summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
* cert renewal: Automatically update KRA agent PEM fileJan Cholasta2015-08-271-1/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/5253 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipactl: Do not start/stop/restart single service multiple timesDavid Kupka2015-08-261-1/+16
| | | | | | | | | In case multiple services are provided by single system daemon it is not needed to start/stop/restart it mutiple time. https://fedorahosted.org/freeipa/ticket/5248 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: add option to establish bidirectional trustPetr Vobornik2015-08-261-1/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/5259 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: harden trust-fetch-domains oddjobd-based scriptAlexander Bokovoy2015-08-182-5/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When ipa-getkeytab is used to fetch trusted domain object credentials, the fetched entry has always kvno 1. ipa-getkeytab always adds a key to keytab which means older key versions will be in the SSSD keytab and will confuse libkrb5 ccache initialization code as all kvno values are equal to 1. Wrong key is picked up then and kinit fails. To solve this problem, always remove existing /var/lib/sss/keytabs/forest.keytab before retrieving a new one. To make sure script's input cannot be used to define what should be removed (by passing a relative path), make sure we retrieve trusted forest name from LDAP. If it is not possible to retrieve, the script will issue an exception and quit. If abrtd is running, this will be recorded as a 'crash' and an attempt to use script by malicious user would be recorded as well in the abrtd journal. Additionally, as com.redhat.idm.trust-fetch-domains will create ID ranges for the domains of the trusted forest if they don't exist, it needs permissions to do so. The permission should be granted only to cifs/ipa.master@IPA.REALM services which means they must have krbprincipalname=cifs/*@IPA.REALM,cn=services,... DN and be members of cn=adtrust agents,cn=sysaccounts,... group. Solves https://bugzilla.redhat.com/show_bug.cgi?id=1250190 Ticket https://fedorahosted.org/freeipa/ticket/5182 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* winsync-migrate: Expand the man pageTomas Babej2015-08-171-1/+26
| | | | | | https://fedorahosted.org/freeipa/ticket/5162 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Added CLI param and ACL for vault service operations.Endi S. Dewata2015-08-171-0/+1
| | | | | | | | | | | | | The CLIs to manage vault owners and members have been modified to accept services with a new parameter. A new ACL has been added to allow a service to create its own service container. https://fedorahosted.org/freeipa/ticket/5172 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add permission for bypassing CA ACL enforcementFraser Tweedale2015-08-141-0/+15
| | | | | | | | | | | | Add the "Request Certificate ignoring CA ACLs" permission and associated ACI, initially assigned to "Certificate Administrators" privilege. Update cert-request command to skip CA ACL enforcement when the bind principal has this permission. Fixes: https://fedorahosted.org/freeipa/ticket/5099 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust-install: Correctly determine 4.2 FreeIPA serversTomas Babej2015-08-111-1/+1
| | | | | | | | | | | | | We need to detect a list of FreeIPA 4.2 (and above) servers, since only there is the required version of SSSD present. Since the maximum domain level for 4.2 is 0 (and not 1), we can filter for any value of ipaMaxDomainLevel / ipaMinDomainLevel attributes to generate the list. https://fedorahosted.org/freeipa/ticket/5199 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add profile for DNP3 / IEC 62351-8 certificatesFraser Tweedale2015-08-112-0/+115
| | | | | | | | | | | The DNP3 smart-grid standard uses certificate with the IEC 62351-8 IECUserRoles extension. Add a profile for DNP3 certificates which copies the IECUserRoles extension from the CSR, if present. Also update cert-request to accept CSRs containing this extension. Fixes: https://fedorahosted.org/freeipa/ticket/4752 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add LDAP vs Kerberos behavior description to user auth typesPetr Vobornik2015-08-103-4/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4935 Reviewed-By: David Kupka <dkupka@redhat.com>
* webui: fix regressions failed auth messagesPetr Vobornik2015-07-292-5/+5
