summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Become IPA 3.1.0Rob Crittenden2012-12-101-2/+2
|
* Compliant client side session cookie behaviorJohn Dennis2012-12-107-80/+1435
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In summary this patch does: * Follow the defined rules for cookies when: - receiving a cookie (process the attributes) - storing a cookie (store cookie + attributes) - sending a cookie + validate the cookie domain against the request URL + validate the cookie path against the request URL + validate the cookie expiration + if valid then send only the cookie, no attribtues * Modifies how a request URL is stored during a XMLRPC request/response sequence. * Refactors a bit of the request/response logic to allow for making the decision whether to send a session cookie instead of full Kerberous auth easier. * The server now includes expiration information in the session cookie it sends to the client. The server always had the information available to prevent using an expired session cookie. Now that expiration timestamp is returned to the client as well and now the client will not send an expired session cookie back to the server. * Adds a new module and unit test for cookies (see below) Formerly we were always returning the session cookie no matter what the domain or path was in the URL. We were also sending the cookie attributes which are for the client only (used to determine if to return a cookie). The attributes are not meant to be sent to the server and the previous behavior was a protocol violation. We also were not checking the cookie expiration. Cookie library issues: We need a library to create, parse, manipulate and format cookies both in a client context and a server context. Core Python has two cookie libraries, Cookie.py and cookielib.py. Why did we add a new cookie module instead of using either of these two core Python libaries? Cookie.py is designed for server side generation but can be used to parse cookies on the client. It's the library we were using in the server. However when I tried to use it in the client I discovered it has some serious bugs. There are 7 defined cookie elements, it fails to correctly parse 3 of the 7 elements which makes it unusable because we depend on those elements. Since Cookie.py was designed for server side cookie processing it's not hard to understand how fails to correctly parse a cookie because that's a client side need. (Cookie.py also has an awkward baroque API and is missing some useful functionality we would have to build on top of it). cookielib.py is designed for client side. It's fully featured and obeys all the RFC's. It would be great to use however it's tightly coupled with another core library, urllib2.py. The http request and response objects must be urllib2 objects. But we don't use urllib2, rather we use httplib because xmlrpclib uses httplib. I don't see a reason why a cookie library should be so tightly coupled to a protocol library, but it is and that means we can't use it (I tried to just pick some isolated entrypoints for our use but I kept hitting interaction/dependency problems). I decided to solve the cookie library problems by writing a minimal cookie library that does what we need and no more than that. It is a new module in ipapython shared by both client and server and comes with a new unit test. The module has plenty of documentation, no need to repeat it here. Request URL issues: We also had problems in rpc.py whereby information from the request which is needed when we process the response is not available. Most important was the requesting URL. It turns out that the way the class and object relationships are structured it's impossible to get this information. Someone else must have run into the same issue because there was a routine called reconstruct_url() which attempted to recreate the request URL from other available information. Unfortunately reconstruct_url() was not callable from inside the response handler. So I decided to store the information in the thread context and when the request is received extract it from the thread context. It's perhaps not an ideal solution but we do similar things elsewhere so at least it's consistent. I removed the reconstruct_url() function because the exact information is now in the context and trying to apply heuristics to recreate the url is probably not robust. Ticket https://fedorahosted.org/freeipa/ticket/3022
* Use DN objects for Dogtag configurationPetr Viktorin2012-12-101-6/+12
| | | | | Use our DN objects for generating DNs, instead of relying on string operations.
* Configuring CA with ConfigParser.Endi Sukma Dewata2012-12-102-79/+86
| | | | | | | | | The configuration code has been modified to use the ConfigParser to set the parameters in the CA section in the deployment configuration. This allows IPA to define additional PKI subsystems in the same configuration file. PKI Ticket #399 (https://fedorahosted.org/pki/ticket/399)
* Fix sshd feature checkMartin Kosek2012-12-101-4/+8
| | | | | | | | | | | OpenSSH server included in Fedora 18 raises a validation error when the tested AuthorizedKeysCommand/PubKeyAgent option is tested with an empty value. It requires a command with an absolute path to be passed. Due to this issue, sshd support is never configured on Fedora 18. Pass the real agent we will use later to the testing command to avoid this error.
