summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
...
* Properly quote passwords sent to pkisilent so special characters work.Rob Crittenden2010-12-171-7/+7
| | | | | | Also check for url-encoded passwords before logging them. ticket 324
* Add krb5-pkinit-openssl as a Requires on ipa-server packageRob Crittenden2010-12-161-10/+0
| | | | ticket 599
* managed entry hostgroup netgroup support ↵Jr Aquino2010-12-131-0/+6
| | | | https://fedorahosted.org/freeipa/ticket/543
* Save exception so it can be passed along.Rob Crittenden2010-12-111-1/+1
|
* Fix Install using dogtag.Simo Sorce2010-12-103-7/+15
| | | | | | | The CA is installed before DS so we need to wait until DS is actually installed to be able to ldap_enable the CA instance. Fixes: https://fedorahosted.org/freeipa/ticket/612
* Move Selfsigned CA creation out of dsinstanceSimo Sorce2010-12-105-47/+47
| | | | | | | | This allows us to have the CA ready to serve out certs for any operation even before the dsinstance is created. The CA is independent of the dsinstance anyway. Also fixes: https://fedorahosted.org/freeipa/ticket/544
* Introduce ipa control script that reads configuration off ldapSimo Sorce2010-12-106-18/+72
| | | | | | | | | | | This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
* Split dsinstance configurationSimo Sorce2010-12-102-33/+82
| | | | | This is so that master and replica creation can perform different operations as they need slightly diffeent settings to be applied.
* Fix search filter generator in ldap2 for NOT operator.Pavel Zuna2010-12-081-0/+6
| | | | | Search filters generated from attributes with multiple values were incorrect when the NOT operator was used (ldap.MATCH_NONE).
* Add new parameter type IA5Str and use this to enforce the right charset.Rob Crittenden2010-12-071-0/+2
| | | | ticket 496
* Ensure list of attrs to retrieve is unique, optimize getting indirect membersRob Crittenden2010-12-061-3/+9
| | | | | | | | | | | This fixes search where we were asking for the member attribute 10 or more times. When retrieving indirect members make sure we always pass around the size and time limits so we don't have to look it up with every call to find_entries() ticket 557
* Do not create reverse zone by defaultJakub Hrozek2010-12-021-2/+10
| | | | | | | Prompt for creation of reverse zone, with the default for unattended installations being False. https://fedorahosted.org/freeipa/ticket/418
* Re-implement access control using an updated model.Rob Crittenden2010-12-011-1/+1
| | | | | | | | | | | | | | | | | | | The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
* Enable EntryUSN plugin by default, with global scopeSimo Sorce2010-11-302-1/+5
| | | | | | | This will allow clients to use entryusn values to track what changed in the directory regardles of replication delays. Fixes: https://fedorahosted.org/freeipa/ticket/526
* Create user private groups with a uniqueid.Rob Crittenden2010-11-301-1/+1
| | | | | | | | | | If we don't then we need to add it when a group is detached causing aci issues. I had to move where we create the UPG template until after the DS restart so the schema is available. ticket 542
* Don't use full pathnames for kerberos binaries, let PATH find them.Rob Crittenden2010-11-221-1/+1
| | | | | Kerberos binaries may be in /usr/kerberos/*bin or /usr/*bin, let PATH sort it out.
* Autotune directory server to use a greater number of filesSimo Sorce2010-11-221-4/+66
| | | | | | | | This changes the system limits for the dirsrv user as well as configuring DS to allow by default 8192 max files and 64 reserved files (for replication indexes, etc..). Fixes: https://fedorahosted.org/freeipa/ticket/464
* Save and restore on uninstall ds related config filesSimo Sorce2010-11-222-1/+14
|
* id ranges: change DNA configurationSimo Sorce2010-11-221-17/+19
| | | | | | | | | | | | | Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
* Configure KDC to use multiple workersSimo Sorce2010-11-221-0/+34
| | | | | Only if more than one CPU is available Only if supported by the installed krb5kdc
* Exclude Krb lockout attributes from replicationSimo Sorce2010-11-181-1/+8
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/440
* pkinit-replica: create certificates for replicas tooSimo Sorce2010-11-182-5/+27
| | | | | altough the kdc certificate name is not tied to the fqdn we create separate certs for each KDC so that renewal of each of them is done separately.
* anon-pkinit: add well known principalSimo Sorce2010-11-181-0/+18
| | | | | | leave it disabled for now we can change this default once we will have some restriction on what services this principal can get tickets for.
* Add support for configuring KDC certs for PKINITSimo Sorce2010-11-182-5/+129
| | | | | This patch adds support only for the selfsign case. Replica support is also still missing at this stage.
