Hello everyone.
I was wondering if it is possible to embed ipa modules in a python virtual environment ? Or is it too tightly linked with the ipa-client installed on the system ?
Best regards.
Lune
On pe, 23 elo 2019, lune voo via FreeIPA-users wrote:
Hello everyone.
I was wondering if it is possible to embed ipa modules in a python virtual environment ? Or is it too tightly linked with the ipa-client installed on the system ?
You can use https://pypi.org/project/ipaclient/
$ virtualenv --python=python3.7 here Running virtualenv with interpreter /usr/bin/python3.7 Using base prefix '/usr' /usr/lib/python3.7/site-packages/virtualenv.py:1055: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses import imp New python executable in /home/abokovoy/tmp/test-pypi/here/bin/python3.7 Also creating executable in /home/abokovoy/tmp/test-pypi/here/bin/python Installing setuptools, pip, wheel...done. $ cd here $ source bin/activate (here) $ pip install ipaclient Collecting ipaclient Downloading https://files.pythonhosted.org/packages/5a/f6/8169c2f40f3adb34c3928a3d3f2a12... (601kB) |████████████████████████████████| 604kB 1.5MB/s Collecting ipapython==4.8.1 (from ipaclient) Downloading https://files.pythonhosted.org/packages/8a/60/25919c8f5029a2c43fd236fa56375e... (111kB) |████████████████████████████████| 112kB 10.1MB/s Collecting cryptography>=1.6 (from ipaclient) Downloading https://files.pythonhosted.org/packages/97/18/c6557f63a6abde34707196fb2cad1c... (2.3MB) |████████████████████████████████| 2.3MB 9.4MB/s Collecting six (from ipaclient) Using cached https://files.pythonhosted.org/packages/73/fb/00a976f728d0d1fecfe898238ce23f... Collecting qrcode>=5.0 (from ipaclient) Using cached https://files.pythonhosted.org/packages/42/87/4a3a77e59ab7493d64da1f69bf1c2e... Collecting ipalib==4.8.1 (from ipaclient) Downloading https://files.pythonhosted.org/packages/a0/19/807dd72d485f9a77d0ec14d61d5dbe... (166kB) |████████████████████████████████| 174kB 9.9MB/s Collecting netaddr (from ipapython==4.8.1->ipaclient) Using cached https://files.pythonhosted.org/packages/ba/97/ce14451a9fd7bdb5a397abf99b24a1... Collecting ipaplatform==4.8.1 (from ipapython==4.8.1->ipaclient) Downloading https://files.pythonhosted.org/packages/ff/34/362e07243fa6314bd618ced3ce67bf... (66kB) |████████████████████████████████| 71kB 8.5MB/s Collecting gssapi>=1.2.0 (from ipapython==4.8.1->ipaclient) Downloading https://files.pythonhosted.org/packages/21/00/61ab7b1e246787ef32e3122011a418... (1.0MB) |████████████████████████████████| 1.0MB 9.4MB/s Collecting cffi (from ipapython==4.8.1->ipaclient) Using cached https://files.pythonhosted.org/packages/a0/ea/37fe21475c884f88a2ae496cab10e8... Collecting dnspython>=1.15 (from ipapython==4.8.1->ipaclient) Using cached https://files.pythonhosted.org/packages/ec/d3/3aa0e7213ef72b8585747aa0e271a9... Collecting asn1crypto>=0.21.0 (from cryptography>=1.6->ipaclient) Using cached https://files.pythonhosted.org/packages/ea/cd/35485615f45f30a510576f1a56d1e0... Collecting pyasn1 (from ipalib==4.8.1->ipaclient) Downloading https://files.pythonhosted.org/packages/6a/6e/209351ec34b7d7807342e2bb6ff8a9... (75kB) |████████████████████████████████| 81kB 11.4MB/s Collecting pyasn1-modules (from ipalib==4.8.1->ipaclient) Downloading https://files.pythonhosted.org/packages/be/70/e5ea8afd6d08a4b99ebfc77bd18452... (95kB) |████████████████████████████████| 