* ipa-kdb: Support Windows 2012 ServerAlexander Bokovoy2012-12-071-15/+253
| | | | | | | | | | | Windows 2012 Server changed procedure how KERB_VALIDATION_INFO ([MS-PAC] section 2.5) is populated. Detailed description is available in [MS-KILE] version 25.0 and above. Refactor KERB_VALIDATION_INFO verification and ensure we filter out extra SIDs in case they belong to our domain. https://fedorahosted.org/freeipa/ticket/3231
* Stop and disable conflicting time&date servicesMartin Kosek2012-12-079-5/+146
| | | | | | | | | | | | | | | | | | | | Fedora 16 introduced chrony as default client time&date synchronization service: http://fedoraproject.org/wiki/Features/ChronyDefaultNTP Thus, there may be people already using chrony as their time and date synchronization service before installing IPA. However, installing IPA server or client on such machine may lead to unexpected behavior, as the IPA installer would configure ntpd and leave the machine with both ntpd and chronyd enabled. However, since the OS does not allow both chronyd and ntpd to be running concurrently and chronyd has the precedence, ntpd would not be run on that system at all. Make sure, that user is warned when trying to install IPA on such system and is given a possibility to either not to let IPA configure ntpd at all or to let the installer stop and disable chronyd. https://fedorahosted.org/freeipa/ticket/2974
* Add OCSP and CRL URIs to certificatesMartin Kosek2012-12-077-40/+256
| | | | | | | | | | | | | | | | | Modify the default IPA CA certificate profile to include CRL and OCSP extensions which will add URIs to IPA CRL&OCSP to published certificates. Both CRL and OCSP extensions have 2 URIs, one pointing directly to the IPA CA which published the certificate and one to a new CNAME ipa-ca.$DOMAIN which was introduced as a general CNAME pointing to all IPA replicas which have CA configured. The new CNAME is added either during new IPA server/replica/CA installation or during upgrade. https://fedorahosted.org/freeipa/ticket/3074 https://fedorahosted.org/freeipa/ticket/1431
* Reorder XML-RPC initialization in ipa-join to avoid segfault.Rob Crittenden2012-12-071-7/+12
| | | | | | | | | | | There were a number of code paths where we would try to call xmlrpc_env_clean() without having first called xmlrpc_env_init() Re-order the code so we always initialize the XML-RPC client first. I also noticed a place where the return value of strdup() was not being checked for NULL. https://fedorahosted.org/freeipa/ticket/3275
* Bump 389-ds-base minimum in our spec fileMartin Kosek2012-12-072-3/+6
| | | | | Our code needs both Requires and BuildRequires set to 389-ds-base which supports transactions. Also add the requires to configure.ac.
* Password change in a transaction, ensure passwords are truly expiredRob Crittenden2012-12-073-4/+34
| | | | | | | | | | Wrap the password change extop in a transaction. Fix the case where a password is reset and then immediately used. If done fast enough then the KDC may not detect that the password is expired and grant access using the expired password rather than prompting for a reset. https://fedorahosted.org/freeipa/ticket/1064
* Better error message for login of users from other realmsPetr Vobornik2012-12-063-12/+43
| | | | | | | | | | | When user from other realm than FreeIPA's tries to use Web UI (login via forms-based auth or with valid trusted realm ticket), he gets an unauthorized error with X-Ipa-Rejection-Reason=denied. Web UI responds with showing login dialog with following error message: 'Sorry you are not allowed to access this service.'. Note: such users are not supported because they don't have a corresponding entry in LDAP which is needed for ACLs. https://fedorahosted.org/freeipa/ticket/3252 denied change
* Set min for selinux-policy to 3.11.1-60Rob Crittenden2012-12-061-1/+5
| | | | | | This fixes errors including sssd domain mapping in krb5.conf (#873429) https://fedorahosted.org/freeipa/ticket/3132
* Add the includedir to krb5.conf on upgradesJakub Hrozek2012-12-061-0/+16
| | | | https://fedorahosted.org/freeipa/ticket/3132
* Specify includedir in krb5.conf on new installsJakub Hrozek2012-12-063-2/+9
| | | | https://fedorahosted.org/freeipa/ticket/3132
* ipachangeconf: allow specifying non-default delimeter for optionsJakub Hrozek2012-12-061-12/+23
| | | | https://fedorahosted.org/freeipa/ticket/3132
* Add detection for users from trusted/invalid realmsTomas Babej2012-12-064-18/+55
