| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
| |
During ipa-client-install SSSD is not always started up properly for some
reason, things like "getent passwd admin" do not work. This is particulary
true for large setups where admin is included in a large set of groups.
https://fedorahosted.org/freeipa/ticket/1774
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1937
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When running ipa-client-install on a system whose clock is not in sync
with the master, kinit fails and enrollment is aborted. Manual checking
of current time at the master and adjusting on the client-to-be is then
needed.
The patch tries to fetch SRV records for NTP servers of the domain we aim
to join and runs ntpdate to get time synchronized. If no SRV records are
found, sync with IPA server itself. If that fails, warn that time might
be not in sync with KDC.
https://fedorahosted.org/freeipa/ticket/1773
|
|
|
|
|
|
|
|
|
| |
When getpass.getpass() function is interrupted via CTRL+D, EOFError
exception is thrown. Most of the install tools are not prepared for
this event and crash with this exception. Make sure that it is
handled properly and nice error message is printed.
https://fedorahosted.org/freeipa/ticket/1916
|
| |
|
|
|
|
|
|
|
|
|
| |
When setting up the client-side NTP configuration, make sure that /etc/ntp/step-tickers
point to IPA NTP server as well.
When restoring the client during ipa-client-install --uninstall, make sure NTP configuration
is fully restored and NTP service is disabled if it was disabled before the installation.
https://fedorahosted.org/freeipa/ticket/1770
|
|
|
|
|
|
|
|
|
| |
use in URLs.
If the host part is a literal IPv6 address, it must be enclosed in square
brackets (RFC 2732).
ticket 1869
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1775
|
|
|
|
|
|
|
|
|
| |
When LDAP server contains more that one suffixes, the ipa client
installation does not detect it as IPA server and fails to install.
Fix ipa server discovery so that it correctly searches all naming
contexts for the IPA one.
https://fedorahosted.org/freeipa/ticket/1868
|
|
|
|
| |
Fixes: https://fedorahosted.org/freeipa/ticket/1881
|
|
|
|
|
|
| |
If /tmp happens to be empty os.removedirs() happily removes it...
https://fedorahosted.org/freeipa/ticket/1843
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1801
|
|
|
|
| |
ticket 1804
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1605
|
|
|
|
|
|
|
|
| |
Fix permissions for (configuration) files produced by
ipa-server-install or ipa-client-install. This patch is needed
when root has a umask preventing files from being world readable.
https://fedorahosted.org/freeipa/ticket/1644
|
|
|
|
|
|
| |
Make it clear in man pages that ipa-join -u does not remove keytab.
https://fedorahosted.org/freeipa/ticket/1317
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
There are too many options in ipa-*-install scripts which makes it
difficult to read. This patch adds subsections to install script
online help and man pages to improve readability. No option has
been changed.
To further improve man pages:
1) All man pages were changed to have the same header and top-center
title to provide united look.
2) Few typos in man pages have been fixed
https://fedorahosted.org/freeipa/ticket/1687
|
|
|
|
|
|
|
|
|
|
|
|
| |
If the client installer fails for some reason and --force was not used
then roll back the configuration.
This is needed because we touch /etc/sysconfig/network early in the
configuration and if it fails due to any number of issues (mostly related
to authentication) it will not be reset. We may as well run through the
entire uninstall process to be sure the system has been reset.
https://fedorahosted.org/freeipa/ticket/1704
|
|
|
|
|
|
|
|
|
| |
Do not forget to add new line in updated /etc/sysconfig/network
configuration. Move the actual change of the hostname after the
user confirmation about proceeding with installation. It confused
users when the hostname change occurred before this prompt.
https://fedorahosted.org/freeipa/ticket/1724
|
|
|
|
|
|
| |
This prevents broken DNS from causing enrollment problems.
https://fedorahosted.org/freeipa/ticket/1693
|
|
|
|
| |
ticket 1580
|
|
|
|
|
|
|
|
| |
Enable GSSAPI credentials delegation in xmlrpc-c/curl to fix client
enrollment. The unconditional GSSAPI was previously dropped from
curl because of CVE-2011-2192.
https://fedorahosted.org/freeipa/ticket/1452
|
|
|
|
|
|
|
|
|
|
| |
As network configuration file is created as temporary file, it has stricter permissions than
we need for the target system configuration file. Ensure permissions are properly reset before
installing file.
