library/ipatest.py: New ipa test module

Test if the krb5.keytab on the machine is valid and can be used.

options:
  servers:
    description: The FQDN of the IPA servers to connect to.
    required: true
  domain:
    description: The primary DNS domain of an existing IPA deployment.
    required: true
  realm:
    description: The Kerberos realm of an existing IPA deployment.
    required: true
  hostname:
    description: The hostname of the machine to join (FQDN).
    required: true
  kdc:
    description: The name or address of the host running the KDC.
    required: true
  principal:
    description: The authorized kerberos principal used to join the IPA realm.
    required: false
  kinit_attempts:
    description: Repeat the request for host Kerberos ticket X times.
    required: false
    default: 5

returns:
  krb5_keytab_ok:
    description: The flag describes if krb5.keytab on the host is usable.
    returned: always
    type: bool

library/ipatest.py

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-client-install code
+#
+# Copyright (C) 2017  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: ipatest
+short description: Test if the krb5.keytab on the machine is valid and can be used.
+description:
+  Test if the krb5.keytab on the machine is valid and can be used.
+  A temporary krb5.conf file will be generated to not fail on an invalid one.
+options:
+  servers:
+    description: The FQDN of the IPA servers to connect to.
+    required: true
+  domain:
+    description: The primary DNS domain of an existing IPA deployment.
+    required: true
+  realm:
+    description: The Kerberos realm of an existing IPA deployment.
+    required: true
+  hostname:
+    description: The hostname of the machine to join (FQDN).
+    required: true
+  kdc:
+    description: The name or address of the host running the KDC.
+    required: true
+  principal:
+    description: The authorized kerberos principal used to join the IPA realm.
+    required: false
+  kinit_attempts:
+    description: Repeat the request for host Kerberos ticket X times.
+    required: false
+    default: 5
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+# Join IPA to get the keytab
+- name: Test IPA in force mode with maximum 5 kinit attempts
+  ipatest:
+    servers: ["server1.example.com","server2.example.com"]
+    domain: example.com
+    realm: EXAMPLE.COM
+    kdc: server1.example.com
+    hostname: client1.example.com
+    principal: admin
+    kinit_attempts: 5
+
+# Join IPA to get the keytab using ipadiscovery return values
+- name: Join IPA
+  ipajoin:
+    servers: "{{ ipadiscovery.servers }}"
+    domain: "{{ ipadiscovery.domain }}"
+    realm: "{{ ipadiscovery.realm }}"
+    kdc: "{{ ipadiscovery.kdc }}"
+    hostname: "{{ ipadiscovery.hostname }}"
+    principal: admin
+'''
+
+RETURN = '''
+krb5_keytab_ok:
+  description: The flag describes if krb5.keytab on the host is usable.
+  returned: always
+  type: bool
+'''
+
+class Object(object):
+    pass
+options = Object()
+
+import os
+import sys
+import gssapi
+import tempfile
+import inspect
+
+from ansible.module_utils.basic import AnsibleModule
+from ipapython.version import NUM_VERSION, VERSION
+if NUM_VERSION < 40400:
+    raise Exception, "freeipa version '%s' is too old" % VERSION
+from ipaplatform.paths import paths
+try:
+    from ipalib.install.kinit import kinit_keytab
+except ImportError:
+    from ipapython.ipautil import kinit_keytab
+try:
+    from ipaclient.install.client import configure_krb5_conf
+except ImportError:
+    # Create temporary copy of ipa-client-install script (as
+    # ipa_client_install.py) to be able to import the script easily and also
+    # to remove the global finally clause in which the generated ccache file
+    # gets removed. The ccache file will be needed in the next step.
+    # This is done in a temporary directory that gets removed right after
+    # ipa_client_install has been imported.
+    import shutil
+    temp_dir = tempfile.mkdtemp(dir="/tmp")
+    sys.path.append(temp_dir)
+    temp_file = "%s/ipa_client_install.py" % temp_dir
+
+    with open("/usr/sbin/ipa-client-install", "r") as f_in:
+        with open(temp_file, "w") as f_out:
+            for line in f_in:
+                if line.startswith("finally:"):
+                    break
+                f_out.write(line)
+    import ipa_client_install
+
+    shutil.rmtree(temp_dir, ignore_errors=True)
+    sys.path.remove(temp_dir)
+
+    argspec = inspect.getargspec(ipa_client_install.configure_krb5_conf)
+    if argspec.keywords is None:
+        def configure_krb5_conf(
+                cli_realm, cli_domain, cli_server, cli_kdc, dnsok,
+                filename, client_domain, client_hostname, force,
+                configure_sssd):
+            global options
+            options.force = force
+            options.sssd = configure_sssd
+            return ipa_client_install.configure_krb5_conf(
+                cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options,
+                filename, client_domain, client_hostname)
+    else:
+        configure_krb5_conf = ipa_client_install.configure_krb5_conf
+from ipapython.ipautil import realm_to_suffix, run
+
+
+import logging
+logger = logging.getLogger("ipa-client-install")
+
+def main():
+    module = AnsibleModule(
+        argument_spec = dict(
+            servers=dict(required=True, type='list'),
+            domain=dict(required=True),
+            realm=dict(required=True),
+            hostname=dict(required=True),
+            kdc=dict(required=True),
+            principal=dict(required=False),
+            kinit_attempts=dict(required=False, type='int', default=5),
+        ),
+        supports_check_mode = True,
+    )
+
+    module._ansible_debug = True
+    servers = module.params.get('servers')
+    domain = module.params.get('domain')
+    realm = module.params.get('realm')
+    hostname = module.params.get('hostname')
+    kdc = module.params.get('kdc')
+    principal = module.params.get('principal')
+    kinit_attempts = module.params.get('kinit_attempts')
+
+    client_domain = hostname[hostname.find(".")+1:]
+    host_principal = 'host/%s@%s' % (hostname, realm)
+    sssd = True
+
+    krb5_keytab_ok = True
+    try:
+        (krb_fd, krb_name) = tempfile.mkstemp()
+        os.close(krb_fd)
+        configure_krb5_conf(
+            cli_realm=realm,
+            cli_domain=domain,
+            cli_server=servers,
+            cli_kdc=kdc,
+            dnsok=False,
+            filename=krb_name,
+            client_domain=client_domain,
+            client_hostname=hostname,
+            configure_sssd=sssd,
+            force=False)
+
+        # Obtain the TGT. We do it with the temporary krb5.conf, so that
+        # only the KDC we're installing under is contacted.
+        # Other KDCs might not have replicated the principal yet.
+        # Once we have the TGT, it's usable on any server.
+        try:
+            kinit_keytab(host_principal, paths.KRB5_KEYTAB,
+                         paths.IPA_DNS_CCACHE,
+                         config=krb_name,
+                         attempts=kinit_attempts)
+        except gssapi.exceptions.GSSError as e:
+            # failure to get ticket makes it impossible to login and bind
+            # from sssd to LDAP, abort installation and rollback changes
+            krb5_keytab_ok = False
+
+    finally:
+        try:
+            os.remove(krb_name)
+        except OSError:
+            module.fail_json(msg="Could not remove %s" % krb_name)
+
+    module.exit_json(changed=False, krb5_keytab_ok=krb5_keytab_ok)
+
+if __name__ == '__main__':
+    main()