summaryrefslogtreecommitdiffstats
path: root/ipa-client
Commit message (Collapse)AuthorAgeFilesLines
* Add nsswitch.conf to FILES section of ipa-client-install man pageMartin Kosek2013-10-291-0/+1
| | | | | | This file is always updated when client is installed or uninstalled. https://fedorahosted.org/freeipa/ticket/3995
* Do not roll back failed client installation on serverAna Krivokapic2013-10-251-0/+5
| | | | | | | | In case of a failed enrollment, IPA client rolls back any changes it has made to the system. In order to have a more debuggable setup, do not roll back these changes in the case of an IPA server install. https://fedorahosted.org/freeipa/ticket/3990
* Added warning if cert '/etc/ipa/ca.crt' existsMartin Basti2013-10-161-0/+4
| | | | https://fedorahosted.org/freeipa/ticket/3944
* ipa-client-install: Verify RPC connection with a pingPetr Viktorin2013-10-041-0/+9
| | | | | | | | | With old servers, it is possible that xmlclient.connect() succeeds but commands fail with a Kerberos error. Verify that commands succeed by sending a ping after connecting. Follow-up to: https://fedorahosted.org/freeipa/ticket/3931
* ipa-client-install: Use direct RPC instead of api.CommandPetr Viktorin2013-10-041-3/+13
| | | | | | | | | | | | To make sure the installation works with older servers, use XML-RPC directly, with a version set explicitly so the request is not rejected. RPC was chosen over ldapmodify, because going through the API allows the server to process the request properly, or even cleanly reject it if there are incompatible changes in future versions. https://fedorahosted.org/freeipa/ticket/3931
* Do not set DNS discovery domain in server modeMartin Kosek2013-10-031-1/+2
| | | | | | | In server mode, the discovery domain should be left unset in all cases as the DNS discovery is only driven by the AD domains. https://fedorahosted.org/freeipa/ticket/3947
* Use getent admin@domain for nss check in ipa-client-installTomas Babej2013-09-201-2/+2
| | | | | | | | Use 'getent admin@domain' rather than 'getent admin@REALM' to check if nss is working properly since admin@REALM check fails in case the domain and the realm name does not match. https://fedorahosted.org/freeipa/ticket/3906
* Fix invocations of FileError in ipa-client-installAna Krivokapic2013-09-091-10/+12
| | | | | | | | Some of the FileErrors in ipa-client-install were raised incorrectly (without the 'reason' argument), which resulted in bad error messages during ipa-client-install. https://fedorahosted.org/freeipa/ticket/3758
* Replace ntpdate calls with ntpdAna Krivokapic2013-09-091-14/+12
| | | | | | | Due to the upcoming deprecation of the ntpdate program (targeted for Fedora 20), replace ntpdate calls with ntpd. https://fedorahosted.org/freeipa/ticket/3797
* Remove __all__ specifications in ipaclient and ipaserver.installPetr Viktorin2013-09-061-3/+0
| | | | | | | | | | | The __all__ list does not cause submodules to be imported, e.g. one would still have to `import ipaclient.ipachangeconf` rather than just `import ipaclient` to use `ipaclient.ipachangeconf`. Even if they did do anything, the lists were incomplete, and (since `import *` is not used on these modules) unnecessary. Pylint 1.0 reports undeclared names in __all__ as a warning.