If permissions are not re-set, system may have no networking enabled after reboot.
https://fedorahosted.org/freeipa/ticket/1606
|
|
|
|
| |
Ticket https://fedorahosted.org/freeipa/ticket/1369
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1368
|
|
|
|
| |
ticket 1375
|
|
|
|
|
|
|
|
|
|
|
| |
* Check remote LDAP server to see if it is a V2 server
* Replace numeric return values with alphanumeric constants
* Display the error message from the ipa-enrollment extended op
* Remove generic join failed error message when XML-RPC fails
* Don't display Certificate subject base when enrollment fails
* Return proper error message when LDAP bind fails
https://fedorahosted.org/freeipa/ticket/1417
|
|
|
|
|
|
|
|
|
| |
Fixes https://fedorahosted.org/freeipa/ticket/1476
SSSD will need TLS for checking if ipaMigrationEnabled attribute is set
Note that SSSD will force StartTLS because the channel is later used for
authentication as well if password migration is enabled. Thus set the option
unconditionally.
|
|
|
|
| |
ticket https://fedorahosted.org/freeipa/ticket/1449
|
|
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1373
When SSSD is in use, we actually trying to disable NSCD daemon. Telling
that we failed to configure automatic _startup_ of the NSCD is wrong then.
|
|
|
|
| |
ticket 1359
|
|
|
|
| |
ticket 1358
|
|
|
|
|
|
|
|
| |
Otherwise it is possible for sssd to pick a different master to
communicate with via the DNS SRV records and if the remote master
goes down the local one will have problems as well.
ticket https://fedorahosted.org/freeipa/ticket/1187
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Client installation with --no-sssd option was broken if the client
was based on a nss-pam-ldap instead of nss_ldap. The main issue is
with authconfig rewriting the nslcd.conf after it has been
configured by ipa-client-install.
This has been fixed by changing an order of installation steps.
Additionally, nslcd daemon needed for nss-pam-ldap function is
correctly started.
https://fedorahosted.org/freeipa/ticket/1235
|
|
|
|
|
|
|
|
|
|
|
| |
Even with --no-sssd authconfig was setting nsswitch.conf to use sssd
for users, groups, shadow and netgroups. We need to pass in the
--enableforcelegacy option hwen configuring nss_ldap.
Also always back up and restore sssd.conf. It still gets configured for
kerberos.
ticket 1142
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When ipa-client-install autodiscovers IPA server values it
doesn't fill the fixed KDC address to Kerberos configuration
file. However, when realm != domain or the autodiscovered values
are overridden, installation may fail because it cannot find the
KDC.
This patch adds a failover to use static KDC address in case when
such an issue occurs.
https://fedorahosted.org/freeipa/ticket/1100
|
|
|
|
|
|
|
|
| |
Remove redundant ipa-client-install error message when optional nscd
daemon was not installed. Additionally, use standard IPA functions
for service manipulation and improve logging.
https://fedorahosted.org/freeipa/ticket/1207
|
|
|
|
|
|
|
|
| |
IPA tools options are not consistent with information in man
pages.
https://fedorahosted.org/freeipa/ticket/1163
https://fedorahosted.org/freeipa/ticket/1178
|
|
|
|
| |
tickets 1166, 1167, 1168, 1169
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This option does not behave properly in F15 as chkconfig does not list services
moved to use systemd service files.
Plus there are more direct ways than parsing its output, which are more
reliable.
Also just testing for the availability of the service calling 'chkconfig name'
is enough.
https://fedorahosted.org/freeipa/ticket/1206
|
|
|
|
|
|
|
|
|
| |
ipa-rmkeytab returns success even when the realm passed to the
program is not found in a keytab. This patch adds an explanatory
error message and returns error code 5 - Principal or realm not
found.
https://fedorahosted.org/freeipa/ticket/694
|
|
|
|
|
|
|
| |
When IPA server is being uninstalled, IPA client on-master
uninstallation which is called by the script fails.
https://fedorahosted.org/freeipa/ticket/1197
|
|
|
|
|
|
|
|
|
|
|
|
| |
The --force option may be misused to reinstall an existing IPA
client. This is not supported and may lead to unexpected errors.
When required, the cleanest way to re-install IPA client is to
run uninstall and then install again.
This patch also includes few cosmetic changes in messages to user
to provide more consistent user experience with the script.
https://fedorahosted.org/freeipa/ticket/1117
|
|
|
|
|
|
|
|
| |
This patch prevents uninstalling IPA client when it is configured
as a part of IPA server. ipa-server-installation script is advised
for this situation.
https://fedorahosted.org/freeipa/ticket/1049
|
|
|
|
|
|
|
|
| |
This patch adds logging of temporary files (Kerberos configuration,
nsupdate commands) that may be very useful for debugging purposes.
https://fedorahosted.org/freeipa/ticket/1093
https://fedorahosted.org/freeipa/ticket/1094
|
| |
|
|
|
|
|
|
|
|
| |
This option is only used when configuring an IPA client on an IPA server.
Describing it on the command-line will only confuse people so don't
list it as an option.
Ticket 1050
|
|
|
|
| |
ticket 1135
|
|
|
|
| |
ticket 1080
|
|
|
|
|
|
|
|
|
| |
When not on master we weren't passing in the user-supplied domain and
server. Because of changes made that require TLS on the LDAP calls
we always need the server name early in the process to retrieve the IPA
CA certificate.
ticket 1090
|