| | | | | | | | | | | | 1. after logout, krb auth no longer shows "session expired" but correct "Authentication with Kerberos failed". 2. "The password or username you entered is incorrect." is showed on failed forms-based auth. https://fedorahosted.org/freeipa/ticket/5163 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove ico files from MakefileMartin Basti2015-07-271-2/+0
| | | | | | | | | Icons were removed in a4be844809179ff0a05286606df1487d81a70022 but still persist in Makefile. This patch fixes Makefile. https://fedorahosted.org/freeipa/ticket/823 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add Kerberos configuration instructions for ChromePetr Vobornik2015-07-273-31/+80
| | | | | | | | | | * IE section moved at the end * Chrome section added * FF and IE icons removed https://fedorahosted.org/freeipa/ticket/823 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: Consolidate DNS RR types in API and schemaMartin Basti2015-07-213-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | * Remove NSEC3, DNSKEY, TSIG, TKEY, TA records from API: These records never worked, they dont have attributes in schema. TSIG and TKEY are meta-RR should not be in LDAP TA is not supported by BIND NSEC3, DNSKEY are DNSSEC records generated by BIND, should not be in LDAP. *! SIG, NSEC are already defined in schema, must stay in API. * Add HINFO, MINFO, MD, NXT records to API as unsupported records These records are already defined in LDAP schema * Add schema for RP, APL, IPSEC, DHCID, HIP, SPF records These records were defined in IPA API as unsupported, but schema definition was missing. This causes that ACI cannot be created for these records and dnszone-find failed. (#5055) https://fedorahosted.org/freeipa/ticket/4934 https://fedorahosted.org/freeipa/ticket/5055 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommandMartin Basti2015-07-172-2/+2
| | | | | | | | | --force option set replica-certify-all to 'no' during abort-clean-ruv subcommand https://fedorahosted.org/freeipa/ticket/4988 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix minor typosYuri Chornoivan2015-07-171-1/+1
| | | | | | | | | | | | | <ame> -> <name> overriden -> overridden ablity -> ability enties -> entries the the -> the https://fedorahosted.org/freeipa/ticket/5109 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* migration: Use api.env variables.David Kupka2015-07-171-28/+5
| | | | | | | | | | | Use api.env.basedn instead of anonymously accessing LDAP to get base DN. Use api.env.basedn instead of searching filesystem for ldapi socket. https://fedorahosted.org/freeipa/ticket/4953 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: fix user reset password dialogPetr Vobornik2015-07-162-3/+3
| | | | | | | | | | Could not open user password dialog. regression introduced in ed78dcfa3acde7aeb1f381f49988c6911c5277ee https://fedorahosted.org/freeipa/ticket/5131 Reviewed-By: Martin Basti <mbasti@redhat.com>
* oddjob: avoid chown keytab to sssd if sssd user does not existAlexander Bokovoy2015-07-161-2/+7
| | | | | | | | | | | | | | | | | | | | If sssd user does not exist, it means SSSD does not run as sssd user. Currently SSSD has too tight check for keytab permissions and ownership. It assumes the keytab has to be owned by the same user it runs under and has to have 0600 permissions. ipa-getkeytab creates the file with right permissions and 'root:root' ownership. Jakub Hrozek promised to enhance SSSD keytab permissions check so that both sssd:sssd and root:root ownership is possible and then when SSSD switches to 'sssd' user, the former becomes the default. Since right now SSSD 1.13 is capable to run as 'sssd' user but doesn't create 'sssd' user in Fedora 22 / RHEL 7 environments, we can use its presence as a version trigger. https://fedorahosted.org/freeipa/ticket/5136 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* copy-schema-to-ca: allow to overwrite schema filesMartin Basti2015-07-151-3/+26
| | | | | | | | | If content of source and target file differs, the script will ask user for permission to overwrite target file. https://fedorahosted.org/freeipa/ticket/5034 Reviewed-By: David Kupka <dkupka@redhat.com>
* webui: remove cert manipulation actions from host and servicePetr Vobornik2015-07-092-16/+4
| | | | | | | | | | | | | Remove * cert_view * cert_get * cert_revoke * cert_restore These actions require serial number which is not provided to Web UI if multiple certificates are present. Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: show multiple certPetr Vobornik2015-07-096-6/+113
