summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
* Use fully qualified CCACHE namesMartin Kosek2013-02-013-3/+3
| | | | | | | | | | | | | | Some parts of install scripts used only ccache name as returned by krbV.CCache.name attribute. However, when this name is used again to initialize krbV.CCache object or when it is used in KRB5CCNAME environmental variable, it fails for new DIR type of CCACHE. We should always use both CCACHE type and name when referring to them to avoid these crashes. ldap2 backend was also updated to accept directly krbV.CCache object which contains everything we need to authenticate with ccache. https://fedorahosted.org/freeipa/ticket/3381
* Remove unused krbV importsMartin Kosek2013-02-013-3/+0
| | | | https://fedorahosted.org/freeipa/ticket/3381
* Fix a typo in ipa-adtrust-install helpTomas Babej2013-01-311-1/+1
| | | | | "Add SIDs for existing users andgroups as the final step" changed to "Add SIDs for existing users and groups as the final step".
* Use new certmonger locking to prevent NSS database corruption.Rob Crittenden2013-01-296-75/+140
| | | | | | | | | | | | | | | | | | | | | | | | dogtag opens its NSS database in read/write mode so we need to be very careful during renewal that we don't also open it up read/write. We basically need to serialize access to the database. certmonger does the majority of this work via internal locking from the point where it generates a new key/submits a rewewal through the pre_save and releases the lock after the post_save command. This lock is held per NSS database so we're save from certmonger. dogtag needs to be shutdown in the pre_save state so certmonger can safely add the certificate and we can manipulate trust in the post_save command. Fix a number of bugs in renewal. The CA wasn't actually being restarted at all due to a naming change upstream. In python we need to reference services using python-ish names but the service is pki-cad. We need a translation for non-Fedora systems as well. Update the CA ou=People entry when he CA subsystem certificate is renewed. This certificate is used as an identity certificate to bind to the DS instance. https://fedorahosted.org/freeipa/ticket/3292 https://fedorahosted.org/freeipa/ticket/3322
* Add the CA cert to LDAP after the CA installPetr Viktorin2013-01-291-0/+3
| | | | | | | | | | | | | The DS is installed before the CA cert is generated. Trying to add the cert to LDAP before it exists resulted in a nasty-looking error message. This moves the cert upload to after the CA cert is ready and the certdb is created. Move the cert upload to after thecertdb is generated. https://fedorahosted.org/freeipa/ticket/3375
* Update anonymous access ACI to protect secret attributes.Rob Crittenden2013-01-231-1/+1
| | | | | | | Update anonymous access ACI so that no users besides Trust Admins users can read AD Trust key attributes (ipaNTTrustAuthOutgoing, ipaNTTrustAuthIncoming). The change is applied both for updated IPA servers and new installations.
* Upload CA cert in the directory on installSimo Sorce2013-01-232-1/+9
| | | | | This will later allow clients to securely download the CA cert by performaing mutual auth using LDAP with GSSAPI
* Change tests to use AMD loaderPetr Vobornik2013-01-1825-149/+243
| | | | | | Test were modified accordingly to AMD changes. https://fedorahosted.org/freeipa/ticket/112
* Updated makefiles to build FreeIPA Web UI layerPetr Vobornik2013-01-187-41/+90
| | | | | | | | | Updated makefiles to comply to new directory structure and also to use builder for building Web UI. FreeIPA package spec is modified to use the output of the builder. https://fedorahosted.org/freeipa/ticket/112
* Change Web UI sources to simple AMD modulesPetr Vobornik2013-01-1838-187/+351
| | | | | | | Web UI sources were wrapped by AMD definition. Listed dependencies were changed accordingly. https://fedorahosted.org/freeipa/ticket/112
* AMD config filePetr Vobornik2013-01-182-45/+52
| | | | | | | Added configuration file for DOJO loader. Removal of JS links from index.html of files which were changed to AMD modules. https://fedorahosted.org/freeipa/ticket/112
* Update JavaScript Lint configuration filePetr Vobornik2013-01-184-39/+13
| | | | | | Update is needed because various files were moved to different directories. https://fedorahosted.org/freeipa/ticket/112
* Move of core Web UI files to AMD directoryPetr Vobornik2013-01-1835-0/+0
| | | | | | SSIA https://fedorahosted.org/freeipa/ticket/112
* Move of Web UI non AMD dep. libs to libs subdirectoryPetr Vobornik2013-01-1811-8/+6
| | | | | | | Third party JS libraries which are not AMD modules were moved to src/libs/ directory. Links in html files were changed accordingly. https://fedorahosted.org/freeipa/ticket/112
* Web UI Sync development utilityPetr Vobornik2013-01-181-0/+348
