summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Support the 1.4.x python installer tools in 389-dsWilliam Brown2018-11-133-26/+139
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipatests: fix CA less expectationsFlorence Blanc-Renaud2018-11-131-2/+7
| | | | | | | | | | | | | | | | | The test TestServerInstall::test_ca_2_certs has a wrong expectation. Scenario: install a CA-less master with ipa-server-install --ca-cert-file root.pem where root.pem contains the CA that signed the http and ldap certificates + an additional (unneeded) CA cert. The test was expecting a failure, but this scenario is not problematic as long as the unneeded CA cert is not added. Related to https://pagure.io/freeipa/issue/6289 which has been closed as won't fix Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Add support for multiple certificates/formats to ipa-cacert-manageRob Crittenden2018-11-132-48/+86
| | | | | | | | | | | | Only a single cert in DER or PEM format would be loaded from the provided file. Extend this to include PKCS#7 format and load all certificates found in the file. Signed-off-by: Rob Crittenden <rcritten@redhat.com> https://pagure.io/freeipa/issue/7579 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add tests for ipa-cacert-manage installRob Crittenden2018-11-131-0/+35
| | | | | | | | | | | Some basic tests like re-loading a certificate, loading a PKCS#7 cert and bad cert handling. Signed-off-by: Rob Crittenden <rcritten@redhat.com> https://pagure.io/freeipa/issue/7579 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Split Web UI test suite in nightly PR CI configurationSerhii Tsymbaliuk2018-11-122-6/+252
| | | | Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certdb: ensure non-empty Subject Key IdentifierFraser Tweedale2018-11-121-1/+4
| | | | | | | | | | | | | | Installation or IPA CA renewal with externally-signed CA accepts an IPA CA certificate with empty Subject Key Identifier. This is technically legal in X.509, but is an operational issue. Furthermore, due to an extant bug in Dogtag (https://pagure.io/dogtagpki/issue/3079) it will cause Dogtag startup failure. Reject CA certificates with empty Subject Key Identifier. Fixes: https://pagure.io/freeipa/issue/7762 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add sysadm_r to default SELinux user map orderFrançois Cami2018-11-093-4/+8
| | | | | | | | | It is a standard SELinux user role included in RHEL (like user_r, staff_r, guest_r) and used quite often. Fixes: https://pagure.io/freeipa/issue/7658 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Nightly tests: add test_user_permissions.pyFlorence Blanc-Renaud2018-11-092-0/+24
| | | | | | | | Run the above test in the nightly test suites Related to https://pagure.io/freeipa/issue/7743 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Speed up test_customized_ds_config_installChristian Heimes2018-11-081-17/+5
| | | | | | | | | | Reuse master instance when installing replica with custom DS config. This avoids one extra ipa-server-install and also tests replica installation from a master with custom DS config. See: https://pagure.io/freeipa/issue/7743 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add missing tests to nighly runsChristian Heimes2018-11-082-0/+48
| | | | | | | | | Run test_customized_ds_config_install and test_dns_locations in nightly runs. See: https://pagure.io/freeipa/issue/7743 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Replace messagebus with modern name dbusChristian Heimes2018-11-085-9/+7
| | | | | | | | | | "messagebus" is an old, archaic name for dbus. Upstream dbus has started to move away from the old name. Let's use the modern term in FreeIPA, too. Fixes: https://pagure.io/freeipa/issue/7754 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Fix test_cli_fsencoding on Python 3.7, take 2Christian Heimes2018-11-081-2/+5
| | | | | | | | | | 0a5a7bdef7c300cb8f8a8128ce6cf5b115683cbe introduced another problem. The test is now failing on systems without a full IPA client or server installation. Use IPA_CONFDIR env var to override location of default.conf, so that the command always fails. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Serhii Tsymbaliuk <stsymbal@redhat.com>
* Copy-paste error in permssions plugin, CID 323649Christian Heimes2018-11-082-3/+3
| | | | | | | | | | | | | | | | Address a bug in the code block for attributeLevelRights for old clients. The backward compatibility code for deprecated options was not triggered, because the new name was checked against wrong dict. Coverity Scan issue 323649, Copy-paste error The copied code will not have its intended effect. In postprocess_result: A copied piece of code is inconsistent with the original (CWE-398) See: Fixes: https://pagure.io/freeipa/issue/7753 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Increase memory size for ipaserver topology (nightly-master.yaml)Serhii Tsymbaliuk2018-11-082-4/+4
