|
 |
d9912c |
From b6100f0c19e2caf73ab70bbc572d3e47e6066b48 Mon Sep 17 00:00:00 2001
|
|
|
d9912c |
From: Thomas Woerner <twoerner@redhat.com>
|
|
|
d9912c |
Date: Tue, 17 Dec 2019 14:04:43 +0100
|
|
|
d9912c |
Subject: [PATCH] ipahost: Fix choices of auth_ind parameter, allow to reset
|
|
|
d9912c |
parameter
|
|
|
d9912c |
|
|
|
d9912c |
The choices for the auth_ind parameter have been wrong. The choices are now
|
|
|
d9912c |
['radius', 'otp', 'pkinit', 'hardened', '']. The empty string has been added
|
|
|
d9912c |
to be able to rest auth_ind for the host entry.
|
|
|
d9912c |
---
|
|
|
d9912c |
README-host.md | 2 +-
|
|
|
d9912c |
plugins/modules/ipahost.py | 15 ++++++++++++---
|
|
|
d9912c |
2 files changed, 13 insertions(+), 4 deletions(-)
|
|
|
d9912c |
|
|
|
d9912c |
diff --git a/README-host.md b/README-host.md
|
|
|
d9912c |
index edec8d9..be5ad79 100644
|
|
|
d9912c |
--- a/README-host.md
|
|
|
d9912c |
+++ b/README-host.md
|
|
|
d9912c |
@@ -280,7 +280,7 @@ Variable | Description | Required
|
|
|
d9912c |
`mac_address` \| `macaddress` | List of hardware MAC addresses. | no
|
|
|
d9912c |
`sshpubkey` \| `ipasshpubkey` | List of SSH public keys | no
|
|
|
d9912c |
`userclass` \| `class` | Host category (semantics placed on this attribute are for local interpretation) | no
|
|
|
d9912c |
-`auth_ind` \| `krbprincipalauthind` | Defines a whitelist for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Other values may be used for custom configurations. choices: ["radius", "otp", "pkinit", "hardened"] | no
|
|
|
d9912c |
+`auth_ind` \| `krbprincipalauthind` | Defines a whitelist for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Use empty string to reset auth_ind to the initial value. Other values may be used for custom configurations. choices: ["radius", "otp", "pkinit", "hardened", ""] | no
|
|
|
d9912c |
`requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service (bool) | no
|
|
|
d9912c |
`ok_as_delegate` \| `ipakrbokasdelegate` | Client credentials may be delegated to the service (bool) | no
|
|
|
d9912c |
`ok_to_auth_as_delegate` \| `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client (bool) | no
|
|
|
d9912c |
diff --git a/plugins/modules/ipahost.py b/plugins/modules/ipahost.py
|
|
|
d9912c |
index ec5e196..b130395 100644
|
|
|
d9912c |
--- a/plugins/modules/ipahost.py
|
|
|
d9912c |
+++ b/plugins/modules/ipahost.py
|
|
|
d9912c |
@@ -147,9 +147,10 @@
|
|
|
d9912c |
Defines a whitelist for Authentication Indicators. Use 'otp' to allow
|
|
|
d9912c |
OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA
|
|
|
d9912c |
authentications. Other values may be used for custom configurations.
|
|
|
d9912c |
+ Use empty string to reset auth_ind to the initial value.
|
|
|
d9912c |
type: list
|
|
|
d9912c |
aliases: ["krbprincipalauthind"]
|
|
|
d9912c |
- choices: ["radius", "otp", "pkinit", "hardened"]
|
|
|
d9912c |
+ choices: ["radius", "otp", "pkinit", "hardened", ""]
|
|
|
d9912c |
required: false
|
|
|
d9912c |
requires_pre_auth:
|
|
|
d9912c |
description: Pre-authentication is required for the service
|
|
|
d9912c |
@@ -277,9 +278,10 @@
|
|
|
d9912c |
Defines a whitelist for Authentication Indicators. Use 'otp' to allow
|
|
|
d9912c |
OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA
|
|
|
d9912c |
authentications. Other values may be used for custom configurations.
|
|
|
d9912c |
+ Use empty string to reset auth_ind to the initial value.
|
|
|
d9912c |
type: list
|
|
|
d9912c |
aliases: ["krbprincipalauthind"]
|
|
|
d9912c |
- choices: ["radius", "otp", "pkinit", "hardened"]
|
|
|
d9912c |
+ choices: ["radius", "otp", "pkinit", "hardened", ""]
|
|
|
d9912c |
required: false
|
|
|
d9912c |
requires_pre_auth:
|
|
|
d9912c |
description: Pre-authentication is required for the service
|
|
|
d9912c |
@@ -590,7 +592,7 @@ def main():
|
|
|
d9912c |
default=None),
|
|
|
d9912c |
auth_ind=dict(type='list', aliases=["krbprincipalauthind"],
|
|
|
d9912c |
default=None,
|
|
|
d9912c |
- choices=['password', 'radius', 'otp']),
|
|
|
d9912c |
+ choices=['radius', 'otp', 'pkinit', 'hardened', '']),
|
|
|
d9912c |
requires_pre_auth=dict(type="bool", aliases=["ipakrbrequirespreauth"],
|
|
|
d9912c |
default=None),
|
|
|
d9912c |
ok_as_delegate=dict(type="bool", aliases=["ipakrbokasdelegate"],
|
|
|
d9912c |
@@ -835,6 +837,13 @@ def main():
|
|
|
d9912c |
if x in args:
|
|
|
d9912c |
del args[x]
|
|
|
d9912c |
|
|
|
d9912c |
+ # Ignore auth_ind if it is empty (for resetting)
|
|
|
d9912c |
+ # and not set in for the host
|
|
|
d9912c |
+ if "krbprincipalauthind" not in res_find and \
|
|
|
d9912c |
+ "krbprincipalauthind" in args and \
|
|
|
d9912c |
+ args["krbprincipalauthind"] == ['']:
|
|
|
d9912c |
+ del args["krbprincipalauthind"]
|
|
|
d9912c |
+
|
|
|
d9912c |
# For all settings is args, check if there are
|
|
|
d9912c |
# different settings in the find result.
|
|
|
d9912c |
# If yes: modify
|