| | | | | | | Add util/sync.sh utility. It serves for copying source codes or compiled code of Web UI to testing servers. Useful for development. https://fedorahosted.org/freeipa/ticket/112
* Web UI development environment directory structure and configurationPetr Vobornik2013-01-184-0/+145
| | | | | | | | | | | | | | | | Added symbolic links which points to directories which should contain files of Web UI layers. By changing those links we can switch between debugging (using source codes) or testing (compiled version). util/change-profile.sh utility serves for changing symbolic links in js/ dir and therefore for switching between debugging and testing. Default configuration for development is: * freeipa source files * libs as in git * compiled Dojo layer https://fedorahosted.org/freeipa/ticket/112
* Minimal Dojo layerPetr Vobornik2013-01-184-0/+139
| | | | | | | | | | | Added configuration files for building Dojo library and built library itself. This configuration contains only modules currently needed. make-dojo.sh script should be used for rebuilding the library when additional modules or an update are needed. https://fedorahosted.org/freeipa/ticket/112
* Config files for builder of FreeIPA UI layerPetr Vobornik2013-01-184-0/+164
| | | | | | | | * Added package configuration and build profile of FreeIPA UI layer for Dojo Builder. * Added script (util/make-ui.sh) which builds the layer https://fedorahosted.org/freeipa/ticket/112
* Dojo BuilderPetr Vobornik2013-01-1812-0/+1046
| | | | | | | | | | | | | | | Added support for Dojo builder. * Includes built builder and patches required to build the builder. * _base/configRhino.js is required by the builder to run under rhino. * added utility scripts for running the builder * build.sh * clean.sh * compile.sh * make-builder.sh * prepare-dojo.sh https://fedorahosted.org/freeipa/ticket/112
* Use Uglify.js for JS optimizationPetr Vobornik2013-01-188-0/+4931
| | | | | | | Uglify.js library was included in ui/util folder. A wrapper script util/uglifyjs/uglify was created to run Uglify.js in Rhino enviroment. https://fedorahosted.org/freeipa/ticket/112
* Enable mod_deflatePetr Vobornik2013-01-171-1/+13
| | | | | | | | | | | | | | | | Enabled mod_deflate for: * text/html (HTML files) * text/plain (for future use) * text/css (CSS files) * text/xml (XML RPC) * application/javascript (JavaScript files) * application/json (JSON RPC) * application/x-font-woff (woff fonts) Added proper mime type for woff fonts. Disabled etag header because it doesn't work with mod_deflate. https://fedorahosted.org/freeipa/ticket/3326
* Add crond as a default HBAC serviceAna Krivokapic2013-01-171-0/+7
| | | | Ticket: https://fedorahosted.org/freeipa/ticket/3215
* Upgrade process should not crash on named restartMartin Kosek2013-01-151-2/+9
| | | | | | | | | | | | When either dirsrv or krb5kdc is down, named service restart in ipa-upgradeconfig will fail and cause a crash of the whole upgrade process. Rather only report a failure to restart the service and continue with the upgrade as it does not need the named service running. Do the same precaution for pki-ca service restart. https://fedorahosted.org/freeipa/ticket/3350
* Avoid CRL migration error messageMartin Kosek2013-01-111-3/+7
| | | | | | | | | | | | | | When CRL files are being migrated to a new directory, the upgrade log may contain an error message raised during MasterCRL.bin symlink migration. This is actually being caused by `chown' operation which tried to chown a symlinked file that was not migrated yet. Sort migrated files before the migration process and put symlinks at the end of the list. Also do not run chown on the symlinks as it is a redundant operation since the symlinked file will be chown'ed on its own. https://fedorahosted.org/freeipa/ticket/3336
* Focus first input element after 'Add and Add another'Petr Vobornik2013-01-072-1/+2
| | | | | | | | When using 'Add and Add Another' button in entity adder dialog the dialog lose focus when an item is successfully added. It caused by search dialog filter input. It gets focus in search facet's refresh. The refresh is happening when item is added. This patch is disabling this focus and additionally is focusing first input element to allow imidiate definion of another item
* Standardize login password reset, user reset password and host set OTP dialogsPetr Vobornik2013-01-074-53/+44
| | | | | | | | | | | | | In all dialogs: * validation notification was standardized * can be confirmed by enter User pwd dialog has fixed focus of first element. https://fedorahosted.org/freeipa/ticket/2884 https://fedorahosted.org/freeipa/ticket/3200 Standartize password reset dialog
* Confirm association dialogs by enterPetr Vobornik2013-01-071-1/+17
| | | | | | Support for confirm mixin in association dialog. https://fedorahosted.org/freeipa/ticket/3200
* Focus last dialog when some is closedPetr Vobornik2013-01-071-0/+45
