summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Add more test tasksPetr Viktorin2013-07-253-17/+42
| | | | | | | | - install_client - connect_replica - disconnect_replica - prepare_host - kinit_admin
* test_integration: Set up CA on replicas by defaultPetr Viktorin2013-07-251-6/+11
| | | | | For complex topologies the CA needs to be available on most replicas, since only servgers with a CA can prepare replica files.
* test_integration: Add log collection to HostPetr Viktorin2013-07-253-23/+36
| | | | This allows collecting logs when a test context is not available.
* Move BeakerLibProcess out of BeakerLibPluginPetr Viktorin2013-07-251-70/+107
| | | | This allows reusing the code elsewhere
* Move requirement for keyutils to freeipa-python packageTomas Babej2013-07-241-1/+4
| | | | | | | | | | There was already a dependency in server package, however, the correct place for such dependency is in freeipa-python, since the relevant code using keyutils resides there. Both freeipa-server and freeipa-client require freeipa-python. https://fedorahosted.org/freeipa/ticket/3808
* Become 3.3.0 Beta 1Martin Kosek2013-07-241-3/+3
|
* Bump minimum SSSD versionMartin Kosek2013-07-241-1/+5
| | | | Pick up latest SSSD 1.11 Beta development
* Print newline after receiving EOF in installutils.read_password.Jan Cholasta2013-07-2412-14/+15
|
* Ask for PKCS#12 password interactively in ipa-replica-prepare.Jan Cholasta2013-07-241-15/+34
| | | | https://fedorahosted.org/freeipa/ticket/3717
* Ask for PKCS#12 password interactively in ipa-server-install.Jan Cholasta2013-07-241-26/+50
| | | | https://fedorahosted.org/freeipa/ticket/3717
* Remove word 'field' from GECOS param labelPetr Vobornik2013-07-234-11/+11
| | | | No other param/field has 'field' in a label.
* Break long words in notification areaPetr Vobornik2013-07-231-0/+1
| | | | Long words (ie. service principal) breaks out of notification area. It doesn't look good. Patch adds word-wrap to break them to multiple pieces.
* IPA KDB MS-PAC: remove unused variableJakub Hrozek2013-07-231-1/+0
|
* IPA KDB MS-PAC: return ENOMEM if allocation failsJakub Hrozek2013-07-231-0/+1
|
* ipaserver/dcerpc: attempt to resolve SIDs through SSSD firstAlexander Bokovoy2013-07-232-7/+47
| | | | | | | | Attempt to resolve SIDs through SSSD first to avoid using trust account password. This makes possible to run HBAC test requests without being in 'trusted admins' group. https://fedorahosted.org/freeipa/ticket/3803
* Use AD LDAP probing to create trusted domain ID rangeTomas Babej2013-07-234-53/+231
| | | | | | | | | | When creating a trusted domain ID range, probe AD DC to get information about ID space leveraged by POSIX users already defined in AD, and create an ID range with according parameters. For more details: http://www.freeipa.org/page/V3/Use_posix_attributes_defined_in_AD https://fedorahosted.org/freeipa/ticket/3649
* ipa-kdb: reinit mspac on HTTP TGT acquisition to aid trust-add caseAlexander Bokovoy2013-07-233-6/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trust is established, we also create idrange for the trusted domain. With FreeIPA 3.3 these ranges can have different types, and in order to detect which one is to create, we need to do lookup at AD LDAP server. Such lookup requires authenticated bind. We cannot bind as user because IPA framework operates under constrained delegation using the user's credentials and allowing HTTP/ipa.server@REALM to impersonate the user against trusted domain's services would require two major things: - first, as we don't really know exact AD LDAP server names (any AD DC can be used), constrained delegation would have to be defined against a wild-card - second, constrained delegation requires that target principal exists in IPA LDAP as DN. These two together limit use of user's ticket for the purpose of IPA framework looking up AD LDAP. Additionally, immediately after trust is established, issuing TGT with MS-PAC to HTTP/ipa.server@REALM may fail due to the fact that KDB driver did not yet refreshed its list of trusted domains -- we have limited refresh rate of 60 seconds by default. This patch makes possible to force re-initialization of trusted domains' view in KDB driver if we are asked for TGT for HTTP/ipa.server@REALM. We will need to improve refresh of trusted domains' view in KDB driver in future to notice changes in cn=etc,$SUFFIX tree automatically. This improvement is tracked in https://fedorahosted.org/freeipa/ticket/1302 and https://fedorahosted.org/freeipa/ticket/3626 Part of https://fedorahosted.org/freeipa/ticket/3649
* ipa-kdb: cache KDC hostname on startupAlexander Bokovoy2013-07-233-6/+19
| | | | | | | | | | | We need KDC hostname for several purposes: - short-circuit detection of principals on the same server as KDC - generating NetBIOS name Make sure we cache hostname information on startup and use it instead of detecting the hostname in run-time. This will miss the case that KDC hostname got changed but such cases are not supported anyway without restarting KDC and making changes to principals.
