summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ipa-run-tests: replace chdir with pluginChristian Heimes2018-01-041-5/+36
| | | | | | | | | | | | | | | | | | | The ipa-run-tests command used os.chdir() to change into the ipatests/ directory. The approach works for simple cases but breaks some pytest features. For example it makes it impossible to selects tests by their fully qualified test name. Further more, coverage statistics break because path and module names get messed up by chdir. A name plugin takes care of adjusting paths relative to ipatests and to add ipatests as base. It's now possible to run tests with qualified test names, e.g. ipa-run-tests ipatests/test_ipalib/test_base.py::test_ReadOnly::test_lock Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* 10-config.update: remove nsslapd-sasl-max-buffer-size override as ↵François Cami2018-01-041-6/+0
| | | | | | | | | | | | | | | | | | | | | https://pagure.io/389-ds-base/issue/47457 was fixed directly in 389 Directory Server. The patch addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1527020 "nsslapd-sasl-max-buffer-size is hardcoded to '2097152' during install even if another value was provided in an LDIF ( --dirsrv-config-file )" Fixes: https://pagure.io/freeipa/issue/7341 Tested against RHEL 7.4, the nsslapd-sasl-max-buffer-size parameter is still 2097152 after this change and the change allows overriding its value using --dirsrv-config-file properly. Fix suggested by Florence Blanc-Renaud. Signed-off-by: François Cami <fcami@fedoraproject.org> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Log contents of files created or modified by IPAChangeConfRob Crittenden2018-01-041-0/+7
| | | | | | | | | | | This will show the status of the files during an installation. This is particularly important during a replica install where default.conf gets written several times. Fixes: https://pagure.io/freeipa/issue/7218 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Don't manually generate default.conf in server, use IPAChangeConfRob Crittenden2018-01-041-17/+38
| | | | | | | Related: https://pagure.io/freeipa/issue/7218 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* test_cert_plugin: check if SAN is added with default profileMichal Reznik2018-01-041-8/+17
| | | | | | https://pagure.io/freeipa/issue/7334 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* WebUI: make keytab tables on service and host pages writablePavel Vomacka2018-01-042-0/+16
| | | | | | | | | | | | There is no object class before adding the first item into tables, therefore there are no ACI and WebUI is not able to figure out whether table is writable or not. Adding flag 'w_if_no_aci' tells "make it writable even if we have not ACIs and try to do the API call. https://pagure.io/freeipa/issue/7111 Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Include ipa_krb5.h without util prefixChristian Heimes2017-12-201-1/+1
| | | | | | | Fixes out-of-tree builds. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Custodia uninstall: Don't fail when LDAP is downChristian Heimes2017-12-203-7/+36
| | | | | | | | | | | The Custodia instance is removed when LDAP is already shut down. Don't fail and only remove the key files from disk. The server_del command takes care of all Custodia keys in LDAP. https://pagure.io/freeipa/issue/7318 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Require python-ldap 3.0.0b2Christian Heimes2017-12-192-9/+3
| | | | | | | | Use new LDAPBytesWarning to ignore python-ldap's bytes warnings. New build is available in @freeipa/freeipa-master. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* test_help: test "help" command without cacheMichal Reznik2017-12-191-0/+25
| | | | | | | | | This test case addresses upsteam ticket #6999, where "ipa help" does not work if called when no schema is cached. https://pagure.io/freeipa/issue/7325 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use pylint 1.7.5 with fix for bad python3 importChristian Heimes2017-12-193-4/+4
| | | | | | Closes: https://pagure.io/freeipa/issue/7315 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com>
* Vault: Add argument checks to encrypt/decryptChristian Heimes2017-12-191-6/+14
| | | | | | | | | | | Vault's encrypt and decrypt helper function take either symmetric or public/private key. Raise an exception if either both or none of them are passed down. See https://pagure.io/freeipa/issue/7326 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Fix pylint warnings inconsistent-return-statementsChristian Heimes2017-12-1814-26/+85
| | | | | | | | | | Add consistent return to all functions and methods that are covered by tox -e pylint[23]. I haven't checked if return None is always a good idea or if we should rather raise an error. See: https://pagure.io/freeipa/issue/7326 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Enable ephemeral KRA requestsRob Crittenden2017-12-154-29/+58
