summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add a "Find enabled services" ACI in 20-aci.update so that all users can ↵reviewFrançois Cami2018-11-211-0/+4
| | | | | | | | find IPA servers and services. ACI suggested by Christian Heimes. Fixes: https://pagure.io/freeipa/issue/7691 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add a shared-vault-retrieve testFrançois Cami2018-11-211-1/+64
| | | | | | | | | | | Add a shared-vault-retrieve test when: * master has KRA installed * replica has no KRA This currently fails because of issue#7691 Related-to: https://pagure.io/freeipa/issue/7691 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipatests: add test for ipa-restore in multi-master configurationSergey Orlov2018-11-212-46/+195
| | | | | | | | | | Test ensures that after ipa-restore on the master, the replica can be re-synchronized and a new replica can be created. https://pagure.io/freeipa/issue/7455 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Unify and simplify LDAP service discoveryChristian Heimes2018-11-2112-164/+191
| | | | | | | | | Move LDAP service discovery and service definitions from ipaserver.install to ipaserver. Simplify and unify different implementations in favor of a single implementation. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: add missing tests for test_replica_promotion.pyFlorence Blanc-Renaud2018-11-212-0/+24
| | | | | | | | | | The following test was missing from nightly: test_replica_promotion.py::TestReplicaInstallCustodia Related to https://pagure.io/freeipa/issue/7743 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipatests: add missing tests for test_installation.pyFlorence Blanc-Renaud2018-11-212-0/+48
| | | | | | | | | | | Some tests were missing in the nightly: - test_installation.py::TestInstallWithCA_DNS3 - test_installation.py::TestInstallWithCA_DNS4 Relates to https://pagure.io/freeipa/issue/7743 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipatests: add missing tests for test_external_ca.pyFlorence Blanc-Renaud2018-11-212-0/+72
| | | | | | | | | | | | Some tests were missing from nightly definition: test_external_ca.py::TestExternalCAdirsrvStop test_external_ca.py::TestExternalCAInvalidCert test_external_ca.py::TestMultipleExternalCA Related to https://pagure.io/freeipa/issue/7743 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipatests: add test for ipa-replica-install optionsFlorence Blanc-Renaud2018-11-201-0/+20
| | | | | | | | | Add a test checking that --password and --admin-password options are mutually exclusive. Related to https://pagure.io/freeipa/issue/6353 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa-replica-install: password and admin-password options mutually exclusiveFlorence Blanc-Renaud2018-11-201-0/+4
| | | | | | | | | | | | | | | Currently it is possible to run ipa-replica-install in one step, and provide --password and --admin-password simultaneously. This is confusing as --password is intended for one-time pwd when the ipa-replica-install command is delegated to a user who doesn't know the admin password. The fix makes --password and --admin-password options mutually exclusive. Fixes https://pagure.io/freeipa/issue/6353 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipatests: fix test_replica_uninstall_deletes_ruvsFlorence Blanc-Renaud2018-11-202-0/+39
| | | | | | | | | | | | | | | | | | | | | | | | | test_topology.py is failing because of a wrong scenario. Currently, test_replica_uninstall_deletes_ruvs does: - install master + replica with CA - ipa-replica-manage list-ruv to check that the repl is propery setup - ipa-replica-manage del $replica - (on replica) ipa-server-install --uninstall -U - ipa-replica-manage list-ruv to check that replica does not appear any more in the RUV list When ipa-replica-manage del is run, the topology plugin creates 2 tasks cleanallruvs (one for the domain, one for the ca) and they are run asynchronously. This means that the ruvs may still be present when the test moves forward and calls list-ruv. The test should wait for the cleanallruvs tasks to finish before checking that list-ruv does not display replica anymore. Fixes https://pagure.io/freeipa/issue/7545 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* PR-CI: Restart rpcbind when it blocks kadmin portChristian Heimes2018-11-201-4/+21
