summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* fix Makefile.am for daemonsAlexander Bokovoy2015-03-264-4/+1
| | | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Sumit Bose <sbose@redhat.com>
* show the exception message thrown by dogtag._parse_ca_status during installMartin Babinsky2015-03-261-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/4885 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* migrate-ds: print out failed attempts when no users/groups are migratedMartin Babinsky2015-03-231-9/+8
| | | | | | | This patch should fix both https://fedorahosted.org/freeipa/ticket/4846 and https://fedorahosted.org/freeipa/ticket/4952. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* upload_cacrt: Fix empty cACertificate in cn=CAcertJan Cholasta2015-03-191-24/+30
| | | | | | https://fedorahosted.org/freeipa/ticket/4565 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: Fix ca_is_enabled callsJan Cholasta2015-03-192-4/+4
| | | | | | | | | The command was added in API version 2.107. Old IPA servers may crash with NetworkError on ca_is_enabled, handle this case gracefully. https://fedorahosted.org/freeipa/ticket/4565 Reviewed-By: David Kupka <dkupka@redhat.com>
* client-install: Do not crash on invalid CA certificate in LDAPJan Cholasta2015-03-191-4/+13
| | | | | | | | | When CA certificates in LDAP are corrupted, use the otherwise acquired CA certificates from before. https://fedorahosted.org/freeipa/ticket/4565 Reviewed-By: David Kupka <dkupka@redhat.com>
* certstore: Make certificate retrieval more robustJan Cholasta2015-03-191-22/+52
| | | | | | https://fedorahosted.org/freeipa/ticket/4565 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: remove --test optionMartin Basti2015-03-197-73/+47
| | | | | | | | | As --test option is not used for developing, and it is not recommended to test if upgrade will pass, this path removes it copmletely. https://fedorahosted.org/freeipa/ticket/3448 Reviewed-By: David Kupka <dkupka@redhat.com>
* Revert "Server Upgrade: respect --test option in plugins"Tomas Babej2015-03-197-35/+0
| | | | This reverts commit c95c4849ae1ecc90ac926b8b7d61e153b42e7699.
* Server Upgrade: respect --test option in pluginsMartin Basti2015-03-197-0/+35
| | | | | | | | | Several plugins do the LDAP data modification directly. In test mode these plugis should not be executed. https://fedorahosted.org/freeipa/ticket/3448 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: order update files by defaultMartin Basti2015-03-194-5/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Update entries in order specified in fileMartin Basti2015-03-199-88/+30
| | | | | | | | | | | | Dictionary replaced with list. Particular upgrades are executed in the same order as they are specified in update a file. Different updates for the smae cn, are not merged into one upgrade https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Set modified to false, before each updateMartin Basti2015-03-191-1/+2
| | | | | | | Variable self.modified should be set to false before each run of update Ticket: https://fedorahosted.org/freeipa/ticket/3560 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Upgrade one file per timeMartin Basti2015-03-191-36/+18
| | | | | | | | * Files are sorted alphabetically, no numbering required anymore * One file updated per time Ticket: https://fedorahosted.org/freeipa/ticket/3560 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: do not sort updates by DNMartin Basti2015-03-191-13/+2
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Remove unused PRE_SCHEMA_UPDATEMartin Basti2015-03-196-56/+10
| | | | | | | This is not used anymore. Ticket: https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* extdom: migrate check-based test to cmockaSumit Bose2015-03-185-245/+176
| | | | | | | | | Besides moving the existing tests to cmocka two new tests are added which were missing from the old tests. Related to https://fedorahosted.org/freeipa/ticket/4922 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Require python2 version of sssd bindingsLukas Slebodnik2015-03-181-0/+6
| | | | | | | | | | | | | | | | | | | | Python modules pysss and pysss_murmur was part of package sssd-common. Fedora 22 tries to get rid of python2 and therefore these modules were extracted from package sssd-common to separate packages python-sss and python-sss-murmur and python3 version of packages python3-sss python3-sss-murmur git grep "pysss" | grep import ipalib/plugins/trust.py: import pysss_murmur #pylint: disable=F0401 ipaserver/dcerpc.py:import pysss ipaserver/dcerpc.py is pacakged in freeipa-server-trust-ad palib/plugins/trust.py is packaged in freeipa-python Resolves: https://fedorahosted.org/freeipa/ticket/4929 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* SPEC: Explicitly requires python-sssdconfigLukas Slebodnik2015-03-181-0/+2
| | | | | | | Resolves: https://fedorahosted.org/freeipa/ticket/4929 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* extdom: add selected error messagesSumit Bose2015-03-181-13/+38
| | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* extdom: add add_err_msg() with testSumit Bose2015-03-183-0/+67
| | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* extdom: add err_msg member to request contextSumit Bose2015-03-183-1/+6
| | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* Always reload StateFile before getting or modifying the stored values.David Kupka2015-03-181-2/+11
| | | | | | | | | | This change does not solve using multiple instances of StateFile concurently because there is no use for it in near future. Instead this solves an issue of loosing records when more instances of StateFile are interleaved in sequential code. https://fedorahosted.org/freeipa/ticket/4901 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-dns-install: use LDAPI to connect to DSMartin Babinsky2015-03-185-50/+37
| | | | | | | | | | | | | ipa-dns-install now uses LDAPI/autobind to connect to DS during the setup of DNS/DNSSEC-related service and thus makes -p option obsolete. Futhermore, now it makes more sense to use LDAPI also for API Backend connections to DS and thus all forms of Kerberos auth were removed. This fixes https://fedorahosted.org/freeipa/ticket/4933 and brings us closer to fixing https://fedorahosted.org/freeipa/ticket/2957 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-dns-install: use STARTTLS to connect to DSMartin Babinsky2015-03-186-17/+33