| | | | | | | | | | | New certificate widget which replaced certificate status widget. It can display multiple certs. Drawback is that it cannot display if the certificate was revoked. Web UI does not have the information. part of: https://fedorahosted.org/freeipa/ticket/5045 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: cert-request improvementsPetr Vobornik2015-07-095-33/+165
| | | | | | | | | | | | | | | Certificate request action and dialog now supports 'profile_id', 'add' and 'principal' options. 'add' and 'principal' are disaplayed only if certificate is added from certificate search facet. Certificate search facet allows to add a certificate. User details facet allows to add a certificate. part of https://fedorahosted.org/freeipa/ticket/5046 Reviewed-By: Martin Basti <mbasti@redhat.com>
* upgrade: Enable and start oddjobd if adtrust is availableTomas Babej2015-07-081-0/+1
| | | | | | | If ipa-adtrust-install has already been run on the system, enable and start the oddjobd service. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: hide facet tab in certificate details facetPetr Vobornik2015-07-081-0/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: caaclPetr Vobornik2015-07-086-1/+401
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: certificate profilesPetr Vobornik2015-07-085-1/+117
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added vault access control.Endi S. Dewata2015-07-082-5/+13
| | | | | | | | | | | New LDAP ACIs have been added to allow vault owners to manage the vaults and to allow members to access the vaults. New CLIs have been added to manage the owner and member list. The LDAP schema has been updated as well. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* trust: support retrieving POSIX IDs with one-way trust during trust-addAlexander Bokovoy2015-07-081-1/+3
| | | | | | | | | | | | With one-way trust we cannot rely on cross-realm TGT as there will be none. Thus, if we have AD administrator credentials we should reuse them. Additionally, such use should be done over Kerberos. Fixes: https://fedorahosted.org/freeipa/ticket/4960 https://fedorahosted.org/freeipa/ticket/4959 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: add ACIs to allow AD trust agents to fetch cross-realm keytabsAlexander Bokovoy2015-07-081-0/+1
| | | | | | Part of https://fedorahosted.org/freeipa/ticket/4959 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: add support for one-way trust and switch to it by defaultAlexander Bokovoy2015-07-086-0/+289
| | | | | | | | | | | | | | | | | | | | | | | | | | One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-adtrust-install: allow configuring of trust agentsAlexander Bokovoy2015-07-082-1/+95
| | | | | | | | | | | | | | | Trust agents are IPA master without Samba which can serve information about users from trusted forests. Such IPA masters cannot be used to configure trust but they can resolve AD users and groups for IPA clients enrolled to them. Since support from both FreeIPA and SSSD is needed to enable trust agent support, we currently only consider those IPA masters which have been upgraded to FreeIPA 4.2 or later. Part of https://fedorahosted.org/freeipa/ticket/4951 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix regression: ipa-dns-install will add CA records if requiredMartin Basti2015-07-081-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5101 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Hide topology and domainlevel featuresTomas Babej2015-07-082-3/+4
| | | | | | | | | | | * Hide topology and domainlevel commands in the CLI * Hide topology and domainlevel in the WebUI * Set maximum allowed domain level to 0 * Do not configure and enable the topology plugin https://fedorahosted.org/freeipa/ticket/5097 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Improve error handling in ipa-httpd-kdcproxyChristian Heimes2015-07-071-20/+55
| | | | | | | | | | | | | The pre start script 'ipa-httpd-kdcproxy' for httpd.service now handles connection and authentication errors more gracefully. If the script is not able to conenct to LDAP, it only prints a warning and exits with status code 0. All other errors are still reported as fatal error and result in a non-zero exit code. This fixes a problem with offline RPM updates. A restart of Apache no longer fails when LDAP is not running. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* l10n: Update translation stringsTomas Babej2015-07-0720-5461/+14028
