Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | Update dogtag configuration to work after CVE-2009-3555 changes | Rob Crittenden | 2010-01-27 | 3 | -6/+18 |
| | | | | | | | | NSS is going to disallow all SSL renegotiation by default. Because of this we need to always use the agent port of the dogtag server which always requires SSL client authentication. The end user port will prompt for a certificate if required but will attempt to re-do the handshake to make this happen which will fail with newer versions of NSS. | ||||
* | Fix schema loading in the ldap backend. | Pavel Zuna | 2010-01-27 | 1 | -1/+4 |
| | |||||
* | Update spec to require python-wehjit >= 0.2.0 | Jason Gerard DeRose | 2010-01-27 | 1 | -1/+4 |
| | |||||
* | Require that the hostname we are joining as is fully-qualified | Rob Crittenden | 2010-01-26 | 1 | -0/+6 |
| | |||||
* | Remove duplicated code | Rob Crittenden | 2010-01-26 | 1 | -6/+0 |
| | | | | This strange bit of duplication was not surprisingly causing a double-free | ||||
* | Enabled CRUDS in webUI using wehjit 0.2.0 | Jason Gerard DeRose | 2010-01-26 | 6 | -199/+239 |
| | |||||
* | Fixed xmlrpc_test.fuzzy_digits for Fedora12 | Jason Gerard DeRose | 2010-01-22 | 2 | -2/+2 |
| | |||||
* | Set BIND to use ldapi and use fake mname | Martin Nagy | 2010-01-21 | 2 | -1/+4 |
| | | | | | | The fake_mname for now doesn't exists but is a feature that will be added in the near future. Since any unknown arguments to bind-dyndb-ldap are ignored, we are safe to use it now. | ||||
* | Move some functions from ipa-server-install into installutils | Martin Nagy | 2010-01-21 | 2 | -54/+54 |
| | | | | | We will need these functions in the new upcoming ipa-dns-install command. | ||||
* | Allow a custom file mode when setting up debugging | Martin Nagy | 2010-01-21 | 1 | -2/+2 |
| | | | | | | This will be handy in the future if we will want to install or uninstall only single IPA components and want to append to the installation logs. This will be used by the upcoming ipa-dns-install script. | ||||
* | Only add an NTP SRV record if we really are setting up NTP | Martin Nagy | 2010-01-21 | 4 | -8/+16 |
| | | | | | | | The sample bind zone file that is generated if we don't use --setup-dns is also changed. Fixes #500238 | ||||
* | Use the dns plug-in for addition of records during installation | Martin Nagy | 2010-01-21 | 4 | -146/+82 |
| | | | | Fixes #528943 | ||||
* | Move api finalization in ipa-server-install after writing default.conf | Martin Nagy | 2010-01-21 | 1 | -23/+22 |
| | | | | | We will need to have ipalib correctly configured before we start installing DNS entries with api.Command.dns. | ||||
* | Fix merge issue, cut-and-paste error | Rob Crittenden | 2010-01-21 | 1 | -2/+1 |
| | |||||
* | Fix merge error, variable mis-named label instead of doc | Rob Crittenden | 2010-01-21 | 1 | -1/+1 |
| | |||||
* | User-defined certificate subjects | Rob Crittenden | 2010-01-20 | 11 | -46/+164 |
| | | | | | | | | | | | | | | | Let the user, upon installation, set the certificate subject base for the dogtag CA. Certificate requests will automatically be given this subject base, regardless of what is in the CSR. The selfsign plugin does not currently support this dynamic name re-assignment and will reject any incoming requests that don't conform to the subject base. The certificate subject base is stored in cn=ipaconfig but it does NOT dynamically update the configuration, for dogtag at least. The file /var/lib/pki-ca/profiles/ca/caIPAserviceCert.cfg would need to be updated and pki-cad restarted. | ||||
* | Stop looking when removing entries from a keytab. | Rob Crittenden | 2010-01-20 | 1 | -0/+5 |
| | | | | keytab entries are locked when looping. Temporarily suspend the looping. | ||||
* | Fix plugin to work with new output validation, add new helpers | Rob Crittenden | 2010-01-20 | 1 | -34/+57 |
| | | | | | | | | Add a new get_subject() helper and return the subject when retrieving certificates. Add a normalizer so that everything before and after the BEGIN/END block is removed. | ||||
* | Add DS migration plugin and password migration page. | Pavel Zuna | 2010-01-20 | 11 | -0/+637 |
| | |||||
* | Add --enable-migration option in config plugin. | Pavel Zuna | 2010-01-20 | 1 | -1/+14 |
| | |||||
* | Add BIND pre-op for DS->IPA password migration to ipa-pwd-extop DS plugin. | Pavel Zuna | 2010-01-20 | 3 | -15/+244 |
| | |||||
* | Allow adding entries with pre-hashed passwords, but don't generate keys for ↵ | root | 2010-01-20 | 1 | -8/+15 |
| | | | | | | them. Fix bug #528922. | ||||
* | Temporary fix for name collision of textui.print_entry. | Pavel Zuna | 2010-01-20 | 2 | -3/+3 |
| | | | | Somehow there's two of them... rename old one to print_entry1. | ||||
* | Make DNS plugin support output validation and thus make it work again. | Pavel Zuna | 2010-01-20 | 1 | -39/+86 |
