summaryrefslogtreecommitdiffstats
path: root/ipa-client
Commit message (Collapse)AuthorAgeFilesLines
* Use Realm as certs subject base nameSimo Sorce2010-11-181-2/+2
| | | | Also use the realm name as nickname for the CA certificate
* Log script options to logfileJakub Hrozek2010-11-091-5/+7
| | | | | | | | Uses a new subclass IPAOptionParser in scripts instead of OptionParser from the standard python library. IPAOptionParser uses its own IPAOption class to store options, which adds a new 'sensitive' attribute. https://fedorahosted.org/freeipa/ticket/393
* Error out when configure finds missing dependenciesRob Crittenden2010-10-261-5/+5
| | | | ticket 315
* Initial gettext support for C utilsSimo Sorce2010-10-125-145/+318
| | | | | | | | Add automatic creation of python an C file lists for potfiles Deletes useless copy of Makefile in install/po Remove duplicate maintainer-clean target Add debug target that prints file lists Unbreak update-po target, merges in patch from John
* Add missing options to ipa-getkeytab man page.Rob Crittenden2010-10-111-8/+20
| | | | ticket 229
* Don't do autodiscovery on master install.Rob Crittenden2010-09-231-2/+8
| | | | | | If we pass in the domain and server to ipa-client-install it doesn't do service discovery which is what we want. We want to be sure the server is properly configured at install time.
* Add minimal client configuration for when we eventually get to PKINITRob Crittenden2010-09-231-8/+13
| | | | | | Also move the unenroll to clients only. This isn't necessary on the master ticket 53
* Unenroll the client from the IPA server on uninstall.Rob Crittenden2010-09-205-73/+356
| | | | | | | | | | | | | | | | | Unenrollment means that the host keytab is disabled on the server making it possible to re-install on the client. This host principal is how we distinguish an enrolled vs an unenrolled client machine on the server. I added a --unroll option to ipa-join that binds using the host credentials and disables its own keytab. I fixed a couple of other unrelated problems in ipa-join at the same time. I also documented all the possible return values of ipa-getkeytab and ipa-join. There is so much overlap because ipa-join calls ipa-getkeytab and it returns whatever value ipa-getkeytab returned on failure. ticket 242
* Better distinguish between when DNS discovery works and search more domains.Rob Crittenden2010-09-202-13/+66
| | | | | | | | | | | | | | | | | | | | | | Passing domain and server on the command-line used to be considered as DNS autodiscovery worked. This was problematic if there was in fact no SRV records because krb5.conf would be configured without a specific KDC causing all Kerberos ops to fail. Now if you pass in a domain/server it still tries to see if they are discoverable and if so won't hardcode a server, but will fall back to doing so if necessary. Also be a lot more aggressive on looking for the SRV records. Use the search and domain values from /etc/resolv.conf on the chance that the SRV records aren't in the domain of the hostname of the machine. An example of this would be if your laptop is in dhcp.example.com and your company's SRV records are in corp.example.com. Searching dhcp.example.com and example.com won't find the SRV records but the user is likely to have corp.redhat.com in the search list, at least. ticket 234
* Use a more specific name for the IPA server certificate we install.Rob Crittenden2010-09-171-9/+24
| | | | | | | This should avoid conflicts with any other certs that might be installed there. ticket 49
* Remove some additional instances of krbV from ipa-clientRob Crittenden2010-09-101-5/+5
| | | | | | | | | | | Make two krbV imports conditional. These aren't used during a client install so should cause no problems. Also fix the client installer to use the new env option in ipautil.run. We weren't getting the krb5 configuration set in the environment because we were overriding the environment to set the PATH. ticket 136
* Fix certmonger errors when doing a client or server uninstall.Rob Crittenden2010-09-092-6/+15
| | | | | | | | | | | | | | | | This started with the client uninstaller returning a 1 when not installed. There was no way to tell whether the uninstall failed or the client simply wasn't installed which caused no end of grief with the installer. This led to a lot of certmonger failures too, either trying to stop tracking a non-existent cert or not handling an existing tracked certificate. I moved the certmonger code out of the installer and put it into the client/server shared ipapython lib. It now tries a lot harder and smarter to untrack a certificate. ticket 142
* Configure nslcd and a host of possible systems that use LDAP.Rob Crittenden2010-08-271-9/+53
| | | | | | | | | We will update any/all of /etc/ldap.conf, /etc/nss_ldap.conf, /etc/libnss-ldap.conf and /etc/pam_ldap.conf. nslcd is the replacement for nss_ldap. ticket 50
* ldap_initializeAdam Young2010-08-201-3/+24
| | | | the code was calling ldap_init, which is a deprecated function, and getting a compilation warning. This version uses the recommended function ldap_initilaize.
