| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If a hostname was provided it wasn't used to configure either
certmonger or sssd. This resulted in a non-working configuration.
Additionally on un-enrollment the wrong hostname was unenrolled, it
used the value of gethostname() rather than the one that was passed
into the installer.
We have to modify the CA configuration of certmonger to make it
use the right principal when requesting certificates. The filename
is unpredicable but it will be in /var/lib/certmonger/cas.
We need to hunt for ipa_submit and add -k <principal> to it, then
undo that on uninstall. These files are created the first time
the certmonger service starts, so start and stop it before messing
with them.
ticket 1029
|
|
|
|
|
|
|
|
|
|
|
| |
stop_tracking() is robust enough to do the right thing if no certificate
exists so go ahead and always call it. If the certificate failed to
be issued for some reason the request will still in certmonger
after uninstalling. This would cause problems when trying to reinstall
the client. This will go ahead and always tell certmonger to stop
tracking it.
ticket 1028
|
| |
|
|
|
|
| |
ticket 969
|
|
|
|
| |
ticket 925
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/974
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/991
|
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/784
https://fedorahosted.org/freeipa/ticket/786
https://fedorahosted.org/freeipa/ticket/787
|
|
|
|
| |
Fixes: https://fedorahosted.org/freeipa/ticket/935
|
|
|
|
|
|
| |
Add the server we registered with as a fallback.
ticket 980
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Apparently we forgot to check OID consistency between the schema and the
extensions, and we got duplicates.
Technically the schema was done later but it is easier to change the extensions
OIDs than to change the schema of current beta2/rc1 installations.
The only side effect is that older ipa-getkeytab and ipa-join binaries will
fail. So all the admin/client tools must be upgraded at the same time as well
as all the masters (otherwise some will show/accept the new OID while others
won't).
Fixes: https://fedorahosted.org/freeipa/ticket/976
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/782
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/959
|
|
|
|
|
|
|
|
|
|
| |
When v2 IPA client is trying to join an IPA v1 server
a strange exception is printed out to the user. This patch
detects this by catching an XML-RPC error reported by ipa-join
binary called in the process which fails on unexisting IPA server
'join' method.
https://fedorahosted.org/freeipa/ticket/553
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add pointer to self to /etc/hosts to avoid chicken/egg problems when
restarting DNS.
On servers set both dns_lookup_realm and dns_lookup_kdc to false so we don't
attempt to do any resolving. Leave it to true on clients.
Set rdns to false on both server and client.
https://fedorahosted.org/freeipa/ticket/931
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/957
|
|
|
|
|
|
|
|
|
|
|
| |
If not then sssd spits out a warning message:
sssd: nscd socket was detected. As nscd caching capabilities may conflict
with SSSD, it is recommended to not run nscd in parallel with SSSD
Stop nscd before configuring sssd so we don't confuse our users.
ticket 743
|
|
|
|
| |
ticket 940
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/723
|
|
|
|
| |
Ticket 834
|
|
|
|
|
|
|
| |
We should still give some feedback when things go wrong when in
non-interactive mode.
ticket 828
|
|
|
|
| |
Fixes: https://fedorahosted.org/freeipa/ticket/783
|
|
|
|
|
|
|
|
| |
Mozldap code removed from all sources and configure source script.
Now, IPA will compile even when package mozldap-devel is not
installed on the system.
https://fedorahosted.org/freeipa/ticket/756
|
|
|
|
|
|
|
| |
This patch fixes a possible situation when krb5_kt_close()
function is called with uninitialized keytab parameter.
https://fedorahosted.org/freeipa/ticket/712
|
|
|
|
|
|
|
|
| |
This patch fixes 2 situations where a pointer to allocated error
string could be overwritten - which could have resulted in
a memory leak.
https://fedorahosted.org/freeipa/ticket/714
|
|
|
|
|
|
|
|
|
|
|
| |
krb5_get_default_realm() and asprintf() return values were ignored.
This could lead to unhandled error issues or memory access
issues.
This patch adds return value checks to all such functions.
As a consequence, one new return value has been added to man page.
https://fedorahosted.org/freeipa/ticket/720
|
|
|
|
|
|
|
|
|
|
|
|
| |
krb5_init_context return value was not checked. This could lead
to unhandled error issues.
