summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ipa-kdb: avoid ENOMEM when all SIDs are filtered outMartin Kosek2013-02-121-4/+14
| | | | | | | | | When all SIDs in info3.sids structure were filtered out, we tried to talloc_realloc to zero memory size. talloc_realloc then returned NULL pointer and filter_login_info returned with ENOMEM. The code now rather frees the SID array and set info3.sidcount to correct value.
* ipa-kdb: add sentinel for LDAPDerefSpec allocationMartin Kosek2013-02-121-5/+6
| | | | | Without sentinel in place, ldap_create_deref_control_value executed an invalid read in unallocated memory.
* Add trusconfig-show and trustconfig-mod commandsMartin Kosek2013-02-115-8/+377
| | | | | | | | | | | | Global trust configuration is generated ipa-adtrust-install script is run. Add convenience commands to show auto-generated options like SID or GUID or options chosen by user (NetBIOS). Most of these options are not modifiable via trustconfig-mod command as it would break current trusts. Unit test file covering these new commands was added. https://fedorahosted.org/freeipa/ticket/3333
* Fix permission_find test errorMartin Kosek2013-02-081-1/+0
| | | | | Remove extraneous memberindirect_role attribute from permission_find unit test to avoid false negative test result.
* Prevent a crash when no entries are successfully migrated.Rob Crittenden2013-02-081-0/+1
| | | | | | | It would fail in _update_default_group() because migrate_cnt wasn't defined in context. https://fedorahosted.org/freeipa/ticket/3386
* Prevent integer overflow when setting krbPasswordExpirationTomas Babej2013-02-085-13/+50
| | | | | | | | | | | | | | | | Since in Kerberos V5 are used 32-bit unix timestamps, setting maxlife in pwpolicy to values such as 9999 days would cause integer overflow in krbPasswordExpiration attribute. This would result into unpredictable behaviour such as users not being able to log in after password expiration if password policy was changed (#3114) or new users not being able to log in at all (#3312). The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver. https://fedorahosted.org/freeipa/ticket/3312 https://fedorahosted.org/freeipa/ticket/3114
* Raise ValidationError on invalid CSV values.Jan Cholasta2013-02-082-3/+14
| | | | https://fedorahosted.org/freeipa/ticket/3323
* Add LDAP server fallback to client installerRob Crittenden2013-02-074-61/+101
| | | | | | | | | | | | | | Change the discovery code to validate all servers, regardless of where the originated (either via SRV records or --server). This will prevent the client installer from failing if one of those records points to a server that is either not running or is not an IPA server. If a server is not available it is not removed from the list of configured servers, simply moved to the end of the list. If a server is not an IPA server it is removed. https://fedorahosted.org/freeipa/ticket/3388
* Take into consideration services when deleting replicasAna Krivokapic2013-02-061-0/+23
| | | | | | | | When deleting a replica from IPA domain: * Abort if the installation is about to be left without CA * Warn if the installation is about to be left without DNS Ticket: https://fedorahosted.org/freeipa/ticket/2879
* Don't add another nsDS5ReplicaId on updates if one already existsPetr Viktorin2013-02-061-3/+3
| | | | | | | | | | Modify update file to use default: rather than add: in cn=replication,cn=etc,$SUFFIX. Drop quotes around nsDS5ReplicaRoot because default: values are not parsed as CSV. https://fedorahosted.org/freeipa/ticket/3394
* Improve migration performanceRob Crittenden2013-02-051-8/+88
| | | | | | | | | | | | | | | | | | | Add new users to the default users group in batches of 100. The biggest overhead of migration is in calculating the modlist when managing the default user's group and applying the changes. A significant amount of time can be saved by not doing this on every add operation. Some other minor improvements include: Add a negative cache for groups not found in the remote LDAP server. Replace call to user_mod with a direct LDAP update. Catch some occurances of LimitError and handle more gracefully. I also added some debug logging to report on migration status and performance. https://fedorahosted.org/freeipa/ticket/3386
* Make ipapython.dogtag log requests at debug level, not infoPetr Viktorin2013-02-011-1/+1
|
* Port ipa-replica-prepare to the admintool frameworkPetr Viktorin2013-02-013-489/+512
| | | | | | | | | | | | | Break the script into several smaller methods. Use modern idioms: os.path.join instead of string addition; the with statement for closing files. Add --quiet, --verbose, and --log-file options. Use logging instead of print statements. (http://freeipa.org/page/V3/Logging_and_output) Part of: https://fedorahosted.org/freeipa/ticket/2652 Fixes: https://fedorahosted.org/freeipa/ticket/3285
* Better logging for AdminTool and ipa-ldap-updaterPetr Viktorin2013-02-014-58/+116