| | | | | | | | | | | | Every now and then, a PR-CI job fails because rpcbind blocks the kadmin port 749/UDP and kadmin.service fails to start. When NFS secure port is configured, rpcbind reserves a random low port. A new workaround detects the blocked port and restarts rpcbind.service. See: https://pagure.io/freeipa/issue/7769 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* ipa-kdb: reduce LDAP operations timeout to 30 secondsAlexander Bokovoy2018-11-161-1/+1
| | | | | | | | | | | | Since LDAP operations used by ipa-kdb driver are synchronous, the timeout specified here is blocking entire KDC. It is worth reducing the timeout and since AS REQ processing timeout in KDC is 1 minute, reducing the timeout for LDAP operations down to 30 seconds allows KDC to respond promptly in worst case scenario as well. Fixes: https://pagure.io/freeipa/issue/7217 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Fix nightly PR CI configuration for Web UI testsSerhii Tsymbaliuk2018-11-162-16/+16
| | | | | | | | Add strip operator for test_suite definitions (in nightly_*.yaml) to prevent inserting line breaks. https://pagure.io/freeipa/issue/7756 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* freeipa.spec.in: add BuildRequires for python3-lib389Florence Blanc-Renaud2018-11-161-0/+1
| | | | | | | | | freeipa.spec.in is missing BuildRequires for python3-lib389. The consequence is that make fasttest is failing. Fixes https://pagure.io/freeipa/issue/7767 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Don't use deprecated Apache Access options.sudharsanomprakash2018-11-153-10/+13
| | | | | | | httpd-2.4+ has deprecated the Order, Allow and Deny directives. Use the Require directive instead. Signed-off-by: Sudharsan Omprakash <sudharsan.omprakash@yahoo.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix pytest deprecation warningChristian Heimes2018-11-151-1/+1
| | | | | | | | | | | conftest uses the Function attribute of a pytest.Function object. Latest pytest has deprecated the attribute: _pytest.warning_types.RemovedInPytest4Warning: usage of Function.Function is deprecated, please use pytest.Function instead Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Serhii Tsymbaliuk <stsymbal@redhat.com>
* certdb: validate server cert signatureChristian Heimes2018-11-141-2/+9
| | | | | | | | | | | PR https://github.com/freeipa/freeipa/pull/2554 added the '-e' option for CA cert validation. Let's also verify signature, key size, and signing algorithm of server certs. With the '-e' option, the installer and other tools will catch weak certs early. Fixes: pagure.io/freeipa/issue/7761 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Update translations from ZanataAlexander Bokovoy2018-11-1323-448/+204
| | | | Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipatests: add missing tests in test_backup_and_restore.pyFlorence Blanc-Renaud2018-11-132-2/+74
| | | | | | | | | | | | | | 3 tests were missing from this test file in the nightly tests: - TestBackupAndRestoreWithReplica - TestBackupAndRestoreDMPassword - TestReplicaInstallAfterRestore one test was having the wrong name in nightly_rawhide: TestUserRootFilesOwnershipPermission Related to https://pagure.io/freeipa/issue/7743 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certdb: validate certificate signaturesFraser Tweedale2018-11-131-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | When verifying a CA certificate, validate its signature. This causes FreeIPA to reject certificate chains with bad signatures, signatures using unacceptable algorithms, or certificates with unacceptable key sizes. The '-e' option to 'certutil -V' was the missing ingredient. An an example of a problem prevented by this change, a certifiate signed by a 1024-bit intermediate CA, would previously have been imported by ipa-cacert-manage, but would cause Dogtag startup failure due to failing self-test. With this change, ipa-cacert-manage will reject the certificate: # ipa-cacert-manage renew --external-cert-file /tmp/ipa.p7 Importing the renewed CA certificate, please wait CA certificate CN=Certificate Authority,O=IPA.LOCAL 201809261455 in /tmp/ipa.p7 is not valid: certutil: certificate is invalid: The certificate was signed using a signature algorithm that is disabled because it is not secure. Fixes: https://pagure.io/freeipa/issue/7761 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Print correct subject on CA cert verification failureFraser Tweedale2018-11-131-0/+1