* Web UI search optimizationPetr Vobornik2013-07-235-11/+21
| | | | | | | | | | | | This patch optimizes options used in commands executed by search pages. 1) Removed --all from _find and _show commands used by search pages. All displayed attributes should be already included in default attributes. 2) Removed search_all_attributes - Not needed since introduction of paging. 3) Added --no-members options to search _show commmands. Members are not displayed on search pages and such change drastically improves performance. It reduces computations on server and amount of data transferred to Web UI. https://fedorahosted.org/freeipa/ticket/3706
* Add new hidden command option to suppress processing of membership attributes.Jan Cholasta2013-07-233-135/+283
| | | | https://fedorahosted.org/freeipa/ticket/3706
* Fix internal error in idrange-addAna Krivokapic2013-07-221-1/+1
| | | | | | | Fix internal error in idrange-add, caused by a missing 'name' argument of ValidationError. https://fedorahosted.org/freeipa/ticket/3781
* Use admin@REALM when testing if SSSD is readyAna Krivokapic2013-07-192-5/+8
| | | | https://fedorahosted.org/freeipa/ticket/3771
* ipa-client: Use "ipa" as the package name for i18nPetr Viktorin2013-07-191-2/+2
| | | | | | | IPA uses "ipa" as the "package name" for all translations, even in the ipa-client package. https://fedorahosted.org/freeipa/ticket/3695
* Use libunistring ulc_casecmp() on unicode stringsNathaniel McCallum2013-07-186-7/+37
| | | | https://fedorahosted.org/freeipa/ticket/3772
* ipa-adtrust-install: configure compatibility tree to serve trusted domain usersAlexander Bokovoy2013-07-183-2/+61
| | | | | | | | | | | | | | | | | | | | | | | | | Enables support for trusted domains users for old clients through Schema Compatibility plugin. SSSD supports trusted domains natively starting with version 1.9 platform. For platforms that lack SSSD or run older SSSD version one needs to use this option. When enabled, slapi-nis package needs to be installed and schema-compat-plugin will be configured to provide lookup of users and groups from trusted domains via SSSD on IPA server. These users and groups will be available under cn=users,cn=compat,$SUFFIX and cn=groups,cn=compat,$SUFFIX trees. SSSD will normalize names of users and groups to lower case. In addition to providing these users and groups through the compat tree, this option enables authentication over LDAP for trusted domain users with DN under compat tree, i.e. using bind DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX. This authentication is related to PAM stack using 'system-auth' PAM service. If you have disabled HBAC rule 'allow_all', then make sure there is special service called 'system-auth' created and HBAC rule to allow access to anyone to this rule on IPA masters is added. Please note that system-auth PAM service is not used directly by any other application, therefore it is safe to create one specifically to support trusted domain users via compatibility path. https://fedorahosted.org/freeipa/ticket/3567
* Bump version of sssd in spec fileAna Krivokapic2013-07-181-1/+4
| | | | https://fedorahosted.org/freeipa/ticket/3652
* Add 'ipa_server_mode' option to SSSD configurationAna Krivokapic2013-07-182-1/+14
| | | | https://fedorahosted.org/freeipa/ticket/3652
* Properly handle non-existent cert filesAna Krivokapic2013-07-182-3/+12
| | | | https://fedorahosted.org/freeipa/ticket/3785
* Hide sensitive attributes in LDAP updater logging and outputRob Crittenden2013-07-181-19/+47
| | | | | | | | The LDAP updater prints the initial and final states of an entry, as well as details on the changes made to attributes. This has the potential to expose sensitive values so exclude those from logging. https://fedorahosted.org/freeipa/ticket/3782
* Add Camellia ciphers to allowed list.Rob Crittenden2013-07-183-0/+10
| | | | https://fedorahosted.org/freeipa/ticket/3749
* Require new selinux-policy replacing old server-selinux subpackageMartin Kosek2013-07-171-1/+5
| | | | | | | | | | Features of the new policy: - labels /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t which is writeable by PKI and readable by HTTPD - contains Conflicts with old freeipa-server-selinux package to avoid SELinux upgrade issues https://fedorahosted.org/freeipa/ticket/3788
* Run gpg-agent explicitly when encrypting/decrypting files.Jan Cholasta2013-07-171-7/+12
| | | | | | Also add an option to ipautil.run to redirect command output to /dev/null. https://fedorahosted.org/freeipa/ticket/3767
* Provide ipa-advise toolTomas Babej2013-07-1714-3/+382
| | | | | | | | | | | | | | Provides a pluggable framework for generating configuration scriptlets and instructions for various machine setups and use cases. Creates a new ipa-advise command, available to root user on the IPA server. Also provides an example configuration plugin, config-fedora-authconfig. https://fedorahosted.org/freeipa/ticket/3670
* Upstream Web UI testsPetr Vobornik2013-07-1633-0/+4026
| | | | | | Documentation: http://www.freeipa.org/page/Web_UI_Integration_Tests https://fedorahosted.org/freeipa/ticket/3744
* Fix container element in adder dialogsPetr Vobornik2013-07-162-9/+9
| | | | | | | | Host and DNS adder dialogs used span element as container for block elements. It's not valid nor consistent with other forms. 'span' was replaced by 'div' https://fedorahosted.org/freeipa/ticket/3744
* Better automated test supportPetr Vobornik2013-07-166-11/+19
| | | | | | | 1. add class to active facet instead of using direct style modification for hiding/showing 2. add name attribute to tables and dialog buttons and error dialog https://fedorahosted.org/freeipa/ticket/3744
* Change group ownership of CRL publish directoryTomas Babej2013-07-164-7/+22
| | | | | | | | | | | Spec file modified so that /var/lib/ipa/pki-ca/publish/ is no longer owned by created with package installation. The directory is rather created/removed with the CA instance itself. This ensures proper creation/removeal, group ownership and SELinux context. https://fedorahosted.org/freeipa/ticket/3727
* Use pkg-config to detect cmockaLukas Slebodnik2013-07-151-25/+12
| | | | https://fedorahosted.org/freeipa/ticket/3434
* Integration test config: Make it possible to specify host IPPetr Viktorin2013-07-152-20/+28
|
* BeakerLib plugin: Log http links in test docstringsPetr Viktorin2013-07-151-0/+13
| | | | The main case for this is having ticket numbers in the Beaker ouput.