* const correctnessAdam Young2010-08-201-3/+3
| | | | made the data type for server consistant and correct across its usage
* Enable a host to retrieve a keytab for all its services.Rob Crittenden2010-08-161-15/+21
| | | | | | | | | | | | | | | | | | | | | | | | Using the host service principal one should be able to retrieve a keytab for other services for the host using ipa-getkeytab. This required a number of changes: - allow hosts in the service's managedby to write krbPrincipalKey - automatically add the host to managedby when a service is created - fix ipa-getkeytab to return the entire prinicpal and not just the first data element. It was returning "host" from the service tgt and not host/ipa.example.com - fix the display of the managedby attribute in the service plugin This led to a number of changes in the service unit tests. I took the opportunity to switch to the Declarative scheme and tripled the number of tests we were doing. This shed some light on a few bugs in the plugin: - if a service had a bad usercertificate it was impossible to delete the service. I made it a bit more flexible. - I added a summary for the mod and find commands - has_keytab wasn't being set in the find output ticket 68
* Retrieve the CA certificate before starting enrollment.Rob Crittenden2010-06-211-2/+9
| | | | | We need the CA certificate so we can use SSL when binding with a one-time password (bulk enrollment)
* Drop --with-openldap option in the client. This is no longer optional.Rob Crittenden2010-06-211-38/+30
|
* Remove Requires on separate package python-krbV in clientRob Crittenden2010-06-021-3/+7
| | | | | | We need the configured kerberos realm so we can clean up /etc/krb5.keytab. We have this already in /etc/ipa/default.conf so use that instead of requiring a whole other python package to do it.
* Check to see if we are configured before uninstalling.Rob Crittenden2010-05-071-1/+5
| | | | Allow the --force flag to override on both install and uninstall
* Add simple test to see if client is already configuredRob Crittenden2010-05-061-0/+4
| | | | | | | | | | | | If this ever gets out of sync the user can always remove /var/lib/ipa-client/sysrestore/*, they just need to understand the implications. One potential problem is with certmonger. If you install the client and then re-install without uninstalling then the subsequent certificate request by certmonger will fail because it will already be tracking a certificate in /etc/pki/nssdb of the same nickname and subject (the old cert).
* Make calling service and chkconfig tolerant of the service not installedRob Crittenden2010-05-061-9/+59
| | | | | For example, if nscd is not installed this would throw lots of errors about not being able to disable it, stop it, etc.
* Call certmonger after krb5, avoid uninstall errors, better password handling.Rob Crittenden2010-05-062-23/+52
| | | | | | | | | - Move the ipa-getcert request to after we set up /etc/krb5.conf - Don't try removing certificates that don't exist - Don't tell certmonger to stop tracking a cert that doesn't exist - Allow --password/-w to be the kerberos password - Print an error if prompting for a password would happen in unattended mode - Still support echoing a password in when in unattended mode
* Initialize XML-RPC structures to fix issues uncovered by MALLOC_PERTURB_Rob Crittenden2010-05-061-13/+11
| | | | | | | Also re-arrange some code around reading the configuration file. In trying to eliminate bogus error messages I prevented the file from being read at all. It isn't a problem when joining with ipa-client (which uses -s) but it wouldn't work if you don't pass in a server name.
* Make the installer/uninstaller more aware of its stateRob Crittenden2010-05-031-4/+3
| | | | | | | | | | | | | | We have had a state file for quite some time that is used to return the system to its pre-install state. We can use that to determine what has been configured. This patch: - uses the state file to determine if dogtag was installed - prevents someone from trying to re-install an installed server - displays some output when uninstalling - re-arranges the ipa_kpasswd installation so the state is properly saved - removes pkiuser if it was added by the installer - fetches and installs the CA on both masters and clients
* client installation fixes: nscd, sssd min version, bogus join errorRob Crittenden2010-05-032-11/+23
| | | | | | - Don't run nscd if using sssd, the caching of nscd conflicts with sssd - Set the minimum version of sssd to 1.1.1 to pick up needed hbac fixes - only try to read the file configuration if the server isn't passed in
* Reorder some things in the client installerRob Crittenden2010-05-031-16/+27
| | | | | | - Fetch the CA cert before running certmonger - Delete entries from the keytab before removing /etc/krb5.conf - Add and remove the IPA CA to /etc/pki/nssdb
* Use the certificate subject base in IPA when requesting certs in certmonger.Rob Crittenden2010-04-232-8/+98
| | | | | | | | | | | | | | | | | When using the dogtag CA we can control what the subject of an issued certificate is regardless of what is in the CSR, we just use the CN value. The selfsign CA does not have this capability. The subject format must match the configured format or certificate requests are rejected. The default format is CN=%s,O=IPA. certmonger by default issues requests with just CN so all requests would fail if using the selfsign CA. This subject base is stored in cn=ipaconfig so we can just fetch that value in the enrollment process and pass it to certmonger to request the right thing. Note that this also fixes ipa-join to work with the new argument passing mechanism.