| | | | | | | | | | | | Enabling ephemeral KRA requests will reduce the amount of LDAP write operations and improve overall performance. Re-order some imports and shorten some lines to make pep8 happy. Fixes: https://pagure.io/freeipa/issue/6703 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Make the path to CS.cfg a class variableRob Crittenden2017-12-155-29/+45
| | | | | | | | | | | | | | Rather than passing around the path to CS.cfg for the CA and KRA set it at object creation and use everywhere. Make update_cert_config() a real class method instead of a static method. It wasn't being called that way in any case and makes it possible to use the class config file. Related: https://pagure.io/freeipa/issue/6703 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* prci: bump ci-master-f27 template to 1.0.2Tomas Krizek2017-12-141-1/+1
| | | | | Signed-off-by: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Include npm related files into Makefile and .gitignorePavel Vomacka2017-12-142-0/+9
| | | | | | | | | Extedned Makefile in install/ui - $ make clean-local removes npm related files in the install/ui directory Add node_modules and package-lock.json into .gitignore Fixes: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update jsl.conf in tests subfolderPavel Vomacka2017-12-141-2/+2
| | | | | | | | - to know QUnit, it is global object provided by QUnit.js library - remove not-existing test navigation_tests.js Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Edit TravisCI conf files to run WebUI unit testsPavel Vomacka2017-12-142-1/+8
| | | | | Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update README about WebUI unit testsPavel Vomacka2017-12-141-7/+17
| | | | | | | Add information how to run tests from command line Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update testsPavel Vomacka2017-12-1415-719/+462
| | | | | | | | | With newer QUnit the API has changed, therefor there are necesary changes in tests. QUnit methods does not pollute global workspace they use global QUnit object or assert object passed as argument to test method. Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Create symlink to qunit.jsPavel Vomacka2017-12-141-0/+1
| | | | | | | | | | | Base path for all unit tests is install/ui/js. This path is also used by PhantomJS when runnig unit tests from command line. PhantomJS then tries to find qunit.js therefor symlink in install/ui/js is needed. This might be automated in the future. Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update jsl to not warn about module in GruntfilePavel Vomacka2017-12-141-1/+2
| | | | | | | | Gruntfile uses module keyword which is not known by our JSLint. Adding it into known keywords fix the warning. Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add Gruntfile and package.json to ui directoryPavel Vomacka2017-12-143-34/+63
| | | | | | | | | | | | Those files are used when running WebUI unit tests from command line. - Gruntfile specifies grunt task which can run the webui tests. - symlink to src/freeipa/package.json where are specified npm packages which are required for running those test. There is only symlink to not duplicite package.json file Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update QUnit CSS file to 2.4.1Pavel Vomacka2017-12-141-57/+338
| | | | | | | Update QUnit CSS to correspond with QUnit JS library Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update qunit.js to version 2.4.1Pavel Vomacka2017-12-141-1253/+5053
| | | | | | | | | It provides more functions, bug fixes, but mainly better error handling therefore it is easier to debug errors while tests are automatically run. Related: https://pagure.io/freeipa/issue/7278 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ensuring 389-ds plugins are enabled after installAlexander Koksharov2017-12-142-0/+77
| | | | | | | | | To avoid problems caused by desabled plugins on 389-ds side explicitly enable plugins required by IPA https://pagure.io/freeipa/issue/7271 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Travis: Add workaround for missing IPv6 supportChristian Heimes2017-12-142-1/+20
| | | | | | | | | | | | | | Latest Travis CI image lacks IPv6 address on localhost. Add some diagnostics and skip IPv6 tests in ipa-server-install when TRAVIS is detected. The hack will be removed as soon as it is no longer required to pass automated testing. https://pagure.io/freeipa/issue/7323 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Replace nose with unittest and pytestChristian Heimes2017-12-1231-328/+385