| | |||||
* | Create pkiuser before calling pkicreate, pkicreate depends on the user existing | John Dennis | 2010-01-20 | 1 | -1/+1 |
| | |||||
* | Correct some comment errors | Rob Crittenden | 2010-01-19 | 1 | -2/+1 |
| | |||||
* | pass DER flag to x509.get_serial_number() | John Dennis | 2010-01-19 | 1 | -1/+1 |
| | |||||
* | Allow cospriority to be updated and fix description of priority ordering | Rob Crittenden | 2010-01-19 | 2 | -16/+40 |
| | | | | | | Need to add a few more places where the DN will not be automatically normalized. The krb5 server expects a very specific format and normalizing causes it to not work. | ||||
* | Use 'l' instead of 'localityname' in host plugin. | Pavel Zuna | 2010-01-14 | 1 | -2/+14 |
| | | | | | It seems that 'localityname' and 'locality' aliases were dropped in newer versions of DS. | ||||
* | Make host objects aware of their membership and that l==localityName. | Pavel Zuna | 2010-01-14 | 1 | -0/+6 |
| | |||||
* | Add default values for krb ticket policy attributes during installation. | Pavel Zuna | 2010-01-13 | 2 | -0/+8 |
| | |||||
* | Add Kerberos Ticket Policy management plugin. | Pavel Zuna | 2010-01-13 | 2 | -27/+167 |
| | |||||
* | Fix backend.Executioner unit test. | Pavel Zuna | 2010-01-13 | 1 | -6/+13 |
| | | | | | | | | | | Before the patch that allows to create unshared instances of Connectible objects, all Connection object were deleted at once in destroy_context(). It made sense at the time, because there was always at most one Connection per Connectible subclass and Connectible.disconnect() was called only internally by the Executioner class. Now that we can make arbitrary connections, it makes more sense to delete the Connection object when Connectible.disconnect() is called. | ||||
* | Improve modlist generation in ldap2. Some code cleanup as bonus. | Pavel Zuna | 2010-01-11 | 1 | -65/+89 |
| | | | | | | | | ldap2._generate_modlist now uses more sophisticated means to decide when to use MOD_ADD+MOD_DELETE instead of MOD_REPLACE. MOD_REPLACE is always used for single value attributes and never for multi value. | ||||
* | Allow creation of new connections by unshared instances of backend.Connectible. | Pavel Zuna | 2010-01-11 | 2 | -14/+22 |
| | |||||
* | Add start/stop for the CA | Rob Crittenden | 2010-01-11 | 1 | -0/+8 |
| | |||||
* | Missed explicit reference to pki-ca, replace with self.service_name | Rob Crittenden | 2010-01-11 | 1 | -2/+2 |
| | |||||
* | Add --all to LDAPCreate and make LDAP commands always display default ↵ | Pavel Zuna | 2010-01-11 | 7 | -14/+30 |
| | | | | attributes. | ||||
* | Use the caIPAserviceCert profile for issuing service certs. | Rob Crittenden | 2010-01-08 | 2 | -3/+3 |
| | | | | | | | | | | | This profile enables subject validation and ensures that the subject that the CA issues is uniform. The client can only request a specific CN, the rest of the subject is fixed. This is the first step of allowing the subject to be set at installation time. Also fix 2 more issues related to the return results migration. | ||||
* | Replace uses of %define with %global in the .spec file | Rob Crittenden | 2010-01-07 | 1 | -7/+7 |
| | | | | | | | Fixes rawhide builds per https://www.redhat.com/archives/fedora-devel-list/2010-January/msg00093.html Contributed by Nalin Dahyabhai | ||||
* | Change the service name to reflect changes in pki-ca (now pki-cad). | Rob Crittenden | 2010-01-07 | 1 | -3/+3 |
| | | | | | | Also properly use the instance name where appropriate. There were a couple of places where the service name was used and this worked because they were the same. | ||||
* | Remove hardcoded domain, example.com | Rob Crittenden | 2009-12-18 | 2 | -6/+6 |
| | |||||
* | Add messages, declarative tests for rolegroup, taskgroup plugins | Jason Gerard DeRose | 2009-12-18 | 5 | -273/+856 |
| | |||||
* | Added Fuzzy docstrings; make-test now runs doctests in tests/*; fixed ↵ | Jason Gerard DeRose | 2009-12-18 | 7 | -32/+106 |
| | | | | 'existant' mispelling | ||||
* | Need to supsend looping through the keytab entries when doing a delete. | Rob Crittenden | 2009-12-18 | 1 | -0/+5 |
| | |||||
* | Handle base64-encoded certificates better, import missing function | Rob Crittenden | 2009-12-18 | 3 | -0/+11 |
| | |||||
* | Fuzzy feelings | Jason Gerard DeRose | 2009-12-17 | 8 | -395/+653 |
| | |||||
* | Make hosts more like real services so we can issue certs for host principals | Rob Crittenden | 2009-12-16 | 5 | -17/+71 |
| | | | | | This patch should make joining a client to the domain and using certmonger to get an initial certificate work. | ||||
* | Set the context of files needed by the selfsign CA so Apache can write them | Rob Crittenden | 2009-12-16 | 2 | -1/+6 |
| | |||||
* | Remove some left-over debugging statements | Rob Crittenden | 2009-12-16 | 1 | -3/+0 |
| |