[dev.icinga.com #9471] Implement ApiUser type

[icinga-migration]

This issue has been migrated from Redmine: https://dev.icinga.com/issues/9471

Created by mfriedrich on 2015-06-22 08:57:01 +00:00

Assignee: mfriedrich
Status: Resolved (closed on 2015-06-25 16:05:04 +00:00)
Target Version: 2.4.0
Last Update: 2015-06-25 16:14:34 +00:00 (in Redmine)

Backport?: No
Include in Changelog: 1

---

• Implement 'ApiUser' object
• attributes: password, client_cn
• Protect the api_password by blocking the getter
• Implement check_password function
• Auto-generate 'root' user when Icinga 2 is installed
  • Add 'api setup' cli command which generates
    • ca and signed certificate
    • enabled api feature
    • apiuser with generated password hash
  • 'node setup' and 'node wizard' in master mode check if the api feature is enabled and run 'api setup' if not

Changesets

2015-06-22 15:51:11 +00:00 by (unknown) 4d72225

Implement the ApiUser object type

Hide password in GetPassword() and add CheckPassword().
Includes basic unit tests.

refs #9471

2015-06-24 12:28:52 +00:00 by (unknown) 14f5986

Implement the ApiUser object type

Hide password in GetPassword() and add CheckPassword().
Includes basic unit tests.

refs #9471

2015-06-24 15:49:51 +00:00 by (unknown) 74c7926

Implement 'api setup' cli command & add ApiUser config (wip)

TODO: Requires removal from nodewizard/setup for the master.

refs #9471

2015-06-25 08:08:34 +00:00 by (unknown) 7b0b04b

Implement 'api setup' cli command & add ApiUser config

refs #9471

2015-06-25 08:14:19 +00:00 by (unknown) 6f43162

Add feature enable/disable helpers

refs #9471

2015-06-25 08:21:18 +00:00 by (unknown) 663f09e

Only run 'api setup' if the feature was not enabled

It is safe to assume that the user either did run
'node wizard' or 'node setup' in >= 2.3.x before, or
manually enabled the api feature and deployed the
certificates (otherwise Icinga2 wouldn't start either).

In that case we'll skip the api setup to ensure that we
don't override any existing configuration at all.

refs #9471

2015-06-25 08:40:50 +00:00 by (unknown) 0d977b9

Allow to pass cn to ApiSetupUtility::SetupMaster()

refs #9471

2015-06-25 09:00:12 +00:00 by (unknown) 5249e4a

Cli: 'node wizard' on the master uses 'api setup' if api feature is disabled

refs #9471

2015-06-25 09:00:25 +00:00 by (unknown) ec3f1c6

Cli: 'node setup' on the master uses 'api setup' if api feature is disabled

refs #9471

2015-06-25 11:28:16 +00:00 by (unknown) 3e3588b

Cli: Still ask for CN in 'node wizard'

refs #9471

2015-06-25 15:13:28 +00:00 by (unknown) 69ef196

spec: run 'api setup' in post install

refs #9471

2015-06-25 15:20:23 +00:00 by (unknown) ee035ae

Fix unity build

refs #9471

2015-06-25 15:38:17 +00:00 by (unknown) 08147aa

Add build post install task requirements to INSTALL.md

refs #9471

2015-06-25 16:00:19 +00:00 by (unknown) 21a7cbe

Update documentation for ApiUser object & node wizard

refs #9471

2015-06-25 16:03:00 +00:00 by (unknown) 2eaae1f

Update documentation for ApiUser object & node wizard

fixes #9471

2015-07-02 07:26:43 +00:00 by (unknown) 8450cb5

MAke ApiUser::CheckPassword() const

refs #9471

2015-07-09 13:25:51 +00:00 by (unknown) f8f86d8

Add ApiUser::GetByClientCN()

refs #9471
refs #9086

2015-10-22 14:03:26 +00:00 by (unknown) f31837a

Clean up the 'api setup' command

refs #9471

2015-10-25 18:57:57 +00:00 by (unknown) b72ba2b

Fix incorrect return value for ApiSetupUtility::SetupMaster

refs #9471

2015-10-26 06:03:41 +00:00 by (unknown) 12015e0

Clean up the 'api setup' command a bit more

refs #9471

---

Parent Task: #9074

Relations:

• relates #9471
• relates #9471

[icinga-migration]

Updated by mfriedrich on 2015-06-24 13:03:24 +00:00

• Description updated
• Estimated Hours set to 8

[icinga-migration]

Updated by mfriedrich on 2015-06-25 09:03:22 +00:00

• Description updated

The beavhiour change of 'node wizard/setup' falling back to 'api setup' if 'api' feature not enabled is something for the ChangeLog.

So far 'api setup' works without params, which is the most common case.

TODOs
Fix GetPassword() inside object list

[icinga-migration]

Updated by mfriedrich on 2015-06-25 11:46:46 +00:00

object list is not relevant to this implementation, GetPassword() is called once /v1/apiusers are listed.

TODO:

• Add to packages %post section and run 'api setup' automatically

[icinga-migration]

Updated by Anonymous on 2015-06-25 16:05:04 +00:00

• Status changed from Assigned to Resolved
• Done % changed from 0 to 100

Applied in changeset 2eaae1f.

[icinga-migration]

Updated by mfriedrich on 2015-06-25 16:14:34 +00:00

• Backport? changed from TBD to No

[icinga-migration]

Updated by mfriedrich on 2015-07-08 13:23:44 +00:00

• Relates set to 9590

[icinga-migration]

Updated by mfriedrich on 2015-08-18 12:15:02 +00:00

• Relates set to 9948