summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Remove ico files from MakefileMartin Basti2015-07-271-2/+0
| | | | | | | | | Icons were removed in a4be844809179ff0a05286606df1487d81a70022 but still persist in Makefile. This patch fixes Makefile. https://fedorahosted.org/freeipa/ticket/823 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add Kerberos configuration instructions for ChromePetr Vobornik2015-07-273-31/+80
| | | | | | | | | | * IE section moved at the end * Chrome section added * FF and IE icons removed https://fedorahosted.org/freeipa/ticket/823 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replication: Fix incorrect exception invocationTomas Babej2015-07-241-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* idviews: Enforce objectclass check in idoverride*-delTomas Babej2015-07-231-0/+19
| | | | | | | | | | | | | Even with anchor to sid type checking, it would be still possible to delete a user ID override by specifying a group raw anchor and vice versa. This patch introduces a objectclass check in idoverride*-del commands to prevent that. https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* idviews: Restrict anchor to name and name to anchor conversionsTomas Babej2015-07-231-4/+46
| | | | | | | | | | | | | When converting the ID override anchor from AD SID representation to the object name, we need to properly restrict the type of the object that is being resolved. The same restriction applies for the opposite direction, when converting the object name to it's SID. https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dcerpc: Add get_trusted_domain_object_type methodTomas Babej2015-07-231-0/+29
| | | | | | https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* fix broken search for users by their managerMartin Babinsky2015-07-233-11/+8
| | | | | | | | | The patch fixes incorrect construction of search filter when using `ipa user-find` with '--manager' option. https://fedorahosted.org/freeipa/ticket/5146 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* dcerpc: Fix UnboundLocalError for ccache_nameTomas Babej2015-07-221-0/+2
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* tests: test_cert: Services can have multiple certificatesTomas Babej2015-07-221-4/+4
| | | | | | | | | Old certificates of the services are no longer removed and revoked after new ones have been issued. Check that both old and new certificates are present. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* tests: test_rpc: Create connection for the current threadTomas Babej2015-07-221-0/+3
| | | | | | | Both context.xmlclient and context.xmlclient_<id> need to be created in order to successfully call the Command.forward method. Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: vault_plugin: Skip tests if KRA not availableTomas Babej2015-07-221-0/+11
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* tests: Version is currently generated during command callTomas Babej2015-07-221-35/+16
| | | | | | | | In the previous versions, version in the response was generated as part of the process_keyword_arguments method. This is no longer true, and so the explicit check for it should be removed. Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: realmdomains_plugin: Add explanatory commentTomas Babej2015-07-221-0/+3
| | | | | | | | | | | The realmdomains_mod command will fail if the testing environment is configured improperly and the IPA domain's NS/SOA records are not resolvable. This can easily happen if the machine's DNS server is not configured to the IPA server. Leave a explanatory note in the class. Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: service_plugin: Make sure the cert is decoded from base64Tomas Babej2015-07-221-1/+5
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* idviews: Check for the Default Trust View only if applying the viewTomas Babej2015-07-221-6/+8
| | | | | | | | | | Currently, the code wrongly validates the idview-unapply command. Move check for the forbidden application of the Default Trust View into the correct logical branch. https://fedorahosted.org/freeipa/ticket/4969 Reviewed-By: Martin Basti <mbasti@redhat.com>
* dcerpc: Expand explanation for WERR_ACCESS_DENIEDTomas Babej2015-07-211-7/+29
| | | | | | | | | | | It's possible for AD to contact a wrong IPA server in case the DNS SRV records on the AD sides are not properly configured. Mention this case in the error message as well. https://fedorahosted.org/freeipa/ticket/5013 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* tests: user_plugin: Add preserved flag when --all is usedTomas Babej2015-07-211-1/+4
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: check if DNS package is installedMartin Basti2015-07-217-39/+10
| | | | | | | | | | | Instead of separate checking of DNS required packages, we need just check if IPA DNS package is installed. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaplatform: Add constants submoduleTomas Babej2015-07-216-1/+64
| | | | | | | | Introduce a ipaplatform/constants.py file to store platform related constants, which are not paths. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS: Consolidate DNS RR types in API and schemaMartin Basti2015-07-217-80/+71