| | | | | | When multiple dialogs is opened and one is closed the new top dialog doesn't recieve focus. It prevents from confirming/canceling the dialog using keyboard. This patch is fixing it. https://fedorahosted.org/freeipa/ticket/3200
* Confirm error dialog by enterPetr Vobornik2013-01-071-45/+45
| | | | | | Refactored error dialog and unauthorized dialog to support confirm mixin. https://fedorahosted.org/freeipa/ticket/3200
* Confirm adder dialog by enterPetr Vobornik2013-01-071-10/+21
| | | | | | Added confirm mixin support to entity adder dialog. https://fedorahosted.org/freeipa/ticket/3200
* Confirm mixinPetr Vobornik2013-01-071-9/+63
| | | | | | | | Base mixin class for dialogs witch confirmation/canceling capabilities. When used, dialog can be 'confirmed' by 'enter' key or canceled by 'escape' key. It doesn't accept confirmation from all elements to not override default expected behavior like creating new line in text area, executing link or selecting a value in a select element. https://fedorahosted.org/freeipa/ticket/3200
* Make confirm_dialog a base class for message_dialogPetr Vobornik2013-01-072-30/+21
| | | | https://fedorahosted.org/freeipa/ticket/3035
* Make confirm_dialog a base class for deleter dialogPetr Vobornik2013-01-076-43/+9
| | | | https://fedorahosted.org/freeipa/ticket/3035
* Make confirm_dialog a base class of revoke and restore certificate dialogsPetr Vobornik2013-01-072-109/+58
| | | | https://fedorahosted.org/freeipa/ticket/3035
* Fixed the catch of the hostname option during ipa-server-installLynn Root2012-12-111-1/+1
| | | | | | Originally ipa-server-install would still prompt for the hostname even if it's supplied in the initial installation command. Ticket: https://fedorahosted.org/freeipa/ticket/2692
* Stop and disable conflicting time&date servicesMartin Kosek2012-12-072-0/+30
| | | | | | | | | | | | | | | | | | | | Fedora 16 introduced chrony as default client time&date synchronization service: http://fedoraproject.org/wiki/Features/ChronyDefaultNTP Thus, there may be people already using chrony as their time and date synchronization service before installing IPA. However, installing IPA server or client on such machine may lead to unexpected behavior, as the IPA installer would configure ntpd and leave the machine with both ntpd and chronyd enabled. However, since the OS does not allow both chronyd and ntpd to be running concurrently and chronyd has the precedence, ntpd would not be run on that system at all. Make sure, that user is warned when trying to install IPA on such system and is given a possibility to either not to let IPA configure ntpd at all or to let the installer stop and disable chronyd. https://fedorahosted.org/freeipa/ticket/2974
* Add OCSP and CRL URIs to certificatesMartin Kosek2012-12-075-14/+70
| | | | | | | | | | | | | | | | | Modify the default IPA CA certificate profile to include CRL and OCSP extensions which will add URIs to IPA CRL&OCSP to published certificates. Both CRL and OCSP extensions have 2 URIs, one pointing directly to the IPA CA which published the certificate and one to a new CNAME ipa-ca.$DOMAIN which was introduced as a general CNAME pointing to all IPA replicas which have CA configured. The new CNAME is added either during new IPA server/replica/CA installation or during upgrade. https://fedorahosted.org/freeipa/ticket/3074 https://fedorahosted.org/freeipa/ticket/1431
* Better error message for login of users from other realmsPetr Vobornik2012-12-063-12/+43
| | | | | | | | | | | When user from other realm than FreeIPA's tries to use Web UI (login via forms-based auth or with valid trusted realm ticket), he gets an unauthorized error with X-Ipa-Rejection-Reason=denied. Web UI responds with showing login dialog with following error message: 'Sorry you are not allowed to access this service.'. Note: such users are not supported because they don't have a corresponding entry in LDAP which is needed for ACLs. https://fedorahosted.org/freeipa/ticket/3252 denied change
* Specify includedir in krb5.conf on new installsJakub Hrozek2012-12-061-0/+2
| | | | https://fedorahosted.org/freeipa/ticket/3132
* Improve ipa-replica-prepare error messageMartin Kosek2012-12-061-4/+17
| | | | | | | | | When DNS zone/record manipulation commands fails for example due to a ValidationError, ipa-replica-prepapre reports a whole traceback which is difficult to read. Make sure our error error is more readable. https://fedorahosted.org/freeipa/ticket/3283
* Only update the list of running services in the installer or ipactl.Rob Crittenden2012-12-051-2/+8
| | | | | | | | The file is only present in the case of a server installation. It should only be touched by the server installer and ipactl. https://fedorahosted.org/freeipa/ticket/3277
* Better licensing information of 3rd party codePetr Vobornik2012-12-051-0/+566