| | | | | | Fix "Cannot allocate memory" error for Web UI tests Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaserver.install.adtrust: fix CID 323644Alexander Bokovoy2018-11-072-2/+55
| | | | | | | | | | | | | | | | | | | | | Fix Coverity finding CID 323644: logically dead code path The code to determine whether NetBIOS name was already set or need to be set after deriving it from a domain or asking a user for an interactive input, was refactored at some point to avoid retrieving the whole LDAP entry. Instead, it was provided with the actual NetBIOS name retrieved. As result, a part of the code got neglected and was never executed. Fix this code and provide a test that tries to test predefined, interactively provided and automatically derived NetBIOS name depending on how the installer is being run. We mock up the actual execution so that no access to LDAP or Samba is needed. Fixes: https://pagure.io/freeipa/issue/7753 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow ipaapi user to access SSSD's info pipeChristian Heimes2018-11-073-16/+83
| | | | | | | | | | | | | | | | | For smart card authentication, ipaapi must be able to access to sss-ifp. During installation and upgrade, the ipaapi user is now added to [ifp]allowed_uids. The commit also fixes two related issues: * The server upgrade code now enables ifp service in sssd.conf. The existing code modified sssd.conf but never wrote the changes to disk. * sssd_enable_service() no longer fails after it has detected an unrecognized service. Fixes: https://pagure.io/freeipa/issue/7751 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: add test for ipa-advise for enabling sudo for admins groupSergey Orlov2018-11-071-0/+33
| | | | | | | | | | | | Test that 1) sudo is not enabled for members of admins group by default 2) sudo is enabled for them after execution of script provided by ipa-advise enable_admins_sudo Related to https://pagure.io/freeipa/issue/7538 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix test_cli_fsencoding on Python 3.7Christian Heimes2018-11-071-2/+8
| | | | | | | | | | Starting with Python 3.7, PEP 538 addresses the locale issue. Python now supports UTF-8 file system encoding with non-UTF-8 C locale. See: https://docs.python.org/3/whatsnew/3.7.html#whatsnew37-pep538 See: https://pagure.io/freeipa/issue/5887 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* rpc: always read responseFraser Tweedale2018-11-071-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the server responds 401 and the response body is empty, the client raises ResponseNotReady. This occurs because: 1. For a non-200 response, the response read only if the Content-Length header occurs. 2. The response must be read before another request (e.g. the follow-up request with WWW-Authenticate header set), and this condition was not met. For details see https://github.com/python/cpython/blob/v3.6.7/Lib/http/client.py#L1305-L1321. This situation should not arise in regular use, because the client either has a session cookie, or, knowing the details of the server it is contacting, it establishes the GSS-API context and includes the WWW-Authenticate header in the initial request. Nevertheless, this problem has been observed in the wild. I do not know its ordinary cause(s), but one can force the issue by removing an authenticated user's session cache from /run/ipa/ccaches, then performing a request. Resolve the issue by always reading the response. It is safe to call response.read() regardless of whether the Content-Length header appears, or whether the body is empty. Fixes: https://pagure.io/freeipa/issue/7752 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaldap: avoid invalid modlist when attribute encoding differsFraser Tweedale2018-11-061-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ipaldap does not take into account the possibility of the attribute encoding returned by python-ldap differing from the attribute encoding produced by FreeIPA. In particular this can occur with DNs with special characters that require escaping. For example, python-ldap (or the underlying LDAP library) escapes special characters using hex encoding: CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\2C Inc.,L=Brisbane,C=AU Whereas FreeIPA, when encoding the DN, escapes the character directly: CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\, Inc.,L=Brisbane,C=AU Therefore it is possible to generate an invalid modlist. For example, during external CA certificate renewal, if the issuer DN includes a comma in one of the attribute values (as above), an invalid modlist will be generated: [ (ldap.MOD_ADD, 'ipacaissuerdn', [b'CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\, Inc.,L=Brisbane,C=AU']) , (ldap.MOD_DELETE, 'ipacaissuerdn', [b'CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\2C