* Make BeakerLib logging less verbosePetr Viktorin2013-07-154-18/+15
| | | | | | | | | | | | | Logs from Beaker jobs are normally very brief, with the standard output/error containing detailed information. Make ipa-run-tests with BeakerLib plugin follow this convention. Only include INFO and higher level messages in the Beaker logs. Downgrade several message levels to DEBUG. Log to console using Python logging instead of showing the Beaker logs. Since ipa-run-tests sets up its own logging, Nose's own log handling just causes duplicate messages. Disable it with --nologcapture.
* Use dosctrings in BeakerLib phase descriptionsPetr Viktorin2013-07-152-4/+21
| | | | | | | Phase names are now in the format: test-module-TestClass-test_method: First line of docstring https://fedorahosted.org/freeipa/ticket/3723
* Host class improvementsPetr Viktorin2013-07-153-15/+34
| | | | | | | | | | - Use the external hostname when connecting to remote hosts - Make it possible to specify working directory for remote commands - Move kinit calls to installation code This allows tests where installation is done later - Log at error level when a remote command fails unexpectedly - Clean up test directory before testing - Break infinite recursion in mkdir_recursive if dir can't be created
* tests: Configure/unconfigure remote hostsPetr Viktorin2013-07-154-9/+135
| | | | | | | | Set up the hostname, /etc/resolv.conf, and /etc/hosts on remote hosts in the test setup. Undo the changes in test teardown. Part of the work for https://fedorahosted.org/freeipa/ticket/3621
* tests: Allow public keys for authentication to the remote machinesPetr Viktorin2013-07-152-2/+23
| | | | Part of the work for https://fedorahosted.org/freeipa/ticket/3621
* Show logs in failed testsPetr Viktorin2013-07-152-0/+31
| | | | | | | | | | | Output from IPA's log manager is not captured by Nose's logcapture plugin. Forward IPA logs to a regular Python logger so that they are shown on failures. IPA log messages are also shown on standard error. Filter out Paramiko logs by default; these are too verbose. Part of the work for: https://fedorahosted.org/freeipa/ticket/3621
* Collect logs from testsPetr Viktorin2013-07-152-12/+69
| | | | | | | | After each test, and after class setups and teardowns, the BeakerLib integration plugin now downloads log files from the remote masters and submits them using rlFileSubmit. Part of the work for: https://fedorahosted.org/freeipa/ticket/3621
* Introduce a class for remote commandsPetr Viktorin2013-07-152-46/+132
| | | | | | | | | | | | Introduce a class inspired by subprocess.Popen that handles running a command on a remote machine and handling its output. To separate stdout & stderr streams of a remote command, they need to be read in parallel, so that one of them doesn't stall the runner when its buffer fills up. Accomplish this by using a thread for each stream. Part of the work for: https://fedorahosted.org/freeipa/ticket/3621
* Add a framework for integration testingPetr Viktorin2013-07-156-55/+450
| | | | | | | | | | | | Add methods to run commands and copy files to Host objects. Adds a base class for integration tests which can currently install and uninstall IPA in a "star" topology with per-test specified number of hosts. A simple test for user replication between two masters is provided. Log files from the remote hosts can be marked for collection, but the actual collection is left to a Nose plugin. Part of the work for: https://fedorahosted.org/freeipa/ticket/3621
* Add a framework for integration test configurationPetr Viktorin2013-07-156-10/+484
| | | | | | | | | | | Integration tests are configured via environment variables. Add a framework for parsing these variables and storing them in easy-to-use objects. Add an `ipa-test-config` executable that loads the configuration and prints out variables needed in shell scripts. Part of the work for https://fedorahosted.org/freeipa/ticket/3621
generated by cgit (git 2.34.1) at 2025-09-02 11:09:44 +0000