| | | | | | | README-LICENSE.txt file with licensing information of third party code used by Web UI in production or development was added. https://fedorahosted.org/freeipa/ticket/3281
* Change network configuration fileMartin Kosek2012-12-051-7/+2
| | | | | | | | | | | Fedora+systemd changed deprecated /etc/sysconfig/network which was used by IPA to store static hostname for the IPA machine. See https://bugzilla.redhat.com/show_bug.cgi?id=881785 for details. Change Fedora platform files to store the hostname to /etc/hostname instead. https://fedorahosted.org/freeipa/ticket/3279
* Editable sshkey, mac address field after upgradePetr Vobornik2012-11-292-3/+17
| | | | | | | | | | After upgrade, sshkeys of existing users and hosts or mac address are not editable because attribute level rights are not send to Web UI due to lack of ipasshuser/ieee802device object classes. 'w_if_no_aci' attribute flag was introduced to bypass this issue. It makes attribute writable when AttributeLevelRights for the attribute are not present and only when user posses rights for modifying object class attribute. The flag was set for sshkeys_field and mac address field. https://fedorahosted.org/freeipa/ticket/3260
* WebUI: Change of default value of type of new group back to POSIXPetr Vobornik2012-11-291-1/+1
| | | | | | In FreeIPA 2.2, the default for group type was 'POSIX', in 3.0 it's 'normal' (non-posix). CLI's default is 'POSIX', Web UI should use 'POSIX' as well. https://fedorahosted.org/freeipa/ticket/3270
* Make ipa-csreplica-manage work with both merged and non-merged DBsPetr Viktorin2012-11-231-21/+72
| | | | | | | | | | | | The ipa-csreplica-manage tool often assumed that the port numbers are the same on both sides of a replication agreement. This assumption doesn't hold in a cluster with both old-style hosts and ones with merged DBs. When managing agreements, determine the port with the PKI (or merged) DS on each master, and use it. Also, in CSReplicationManager, always use starttls rather than ldaps://.
* Filter suffix in replication management toolsMartin Kosek2012-11-231-1/+1
| | | | | | | | | With the new unified Dogtag10 LDAP database, PKI-CA data and the agreements themselves are now in the main LDAP instance. Replication management tools now need to properly filter replication agreements based on the suffix to avoid clashing of agreements of different types.
* Properly stop tracking certificates on uninstallPetr Viktorin2012-11-231-2/+3
| | | | | | | | | | Stopping certificate tracking was done as part of the PKI DS uninstall. Since with the merged DB, thePKI DS is not used any more, this step was skipped. Move certificate untracking to a separate step and call it separately. Also, the post-uninstall check for tracked certificates used the wrong set of Dogtag constants. Fix the issue.
* Update certmap.conf on IPA upgradesPetr Viktorin2012-11-232-2/+21
| | | | | | | | This brings /etc/dirsrv/slapd-REALM/certmap.conf under IPA control. The file is overwritten on upgrades. This ensures that the cert for the ipaca user is recognized when ipa-ca-install is run on older masters.
* Fix schema replication from old mastersPetr Viktorin2012-11-236-0/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new merged database will replicate with both the IPA and CA trees, so all DS instances (IPA and CA on the existing master, and the merged one on the replica) need to have the same schema. Dogtag does all its schema modifications online. Those are replicated normally. The basic IPA schema, however, is delivered in ldif files, which are not replicated. The files are not present on old CA DS instances. Any schema update that references objects in these files will fail. The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is replicated as a blob. If we updated the old master's CA schema dynamically during replica install, it would conflict with updates done during the installation: the one with the lower CSN would get lost. Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'. Turning it off tells Dogtag to create its schema in the clone, where the IPA modifications are taking place, so that it is not overwritten by the IPA schema on replication. The patch solves the problems by: - In __spawn_instance, turning off the pki_clone_replicate_schema flag. - Providing a script to copy the IPA schema files to the CA DS instance. The script needs to be copied to old masters and run there. - At replica CA install, checking if the schema is updated, and failing if not. The --skip-schema-check option is added to ipa-{replica,ca}-install to override the check. All pre-3.1 CA servers in a domain will have to have the script run on them to avoid schema replication errors. https://fedorahosted.org/freeipa/ticket/3213
generated by cgit (git 2.34.1) at 2024-06-21 05:47:22 +0000