Inc.,L=Brisbane,C=AU']) ] Although encoded differently, these are the same value. If this modification is applied to the object, attributeOrValueExists (error 20) occurs. To avoid the issue, put deletes before adds in the modlist. If a value is present (with different encodings) as both an addition and a deletion, it must be because the original object contained the value with a different encoding. Therefore it is safe to delete it, then add it back. Note that the modlist is not optimal. In the simplest case (like above example), there should be no modification to perform. It is considerably more complex (and more computation) to implement this because the raw attribute values must be decoded before comparison. Fixes: https://pagure.io/freeipa/issue/7750 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipapwd_pre_mod: NULL ptr derefChristian Heimes2018-11-011-1/+1
| | | | | | | | | In ipapwd_pre_mod, check userpw for NULL before dereferencing its first element. See: https://pagure.io/freeipa/issue/7738 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipadb_mspac_get_trusted_domains: NULL ptr derefChristian Heimes2018-11-011-0/+6
| | | | | | | | | | Fix potential NULL pointer deref in ipadb_mspac_get_trusted_domains(). In theory, dn could be empty and rdn NULL. The man page for ldap_str2dn() does not guarantee that it returns a non-empty result. See: https://pagure.io/freeipa/issue/7738 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* has_krbprincipalkey: avoid double freeChristian Heimes2018-11-011-1/+5
| | | | | | | | Set keys to NULL after free rder to avoid potential double free. See: https://pagure.io/freeipa/issue/7738 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Enable replica install info logging to match ipa-server-installRob Crittenden2018-11-011-0/+2
| | | | | | | | | | | Increase log level to info by setting verbose=True and adding a console format. Signed-off-by: Rob Crittenden <rcritten@redhat.com> https://pagure.io/freeipa/issue/7408 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Demote log message in custodia _wait_keys to debugRob Crittenden2018-11-011-2/+2
| | | | | | | | | | | | This was previously suppressed because of the log level in an installation was set to error so it was never displayed Keeping consistency and demoting it to debug since the log level is increased to info. Related: https://pagure.io/freeipa/issue/7408 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Pass a list of values into add_master_dns_recordsRob Crittenden2018-11-011-1/+1
| | | | | | | | | | | | During replica installation the local IP addresses should be added to DNS but will fail because a string is being passed to an argument expecting a list. Convert to a list before passing in individual IPs. Discovered when fixing https://pagure.io/freeipa/issue/7408 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* WebUI tests: Make possible to use kwargs with @screenshot decoratorSerhii Tsymbaliuk2018-10-311-2/+2
| | | | Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automount": check dialog confirmation using ENTERSerhii Tsymbaliuk2018-10-311-2/+55
| | | | | | https://pagure.io/freeipa/issue/7735 Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automount": check some negative casesSerhii Tsymbaliuk2018-10-311-0/+15
| | | | | | https://pagure.io/freeipa/issue/7735 Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automount": check indirect map duplicationSerhii Tsymbaliuk2018-10-311-99/+172
| | | | | | https://pagure.io/freeipa/issue/7735 Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automount": check creating automount key without some fieldsSerhii Tsymbaliuk2018-10-311-0/+32
| | | | | | https://pagure.io/freeipa/issue/7735 Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automount": check creating indirect automount map without some ↵Serhii Tsymbaliuk2018-10-311-0/+37
| | | | | | | | fields https://pagure.io/freeipa/issue/7735 Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automount": Fix item deletingSerhii Tsymbaliuk2018-10-311-0/+11
| | | | | | https://pagure.io/freeipa/issue/7735 Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automount": check modifying map and key settingsSerhii Tsymbaliuk2018-10-311-0/+80
| | | | | | https://pagure.io/freeipa/issue/7735 Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automount": check "Add Automount..." dialogsSerhii Tsymbaliuk2018-10-311-1/+176
| | | | | | https://pagure.io/freeipa/issue/7735 Reviewed-By: Petr Cech <pcech@redhat.com>
* UI tests for "Automember": Extend search casesSerhii Tsymbaliuk2018-10-301-7/+40
| | | | | | | | https://pagure.io/freeipa/issue/7721 Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* UI tests for "Automember": Negative casesSerhii Tsymbaliuk2018-10-301-4/+77