* Add option to ipa-client-install to configure automountAna Krivokapic2013-09-052-1/+32
| | | | | | | Add the --automount-location option to ipa-client-install. If the option is used, ipa-client-automount is called at the end of ipa-client-install. https://fedorahosted.org/freeipa/ticket/3740
* Prevent *.pyo and *.pyc multilib problemsMartin Kosek2013-08-131-0/+1
| | | | | | | | | | | | | Differences in the python byte code fails in a build validation (rpmdiff) done on difference architecture of the same package. This patch: 1) Ensures that timestamps of generated *.pyo and *.pyc files match 2) Python integer literals greater or equal 2^32 and lower than 2^64 are converted to long right away to prevent different type of the integer on architectures with different size of int https://fedorahosted.org/freeipa/ticket/3858
* Improve help entry for ipa hostTomas Babej2013-08-061-0/+25
| | | | | | | | Updates old information produced by the ipa help host command. Also adds a section to ipa-client-install manpage about client re-enrollment. https://fedorahosted.org/freeipa/ticket/3820
* Change shebang to absolute path in ipa-client-automountTomas Babej2013-07-251-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/3811
* Use admin@REALM when testing if SSSD is readyAna Krivokapic2013-07-192-5/+8
| | | | https://fedorahosted.org/freeipa/ticket/3771
* ipa-client: Use "ipa" as the package name for i18nPetr Viktorin2013-07-191-2/+2
| | | | | | | IPA uses "ipa" as the "package name" for all translations, even in the ipa-client package. https://fedorahosted.org/freeipa/ticket/3695
* Add 'ipa_server_mode' option to SSSD configurationAna Krivokapic2013-07-181-0/+2
| | | | https://fedorahosted.org/freeipa/ticket/3652
* Fix client install exception if /etc/ssh is missingNathaniel McCallum2013-07-091-0/+3
| | | | https://fedorahosted.org/freeipa/ticket/3766
* Do not skip SSSD known hosts in ipa-client-install --ssh-trust-dns.Jan Cholasta2013-06-271-3/+3
| | | | https://fedorahosted.org/freeipa/ticket/3705
* Remove entitlement supportMartin Kosek2013-06-261-1/+0
| | | | | | | Entitlements code was not tested nor supported upstream since version 3.0. Remove the associated code. https://fedorahosted.org/freeipa/ticket/3739
* Improve handling of options in ipa-client-installAna Krivokapic2013-06-201-0/+9
| | | | | | | | | | | Improve handling of command line options related to forced client re-enrollment in ipa-client-install: * Make --keytab and --principal options mutually exclusive. * Warn that using --force-join together with --keytab provides no additional functionality. https://fedorahosted.org/freeipa/ticket/3686
* ipa-client-install: Add 'debug' and 'show' statements to nsupdate commandsPetr Spacek2013-05-221-2/+9
| | | | https://fedorahosted.org/freeipa/ticket/3629
* Drop uniqueMember mapping with nss-pam-ldapd.Rob Crittenden2013-05-021-1/+0
| | | | | | | | | | nss-pam-ldapd in 0.8.4 changed the default to map uniqueMember to member so it is no longer needed in the config file, and in fact causes an error to be raised. Add a Conflicts on older versions. https://fedorahosted.org/freeipa/ticket/3589
* Add support for OpenSSH 6.2.Jan Cholasta2013-04-301-21/+42
| | | | | | | Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
* Preserve already configured options in openldap confTomas Babej2013-04-302-11/+65
| | | | | | | | | | | | | We should respect already configured options present in /etc/openldap/ldap.conf when generating our own configuration. With this patch, we only rewrite URI, BASE and TLS_CACERT options only if they are not configured. In the case they are, our suggested configuration is inserted as a comment. Also adds tab as a delimeter character in /etc/openldap/ldap.conf https://fedorahosted.org/freeipa/ticket/3582
* Avoid removing sss from nssswitch.conf during client uninstallTomas Babej2013-04-231-5/+7
| | | | | | | | | This patch makes sure that sss is not removed from nsswitch.conf which causes probles with later uses of sssd. Makes sure that authconfig with --disablesssd option is not executed during ipa client uninstall. https://fedorahosted.org/freeipa/ticket/3577