| | | | | | | | | | * Generate new l10n strings * Include newly created python implicit files * Merges already translated strings from Zanata https://fedorahosted.org/freeipa/ticket/4832 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added ipaVaultPublicKey attribute.Endi S. Dewata2015-07-071-1/+2
| | | | | | | | | A new attribute ipaVaultPublicKey has been added to replace the existing ipaPublicKey used to store the vault public key. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added symmetric and asymmetric vaults.Endi S. Dewata2015-07-071-1/+3
| | | | | | | | | | | The vault plugin has been modified to support symmetric and asymmetric vaults to provide additional security over the standard vault by encrypting the data before it's sent to the server. The encryption functionality is implemented using the python-cryptography library. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSSEC: Detect attempt to install & disable master at the same time.Petr Spacek2015-07-071-0/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: update messageMartin Basti2015-07-071-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: allow to disable/replace DNSSEC key masterMartin Basti2015-07-071-0/+12
| | | | | | | | | | | | | | | This commit allows to replace or disable DNSSEC key master Replacing DNSSEC master requires to copy kasp.db file manually by user ipa-dns-install: --disable-dnssec-master DNSSEC master will be disabled --dnssec-master --kasp-db=FILE This configure new DNSSEC master server, kasp.db from old server is required for sucessful replacement --force Skip checks https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* webui: add mangedby tab to otptokenPetr Vobornik2015-07-071-0/+6
| | | | | | | | Added managedby_user tab to manage users who can manage the token. https://fedorahosted.org/freeipa/ticket/5003 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: API browserPetr Vobornik2015-07-037-1/+1016
| | | | | | | | | First part of API browser - displaying metadata in more consumable way. https://fedorahosted.org/freeipa/ticket/3129 Reviewed-By: Martin Kosek <mkosek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* webui: menu and navigation fixesPetr Vobornik2015-07-033-5/+32
| | | | | | | | | | | | | | | | | | | fixes: 1. When navigation is initiated from clicking and a link with hash, update of facet state causes that subsequent click on a link with hash will be ignored. Caused by a code which prevents infinite loop because of facet state update. Now hash update is done only if it was really changed. 2. registered correct handler for standalone pages 3. fix selection of menu item where the items differ only in args. Chooses the item with the most similar state to current facet. https://fedorahosted.org/freeipa/ticket/3129 Reviewed-By: Martin Kosek <mkosek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* webui: fix webui specific metadataPetr Vobornik2015-07-032-1/+3
| | | | | | | | | | | | Mark all Web UI specific metadata so they could be filtered out in the API Browser. Fix cert name. https://fedorahosted.org/freeipa/ticket/3129 Reviewed-By: Martin Kosek <mkosek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* webui: ListViewWidgetPetr Vobornik2015-07-031-0/+233
| | | | | | | | | | A widget for rendering a list of groups of items. Intended to be used in sidebar. Plan is to serve also as a base for FacetGroupsWidget. https://fedorahosted.org/freeipa/ticket/3129 Reviewed-By: Martin Kosek <mkosek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* topologysegment: hide direction and enable optionsPetr Vobornik2015-07-031-9/+2
| | | | | | | | These options should not be touched by users yet. https://fedorahosted.org/freeipa/ticket/5061 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa-replica-manage del: add timeout to segment removal checkPetr Vobornik2015-07-031-2/+10
| | | | Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa-replica-manage del: relax segment deletement check if topology is ↵Petr Vobornik2015-07-031-4/+34
| | | | | | | | disconnected https://fedorahosted.org/freeipa/ticket/5072 Reviewed-By: David Kupka <dkupka@redhat.com>
* man: Add manpage for ipa-winsync-migrateTomas Babej2015-07-022-0/+28
| | | | | | https://fedorahosted.org/freeipa/ticket/4524 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-07 20:40:30 +0000