| | | | | | | | | | | | | | In load_external_cert(), if verification fails for a certificate in the trust chain, the error message contains the last subject name from a previous iteration of the trust chain, instead of the subject name of the current certificate. To report the correct subject, look it up using the current nickname. Part of: https://pagure.io/freeipa/issue/7761 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Require pylint 2.1.1-2Christian Heimes2018-11-131-0/+5
| | | | | | | | | | | | | | pylint 2.1.1-2 contains a backport of pylint's fix for RHBZ#1648299: is_subclass_of fails with AttributeError: 'NoneType' object has no attribute 'name' pylint 2.1.1-2 is in @freeipa/freeipa-master COPR. See: https://github.com/PyCQA/pylint/pull/2429 See: https://bugzilla.redhat.com/show_bug.cgi?id=1648299 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Silence comparison-with-itself in testsChristian Heimes2018-11-133-0/+4
| | | | | | | | | Test code performs comparison to itself in order to verify __eq__ and __ne__ implementations. See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix raising-format-tupleChristian Heimes2018-11-131-1/+1
| | | | | | See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix various dict related pylint warningsChristian Heimes2018-11-132-11/+15
| | | | | | | | | | | * dict-keys-not-iterating * dict-values-not-iterating * dict-items-not-iterating * dict-iter-method See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix Module 'pytest' has no 'config' memberChristian Heimes2018-11-131-2/+4
| | | | | | | | pytest.config is created dynamically. See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix useless-import-aliasChristian Heimes2018-11-131-1/+1
| | | | | | See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix comparison-with-callableChristian Heimes2018-11-131-7/+7
| | | | | | | | | Pylint warns about comparing callable. Replace equality with identity test. See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Address consider-using-inChristian Heimes2018-11-132-2/+2
| | | | | | | | Replace multiple comparisons with 'in' operation. See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Ignore consider-using-enumerate for nowChristian Heimes2018-11-131-0/+1
| | | | | | | | | Ignore new consider-using-enumerate warning for now and clean up code later. See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Address inconsistent-return-statementsChristian Heimes2018-11-139-6/+18
| | | | | | | | | | Pylint warns about inconsistent return statements when some paths of a function return None implicitly. Make all implicit returns either explicit or raise a proper exception. See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Address pylint violations in lite-serverChristian Heimes2018-11-131-0/+4
| | | | | | | | Teach pylint that env instance has lite_* members See: https://pagure.io/freeipa/issue/7758 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Ignore W504 code style like in travis configChristian Heimes2018-11-131-1/+2
| | | | | | | | | | pycodestyle both complains about "W504 line break after binary operator" and "W503 line break before binary operator" when all warnings are enabled. FreeIPA already ignores W504 in travis config. Let's ignore it in fastcheck, too. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Revert "temp commit: run test_integration/test_caless.py::TestCertInstall"Florence Blanc-Renaud2018-11-131-12/+0
| | | | This reverts commit 5483f9f6bb268f42b70eef227e268f8e28922f01.