* Add hint message about --force-join option when enrollment failsTomas Babej2013-04-231-0/+4
| | | | | | | | When client enrollment fails due to the fact that host entry already exists on the server, display an message informing the user about the possibility of using --force-join option. https://fedorahosted.org/freeipa/ticket/3572
* Handle missing /etc/ipa in ipa-client-installAna Krivokapic2013-04-191-0/+9
| | | | | | | | Make sure /etc/ipa is created and owned by freeipa-python package. Report correct error to user if /etc/ipa is missing during client installation. https://fedorahosted.org/freeipa/ticket/3551
* Remove obsolete self-sign references from man pages, docstrings, commentsPetr Viktorin2013-04-151-1/+1
| | | | Part of the work for https://fedorahosted.org/freeipa/ticket/3494
* Remove CA cert on client uninstallAna Krivokapic2013-04-041-0/+9
| | | | | | | | The CA cert (/etc/ipa/ca.crt) was not being removed on client uninstall, causing failure on subsequent client installation in some cases. https://fedorahosted.org/freeipa/ticket/3537
* ipa-client-install: Do not request host certificate if server is CA-lessPetr Viktorin2013-04-021-10/+37
| | | | https://fedorahosted.org/freeipa/ticket/3536
* Remove build warningsMartin Kosek2013-03-291-1/+1
| | | | | | Fix rpm build warnings report in Fedora 19 build. https://fedorahosted.org/freeipa/ticket/3500
* Allow host re-enrollment using delegationTomas Babej2013-03-252-1/+9
| | | | | | | | | | A new option --force-join has been added to ipa-client-install. It forces the host enrollment even if the host entry exists. Old certificate is revoked, new certificate and ssh key pair generated. See the relevant design for the re-enrollment part: http://freeipa.org/page/V3/Forced_client_re-enrollment https://fedorahosted.org/freeipa/ticket/3482
* Improve client install LDAP cert retrieval fallbackMartin Kosek2013-03-211-1/+1
| | | | | | | | CA certificate retrieval function did not fallback from LDAP to HTTP based retrieval in case of an LDAP error, when for example GSSAPI authentication failed. https://fedorahosted.org/freeipa/ticket/3512
* Use temporary CCACHE in ipa-client-installMartin Kosek2013-03-211-0/+7
| | | | | | | | ipa-client-install failed if user had set his own KRB5CCNAME in his environment. Use a temporary CCACHE for the installer to avoid these kind of errors. https://fedorahosted.org/freeipa/ticket/3512
* ipa-client discovery with anonymous access offMartin Kosek2013-03-201-5/+1
| | | | | | | | | | | | | When RootDSE could be read (nsslapd-allow-anonymous-access set to "rootdse"), autodiscovery module failed to report success to the client installer. Remove faulty "verified_servers" flag from autodiscovery module as it has no point since we consider both scenarios (IPA server with anonymous access on and unknown LDAP server with anonymous access off) as success. https://fedorahosted.org/freeipa/ticket/3519
* Avoid multiple client discovery with fixed server listMartin Kosek2013-03-141-0/+11
| | | | | | | | | | | | In client discovery module, we used to run up to three discovery processes even though we received a fixed list of servers to connect to. This could result in up to 3 identical "not an IPA server" error messages when the passed server is not an IPA server. Error out immediately when we are discovering against a fixed set of servers. Related to fixes in https://fedorahosted.org/freeipa/ticket/3418
* Preserve order of servers in ipa-client-installMartin Kosek2013-03-141-9/+12
| | | | | | | | | | | | When multiple servers are passed via --server option, ipadiscovery module changed its order. Make sure that we preserve it. Also make sure that user is always warned when a tested server is not available as then the server will be excluded from the fixed server list. Log messages were made more informative so that user knows which server is actually failing to be verified. https://fedorahosted.org/freeipa/ticket/3418
* Make sure uninstall script prompts for reboot as lastTomas Babej2013-03-131-19/+35