102kB 9.7MB/s Collecting decorator (from gssapi>=1.2.0->ipapython==4.8.1->ipaclient) Using cached https://files.pythonhosted.org/packages/5f/88/0075e461560a1e750a0dcbf77f1d9d... Collecting pycparser (from cffi->ipapython==4.8.1->ipaclient) Building wheels for collected packages: gssapi Building wheel for gssapi (setup.py) ... done Created wheel for gssapi: filename=gssapi-1.6.1-cp37-cp37m-linux_x86_64.whl size=2822815 sha256=25a77bc9efceeee48e54044cd119b9be56df997e885e6add8980c5e778c27b6b Stored in directory: /home/abokovoy/.cache/pip/wheels/e6/14/54/6bba9edd808d0ce1680d0212b28a41a98f284a3ee83ae7d44a Successfully built gssapi Installing collected packages: netaddr, six, pycparser, cffi, pyasn1, ipaplatform, asn1crypto, cryptography, decorator, gssapi, dnspython, ipapython, qrcode, pyasn1-modules, ipalib, ipaclient Successfully installed asn1crypto-0.24.0 cffi-1.12.3 cryptography-2.7 decorator-4.4.0 dnspython-1.16.0 gssapi-1.6.1 ipaclient-4.8.1 ipalib-4.8.1 ipaplatform-4.8.1 ipapython-4.8.1 netaddr-0.7.19 pyasn1-0.4.6 pyasn1-modules-0.2.6 pycparser-2.19 qrcode-6.1 six-1.12.0 (here) $ ls bin activate activate.csh activate.fish activate_this.py easy_install easy_install-3.7 ipa netaddr pip pip3 pip3.7 python python3 python3.7 python-config qr wheel (here) $ which ipa ~/tmp/test-pypi/here/bin/ipa (here) $ ipa ping ------------------------------------------- IPA server version 4.7.2. API version 2.230 -------------------------------------------
Hello Alexander.
Thank you for your answer. Do you know if I will have any problem with the certificate to connect to the server ? Generally there is a ca.crt in /etc/ipa/ca.crt, does it need to be included in the virtual environment also ?
Best regards.
Lune
Le ven. 23 août 2019 à 15:06, Alexander Bokovoy abokovoy@redhat.com a écrit :
On pe, 23 elo 2019, lune voo via FreeIPA-users wrote:
Hello everyone.
I was wondering if it is possible to embed ipa modules in a python virtual environment ? Or is it too tightly linked with the ipa-client installed on the system ?
You can use https://pypi.org/project/ipaclient/
$ virtualenv --python=python3.7 here Running virtualenv with interpreter /usr/bin/python3.7 Using base prefix '/usr' /usr/lib/python3.7/site-packages/virtualenv.py:1055: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses import imp New python executable in /home/abokovoy/tmp/test-pypi/here/bin/python3.7 Also creating executable in /home/abokovoy/tmp/test-pypi/here/bin/python Installing setuptools, pip, wheel...done. $ cd here $ source bin/activate (here) $ pip install ipaclient Collecting ipaclient Downloading https://files.pythonhosted.org/packages/5a/f6/8169c2f40f3adb34c3928a3d3f2a12... (601kB) |████████████████████████████████| 604kB 1.5MB/s Collecting ipapython==4.8.1 (from ipaclient) Downloading https://files.pythonhosted.org/packages/8a/60/25919c8f5029a2c43fd236fa56375e... (111kB) |████████████████████████████████| 112kB 10.1MB/s Collecting cryptography>=1.6 (from ipaclient) Downloading https://files.pythonhosted.org/packages/97/18/c6557f63a6abde34707196fb2cad1c... (2.3MB) |████████████████████████████████| 2.3MB 9.4MB/s Collecting six (from ipaclient) Using cached https://files.pythonhosted.org/packages/73/fb/00a976f728d0d1fecfe898238ce23f... Collecting qrcode>=5.0 (from ipaclient) Using cached