* Add option to enable pam_mkhomedirs in the IPA client installerrcrit2010-03-192-5/+15
|
* Add the popt auto-help/usage macro for enhanced help output.Rob Crittenden2010-03-023-3/+6
|
* Update available options and descriptions in client man pagesRob Crittenden2010-03-023-14/+50
|
* Fix command-line options convention in ipa-getkeytab man pageRob Crittenden2010-02-191-1/+1
| | | | Resolves #481230
* Fix a crash and memory leak in get_config_entry()Martin Nagy2010-02-161-1/+2
|
* Make sure the incoming data ins't NULL before strduping itRob Crittenden2010-02-101-1/+6
|
* Configure sssd and certmonger in ipa-client-installRob Crittenden2010-02-031-8/+94
| | | | | | | | | | | This does a number of things under the hood: - Use authconfig to enable sssd in nss and pam - Configure /etc/sssd/sssd.conf to use our IPA provider - Enable the certmonger process and request a server cert - join the IPA domain and retrieve a principal. The clinet machine *must* exist in IPA to be able to do a join. - And then undo all this on uninstall
* Remove some configuration files we create upon un-installationRob Crittenden2010-01-281-0/+6
| | | | | This is particularly important for Apache since we'd leave the web server handling unconfigured locations.
* Require that the hostname we are joining as is fully-qualifiedRob Crittenden2010-01-261-0/+6
|
* Remove duplicated codeRob Crittenden2010-01-261-6/+0
| | | | This strange bit of duplication was not surprisingly causing a double-free
* Stop looking when removing entries from a keytab.Rob Crittenden2010-01-201-0/+5
| | | | keytab entries are locked when looping. Temporarily suspend the looping.
* Need to supsend looping through the keytab entries when doing a delete.Rob Crittenden2009-12-181-0/+5
|
* Pass on debug option from ipa-client-install to ipa-joinRob Crittenden2009-12-091-0/+2
|
* A utility for removing principals from a keytab.Rob Crittenden2009-12-044-0/+319
| | | | | | | | | | | | When we un-enroll a client we'll do a bit of cleanup including removing any principals for the IPA realm from /etc/krb5.keytab. This removes principals in 2 ways: - By principal, only entries matching the full principal are removed - By realm. Any principal for that realm is removed This does not change the KDC at all, just removes entries from a file on the client machine.
* Better LDAP error handling in ipa-client-installRob Crittenden2009-12-011-9/+5
|
* Add server option to ipa-join so the IPA server can be specified.Rob Crittenden2009-11-302-5/+9
| | | | | | | This is needed because in the client installer we actually perform the join before creating the configuration files that join uses. All we need is the IPA server to join to and we have that from the CLI options so use that.
* Integrate ipa-join and ipa-rmkeytab into the client install/uninstallRob Crittenden2009-11-251-110/+209
| | | | This will fetch a keytab on installation and remove it upon uninstallation.
* Clean up some return valuesRob Crittenden2009-11-191-12/+20
| | | | | | | Because ipa-join calls ipa-getkeytab I'd like to keep the return values in sync. ipa-join returns the value returned by ipa-getkeytab so in order to tell what failed the return values need to mean the same things and not overlap.
* Add man page for ipa-join commandRob Crittenden2009-10-122-1/+62
|
* Improve debugging, general output, initialize xmlrpc-c properlyRob Crittenden2009-10-121-9/+34
|
* Enrollment for a host in an IPA domainRob Crittenden2009-09-246-10/+889
| | | | | | | | | | | | This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
* Clean up additional issues discovered with pylint and pycheckerRob Crittenden2009-08-201-4/+4
|
generated by cgit (git 2.34.1) at 2024-05-04 06:20:11 +0000