* Use Realm as certs subject base nameSimo Sorce2010-11-185-24/+34
| | | | Also use the realm name as nickname for the CA certificate
* Set CACERTDIR during install to work around openldap bugJakub Hrozek2010-11-111-1/+3
| | | | | | | | Even though ldap.conf(5) claims that LDAPTLS_CACERT takes precedence over LDAPTLS_CACERTDIR, this seems to be broken in F14. This patch works around the issue by setting both into the environment. https://fedorahosted.org/freeipa/ticket/467
* Fix NotFound exception in ipa-nis-manage.Rob Crittenden2010-11-091-1/+1
| | | | | | | | The signature of ldap2.get_entry() changed so normalize wasn't being handled properly so the basedn was always being appended causing our entry in cn=config to be not found. ticket 414
* Rename 60sudo.ldif to 60ipasudo.ldif to not overwrite the 389-ds version.Rob Crittenden2010-11-091-2/+2
| | | | | | This meant that the compat sudo schema was not available. ticket 439
* Use kerberos password policy.Rob Crittenden2010-11-011-0/+4
| | | | | | | | | | | | | | | | | | | | | | | This lets the KDC count password failures and can lock out accounts for a period of time. This only works for KDC >= 1.8. There currently is no way to unlock a locked account across a replica. MIT Kerberos 1.9 is adding support for doing so. Once that is available unlock will be added. The concept of a "global" password policy has changed. When we were managing the policy using the IPA password plugin it was smart enough to search up the tree looking for a policy. The KDC is not so smart and relies on the krbpwdpolicyreference to find the policy. For this reason every user entry requires this attribute. I've created a new global_policy entry to store the default password policy. All users point at this now. The group policy works the same and can override this setting. As a result the special "GLOBAL" name has been replaced with global_policy. This policy works like any other and is the default if a name is not provided on the command-line. ticket 51
* Populate indirect members when showing a group object.Rob Crittenden2010-10-281-0/+71
| | | | | | | | | | | | | | | This is done by creating a new attribute, memberindirect, to hold this indirect membership. The new function get_members() can return all members or just indirect or direct. We are only using it to retrieve indirect members currently. This also: * Moves all member display attributes into baseldap.py to reduce duplication * Adds netgroup nesting * Use a unique object name in hbacsvc and hbacsvcgroup ticket 296
* Allow RDN changes for users, groups, rolegroups and taskgroups.Rob Crittenden2010-10-281-0/+2
| | | | | | | | | | | | To do a change right now you have to perform a setattr like: ipa user-mod --setattr uid=newuser olduser The RDN change is performed before the rest of the mods. If the RDN change is the only change done then the EmptyModlist that update_entry() throws is ignored. ticket 323
* UUIDs: remove uuid python plugin and let DS always autogenerateSimo Sorce2010-10-284-10/+5
| | | | merge in remove uuid
* ipa-modrdn: Enable plugin to handle krbPrincipalName on renamesSimo Sorce2010-10-281-0/+5
|
* find_entries paramAdam Young2010-10-251-3/+1
| | | | | | Fixes a bug where find_entries was not passed a parameter for filter. Instead of fixing the call point, this patch adds a defaulty value for the parameter, so that they can all be passed by name.
* Add fail-safe defaults to time and size limits in ldap2 searches.Pavel Zuna2010-10-221-5/+11
|
* ipa-uuid: enable plugin in IPASimo Sorce2010-10-221-0/+5
|
* Handle cases where ntpd options are scattered on multiple linesSimo Sorce2010-10-221-29/+33
|
* Disallow RDN change and single-value bypass using setattr/addattr.Pavel Zuna2010-10-181-13/+31
| | | | | | | | | | | When setting or adding an attribute wiht setatt/addattr check to see if there is a Param for the attribute and enforce the multi-value. If there is no Param check the LDAP schema for SINGLE-VALUE. Catch RDN mods and try to return a more reasonable error message. Ticket #230 Ticket #246
* ntpdinstance: Do not replace the config files, just add needed optionsSimo Sorce2010-10-181-19/+86
|
* dsinstance: Fix ldappasswd invocation to specify the server nameSimo Sorce2010-10-181-1/+1
| | | | | Apparently on some machines if this is not done SSL validation will fail. Fixes bug #394
* Remove the directory server ldapi socket on uninstall.Rob Crittenden2010-10-151-0/+4
| | | | ticket 350
* Compare resolver IP address with DNS IP addressRob Crittenden2010-10-152-1/+4
| | | | | | | | | | | We check the resolver against the resolver and DNS against DNS but not the resolver against DNS so if something is wrong in /etc/hosts we don't catch it and nasty connection messages occur. Also fix a problem where a bogus error message was being displayed because we were trying to close an unconnected LDAP connection. ticket 327
* Avoid writing customized perl scripts in /usrSimo Sorce2010-10-141-0/+1
| | | | Keep instance specific data in /var/lib/dirsrv
* dsinstance: avoid exposing passwords when invoking ldappaswdSimo Sorce2010-10-141-13/+29
| | | | | Pass passwords to ldappasswd by using files. Replace use of mozldap's ldappaswd with openldap's one.
* Detect if DNS is already configured in IPA, or if IPA is not yet installed.Rob Crittenden2010-10-081-2/+5
| | | | | | | ipa-dns-manage could fail in very odd ways depending on the current configuration of the server. Handle things a bit better. ticket 210
* Include time duration hints when configuring services in ipa-server-install.Rob Crittenden2010-10-085-8/+26
| | | | | | | Give a better heads-up on how long the installation will take. Particularly important when configuring dogtag. ticket 139
* Quote passwords when calling pkisilentRob Crittenden2010-10-011-6/+7
| | | | ticket 243
* Use consistent, specific nickname for the IPA CA certificate.Rob Crittenden2010-10-014-12/+10
| | | | | | Also fix some imports for sha. We have a compat module for it, use it. ticket 181
* Handle an empty base_dn and no cn=ipaconfig in the ldap2 backend, fix migration.Rob Crittenden2010-09-281-3/+11
| | | | | | | | | | | | | We lacked good error messages if the user/group container you used doesn't exist. Add a --continue option so things can continue if you use a bad user/group container. This has the side-effect of letting you migrate just users or groups by using a bad container for the one you don't want. Fix a Gettext() error when displaying the migrated password message. ticket 289
* Handle search_ext() returning ldap.SUCCESSRob Crittenden2010-09-281-0/+2
| | | | | | | | | In ipa-replica-prepare a call to search_ext() was returning ldap.SUCCESS. The search actually was fine and returned data but an exception was returned and handled (though we didn't know what to do with it). This patch lets it continue along. ticket 285
generated by cgit (git 2.34.1) at 2024-05-25 00:32:40 +0000