https://files.pythonhosted.org/packages/42/87/4a3a77e59ab7493d64da1f69bf1c2e... Collecting ipalib==4.8.1 (from ipaclient) Downloading https://files.pythonhosted.org/packages/a0/19/807dd72d485f9a77d0ec14d61d5dbe... (166kB) |████████████████████████████████| 174kB 9.9MB/s Collecting netaddr (from ipapython==4.8.1->ipaclient) Using cached https://files.pythonhosted.org/packages/ba/97/ce14451a9fd7bdb5a397abf99b24a1... Collecting ipaplatform==4.8.1 (from ipapython==4.8.1->ipaclient) Downloading https://files.pythonhosted.org/packages/ff/34/362e07243fa6314bd618ced3ce67bf... (66kB) |████████████████████████████████| 71kB 8.5MB/s Collecting gssapi>=1.2.0 (from ipapython==4.8.1->ipaclient) Downloading https://files.pythonhosted.org/packages/21/00/61ab7b1e246787ef32e3122011a418... (1.0MB) |████████████████████████████████| 1.0MB 9.4MB/s Collecting cffi (from ipapython==4.8.1->ipaclient) Using cached https://files.pythonhosted.org/packages/a0/ea/37fe21475c884f88a2ae496cab10e8... Collecting dnspython>=1.15 (from ipapython==4.8.1->ipaclient) Using cached https://files.pythonhosted.org/packages/ec/d3/3aa0e7213ef72b8585747aa0e271a9... Collecting asn1crypto>=0.21.0 (from cryptography>=1.6->ipaclient) Using cached https://files.pythonhosted.org/packages/ea/cd/35485615f45f30a510576f1a56d1e0... Collecting pyasn1 (from ipalib==4.8.1->ipaclient) Downloading https://files.pythonhosted.org/packages/6a/6e/209351ec34b7d7807342e2bb6ff8a9... (75kB) |████████████████████████████████| 81kB 11.4MB/s Collecting pyasn1-modules (from ipalib==4.8.1->ipaclient) Downloading https://files.pythonhosted.org/packages/be/70/e5ea8afd6d08a4b99ebfc77bd18452... (95kB) |████████████████████████████████| 102kB 9.7MB/s Collecting decorator (from gssapi>=1.2.0->ipapython==4.8.1->ipaclient) Using cached https://files.pythonhosted.org/packages/5f/88/0075e461560a1e750a0dcbf77f1d9d... Collecting pycparser (from cffi->ipapython==4.8.1->ipaclient) Building wheels for collected packages: gssapi Building wheel for gssapi (setup.py) ... done Created wheel for gssapi: filename=gssapi-1.6.1-cp37-cp37m-linux_x86_64.whl size=2822815 sha256=25a77bc9efceeee48e54044cd119b9be56df997e885e6add8980c5e778c27b6b Stored in directory: /home/abokovoy/.cache/pip/wheels/e6/14/54/6bba9edd808d0ce1680d0212b28a41a98f284a3ee83ae7d44a Successfully built gssapi Installing collected packages: netaddr, six, pycparser, cffi, pyasn1, ipaplatform, asn1crypto, cryptography, decorator, gssapi, dnspython, ipapython, qrcode, pyasn1-modules, ipalib, ipaclient Successfully installed asn1crypto-0.24.0 cffi-1.12.3 cryptography-2.7 decorator-4.4.0 dnspython-1.16.0 gssapi-1.6.1 ipaclient-4.8.1 ipalib-4.8.1 ipaplatform-4.8.1 ipapython-4.8.1 netaddr-0.7.19 pyasn1-0.4.6 pyasn1-modules-0.2.6 pycparser-2.19 qrcode-6.1 six-1.12.0 (here) $ ls bin activate activate.csh activate.fish activate_this.py easy_install easy_install-3.7 ipa netaddr pip pip3 pip3.7 python python3 python3.7 python-config qr wheel (here) $ which ipa ~/tmp/test-pypi/here/bin/ipa (here) $ ipa ping
IPA server version 4.7.2. API version 2.230
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland
On pe, 23 elo 2019, lune voo wrote:
Hello Alexander.
Thank you for your answer. Do you know if I will have any problem with the certificate to connect to the server ? Generally there is a ca.crt in /etc/ipa/ca.crt, does it need to be included in the virtual environment also ?