| | | | | | | | | | | | | | | | | | | | | | | | * Remove NSEC3, DNSKEY, TSIG, TKEY, TA records from API: These records never worked, they dont have attributes in schema. TSIG and TKEY are meta-RR should not be in LDAP TA is not supported by BIND NSEC3, DNSKEY are DNSSEC records generated by BIND, should not be in LDAP. *! SIG, NSEC are already defined in schema, must stay in API. * Add HINFO, MINFO, MD, NXT records to API as unsupported records These records are already defined in LDAP schema * Add schema for RP, APL, IPSEC, DHCID, HIP, SPF records These records were defined in IPA API as unsupported, but schema definition was missing. This causes that ACI cannot be created for these records and dnszone-find failed. (#5055) https://fedorahosted.org/freeipa/ticket/4934 https://fedorahosted.org/freeipa/ticket/5055 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipa-client-install: Do not (re)start certmonger and DBus daemons.David Kupka2015-07-201-56/+15
| | | | | | | | | | | | When DBus is present in the system it is always running. Starting of certmomger is handled in ipapython/certmonger.py module if necessary. Restarting is no longer needed since freeipa is not changing certmonger's files. https://fedorahosted.org/freeipa/ticket/5095 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cermonger: Use private unix socket when DBus SystemBus is not available.David Kupka2015-07-202-43/+98
| | | | | | https://fedorahosted.org/freeipa/ticket/5095 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* enable debugging of ntpd during client installationMartin Babinsky2015-07-202-4/+8
| | | | | | | | | | When installing IPA client in debug mode, the ntpd command spawned during initial time-sync with master KDC will also run in debug mode. https://fedorahosted.org/freeipa/ticket/4931 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* domainlevel: Fix incorrect initializations of InvalidDomainLevelError exceptionsTomas Babej2015-07-202-4/+4
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Py3: replace tab with spaceMartin Basti2015-07-173-5/+5
| | | | | | python3 does not allow to mix spaces and tabs Reviewed-By: Christian Heimes <cheimes@redhat.com>
* trusts: Check for AD root domain among our trusted domainsTomas Babej2015-07-171-1/+20
| | | | | | | | | | | | | Check for the presence of the forest root DNS domain of the AD realm among the IPA realm domains prior to esablishing the trust. This prevents creation of a failing setup, as trusts would not work properly in this case. https://fedorahosted.org/freeipa/ticket/4799 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommandMartin Basti2015-07-173-3/+4
| | | | | | | | | --force option set replica-certify-all to 'no' during abort-clean-ruv subcommand https://fedorahosted.org/freeipa/ticket/4988 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix minor typosYuri Chornoivan2015-07-1710-11/+11
| | | | | | | | | | | | | <ame> -> <name> overriden -> overridden ablity -> ability enties -> entries the the -> the https://fedorahosted.org/freeipa/ticket/5109 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* sysrestore: copy files instead of moving them to avoind SELinux issuesMartin Basti2015-07-171-2/+6
| | | | | | | | Copying files restores SELinux context. https://fedorahosted.org/freeipa/ticket/4923 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Create server-dns sub-package.Petr Spacek2015-07-171-15/+35
| | | | | | | | | | | | | | | This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* migration: Use api.env variables.David Kupka2015-07-171-28/+5
| | | | | | | | | | | Use api.env.basedn instead of anonymously accessing LDAP to get base DN. Use api.env.basedn instead of searching filesystem for ldapi socket. https://fedorahosted.org/freeipa/ticket/4953 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Validate adding privilege to a permissionMartin Basti2015-07-172-25/+33
| | | | | | | | | Adding priviledge to a permission via webUI allowed to avoid check and to add permission with improper type. https://fedorahosted.org/freeipa/ticket/5075 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* fix selinuxusermap search for non-admin usersMartin Basti2015-07-161-1/+1
| | | | | | | | Remove nonexistent attribute 'hostmembergroup' that is not in ACI nor schema. Related to https://fedorahosted.org/freeipa/ticket/5130 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* fix hbac rule search for non-admin usersPetr Vobornik2015-07-161-1/+1
| | | | | | | | | | | | | hbacrule has it default attributes (which are used in search) attribute 'memberhostgroup'. This attr is not in ACI nor in schema. If the search contains an attribute which can't be read then the search won't return anything. Therefore all searches with filter set fail. https://fedorahosted.org/freeipa/ticket/5130 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-ca-install: print more specific errors when CA is already installedMartin Babinsky2015-07-161-2/+10
| | | | | | | | | | | This patch implements a more thorough checking for already installed CAs during standalone CA installation using ipa-ca-install. The installer now differentiates between CA that is already installed locally and CA installed on one or more masters in topology and prints an appropriate error message. https://fedorahosted.org/freeipa/ticket/4492 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: fix user reset password dialogPetr Vobornik2015-07-162-3/+3
| | | | | | | | | | Could not open user password dialog. regression introduced in ed78dcfa3acde7aeb1f381f49988c6911c5277ee https://fedorahosted.org/freeipa/ticket/5131 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix selinux denial during kdcproxy user creationChristian Heimes2015-07-161-1/+3