| | | | | | | | https://pagure.io/freeipa/issue/7721 Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* UI tests for "Automember": check setting default user/host groupSerhii Tsymbaliuk2018-10-302-5/+59
| | | | | | | | https://pagure.io/freeipa/issue/7721 Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* UI tests for "Automember": check creating and deleting of automember rule ↵Serhii Tsymbaliuk2018-10-302-16/+194
| | | | | | | | | | conditions https://pagure.io/freeipa/issue/7721 Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* UI tests for "Automember": check creating and deleting of multiple rulesSerhii Tsymbaliuk2018-10-301-27/+78
| | | | | | | | https://pagure.io/freeipa/issue/7721 Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* UI tests for "Automember": check search filterSerhii Tsymbaliuk2018-10-302-48/+105
| | | | | | | | https://pagure.io/freeipa/issue/7721 Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Require Dogtag 10.6.7-3Christian Heimes2018-10-261-2/+3
| | | | | | | | | 10.6.7-3 fixes a problem with ipa-ca-install and ipa-kra-install on replicas. See: https://pagure.io/dogtagpki/issue/3073 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Restore KRA clone installation integration testFraser Tweedale2018-10-262-4/+3
| | | | | | | | | | | This Dogtag issue that caused KRA clone installation failure in some scenarios has been fixed (https://pagure.io/dogtagpki/issue/3055). This reverts commit 2488813260a407477c7516b33ce4238b69c8dd8d and bumps the pki-core dependency. Fixes: https://pagure.io/freeipa/issue/7654 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use tasks.install_master() in external_ca testsChristian Heimes2018-10-262-17/+8
| | | | | | | | | The install_master() function performs additional steps besides just installing a server. It also sets up log collection and performs additional tests. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Keep Dogtag's client db in external CA step 1Christian Heimes2018-10-262-4/+11
| | | | | | | | | | Don't remove /root/.dogtag/pki-tomcat when performing step 1 of external CA installation process. Dogtag 10.6.7 changed behavior and no longer re-creates the client database in step 2. Fixes: https://pagure.io/freeipa/issue/7742 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Improve Python configuration for LGTMChristian Heimes2018-10-262-2/+126
| | | | | | | | | LGTM is no longer able to analyse all Python code without importing it. Define OS and Python package dependencies and build the project for Python, too. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatest: add functional test for ipa-backupFlorence Blanc-Renaud2018-10-261-0/+6
| | | | | | | | | The test ensures that ipa-backup compresses the files after the IPA services are restarted. Related to: https://pagure.io/freeipa/issue/7632 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-backup: restart services before compressing the backupFlorence Blanc-Renaud2018-10-261-12/+23
| | | | | | | | | | | | | ipa-backup gathers all the files needed for the backup, then compresses the file and finally restarts the IPA services. When the backup is a large file, the compression may take time and widen the unavailabity window. This fix restarts the services as soon as all the required files are gathered, and compresses after services are restarted. Fixes: https://pagure.io/freeipa/issue/7632 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Collect the client and server uninstall logs in testsRob Crittenden2018-10-261-1/+2
| | | | | | | When running the integration tests capture the uninstallation logs as well as the installation logs. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix misleading errors during client install rollbackRob Crittenden2018-10-264-10/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some incorrect errors are possible if a client installation fails and a configuration rollback is required. These include: 1. Unconfigured automount client failed: CalledProcessError(Command ['/usr/sbin/ipa-client-automount', '--uninstall', '--debug'] returned non-zero exit status 1: '') Caused by check_client_configuration() not returning the correct return value (2). 2. WARNING: Unable to revert to the pre-installation state ('authconfig' tool has been deprecated in favor of 'authselect'). The default sssd profile will be used instead. The authconfig arguments would have been: authconfig --disableldap --disablekrb5 --disablesssdauth --disablemkhomedir If installation fails before SSSD is configured there is no state to roll back to. Detect this condition. 3. An error occurred while removing SSSD's cache.Please remove the cache manually by executing sssctl cache-remove -o. Again, if SSSD is not configured yet then there is no cache to remove. Also correct the missing space after the period. https://pagure.io/freeipa/issue/7729 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 20:05:35 +0000