* temp commit: run test_integration/test_caless.py::TestCertInstallFlorence Blanc-Renaud2018-11-131-0/+12
| | | | | | Please remove before pushing Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipatests: update tests for ipa-server-certinstallFlorence Blanc-Renaud2018-11-131-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The test test_http_intermediate_ca was expecting success when it should expect a failure. Scenario: - install IPA ca-less with certs signed by rootCA - call ipa-server-certinstall with a cert signed by a subCA to replace http cert. In this case, the command should refust changing the cert (otherwise the clients won't be able any more to use ipa * commands as the subca is not installed in /etc/ipa/nssdb or in /etc/ipa/ca.crt). The commit fixes the test expectation and marks the test as xfail (see ticket 7759). The test test_ds_intermediate_ca was expecting success when it should expect a failure. Same scenario as above, but for the ldap server cert. The commit fixes the test expectation and removes the xfail (ticket 6959 was closed as invalid). Note: The behavior differs for ldap and http cert because LDAP server is using a NSSDB and http server is using openssl, hence ipa-server-certinstall follows 2 different code paths when changing the server cert. Related to https://pagure.io/freeipa/issue/7759 Related to https://pagure.io/freeipa/issue/6959 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipatests: add missing tests for test_calessFlorence Blanc-Renaud2018-11-132-0/+48
| | | | | | | | | | Two tests were missing from nightly definition: - test_caless.py::TestReplicaCALessToCAFull - test_caless.py::TestServerCALessToExternalCA Related to https://pagure.io/freeipa/issue/7743 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipatests: add integration test for "Read radius servers" permFlorence Blanc-Renaud2018-11-131-0/+43
| | | | | | | | | | | | | | | Add a new integration test for the following scenario: - create a user with the "User Administrator" role - as this user, create a user with a --radius=<radius_proxy_server> This scenario was previously failing because ipa user-add --radius requires read access to the radius server entries, and there was no permission granting this access. Related to https://pagure.io/freeipa/issue/7570 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* radiusproxy: add permission for reading radius proxy serversFlorence Blanc-Renaud2018-11-132-0/+21
| | | | | | | | | | | | | | | | A non-admin user which has the "User Administrator" role cannot add a user with ipa user-add --radius=<proxy> because the call needs to read the radius proxy server entries. The fix adds a System permission for reading radius proxy server entries (all attributes except the ipatokenradiussecret). This permission is added to the already existing privileges "User Administrators" and "Stage User Administrators", so that the role "User Administrator" can call ipa [stage]user-add|mod --radius=<proxy> Fixes: https://pagure.io/freeipa/issue/7570 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* tests: add xmlrpc test for ipa user-add --radius-usernameFlorence Blanc-Renaud2018-11-131-0/+29
| | | | | | | | | | | | | | Add a xmlrpc test for ipa user-add/user-mod --radius-username The command were previously failing because the objectclass ipatokenradiusproxyuser was not automatically added when the attribute ipatokenRadiusUserName was added to the entry. The test ensures that the command is now succeeding. Related to https://pagure.io/freeipa/issue/7569 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa user-add: add optional objectclass for radius-usernameFlorence Blanc-Renaud2018-11-131-2/+16
| | | | | | | | | | | | | | | | | | The command "ipa user-add --radius-username" fails with ipa: ERROR: attribute "ipatokenRadiusUserName" not allowed because it does not add the objectclass ipatokenradiusproxyuser that is required by the attribute ipatokenradiususername. The issue happens with ipa user-add / stageuser-add / user-mod / stageuser-mod. The fix adds the objectclass when needed in the pre_common_callback method of baseuser_add and baseuser_mod (ensuring that user and stageuser commands are fixed). Fixes https://pagure.io/freeipa/issue/7569 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Remove DS perl paths from debian platformChristian Heimes2018-11-131-2/+0
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Drop dependency on 389-ds-base-legacy-toolsChristian Heimes2018-11-132-5/+0
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Use the newer way of removing the DS instanceStanislav Laznicka2018-11-131-0/+3
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DS install: don't fail if SSL already configuredStanislav Laznicka2018-11-131-8/+20
| | | | | | | | | | | DS now comes with certain SSL capabilities turned on after installation. Previously, we did not expect this and were blindly forcing everything on without checking, whether it needs turning on. This would result in failures if the config entries are already set the way we want. Relax this configuration. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DS install: fix DS asking for NSS pin during installStanislav Laznicka2018-11-131-2/+4
| | | | | | | | | DS now comes with nsslapd-security turned on and its own CA cert in its NSS database. We're re-setting the NSS database and setting our own CA cert to it, the DS pin file therefore needs to be updated with the new password after this reset. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DS uninstall: fix serverid missing in state restoreStanislav Laznicka2018-11-131-1/+4
| | | | | | | | During uninstallation, we're using serverid which we get from sysrestore.state. This was not set in the newer install, return it back. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move lib389 imports to module scopeStanislav Laznicka2018-11-133-24/+22
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Don't try legacy installsStanislav Laznicka2018-11-131-85/+2
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove some basic pystyle and pylint errorsStanislav Laznicka2018-11-131-36/+39
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 11:37:56 +0000