| | | | | | | | | The home directory of the kdcproxy user is now properly owned by the package and no longer created by useradd. https://fedorahosted.org/freeipa/ticket/5135 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* oddjob: avoid chown keytab to sssd if sssd user does not existAlexander Bokovoy2015-07-161-2/+7
| | | | | | | | | | | | | | | | | | | | If sssd user does not exist, it means SSSD does not run as sssd user. Currently SSSD has too tight check for keytab permissions and ownership. It assumes the keytab has to be owned by the same user it runs under and has to have 0600 permissions. ipa-getkeytab creates the file with right permissions and 'root:root' ownership. Jakub Hrozek promised to enhance SSSD keytab permissions check so that both sssd:sssd and root:root ownership is possible and then when SSSD switches to 'sssd' user, the former becomes the default. Since right now SSSD 1.13 is capable to run as 'sssd' user but doesn't create 'sssd' user in Fedora 22 / RHEL 7 environments, we can use its presence as a version trigger. https://fedorahosted.org/freeipa/ticket/5136 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* selinux: enable httpd_run_ipa to allow communicating with oddjobd servicesAlexander Bokovoy2015-07-162-1/+2
| | | | | | | | | | | | | A new SELinux policy allows communication between IPA framework running under Apache with oddjobd-based services via DBus. This communication is crucial for one-way trust support and also is required for any out of band tools which may be executed by IPA framework. Details of out of band communication and SELinux policy can be found in a bug https://bugzilla.redhat.com/show_bug.cgi?id=1238165 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* do not import memcache on clientPetr Vobornik2015-07-161-2/+4
| | | | | | | | | | | | Fixes regression caused by cd3ca94ff2ef738cb3a9eae502193413058f976d. Which caused: * client installation failure (missing memcache) * invalid warning in CLI on server https://fedorahosted.org/freeipa/ticket/5133 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* spec file: Update minimum required version of krb5Jan Cholasta2015-07-151-2/+4
| | | | | | | | Automatically require the krb5 version used at build time. https://fedorahosted.org/freeipa/ticket/5132 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* spec file: Move /etc/ipa/kdcproxy to the server subpackageJan Cholasta2015-07-151-1/+1
| | | | | | | | The directory was in the python subpackage, but that broke client-only build. We don't want the directory to be installed on clients anyway, since it is part of a server-side feature. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* copy-schema-to-ca: allow to overwrite schema filesMartin Basti2015-07-151-3/+26
| | | | | | | | | If content of source and target file differs, the script will ask user for permission to overwrite target file. https://fedorahosted.org/freeipa/ticket/5034 Reviewed-By: David Kupka <dkupka@redhat.com>
* Stageusedr-activate: show username instead of DNMartin Basti2015-07-151-2/+3
| | | | | | | | | | | If activate user already exists, show name of this user in error message instead of user DN. Error message reworder to keep the same format as stageuser-add, user-add. https://fedorahosted.org/freeipa/ticket/5038 Reviewed-By: David Kupka <dkupka@redhat.com>
* Replace file() with open()Christian Heimes2015-07-141-6/+4
| | | | | | | | | The open() function is the recommended way to open a file. In Python 3 the file type is gone, but open() still works the same. The patch is related to https://fedorahosted.org/freeipa/ticket/5127 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Remove tuple unpacking from except clause ipaserver/dcerpc.pyChristian Heimes2015-07-141-6/+12
| | | | | | | | | | Python 3 doesn't support tuple unpacking in except clauses. All implicit tuple unpackings have been replaced with explicit unpacking of e.args. https://fedorahosted.org/freeipa/ticket/5120 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove tuple unpacking from except clause ipalib/plugins/hbactest.pyChristian Heimes2015-07-141-3/+4
| | | | | | | | | | Python 3 doesn't support tuple unpacking in except clauses. All implicit tuple unpackings have been replaced with explicit unpacking of e.args. https://fedorahosted.org/freeipa/ticket/5120 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove tuple unpacking from except clause ipa-client/ipaclient/ipachangeconf.pyChristian Heimes2015-07-141-2/+2
| | | | | | | | | | Python 3 doesn't support tuple unpacking in except clauses. All implicit tuple unpackings have been replaced with explicit unpacking of e.args. https://fedorahosted.org/freeipa/ticket/5120 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove tuple unpacking from except clause contrib/RHEL4/ipachangeconf.pyChristian Heimes2015-07-141-2/+2
| | | | | | | | | | Python 3 doesn't support tuple unpacking in except clauses. All implicit tuple unpackings have been replaced with explicit unpacking of e.args. https://fedorahosted.org/freeipa/ticket/5120 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* spec file: update the python package names for libipa_hbac and libsss_nss_idmapMilan Kubík2015-07-141-3/+3
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-09 05:27:52 +0000