| | | | | | | | | | | | | | | | | * Replace raise nose.SkipTest with raise unittest.SkipTest * Replace nose.tools.assert_equal(a, b) with assert a == b * Replace nose.tools.raises with pytest.raises * Convert @raises decorator to pytest.raises() but just for relevant lines. * Remove nose dependency I left the nose_compat pytest plugin in place. It can be removed in another request in case it is no longer used. https://pagure.io/freeipa/issue/7301 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Don't use admin cert during KRA installationFraser Tweedale2017-12-121-3/+7
| | | | | | | | | | | KRA installation currently imports the admin cert. FreeIPA does not track this cert and it may be expired, causing installation to fail. Do not import the existing admin cert, and discard the new admin cert that gets created during KRA installation. Part of: https://pagure.io/freeipa/issue/7287 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add uniqueness constraint on CA ACL nameFraser Tweedale2017-12-121-0/+17
| | | | | | | | | | | | It is possible to add caacl entries with same "name" (cn). The command is supposed to prevent this but direct LDAP operations allow it and doing that will cause subsequent errors. Enable the DS uniqueness constraint plugin for the cn attribute in CA ACL entries. Fixes: https://pagure.io/freeipa/issue/7304 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Extend ui_driver to support geckodriver log_pathPavel Vomacka2017-12-121-1/+2
| | | | | | | | | | | | | | | | | Geckodriver automatically logs into geckodriver.log file which is placed in the same directory from which tests are run. In case of running tests using ipa-run-tests the current working directory is /usr/lib/python*/site-packages/ipatests where most of users cannot write because of priviledges. By adding "geckodriver_log_path" into test configuration we allow to set path where user who run tests have priviledges to write. Config file might be seen here: https://www.freeipa.org/page/Web_UI_Integration_Tests#Running_tests Fixes: https://pagure.io/freeipa/issue/7311 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add safe DirectiveSetter context managerChristian Heimes2017-12-123-58/+205
| | | | | | | | | | | | | | | installutils.set_directive() is both inefficient and potentially dangerous. It does not ensure that the whole file is written and properly synced to disk. In worst case it could lead to partially written or destroyed config files. The new DirectiveSetter context manager wraps everything under an easy to use interface. https://pagure.io/freeipa/issue/7312 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add tests for installutils.set_directiveFraser Tweedale2017-12-121-0/+57
| | | | | | Part of: https://pagure.io/freeipa/issue/7288 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* installutils: refactor set_directiveFraser Tweedale2017-12-121-23/+33
| | | | | | | | | | | To separate concerns and make it easier to test set_directive, extract function ``set_directive_lines`` to do the line-wise search/replace, leaving ``set_directive`` to deal with the file handling. Part of: https://pagure.io/freeipa/issue/7288 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pep8: reduce line lengths in CAInstance.__enable_crl_publishFraser Tweedale2017-12-121-30/+41
| | | | | | Part of: https://pagure.io/freeipa/issue/7288 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Prevent set_directive from clobbering other keysFraser Tweedale2017-12-123-5/+5
| | | | | | | | | | | | | | | | `set_directive` only looks for a prefix of the line matching the given directive (key). If a directive is encountered for which the given key is prefix, it will be vanquished. This occurs in the case of `{ca,kra}.sslserver.cert[req]`; the `cert` directive gets updated after certificate renewal, and the `certreq` directive gets clobbered. This can cause failures later on during KRA installation, and possibly cloning. Match the whole directive to avoid this issue. Fixes: https://pagure.io/freeipa/issue/7288 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* More log in verbsChristian Heimes2017-12-122-7/+15
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Address more 'to login'Christian Heimes2017-12-123-6/+6
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Fix grammar error: Log outChristian Heimes2017-12-121-1/+1
| | | | | | | https://pagure.io/freeipa/issue/7258 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Fix grammar in login screenChristian Heimes2017-12-121-2/+2
| | | | | | | https://pagure.io/freeipa/issue/7263 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Run server upgrade in ipactl start/restartRob Crittenden2017-12-124-12/+32
| | | | | | | | | | | | | | | | | | | | During a distro upgrade, e.g. F-26 to F-27, networking may not be available which will cause the upgrade to fail. Despite this the IPA service can be subsequently restarted running new code with old data. This patch relies on the existing version-check cdoe to determine when/if an upgrade is required and will do so during an ipactl start or restart. The upgrade is now run implicitly in the spec file and will cause the server to be stopped after the package is installed if the upgrade fails. Fixes: https://pagure.io/freeipa/issue/6968 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add make targets for fast linting and testingChristian Heimes2017-12-116-5/+72
| | | | | | | | | | | | | | | | | | | | | Fast linting only needs modified files with pylint and diff with pycodestyle. It's good enough to detect most code errors very fast. It typically takes less than 10 seconds. A complete full pylint run uses all CPU cores for several minutes. PEP 8 violations are typically reported after 30 minutes to several hours on Travis CI. Fast lintings uses git diff and git merge-base to find all modified files in a branch or working tree. There is no easy way to find the branch source. On Travis the information is provided by Travis. For local development it's a new variable IPA_GIT_BRANCH in VERSION.m4. Fast testing execute all unit tests that do not depend on ipalib.api. In total it takes about 30-40 seconds (!) to execute linting, PEP 8 checks and unittests for both Python 2 and 3. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add marker needs_ipaapi and option to skip testsChristian Heimes2017-12-1114-0/+40
| | | | | | | | | | | | | | | The new marker needs_ipaapi is used to mark tests that needs an initialized API (ipalib.api) or some sort of other API services (running LDAP server) to work. Some packages use api.Command or api.Backend on module level. They are not marked but rather skipped entirely. A new option ``skip-ipaapi`` is added to skip all API based tests. With the option, only simple unit tests are executed. As of now, freeIPA contains more than 500 unit tests that can be executed in about 5 seconds. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add python_requires to Python package metadataChristian Heimes2017-12-111-0/+1
| | | | | | | | | freeIPA 4.6 and 4.7 requires Python 2.7 or >= 3.5. https://pagure.io/freeipa/issue/7294 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: report CA Subject DN and subject base to be usedFraser Tweedale2017-12-113-0/+29
| | | | | | | | | | | | | | Currently we do not report what Subject DN or subject base will be used for the CA installation. This leads to situations where the administrator wants a different Subject DN later. Display these data as part of the "summary" prior to the final go/no-go prompt in ipa-server-install and ipa-ca-install. The go/no-go prompt in ipa-ca-install is new. It is suppressed for unattended installations. Fixes: https://pagure.io/freeipa/issue/7246 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* test_x509: test very long OIDMichal Reznik2017-12-111-0/+51
| | | | | | | | | | Active Directory creates OIDs long enough to trigger a failure. This can cause e.g. ipa-server-install failure when installing with an externally-signed CA. https://pagure.io/freeipa/issue/7300 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa_certupdate: avoid classmethod and staticmethodFraser Tweedale2017-12-112-139/+137
| | | | | | | | | | | | | Because classmethod and staticmethod are just fancy ways of calling plain old functions, turn the classmethods and staticmethods of CertUpdate into plain old functions. This improves readability by making it clear that the behaviour of the routines cannot depend on instance or class variables. Part of: https://pagure.io/freeipa/issue/6577 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Run certupdate after promoting to CA-ful deploymentFraser Tweedale2017-12-111-0/+4
| | | | | | | | | | | | | | After installing a CA in a CA-less installations (using ipa-ca-install), the new CA certificate is not installed in /etc/httpd/alias. This causes communication failure between IPA framework and Dogtag (it cannot verify the Dogtag server certificate). Perform a CertUpdate as the final step when promoting a CA-less deployment to CA-ful. Fixes: https://pagure.io/freeipa/issue/7230 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-ca-install: run certupdate as initial stepFraser Tweedale2017-12-111-0/+11
| | | | | | | | | | When installing a CA replica, perform a certupdate to ensure that the relevant CA cert is present. This is necessary if the admin has just promoted the topology from CA-less to CA-ful but didn't manually run ipa-certupdate afterwards. Fixes: https://pagure.io/freeipa/issue/6577 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 18:37:46 +0000