See manual page for ipa(1) tool, it documents use of IPA_CONFDIR to specify /etc/ipa location. However, /etc/ipa/ca.crt is not configurable this way, only through ipaplatform.paths.IPA_CA_CRT value.
$ python3 Python 3.7.4 (default, Jul 9 2019, 16:32:37) [GCC 9.1.1 20190503 (Red Hat 9.1.1-1)] on linux Type "help", "copyright", "credits" or "license" for more information.
from ipaplatform.paths import paths paths.IPA_CA_CRT
'/etc/ipa/ca.crt'
paths.IPA_CA_CRT="./my.ca.crt" from ipaclient.discovery import IPADiscovery discover = IPADiscovery() discover.search("vda.li", ca_cert_path=paths.IPA_CA_CRT)
0
discover.realm
'VDA.LI'
discover.basedn
ipapython.dn.DN('dc=vda,dc=li')
So, for most of Python code you can redefine paths. But for ipa-join and other binaries you cannot.
Thank you again for your answer Alexander.
A last question : I'm setting up a python virtual environment for an old project that I need to maintain without any modification. This old project use currently an ipa 3.0 on a physical RHEL 6.6 using python 2.6.6. I'm trying to create the python environment using python 2.6 for the project because the server will soon be upgraded in RHEL7.
I'm using ipalib to perform ipa user-show etc... command directly in python. But I get an "(SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user." when I try to use it. Pretty sure this is related with my ca.crt file being not found.
Any hope there is a way to check the default path which is used by the ca.crt file ?
Best regards.
Lune
Le ven. 23 août 2019 à 15:41, Alexander Bokovoy abokovoy@redhat.com a écrit :
On pe, 23 elo 2019, lune voo wrote:
Hello Alexander.
Thank you for your answer. Do you know if I will have any problem with the certificate to connect to the server ? Generally there is a ca.crt in /etc/ipa/ca.crt, does it need to be
included
in the virtual environment also ?
See manual page for ipa(1) tool, it documents use of IPA_CONFDIR to specify /etc/ipa location. However, /etc/ipa/ca.crt is not configurable this way, only through ipaplatform.paths.IPA_CA_CRT value.
$ python3 Python 3.7.4 (default, Jul 9 2019, 16:32:37) [GCC 9.1.1 20190503 (Red Hat 9.1.1-1)] on linux Type "help", "copyright", "credits" or "license" for more information.
from ipaplatform.paths import paths paths.IPA_CA_CRT
'/etc/ipa/ca.crt'
paths.IPA_CA_CRT="./my.ca.crt" from ipaclient.discovery import IPADiscovery discover = IPADiscovery() discover.search("vda.li", ca_cert_path=paths.IPA_CA_CRT)
0
discover.realm
'VDA.LI'
discover.basedn
ipapython.dn.DN('dc=vda,dc=li')
So, for most of Python code you can redefine paths. But for ipa-join and other binaries you cannot.
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland
On pe, 23 elo 2019, lune voo via FreeIPA-users wrote:
Thank you again for your answer Alexander.
A last question : I'm setting up a python virtual environment for an old project that I need to maintain without any modification. This old project use currently an ipa 3.0 on a physical RHEL 6.6 using python 2.6.6.
I don't think we supported any use of pip-based ipaclient at that version.
I'm trying to create the python environment using python 2.6 for the project because the server will soon be upgraded in RHEL7.
I'm using ipalib to perform ipa user-show etc... command directly in python. But I get an "(SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user." when I try to use it. Pretty sure this is related with my ca.crt file being not found.
This is related to nssdb in use -- at that time we didn't have any support for relocating files and we also used nssdb at /etc/ipa/nssdb, I think. So check whether you have trust flags on the certificates in that NSS database.
Any hope there is a way to check the default path which is used by the ca.crt file ?
Best regards.
Lune
Le ven. 23 août 2019 à 15:41, Alexander Bokovoy abokovoy@redhat.com a écrit :
On pe, 23 elo 2019, lune voo wrote:
Hello Alexander.
Thank you for your answer. Do you know if I will have any problem with the certificate to connect to the server ? Generally there is a ca.crt in /etc/ipa/ca.crt, does it need to be
included
in the virtual environment also ?