This patch moves the Kerberos context initialization to the
branch where it is needed and handles the error value in a way
that allows program exit in a standard way deallocating all
resources.
https://fedorahosted.org/freeipa/ticket/721
|
|
|
|
|
|
|
| |
Fix "--realm" parameter processing in ipa-rmkeytab. Also make sure
that memory allocated in this process is also freed.
https://fedorahosted.org/freeipa/ticket/711
|
|
|
|
|
|
|
|
| |
In some cases recently freed memory was used/freed again. This
patch introduces more consistency between functions
join_ldap/join_krb5 when dealing with affected variables.
https://fedorahosted.org/freeipa/ticket/709
|
|
|
|
|
|
|
| |
Resolving the keytab isn't enough, this just creates a name. Try to
create a cursor into the keytab to see if it is a valid keytab.
ticket 654
|
|
|
|
|
|
|
|
|
| |
Remove the LDAP_DEPRECATED constant and do not use functions that are
marked as deprecated in recent OpenLDAP releases. Also always define
WITH_{MOZLDAP,OPENLDAP} since there are conditional header includes that
depend on that constant.
https://fedorahosted.org/freeipa/ticket/576
|
|
|
|
|
|
|
|
|
|
| |
The changes include:
* Change license blobs in source files to mention GPLv3+ not GPLv2 only
* Add GPLv3+ license text
* Package COPYING not LICENSE as the license blobs (even the old ones)
mention COPYING specifically, it is also more common, I think
https://fedorahosted.org/freeipa/ticket/239
|
| |
|
|
|
|
| |
satisfy gnu mode - run autoreconf -f to ensure that everything matches
|
|
|
|
|
|
|
| |
Fixes errors about implicit function declaration and moves duplicated
gettext code into a common module. Also silences some warnings.
Signed-off-by: Simo Sorce <ssorce@redhat.com>
|
|
|
|
|
|
| |
ldap_bind_s is marked as deprecated in new libldap releases.
Signed-off-by: Simo Sorce <ssorce@redhat.com>
|
|
|
|
|
|
|
|
|
|
|
| |
Don't use KRB5_PRIVATE.
The patch implements and uses the following krb5 functions that are
otherwise private in recent MIT Kerberos releases:
* krb5_principal2salt_norealm
* krb5_free_ktypes
Signed-off-by: Simo Sorce <ssorce@redhat.com>
|
|
|
|
|
|
|
| |
Use a little stricter compilation flags, in particular -Wall and treat
implicit function declarations as errors.
Signed-off-by: Simo Sorce <ssorce@redhat.com>
|
|
|
|
| |
ticket 405
|
|
|
|
|
|
|
| |
Instead of print and return, use sys.exit() to quit scripts with an
error message and a non zero return code.
https://fedorahosted.org/freeipa/ticket/425
|
|
|
|
|
|
|
|
| |
When installing IPA client, the install script used detected domain name
of the machine instead of that given by administrator (in case one was
given)
https://fedorahosted.org/freeipa/ticket/363
|
| |
|
|
|
|
| |
Also use the realm name as nickname for the CA certificate
|
|
|
|
|
|
|
|
| |
Uses a new subclass IPAOptionParser in scripts instead of OptionParser
from the standard python library. IPAOptionParser uses its own IPAOption
class to store options, which adds a new 'sensitive' attribute.
https://fedorahosted.org/freeipa/ticket/393
|
|
|
|
| |
ticket 315
|
|
|
|
|
|
|
|
| |
Add automatic creation of python an C file lists for potfiles
Deletes useless copy of Makefile in install/po
Remove duplicate maintainer-clean target
Add debug target that prints file lists
Unbreak update-po target, merges in patch from John
|
|
|
|
| |
ticket 229
|
|
|
|
|
|
| |
If we pass in the domain and server to ipa-client-install it doesn't do
service discovery which is what we want. We want to be sure the server
is properly configured at install time.
|
|
|
|
|
|
| |
Also move the unenroll to clients only. This isn't necessary on the master
ticket 53
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Unenrollment means that the host keytab is disabled on the server making
it possible to re-install on the client. This host principal is how we
distinguish an enrolled vs an unenrolled client machine on the server.
I added a --unroll option to ipa-join that binds using the host credentials
and disables its own keytab.
I fixed a couple of other unrelated problems in ipa-join at the same time.
I also documented all the possible return values of ipa-getkeytab and
ipa-join. There is so much overlap because ipa-join calls ipa-getkeytab
and it returns whatever value ipa-getkeytab returned on failure.
ticket 242
|