| | | | | | | | | | | | | - Automatically add a "Logging and output options" group with the --quiet, --verbose, --log-file options. - Set up logging based on these options; details are in the setup_logging docstring and in the design document. - Don't bind log methods as individual methods of the class. This means one less linter exception. - Make the help for command line options consistent with optparse's --help and --version options. Design document: http://freeipa.org/page/V3/Logging_and_output
* Add support for RFC 6594 SSHFP DNS records.Jan Cholasta2013-02-013-3/+21
| | | | https://fedorahosted.org/freeipa/ticket/2642
* Drop ipapython.compat.Jan Cholasta2013-02-016-90/+7
|
* Use fully qualified CCACHE namesMartin Kosek2013-02-015-9/+21
| | | | | | | | | | | | | | Some parts of install scripts used only ccache name as returned by krbV.CCache.name attribute. However, when this name is used again to initialize krbV.CCache object or when it is used in KRB5CCNAME environmental variable, it fails for new DIR type of CCACHE. We should always use both CCACHE type and name when referring to them to avoid these crashes. ldap2 backend was also updated to accept directly krbV.CCache object which contains everything we need to authenticate with ccache. https://fedorahosted.org/freeipa/ticket/3381
* Remove unused krbV importsMartin Kosek2013-02-014-5/+0
| | | | https://fedorahosted.org/freeipa/ticket/3381
* Fix migration for openldap DSMartin Kosek2013-02-012-3/+22
| | | | | | | | | | | | | | | | | openldap server does not store its schema in cn=schema entry, but rather in cn=subschema. Add a fallback to ldap2 plugin to read from this entry when cn=schema is not found. ldap2 plugin uses the schema when doing some of the automatic encoding, like an automatic encoding of DN object. IPA migration plugin DN attribute processing is now also more tolerant when it finds that some DN attribute was not autoencoded. It tries to convert it to DN on its own and report a warning and continue with user processing when the conversion fails instead of crashing with AssertionError and thus abandoning the whole migration run. https://fedorahosted.org/freeipa/ticket/3372
* Fix a typo in ipa-adtrust-install helpTomas Babej2013-01-311-1/+1
| | | | | "Add SIDs for existing users andgroups as the final step" changed to "Add SIDs for existing users and groups as the final step".
* Use new certmonger locking to prevent NSS database corruption.Rob Crittenden2013-01-299-100/+274
| | | | | | | | | | | | | | | | | | | | | | | | dogtag opens its NSS database in read/write mode so we need to be very careful during renewal that we don't also open it up read/write. We basically need to serialize access to the database. certmonger does the majority of this work via internal locking from the point where it generates a new key/submits a rewewal through the pre_save and releases the lock after the post_save command. This lock is held per NSS database so we're save from certmonger. dogtag needs to be shutdown in the pre_save state so certmonger can safely add the certificate and we can manipulate trust in the post_save command. Fix a number of bugs in renewal. The CA wasn't actually being restarted at all due to a naming change upstream. In python we need to reference services using python-ish names but the service is pki-cad. We need a translation for non-Fedora systems as well. Update the CA ou=People entry when he CA subsystem certificate is renewed. This certificate is used as an identity certificate to bind to the DS instance. https://fedorahosted.org/freeipa/ticket/3292 https://fedorahosted.org/freeipa/ticket/3322
* Add the CA cert to LDAP after the CA installPetr Viktorin2013-01-292-2/+4
| | | | | | | | | | | | | The DS is installed before the CA cert is generated. Trying to add the cert to LDAP before it exists resulted in a nasty-looking error message. This moves the cert upload to after the CA cert is ready and the certdb is created. Move the cert upload to after thecertdb is generated. https://fedorahosted.org/freeipa/ticket/3375
* Pylint cleanup.Jan Cholasta2013-01-2910-76/+78
| | | | | | | Add more dynamic attribute info to IPATypeChecker in make-lint. Remove unnecessary pylint comments. Fix false positivies introduced by Pylint 0.26. https://fedorahosted.org/freeipa/ticket/3379
* Make certmonger a (pre) requires on server, restart it before upgradingRob Crittenden2013-01-251-1/+7
| | | | | | | | | | | certmonger may provide new CAs, as in the case from upgrading IPA 2.2 to 3.x. We need these new CAs available during the upgrade process. The certmonger package does its own condrestart as part of %postun which runs after the %post script of freeipa-server, so we need to restart it ourselves before upgrading. https://fedorahosted.org/freeipa/ticket/3378
* Update anonymous access ACI to protect secret attributes.Rob Crittenden2013-01-233-1/+83
| | | | | | | Update anonymous access ACI so that no users besides Trust Admins users can read AD Trust key attributes (ipaNTTrustAuthOutgoing, ipaNTTrustAuthIncoming). The change is applied both for updated IPA servers and new installations.
* Don't initialize NSS if we don't have to, clean up unused cert refsRob Crittenden2013-01-232-13/+30
| | | | | | | | | | | Check to see if NSS is initialized before trying to do so again. If we are temporarily creating a certificate be sure to delete it in order to remove references to it and avoid NSS shutdown issues. In the certificate load validator shut down NSS if we end up initializing it. I'm not entirely sure why but this prevents a later shutdown issue if we are passed the --ca-cert-file option.
* Use secure method to acquire IPA CA certificateJohn Dennis2013-01-236-56/+465
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Major changes ipa-client-install: * Use GSSAPI connection to LDAP server to download CA cert (now the default method) * Add --ca-cert-file option to load the CA cert from a disk file. Validate the file. If this option is used the supplied CA cert is considered definitive. * The insecure HTTP retrieval method is still supported but it must be explicitly forced and a warning will be emitted. * Remain backward compatible with unattended case (except for aberrant condition when preexisting /etc/ipa/ca.crt differs from securely obtained CA cert, see below) * If /etc/ipa/ca.crt CA cert preexists the validate it matches the securely acquired CA cert, if not: - If --unattended and not --force abort with error - If interactive query user to accept new CA cert, if not abort In either case warn user. * If interactive and LDAP retrieval fails prompt user if they want to proceed with insecure HTTP method * If not interactive and LDAP retrieval fails abort unless --force * Backup preexisting /etc/ipa/ca.crt in FileStore prior to execution, if ipa-client-install fails it will be restored. Other changes: * Add new exception class CertificateInvalidError * Add utility convert_ldap_error() to ipalib.ipautil * Replace all hardcoded instances of /etc/ipa/ca.crt in ipa-client-install with CACERT constant (matches existing practice elsewhere). * ipadiscovery no longer retrieves CA cert via HTTP. * Handle LDAP minssf failures during discovery, treat failure to check ldap server as a warninbg in absebce of a provided CA certificate via --ca-cert-file or though existing /etc/ipa/ca.crt file. Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Rob Crittenden <rcritten@redhat.com>
* Do SSL CA verification and hostname validation.Rob Crittenden2013-01-231-2/+2
|
* Update plugin to upload CA certificate to LDAPAlexander Bokovoy2013-01-231-0/+56
| | | | | | Define post-update plugin to upload public CA certificate to IPA LDAP server. The plugin includes also update file that creates default container for the certificate.
* Upload CA cert in the directory on installSimo Sorce2013-01-233-1/+24
| | | | | This will later allow clients to securely download the CA cert by performaing mutual auth using LDAP with GSSAPI
* Fix BuildRequires: rhino replaced with java-1.7.0-openjdkPetr Vobornik2013-01-221-1/+10
| | | | | | Rhino is needed for Web UI build. Rhino needs java, but from package perspective java-1.7.0-openjdk requires rhino. So the correct BuildRequires is java-1.7.0-openjdk.
