summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Become IPA 4.0.4become-ipa-4-0-4Petr Vobornik2014-10-231-1/+1
|
* Do not check if port 8443 is available in step 2 of external CA installJan Cholasta2014-10-221-4/+5
| | | | | | | | | | The port is never available in step 2 of external CA install, as Dogtag is already running. https://fedorahosted.org/freeipa/ticket/4660 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* build: increase java stack size for all archesPetr Vobornik2014-10-221-2/+1
| | | | | | | Gradually new arches which need a bigger stack size for web ui build appear. It's safer to increase the stack size for every architecture and avoid possible future issues. Reason: build fail on armv7hl Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Default to use TLSv1.0 and TLSv1.1 on the IPA server sideAlexander Bokovoy2014-10-211-0/+4
| | | | | | | | We only will be changing the setting on the install. For modifying existing configurations please follow instructions at https://access.redhat.com/solutions/1232413 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Configure IPA OTP Last Token plugin on upgradeNathaniel McCallum2014-10-204-23/+15
| | | | Reviewed-By: Martin Kosek <mkosek@redhat.com>
* dns: fix privileges' memberof during dns installPetr Vobornik2014-10-171-0/+30
| | | | | | | | | | Permissions with member attrs pointing to privileges are created before the privileges. Run memberof plugin task to fix other ends of the relationships. https://fedorahosted.org/freeipa/ticket/4637 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Remove changetype attribute from update pluginMartin Kosek2014-10-171-1/+0
| | | | The attribute addition had no effect, but it should not be there.
* Fix typo causing certmonger is provided with wrong path to ipa-submit.David Kupka2014-10-161-3/+4
| | | | | | | | | Using strip() instead split() caused that only first character of path was specified. Also using shlex for more robust parsing. https://fedorahosted.org/freeipa/ticket/4624 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Stop dogtag when updating its configuration in ipa-upgradeconfig.David Kupka2014-10-152-21/+28
| | | | | | | | | Modifying CS.cfg when dogtag is running may (and does) result in corrupting this file. https://fedorahosted.org/freeipa/ticket/4569 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Ignore irrelevant subtrees in schema compat pluginLudwig Krispenz2014-10-141-0/+14
| | | | | | | | | | For changes in cn=changelog or o=ipaca the scheam comapat plugin doesn't need to be executed. It saves many internal searches and reduces contribution to lock contention across backens in DS. https://fedorahosted.org/freeipa/ticket/4586 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Set IPA CA for freeipa certificates.David Kupka2014-10-141-1/+5
| | | | | | | | | | In previous versions (before moving certmonger.py to DBus) it was set and some tools and modules depends on it. For example: ipa-getcert uses this to filter freeipa certificates. https://fedorahosted.org/freeipa/ticket/4618 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Check that port 8443 is available when installing PKI.David Kupka2014-10-104-0/+25
| | | | | | https://fedorahosted.org/freeipa/ticket/4564 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Support building RPMs for RHEL/CentOS 7.0Jan Cholasta2014-10-091-8/+24
| | | | | | https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add RHEL platform moduleJan Cholasta2014-10-095-1/+149
| | | | | | https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Split off generic Red Hat-like platform code from Fedora platform codeJan Cholasta2014-10-099-416/+572
| | | | | | https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix ipactl service orderingMartin Basti2014-10-091-1/+5
| | | | | | | | | Ipactl sorted service start order as string, which causes service with start order 100 starts before service with start order 30. Patch fixes ipactl to use integers for ordering. Reviewed-By: David Kupka <dkupka@redhat.com>
* Missing requires on python-dns in spec fileGabe2014-10-091-3/+3
| | | | | | | | - Updated to required python-dns version 1.11.1 https://fedorahosted.org/freeipa/ticket/4613 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix example usage in ipa man page.David Kupka2014-10-081-2/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4587 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove misleading authorization error message in cert-request with --addJan Cholasta2014-10-081-5/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4540 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* sudo integration test: Remove the local user testPetr Viktorin2014-10-031-23/+0
| | | | | | | | | SSSD does not support sudo rules for local users; these should be added in a local sudoers file. https://fedorahosted.org/freeipa/ticket/4608 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui-ci: case-insensitive record checkPetr Vobornik2014-10-021-3/+2
| | | | | | Indirect association are no longer lower cased, which caused a issue in CI. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* test_forced_client_reenrollment: Don't check for host certificatesPetr Viktorin2014-10-021-1/+1
| | | | | | | Since ticket 4449 we no longer generate host certificates by defailt. Checdk that they are not present. https://fedorahosted.org/freeipa/ticket/4601
* Sudorule RunAsUser should work with external groupsMartin Kosek2014-10-021-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4600 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-kdb: fix unit testsSumit Bose2014-09-262-1/+4
| | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* ipa-replica-prepare: Wait for the DNS entry to be resolvablePetr Viktorin2014-09-251-0/+53
| | | | | | | | | | | | | | | | | | | It takes some time after the DNS record is added until it propagates to Bind. In automated installations, it might happen that replica-install is attempted before the hostname is resolvable; in that case the connection check would fail. Wait for the name to be resolvable at the end of replica-prepare. Mention that this can be interrupted (Ctrl+C). Provide an option to skip the wait. In case DNS is not managed by IPA, this reminds the admin of the necessary configuration and checks their work, but it's possible to skip (either by interrupting it interactively, or by the option). https://fedorahosted.org/freeipa/ticket/4551 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* test_permission_plugin: Check legacy permissionsPetr Viktorin2014-09-251-4/+12