| | | | | | | | | | | Parts of client uninstall logic could be skipped in attended uninstallation if user agreed to reboot the machine. Particulary, the uninstall script would not try to remove /etc/ipa/default.conf and therefore subsequent installation would fail, client being detected as already configured. https://fedorahosted.org/freeipa/ticket/3462 https://fedorahosted.org/freeipa/ticket/3463
* Don't download the schema in ipadiscoveryPetr Viktorin2013-03-131-1/+3
|
* Remove unneeded python-ldap importsPetr Viktorin2013-03-131-2/+0
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Use IPAdmin rather than raw python-ldap in migration.py and ipadiscovery.pyPetr Viktorin2013-03-131-42/+49
| | | | | | | | | | | | | These used ipautil.get_ipa_basedn. Convert that to use the new wrappers. Beef up the error handling in ipaldap to accomodate the errors we catch in the server discovery. Add a DatabaseTimeout exception to errors.py. These were the last uses of ipautil.convert_ldap_error, remove that. https://fedorahosted.org/freeipa/ticket/3487 https://fedorahosted.org/freeipa/ticket/3446
* Use IPAdmin rather than raw python-ldap in ipa-client-installPetr Viktorin2013-03-131-37/+31
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3487
* Add support for re-enrolling hosts using keytabTomas Babej2013-03-124-10/+50
| | | | | | | | | | | | | | | | | | A host that has been recreated and does not have its host entry disabled or removed, can be re-enrolled using a previously backed up keytab file. A new option --keytab has been added to ipa-client-install. This can be used to specify path to the keytab and can be used instead of -p or -w options. A new option -f has been added to ipa-join. It forces client to join even if the host entry already exits. A new certificate, ssh keys are generated, ipaUniqueID stays the same. Design page: http://freeipa.org/page/V3/Client_install_using_keytab https://fedorahosted.org/freeipa/ticket/3374
* Use default.conf as flag of IPA client being installedTomas Babej2013-02-221-3/+18
| | | | | | | | | | | | | | When installing / uninstalling IPA client, the checks that determine whether IPA client is installed now take the existence of /etc/ipa/default.conf into consideration. The client will not uninstall unless either something is backed up or /etc/ipa/default.conf file does exist. The client will not install if something is backed up or default.conf file does exist (unless it's installation on master). https://fedorahosted.org/freeipa/ticket/3331
* Add autodiscovery section in ipa-client-install man pagesMartin Kosek2013-02-191-6/+28
| | | | | | | Explain how autodiscovery and failover works and which options are important for these elements. https://fedorahosted.org/freeipa/ticket/3383
* Add LDAP server fallback to client installerRob Crittenden2013-02-073-60/+100
| | | | | | | | | | | | | | Change the discovery code to validate all servers, regardless of where the originated (either via SRV records or --server). This will prevent the client installer from failing if one of those records points to a server that is either not running or is not an IPA server. If a server is not available it is not removed from the list of configured servers, simply moved to the end of the list. If a server is not an IPA server it is removed. https://fedorahosted.org/freeipa/ticket/3388
* Add support for RFC 6594 SSHFP DNS records.Jan Cholasta2013-02-011-0/+3
| | | | https://fedorahosted.org/freeipa/ticket/2642
* Pylint cleanup.Jan Cholasta2013-01-291-1/+0
| | | | | | | Add more dynamic attribute info to IPATypeChecker in make-lint. Remove unnecessary pylint comments. Fix false positivies introduced by Pylint 0.26. https://fedorahosted.org/freeipa/ticket/3379
* Don't initialize NSS if we don't have to, clean up unused cert refsRob Crittenden2013-01-231-0/+10
| | | | | | | | | | | Check to see if NSS is initialized before trying to do so again. If we are temporarily creating a certificate be sure to delete it in order to remove references to it and avoid NSS shutdown issues. In the certificate load validator shut down NSS if we end up initializing it. I'm not entirely sure why but this prevents a later shutdown issue if we are passed the --ca-cert-file option.
generated by cgit (git 2.34.1) at 2024-11-13 00:45:55 +0000