* Installer should not connect to 127.0.0.1Martin Kosek2013-01-212-3/+3
| | | | | | | | | | | | | IPA installer sometimes tries to connect to the Directory Server via loopback address 127.0.0.1. However, the Directory Server on pure IPv6 systems may not be listening on this address. This address may not even be available. Rather use the FQDN of the server when connecting to the DS to fix this issue and make the connection consistent ldapmodify calls which also use FQDN instead of IP address. https://fedorahosted.org/freeipa/ticket/3355
* Change tests to use AMD loaderPetr Vobornik2013-01-1825-149/+243
| | | | | | Test were modified accordingly to AMD changes. https://fedorahosted.org/freeipa/ticket/112
* Updated makefiles to build FreeIPA Web UI layerPetr Vobornik2013-01-189-42/+98
| | | | | | | | | Updated makefiles to comply to new directory structure and also to use builder for building Web UI. FreeIPA package spec is modified to use the output of the builder. https://fedorahosted.org/freeipa/ticket/112
* Change Web UI sources to simple AMD modulesPetr Vobornik2013-01-1838-187/+351
| | | | | | | Web UI sources were wrapped by AMD definition. Listed dependencies were changed accordingly. https://fedorahosted.org/freeipa/ticket/112
* AMD config filePetr Vobornik2013-01-182-45/+52
| | | | | | | Added configuration file for DOJO loader. Removal of JS links from index.html of files which were changed to AMD modules. https://fedorahosted.org/freeipa/ticket/112
* Update JavaScript Lint configuration filePetr Vobornik2013-01-184-39/+13
| | | | | | Update is needed because various files were moved to different directories. https://fedorahosted.org/freeipa/ticket/112
* Move of core Web UI files to AMD directoryPetr Vobornik2013-01-1835-0/+0
| | | | | | SSIA https://fedorahosted.org/freeipa/ticket/112
* Move of Web UI non AMD dep. libs to libs subdirectoryPetr Vobornik2013-01-1811-8/+6
| | | | | | | Third party JS libraries which are not AMD modules were moved to src/libs/ directory. Links in html files were changed accordingly. https://fedorahosted.org/freeipa/ticket/112
* Web UI Sync development utilityPetr Vobornik2013-01-181-0/+348
| | | | | | | Add util/sync.sh utility. It serves for copying source codes or compiled code of Web UI to testing servers. Useful for development. https://fedorahosted.org/freeipa/ticket/112
* Web UI development environment directory structure and configurationPetr Vobornik2013-01-184-0/+145
| | | | | | | | | | | | | | | | Added symbolic links which points to directories which should contain files of Web UI layers. By changing those links we can switch between debugging (using source codes) or testing (compiled version). util/change-profile.sh utility serves for changing symbolic links in js/ dir and therefore for switching between debugging and testing. Default configuration for development is: * freeipa source files * libs as in git * compiled Dojo layer https://fedorahosted.org/freeipa/ticket/112
* Minimal Dojo layerPetr Vobornik2013-01-184-0/+139
| | | | | | | | | | | Added configuration files for building Dojo library and built library itself. This configuration contains only modules currently needed. make-dojo.sh script should be used for rebuilding the library when additional modules or an update are needed. https://fedorahosted.org/freeipa/ticket/112
* Config files for builder of FreeIPA UI layerPetr Vobornik2013-01-184-0/+164
| | | | | | | | * Added package configuration and build profile of FreeIPA UI layer for Dojo Builder. * Added script (util/make-ui.sh) which builds the layer https://fedorahosted.org/freeipa/ticket/112
* Dojo BuilderPetr Vobornik2013-01-1813-0/+1049
| | | | | | | | | | | | | | | Added support for Dojo builder. * Includes built builder and patches required to build the builder. * _base/configRhino.js is required by the builder to run under rhino. * added utility scripts for running the builder * build.sh * clean.sh * compile.sh * make-builder.sh * prepare-dojo.sh https://fedorahosted.org/freeipa/ticket/112
* Use Uglify.js for JS optimizationPetr Vobornik2013-01-188-0/+4931
| | | | | | | Uglify.js library was included in ui/util folder. A wrapper script util/uglifyjs/uglify was created to run Uglify.js in Rhino enviroment. https://fedorahosted.org/freeipa/ticket/112
* Enable mod_deflatePetr Vobornik2013-01-171-1/+13
| | | | | | | | | | | | | | | | Enabled mod_deflate for: * text/html (HTML files) * text/plain (for future use) * text/css (CSS files) * text/xml (XML RPC) * application/javascript (JavaScript files) * application/json (JSON RPC) * application/x-font-woff (woff fonts) Added proper mime type for woff fonts. Disabled etag header because it doesn't work with mod_deflate. https://fedorahosted.org/freeipa/ticket/3326
* Add Ana Krivokapic to Contributors.txtRob Crittenden2013-01-171-0/+1
|
* Add crond as a default HBAC serviceAna Krivokapic2013-01-171-0/+7
| | | | Ticket: https://fedorahosted.org/freeipa/ticket/3215
* Upgrade process should not crash on named restartMartin Kosek2013-01-151-2/+9
| | | | | | | | | | | | When either dirsrv or krb5kdc is down, named service restart in ipa-upgradeconfig will fail and cause a crash of the whole upgrade process. Rather only report a failure to restart the service and continue with the upgrade as it does not need the named service running. Do the same precaution for pki-ca service restart. https://fedorahosted.org/freeipa/ticket/3350
* convert the base platform modules into packagesTimo Aaltonen2013-01-1411-178/+281
|
generated by cgit (git 2.34.1) at 2024-11-10 17:36:52 +0000