp.py @@ -315,6 +315,9 @@ class Installer(ProviderInstaller): 'idp key file': keyfile, 'idp sig key id': '%s-sig' % keyid, 'idp subject salt': subject_salt} + opt_dam = opts.get('openidc_default_attribute_mapping') + if opt_dam: + config['default attribute mapping'] = opt_dam po.save_plugin_config(config) # Update global config to add login plugin From f91173d5b713a2825597f6a5b3f19e78b9596c61 Mon Sep 17 00:00:00 2001 From: Aurélien Bompard Date: Jun 24 2022 13:45:23 +0000 Subject: [PATCH 3/3] Fix the logging in infosssd Signed-off-by: Aurélien Bompard --- diff --git a/ipsilon/info/infosssd.py b/ipsilon/info/infosssd.py index 8ce779b..7dced74 100644 --- a/ipsilon/info/infosssd.py +++ b/ipsilon/info/infosssd.py @@ -10,7 +10,6 @@ from ipsilon.util import config as pconfig import time import subprocess import SSSDConfig -import logging import dbus SSSD_CONF = '/etc/sssd/sssd.conf' @@ -172,7 +171,7 @@ class Installer(InfoProviderInstaller): except Exception as e: # pylint: disable=broad-except # Unable to read existing SSSD config so it is probably not # configured. - logging.info('Loading SSSD config failed: %s', e) + self.log('Loading SSSD config failed: %s', e) return False if not opts['info_sssd_domain']: @@ -186,7 +185,7 @@ class Installer(InfoProviderInstaller): try: sssd_domain = sssdconfig.get_domain(domain) except SSSDConfig.NoDomainError: - logging.info('No SSSD domain %s', domain) + self.log('No SSSD domain %s', domain) continue else: try: @@ -201,10 +200,10 @@ class Installer(InfoProviderInstaller): ) sssdconfig.save_domain(sssd_domain) configured += 1 - logging.info("Configured SSSD domain %s", domain) + self.log("Configured SSSD domain %s", domain) if configured == 0: - logging.info('No SSSD domains configured') + self.log('No SSSD domains configured') return False changes['ifp'] = {} @@ -272,14 +271,14 @@ class Installer(InfoProviderInstaller): except Exception as e: # pylint: disable=broad-except # Unable to read existing SSSD config so it is probably not # configured. - logging.info('Loading SSSD config failed: %s', e) + self.log('Loading SSSD config failed: %s', e) return False for domain in changes['domains']: try: sssd_domain = sssdconfig.get_domain(domain.encode('utf-8')) except SSSDConfig.NoDomainError: - logging.info('No SSSD domain %s', domain) + self.log('No SSSD domain %s', domain) continue else: if 'ldap_user_extra_attrs' in changes['domains'][domain]: