summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* temp commit to run the affected teststest_realmdomainsPetr Vobornik2018-02-161-30/+10
|
* webui:tests: realm domain add with DNS checkPetr Vobornik2018-02-161-4/+58
| | | | | | | | | | | | Try adding and deleting with "Check DNS" (in html 'ok' button) DNS check expects that the added domain will have DNS record: TXT _kerberos.$domain "$REALM" When a new domain is added using dnszone-add it automatically adds this TXT record and adds a realm domain. So in order to test without external DNS we must get into state where realm domain is not added (in order to add it) but DNS domain with the TXT record exists.
* webui:tests: move DNS test data to separate filePetr Vobornik2018-02-162-60/+69
| | | | | So that the data can be used in other test without running the DNS tests.
* freeipa-server no longer supports i686 arch on F28Christian Heimes2018-02-161-0/+8
| | | | | | | | | | | | 389-ds-base 1.4 is going to drop 32bit i686 arch support in Fedora 28, https://bugzilla.redhat.com/show_bug.cgi?id=1530832 . Skip server related packages (freeipa-server, python[23]-ipaserver, freeipa-server-common, freeipa-server-dns, freeipa-server-trust-ad). RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1544386 Fixes: https://pagure.io/freeipa/issue/7400 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* WebUI Tests: changing the ActionsChains.move_to_element to a new approachFelipe Barreto2018-02-161-5/+11
| | | | | | | | | | | | | | | The approach ActionChains.move_to_element no longer works as said here [1], so, it's necessary to change it to the new one. This means, running a javascript script to move the page to where the element is. There are more details in the link [1], but in summary the w3c spec is not obvious if a click should scroll the page to the element or not. In one hand Chrome and Edge does that, but Firefox don't. As we use Firefox to run the tests, we need the workaround. [1] https://github.com/mozilla/geckodriver/issues/776 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI Tests: fixing test_user.py::test_test_noprivate_posixFelipe Barreto2018-02-161-0/+1
| | | | | | | | When filling the combo box (the gidnumber) in the dialog to create a new user, the Add button was also clicked; closing the dialog. The wait makes it to not click. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI Tests: Changing how the initial load process is doneFelipe Barreto2018-02-161-1/+19
| | | | | | | | | | | | | | Instead of always entering the address on the address bar and reloading the application, now the code checks if that is necessary. With the change, the logout process is done correctly and we do not keep any AJAX call left behind. Which could cause the user not being logout properly and breaking the tests. More about the logout problem described in: https://github.com/freeipa/freeipa/pull/1479 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI Tests: fixing test_range test caseFelipe Barreto2018-02-162-2/+37
| | | | | | | | | | | | | As described in the commit [1] and ticket [2], it should not be possible to change the range of a local IPA domain. The basic_crud was changed to make it flexible to do not run the mod operation if needed. [1] 55feea500be1f4ae7bf02ef3c48377a6751ca71d [2] https://pagure.io/freeipa/issue/4826 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI Tests: changing how the login screen is detectedFelipe Barreto2018-02-161-9/+11
| | | | | | | | | | | The "rcue-login-screen" element does not exist anymore. Changing the code to use the ".login-pf" instead. With the change, it's also necessary to check if the login screen is still visible when trying to fill the fields of new password, otherwise a StaleElementReferenceException exception will be raised. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI Tests: refactoring login method to be more readableFelipe Barreto2018-02-161-25/+28
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI Tests: fixing test_navigationFelipe Barreto2018-02-161-3/+5
| | | | | | | Removing old menu options, including idview and navigation on the side bar Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI Tests: fixing test_groupFelipe Barreto2018-02-161-1/+1
| | | | | | Removing old data that is not needed anymore. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI Tests: fixing test_hbacFelipe Barreto2018-02-161-10/+11
| | | | | | | Adding more wait_for_request between navigation and small code refactor. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-custodia-checker now uses python3 shebangChristian Heimes2018-02-161-1/+1
| | | | | | | https://pagure.io/freeipa/issue/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Have all the scripts run in python 3 by defaultStanislav Laznicka2018-02-1566-133/+70
| | | | | | | | | The Python 3 refactoring effort is finishing, it should be safe to turn all scripts to run in Python 3 by default. https://pagure.io/freeipa/issue/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Unified ldap_initialize() functionChristian Heimes2018-02-157-21/+47
| | | | | | | | | | | Replace all ldap.initialize() calls with a helper function ldap_initialize(). It handles cacert and cert validation correctly. It also provides a unique place to handle python-ldap 3.0 bytes warnings in the future. Fixes: https://pagure.io/freeipa/issue/7411 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* 389-ds OTP lasttoken plugin: Add unit testFlorence Blanc-Renaud2018-02-151-0/+173
| | | | | | | | | | | Add a xmlrpc test checking that a user cannot delete his last OTP token. Related to https://pagure.io/freeipa/issue/7012 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Alexey Slaykovsky <alexey@slaykovsky.com>
* User must not be able to delete his last active otp tokenFlorence Blanc-Renaud2018-02-151-8/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 389-ds plugin for OTP last token is performing data initialization in its ipa_otp_lasttoken_init method, which is wrong according to the Plug-in Guide: > For example, the init function should not attempt to perform an > internal search or other internal operation, because the all of > the subsystems are not up and running during the init phase. This init method fills a structure containing the configuration of allowed authentication types. As the method is called too early, the method does not find any suffix and leaves the structure empty. Subsequent calls find an empty structure and take the default values (for authentication methods, the default is 1 = password). Because of that, the code consider that the global configuration defines password authentication method, and in this case it is allowed to delete a user's last otp token. The fix implements a SLAPI_PLUGIN_START_FN method that will be called when 389-ds is ready to initialize the plugin data, ensuring that the structure is properly initialized. Fixes: https://pagure.io/freeipa/issue/7012 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Alexey Slaykovsky <alexey@slaykovsky.com>
* Fix multiple uninstallation of serverChristian Heimes2018-02-153-8/+24
| | | | | | | | | | "ipa-server-install --uninstall" no longer fails with error message "'Env' object has no attribute 'basedn'" when executed on a system that has no freeIPA server installation. Fixes: https://pagure.io/freeipa/issue/7063 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Fix i18n test for Chinese translationChristian Heimes2018-02-152-10/+19
| | | | | | | | | | Python 3's regular expression default to full range of unicode characters. Restrict \w matches to ASCII and drop \b suffix check to fix a problem with validation the Chinese translation zh_CN. Co-Authored-By: Stanislav Laznicka <slaznick@redhat.com> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Run API and ACI under Python 2 and 3Christian Heimes2018-02-152-10/+14
| | | | | | | Make it possible to run API, ACI, and potests under Python 3. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Generate same API.txt under Python 2 and 3Christian Heimes2018-02-158-60/+111
| | | | | | | | | Use Python 3's reprlib with customizations to create same API.txt under Python 2 and 3. Some plugins have been slightly altered to use stable sorting for dynamically created parameter lists. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* test_backup_and_restore.py Fix loggingAleksei Slaikovskii2018-02-141-3/+3
| | | | | | Use strings to log in restore_checker and backup functions. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Before the fix, when ipa-backup was called for the first time, the LDAP ↵Mohammad Rizwan Yusuf2018-02-141-0/+52
| | | | | | | | | | | | | | | | database exported to /var/lib/dirsrv/slapd-<instance>/ldif/<instance>-userRoot.ldif. db2ldif is called for this and it runs under root, hence files were owned by root. When ipa-backup called the next time, the db2ldif fails, because the tool does not have permissions to write to the ldif file which was owned by root (instead of dirsrv) This test check if files are owned by dirsrv and db2ldif doesn't fails related ticket: https://pagure.io/freeipa/issue/7010 Signed-off-by: Mohammad Rizwan Yusuf <myusuf@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa host-add --ip-address: properly handle NoNameserversFlorence Blanc-Renaud2018-02-122-1/+80
| | | | | | | | | | | | | | | | When ipa host-add --ip-address is called but no DNS server is able to answer for the reverse zone, get_reverse_zone raises a NoNameservers exception. The exception is not managed by add_records_for_host_validation, and this leads to the command exiting on failure with an InternalError: $ ipa host-add testhost.ipadomain.com --ip-address 172.16.30.22 ipa: ERROR: an internal error has occurred A traceback is also logged in httpd error_log. This commit properly handles the exception, and adds a test. https://pagure.io/freeipa/issue/7397 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Enable and start oddjobd after ipa-restore if it's not running.Aleksei Slaikovskii2018-02-094-36/+116
| | | | | | | | | | | | | | If after ipa-restore the service oddjobd is not running, domain-level1 replica installation will fail during ipa-replica-conncheck because this step is using oddjob to start the process ipa-replica-conncheck on the master. This patch fixes it. Also added regression test. https://pagure.io/freeipa/issue/7234 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* ipaplatform, ipa.conf: Use paths variables in ipa.conf.templateTimo Aaltonen2018-02-094-9/+20
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Move config templates from install/conf to install/shareTimo Aaltonen2018-02-0912-24/+17
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ldap2: fix implementation of can_addFraser Tweedale2018-02-093-15/+39
| | | | | | | | | | | | | | | | | | | | | ldap2.can_add checks for add permission of a given entry. It did not work properly due to a defect in 389 DS. Now that the defect has been fixed, we also need to update can_add to work with the mechanism 389 DS provides for checking add permission for entries where ACIs are in effect. Update the ldap2.can_add implementation to perform the add permission check properly. Also update call sites accordingly. Update the spec file to require 389-ds-base-1.3.7.9-1 which is the first release containing the fix. This version of 389-ds-base also resolves a couple of other issues related to replication and connection management. Fixes: https://pagure.io/freeipa/issue/6609 Fixes: https://pagure.io/freeipa/issue/7165 Fixes: https://pagure.io/freeipa/issue/7228 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaldap: allow GetEffectiveRights on individual operationsFraser Tweedale2018-02-092-33/+36
| | | | | | | | | | Allow caller to specify that the GetEffectiveRights server control should be used on a per-operation basis. Also update ldap2.get_effective_rights to use this new API. Part of: https://pagure.io/freeipa/issue/6609 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Check if replication agreement exist before enable/disable itFelipe Barreto2018-02-092-2/+16
| | | | | | | | | If the replication agreement does not exist, a custom exception is raised explaining the problem. https://pagure.io/freeipa/issue/7201 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Replace wsgi package conflict with config fileChristian Heimes2018-02-0912-5/+75
| | | | | | | | | | | | | Instead of a package conflict, freeIPA now uses an Apache config file to enforce the correct wsgi module. The workaround only applies to Fedora since it is the only platform that permits parallel installation of Python 2 and Python 3 mod_wsgi modules. RHEL 7 has only Python 2 and Debian doesn't permit installation of both variants. See: https://pagure.io/freeipa/issue/7161 Fixes: https://pagure.io/freeipa/issue/7394 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-kdb: update trust information in all workersSumit Bose2018-02-081-13/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently there is already code to make sure that after trust is established an AS-REQ of the local HTTP principal causes a refresh of the internal structures holding the information about the trusted domains. But this refreshes only the data of the current krb5kdc worker process on the local host. Other workers and the KDCs on other hosts will update the data eventually when a request with a principal from a trusted realm is handled. During this phase, which might last quite long if remote principals are only handled rarely, TGTs for local principals might or might not contain a PAC because the decision if a PAC should be added or not is based on the information about trusted domains. Since the PAC is needed to access services on the AD side this access might fail intermittently depending which worker process on which host is handling the request. This might e.g. affect SSSD running on the IPA server with two-way trust. To fix this this patch calls ipadb_reinit_mspac() whenever a PAC is needed but without the 'force' flag so that the refresh will only happen if it wasn't called recently (currently not more often than once a minute). An alternative might be to do the refresh only when processing cross-realm TGT requests. But this would be already too late because the local principal asking for a cross-realm ticket would not have a PAC and hence the first attempt will still fail due to the missing PAC. And injecting the PAC in the cross-realm TGT while there is none in the requesting ticket does not sound right. Related to https://pagure.io/freeipa/issue/7351 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Restart named-pkcs11 after KRA installationChristian Heimes2018-02-081-0/+5
| | | | | | | | | | KRA installer restarts 389-DS, which disrupts named-pkcs11 bind-dyndb-ldap for a short while. Restart named-pkcs11 to fix DNS resolver. Fixes: https://pagure.io/freeipa/issue/5813 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Update existing 389-DS cn=RSA,cn=encryption configChristian Heimes2018-02-081-1/+5
| | | | | | | | | | | 389-DS >= 1.4.0 on Fedora 28 has a default entry for cn=RSA,cn=encryption,cn=config. The installer now updates the entry in case it already exists. This ensures that token and personality are correct for freeIPA Fixes: https://pagure.io/freeipa/issue/7393 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Update IPA CA issuer DN upon renewalFraser Tweedale2018-02-081-1/+25
| | | | | | | | | | | When renewing externally-signed CA or when switching from externally-signed to self-signed CA, the Issuer DN can change. Update the ipaCaIssuerDn field of the IPA CA entry upon renewal, to keep it in sync. Fixes: https://pagure.io/freeipa/issue/7316 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Fix detection of KRA installation so upgrades can succeedRob Crittenden2018-02-082-2/+23
| | | | | | | | | | | Use is_installed() instead of is_configured() because is_installed() does a config file check to see if the service is in use. https://pagure.io/freeipa/issue/7389 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Replace hard-coded paths with path constantsChristian Heimes2018-02-0817-40/+70
| | | | | | | | | | | Several run() calls used hard-coded paths rather than pre-defined paths from ipaplatform.paths. The patch fixes all places that I was able to find with a simple search. The fix simplifies Darix's port of freeIPA on openSuSE. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Bump python-ldap version to fix syncrepl bugChristian Heimes2018-02-081-1/+2
| | | | | | | | | python-ldap had a bug in syncrepl caused by incompatible changes in pyasn1. The bug has been fixed in 2.4.25-9. Fixes: https://pagure.io/freeipa/issue/7240 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa-kdb: use magic value to check if ipadb is usedSumit Bose2018-02-083-1/+4
| | | | | | | | | | | | | The certauth plugin is configured in /etc/krb5.conf independently form the database module. As a result the IPA certauth plugin can be added to the configuration without the IPA DAL driver. Since the IPA certauth plugin depends on the presence of the IPA DAL driver this patch adds a magic value at the beginning of struct ipadb_context which can be checked to see if the IPA DAL driver is properly initialized. Resolves https://pagure.io/freeipa/issue/7261 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Bump SELinux policy for DNSSECChristian Heimes2018-02-081-1/+2
| | | | | | | | | selinux-policy-3.13.1-283.24 fixes an AVC with OpenDNSSEC ods-signer. See: https://bugzilla.redhat.com/show_bug.cgi?id=1537971 See: https://pagure.io/freeipa/issue/7378 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipa-server-upgrade now checks custodia server keysChristian Heimes2018-02-081-1/+11
| | | | | | | | | | | | The ipa-server-upgrade command now checks for presence of ipa-custodia's config and server keys. In case any of the files is missing, it re-creates both files. Partly resolves https://pagure.io/freeipa/issue/6893. The upgrader does not auto-detect broken or mismatching keys yet. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipa_tests: test subca key replicationMichal Reznik2018-02-071-3/+46
| | | | | | | | Test if key replication is not failing. https://pagure.io/freeipa/issue/7387 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* DNSSEC code cleanupChristian Heimes2018-02-073-80/+134
| | | | | | | Replace assert with proper check and exception. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* DNSSEC: Reformat lines to address PEP8 violationsChristian Heimes2018-02-074-12/+24
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Decode ODS commandsChristian Heimes2018-02-071-7/+14
| | | | | | | | ODS commands are ASCII strings, but socket.recv() returns bytes and socket.send() expects bytes. Encode/decode values properly. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Run DNSSEC under Python 3Christian Heimes2018-02-071-4/+3
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* More DNSSEC house keepingChristian Heimes2018-02-072-30/+29
| | | | | | Related: https://pagure.io/freeipa/issue/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3 dnssec: convert hexlify to strTomas Krizek2018-02-074-37/+50
| | | | | | | | | | hexlify returns bytes and needs to be casted to string before printing it out. Related: https://pagure.io/freeipa/issue/4985 Signed-off-by: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3: bindmgr: fix bytes issuesTomas Krizek2018-02-071-6/+8
| | | | | | | | | | LDAP client returns values as bytes, thus bindmgr must work with bytes properly. https://pagure.io/freeipa/issue/4985 Signed-off-by: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-29 06:37:34 +0000