| | | | | | | | | Currently a number of v2 permissions are in $SUFFIX, which the original test did not anticipate. Properly check that legacy permissions are found. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* dnszone-remove-permission should raise errorMartin Basti2014-09-251-4/+1
| | | | | | | dnszone-remove-permission should raise NotFound error if permission was not found (regression of 21c829ff). Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Set the default attributes for RootDSETomas Babej2014-09-242-0/+10
| | | | | | | | | | | With 389 DS 1.3.3 upwards we can leverage the nsslapd-return-default-opattr attribute to enumerate the list of attributes that should be returned even if not specified explicitly. Use the behaviour to get the same attributes returned from searches on rootDSE as in 1.3.1. https://fedorahosted.org/freeipa/ticket/4288 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Include the ipa command in client-only buildJan Cholasta2014-09-232-6/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4536 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Include ipaplatform in client-only buildJan Cholasta2014-09-233-3/+9
| | | | | | https://fedorahosted.org/freeipa/ticket/4533 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Allow RPM upgrade from ipa-* packagesJan Cholasta2014-09-231-5/+16
| | | | | | https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix certmonger code causing the ca_renewal_master update plugin to failJan Cholasta2014-09-232-2/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/4547 Reviewed-By: David Kupka <dkupka@redhat.com>
* Become IPA 4.0.3Petr Viktorin2014-09-121-1/+1
|
* Allow deleting obsolete permissions; remove operational attribute permissionsPetr Viktorin2014-09-122-22/+21
| | | | | | https://fedorahosted.org/freeipa/ticket/4534 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Auto-add operational atttributes to read permissionsPetr Viktorin2014-09-124-42/+95
| | | | | | | | | | | The attributes entryusn, createtimestamp, and modifytimestamp should be readable whenever thir entry is, i.e. when we allow reading the objectclass. Automatically add them to every read permission that includes objectclass. https://fedorahosted.org/freeipa/ticket/4534 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Update referential integrity config for DS 1.3.3Petr Viktorin2014-09-122-43/+24
| | | | | | | | | | | | | | | | | | | | | | | Hisorically DS provided defaults for the referential integrity plugin in nsslapd-pluginArg*: nsslapd-pluginarg3: member nsslapd-pluginarg4: uniquemember nsslapd-pluginarg5: owner nsslapd-pluginarg6: seeAlso In 389-ds 1.3.3, the multi-valued referint-membership-attr is used instead. The old way still works, but it requires that the values are numbered consecutively, so IPA's defaults that started with 7 were not taken into account. Convert IPA defaults to use referint-membership-attr. https://fedorahosted.org/freeipa/ticket/4537 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Update SSL ciphers configured in 389-ds-baseLudwig Krispenz2014-09-124-8/+12
| | | | | | | | | | use configuration parameters to enable ciphers provided by NSS and not considered weak. This requires 389-ds version 1.3.3.2 or later https://fedorahosted.org/freeipa/ticket/4395 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Fix typo causing ipa-upgradeconfig to fail.David Kupka2014-09-111-1/+1
| | | | | | | | Replace 'post-certsave-command' by 'cert-postsave-command'. https://fedorahosted.org/freeipa/ticket/4529 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Update qrcode support for newer python-qrcodeNathaniel McCallum2014-09-112-4/+4
| | | | | | | | | This substantially reduces the FreeIPA dependencies and allows QR codes to fit in a standard terminal. https://fedorahosted.org/freeipa/ticket/4430 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Become IPA 4.0.2Petr Viktorin2014-09-051-1/+1
|
* No longer generate a machine certificate on client installsRob Crittenden2014-09-051-66/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4449 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Backup CS.cfg before modifying itJan Cholasta2014-09-052-0/+22
| | | | | | https://fedorahosted.org/freeipa/ticket/4166 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Fix: Add managed read permissions for compat tree and operational attrsPetr Viktorin2014-09-056-10/+32
| | | | | | | | | | | This is a fix for an earlier version, which was committed by mistake as: master: 418ce870bfbe13cea694a7b862cafe35c703f660 ipa-4-0: 3e2c86aeabbd2e3c54ad73a40803ef2bf5b0cb17 ipa-4-1: 9bcd88589e30d31d3f533cd42d2f816ef01b07c7 Thanks to Alexander Bokovoy for contributions https://fedorahosted.org/freeipa/ticket/4521
* webui: extract complex pkey on Add and EditPetr Vobornik2014-09-051-3/+4
| | | | | | | | | | DNS zone 'Add and Edit' failed because of new DNS name encoding. This patch makes sure that keys are extracted properly. https://fedorahosted.org/freeipa/ticket/4520 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* Allow user to force Kerberos realm during installation.David Kupka2014-09-052-21/+33
| | | | | | | | | User can set realm not matching one resolved from DNS. This is useful especially when DNS is missconfigured. https://fedorahosted.org/freeipa/ticket/4444 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make CA-less ipa-server-install option --root-ca-file optional.Jan Cholasta2014-09-056-44/+59
| | | | | | | | | | | | | The CA cert specified by --root-ca-file option must always be the CA cert of the CA which issued the server certificates in the PKCS#12 files. As the cert is not actually user selectable, use CA cert from the PKCS#12 files by default if it is present. Document --root-ca-file in ipa-server-install man page. https://fedorahosted.org/freeipa/ticket/4457 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add new NSSDatabase method get_cert for getting certs from NSS databases.Jan Cholasta2014-09-051-1/+13
| | | | | | Part of https://fedorahosted.org/freeipa/ticket/3737 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add managed read permissions for compat treePetr Viktorin2014-09-055-0/+49
| | | | | | https://fedorahosted.org/freeipa/ticket/4521 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Do not restart apache server when not necessary.David Kupka2014-09-051-1/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/4352 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Tests: DNS wildcard recordsMartin Basti2014-09-051-1/+46
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4488 Reviewed-By: Petr Spacek <pspacek@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-01 09:04:04 +0000