| | | | | | | BindInstance et al. now use STARTTLS to set up secure connection to DS during ipa-dns-install. This fixes https://fedorahosted.org/freeipa/ticket/4933 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Timeout when performing time sync during client installNathan Kinder2015-03-163-2/+19
| | | | | | | | | | | | | We use ntpd now to sync time before fetching a TGT during client install. Unfortuantely, ntpd will hang forever if it is unable to reach the NTP server. This patch adds the ability for commands run via ipautil.run() to have an optional timeout. This capability is used by the NTP sync code that is run during ipa-client-install. Ticket: https://fedorahosted.org/freeipa/ticket/4842 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-replica-prepare can only be created on the first masterGabe2015-03-131-2/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4944 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix dead code in ipap11helper moduleMartin Basti2015-03-111-7/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* extdom: fix memory leakSumit Bose2015-03-101-0/+1
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: return LDAP_NO_SUCH_OBJECT to the clientSumit Bose2015-03-101-2/+6
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DNS: remove NSEC3PARAM from recordsMartin Basti2015-03-093-17/+7
| | | | | | | | NSEC3PARAM is configurable only from zone commands. This patch removes this record type from DNS records. Ticket: https://fedorahosted.org/freeipa/ticket/4930 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS fix: do not show part options for unsupported recordsMartin Basti2015-03-091-1/+2
| | | | | | | Do not show parts options in help output, if record is marked as unsupported. Ticket: https://fedorahosted.org/freeipa/ticket/4930 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS fix: do not traceback if unsupported records are in LDAPMartin Basti2015-03-091-32/+32
| | | | | | | | | | Show records which are unsupported, if they are in LDAP. Those records are not editable, and web UI doesnt show them. Fixes traceback caused by --structured option Ticket: https://fedorahosted.org/freeipa/ticket/4930 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* extdom: make nss buffer configurableSumit Bose2015-03-093-22/+48
| | | | | | | | | | | | The get*_r_wrapper() calls expect a maximum buffer size to avoid memory shortage if too many threads try to allocate buffers e.g. for large groups. With this patch this size can be configured by setting ipaExtdomMaxNssBufSize in the plugin config object cn=ipa_extdom_extop,cn=plugins,cn=config. Related to https://fedorahosted.org/freeipa/ticket/4908 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: handle ERANGE return code for getXXYYY_r() callsSumit Bose2015-03-097-84/+498
| | | | | | | | | | | | The getXXYYY_r() calls require a buffer to store the variable data of the passwd and group structs. If the provided buffer is too small ERANGE is returned and the caller can try with a larger buffer again. Cmocka/cwrap based unit-tests for get*_r_wrapper() are added. Resolves https://fedorahosted.org/freeipa/ticket/4908 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add configure check for cwrap librariesSumit Bose2015-03-091-0/+24
| | | | | | | | | Currently only nss-wrapper is checked, checks for other crwap libraries can be added e.g. as AM_CHECK_WRAPPER(uid_wrapper, HAVE_UID_WRAPPER) Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove unused disable-betxn.ldif fileMartin Basti2015-03-092-62/+0
| | | | Reviewed-By: David Kupka <dkupka@redhat.com>
* p11helper: clarify error messagePetr Spacek2015-03-061-1/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* p11helper: use sizeof() instead of magic constantsPetr Spacek2015-03-061-6/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* p11helper: standardize indentation and other visual aspects of the codePetr Spacek2015-03-061-589/+744
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused method from ipap11pkcs helper moduleMartin Basti2015-03-061-51/+0
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix memory leaks in ipap11helperMartin Basti2015-03-061-117/+194
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC add support for CKM_RSA_PKCS_OAEP mechanismMartin Basti2015-03-061-3/+73
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4657#comment:13 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Limit deadlocks between DS plugin DNA and slapi-nisroot2015-03-051-0/+5
| | | | | | | | | | Deadlock can occur if DNA plugin (shared) config and Schema-compat plugin config are updated at the same time. Schema-compat should ignore update on DNA config. https://fedorahosted.org/freeipa/ticket/4927 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Restore default.conf and use it to build API.David Kupka2015-03-051-16/+48
| | | | | | | | | When restoring ipa after uninstallation we need to extract and load configuration of the restored environment. https://fedorahosted.org/freeipa/ticket/4896 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix uniqueness pluginsMartin Basti2015-03-053-127/+48
| | | | | | | | | | | | * add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users will not be forced to have unique uid * remove unneded update plugins -> update was moved to .update file * add uniqueness-across-all-subtrees required by user lifecycle management Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Migrate uniquess plugins configuration to new styleMartin Basti2015-03-053-31/+232
| | | | | | | New configuration style contains options required for user lifecycle management. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* replica-install: Use different API instance for the remote serverJan Cholasta2015-03-052-157/+133
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ldap2: Use self API instance instead of ipalib.apiJan Cholasta2015-03-051-13/+32
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* advise: Add separate API object for ipa-adviseJan Cholasta2015-03-055-82/+79
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-26 22:52:48 +0000