See manual page for ipa(1) tool, it documents use of IPA_CONFDIR to specify /etc/ipa location. However, /etc/ipa/ca.crt is not configurable this way, only through ipaplatform.paths.IPA_CA_CRT value.
$ python3 Python 3.7.4 (default, Jul 9 2019, 16:32:37) [GCC 9.1.1 20190503 (Red Hat 9.1.1-1)] on linux Type "help", "copyright", "credits" or "license" for more information.
from ipaplatform.paths import paths paths.IPA_CA_CRT
'/etc/ipa/ca.crt'
paths.IPA_CA_CRT="./my.ca.crt" from ipaclient.discovery import IPADiscovery discover = IPADiscovery() discover.search("vda.li", ca_cert_path=paths.IPA_CA_CRT)
0
discover.realm
'VDA.LI'
discover.basedn
ipapython.dn.DN('dc=vda,dc=li')
So, for most of Python code you can redefine paths. But for ipa-join and other binaries you cannot.
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Hello ALexander.
Thank you for your reply.
In fact, I solved this problem by following this KB frmo RHEL support :
https://access.redhat.com/solutions/482063
Basically : certutil -A -d /etc/pki/nssdb -n 'IPA CA' -t CT,C,C -a -i /etc/ipa/ca.crt
It helped my python venv with ipa 3.0 modules to work on a RHEL7 with an ipa 4.4 client installed. I know this is currently dirty enough, but I plan to upgrade everything asap (python version, ipa version etc...) for the tool that I need to maintain.
Thanks a lot for your information.
Best regards.
Lune
Le ven. 23 août 2019 à 17:09, Alexander Bokovoy abokovoy@redhat.com a écrit :
On pe, 23 elo 2019, lune voo via FreeIPA-users wrote:
Thank you again for your answer Alexander.
A last question : I'm setting up a python virtual environment for an old project that I need to maintain without any modification. This old project use currently an ipa 3.0 on a physical RHEL 6.6 using python 2.6.6.
I don't think we supported any use of pip-based ipaclient at that version.
I'm trying to create the python environment using python 2.6 for the project because the server will soon be upgraded in RHEL7.
I'm using ipalib to perform ipa user-show etc... command directly in
python.
But I get an "(SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user." when I try to use it. Pretty sure this is related with my ca.crt file being not found.
This is related to nssdb in use -- at that time we didn't have any support for relocating files and we also used nssdb at /etc/ipa/nssdb, I think. So check whether you have trust flags on the certificates in that NSS database.
Any hope there is a way to check the default path which is used by the ca.crt file ?
Best regards.
Lune
Le ven. 23 août 2019 à 15:41, Alexander Bokovoy abokovoy@redhat.com a écrit :
On pe, 23 elo 2019, lune voo wrote:
Hello Alexander.
Thank you for your answer. Do you know if I will have any problem with the certificate to connect
to
the server ? Generally there is a ca.crt in /etc/ipa/ca.crt, does it need to be
included
in the virtual environment also ?
See manual page for ipa(1) tool, it documents use of IPA_CONFDIR to specify /etc/ipa location. However, /etc/ipa/ca.crt is not configurable this way, only through ipaplatform.paths.IPA_CA_CRT value.
$ python3 Python 3.7.4 (default, Jul 9 2019, 16:32:37) [GCC 9.1.1 20190503 (Red Hat 9.1.1-1)] on linux Type "help", "copyright", "credits" or "license" for more information.
from ipaplatform.paths import paths paths.IPA_CA_CRT
'/etc/ipa/ca.crt'
paths.IPA_CA_CRT="./my.ca.crt" from ipaclient.discovery import IPADiscovery discover = IPADiscovery() discover.search("vda.li", ca_cert_path=paths.IPA_CA_CRT)
0
discover.realm
'VDA.LI'
discover.basedn
ipapython.dn.DN('dc=vda,dc=li')
So, for most of Python code you can redefine paths. But for ipa-join and other binaries you cannot.
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland
freeipa-users@lists.fedorahosted.org