| | | | | | | | | | | | When user from other realm than FreeIPA's tries to use Web UI (login via forms-based auth or with valid trusted realm ticket), the 401 Unauthorized error with X-Ipa-Rejection-Reason=denied is returned. Also, the support for usernames of the form user@SERVER.REALM or user@server.realm was added. https://fedorahosted.org/freeipa/ticket/3252
* Improve ipa-replica-prepare error messageMartin Kosek2012-12-061-4/+17
| | | | | | | | | When DNS zone/record manipulation commands fails for example due to a ValidationError, ipa-replica-prepapre reports a whole traceback which is difficult to read. Make sure our error error is more readable. https://fedorahosted.org/freeipa/ticket/3283
* Only update the list of running services in the installer or ipactl.Rob Crittenden2012-12-053-6/+25
| | | | | | | | The file is only present in the case of a server installation. It should only be touched by the server installer and ipactl. https://fedorahosted.org/freeipa/ticket/3277
* Honor the kdb options disabling KDC writes in ipa_lockout pluginRob Crittenden2012-12-051-1/+119
| | | | | | | | | | | | | Ther3 are two global ipaConfig options to disable undesirable writes that have performance impact. The "KDC:Disable Last Success" will disable writing back to ldap the last successful AS Request time (successful kinit) The "KDC:Disable Lockout" will disable completely writing back lockout related data. This means lockout policies will stop working. https://fedorahosted.org/freeipa/ticket/2734
* Better licensing information of 3rd party codePetr Vobornik2012-12-051-0/+566
| | | | | | | README-LICENSE.txt file with licensing information of third party code used by Web UI in production or development was added. https://fedorahosted.org/freeipa/ticket/3281
* Change network configuration fileMartin Kosek2012-12-057-18/+154
| | | | | | | | | | | Fedora+systemd changed deprecated /etc/sysconfig/network which was used by IPA to store static hostname for the IPA machine. See https://bugzilla.redhat.com/show_bug.cgi?id=881785 for details. Change Fedora platform files to store the hostname to /etc/hostname instead. https://fedorahosted.org/freeipa/ticket/3279
* Add Lubomir Rintel to Contributors.txtPetr Viktorin2012-12-041-0/+1
|
* Drop unused readline importLubomir Rintel2012-12-041-1/+1
| | | | | | | | | | | | | | | | | | | The actual readline usage was removed in commit f19218f7 (Remove duplicate and unused utility code, https://fedorahosted.org/freeipa/ticket/2650) and the import remained. Readline should not be initialized if the output is not to terminal (and it does no checks itself, so import in anything that would be useful to redirect should be conditional), since it may garble the output [1]: $ TERM=xterm python -c 'import readline' |hexdump -C 00000000 1b 5b 3f 31 30 33 34 68 |.[?1034h| 00000008 [1] https://bugzilla.redhat.com/show_bug.cgi?id=304181#c1 https://fedorahosted.org/freeipa/ticket/2691 https://fedorahosted.org/freeipa/ticket/3276
* Do not recommend how to configure DNS in error messageSumit Bose2012-12-031-13/+9
| | | | | | | | The best way to configure DNS depends on the environment and no general recommendations should be given by the CLI or Web UI. Especially forwarders should not be recommended by only be option of last resort. Fixes https://fedorahosted.org/freeipa/ticket/3261
* Restart sssd after authconfig updateSumit Bose2012-12-031-0/+6
| | | | | | | | | | | | | Recent versions of authconfig do not restart sssd if only the --enablesssd and --enablesssdauth options are used. To make sure sssd is running after ipa-server-install is run this patch add an unconditional restart of sssd after authconfig is run during the installation. Since there already is some logic trying to determine if sssd needs to be restarted or stopped if freeipa in uninstalled no changes are needed here. Fixes https://fedorahosted.org/freeipa/ticket/3267
* Lookup the user SID in external group as wellSumit Bose2012-11-301-5/+14
| | | | | | | Currently only the group SIDs from a PAC are used to find out about the membership in local groups. This patch adds the user SID to the list. Fixes https://fedorahosted.org/freeipa/ticket/3257
* MS-PAC: Special case NFS servicesSimo Sorce2012-11-301-1/+35
| | | | | | | | | | The current Linux NFS server is severely limited when it comes to handling kerberos tickets. Bsically any ticket bigger than 2k will cause it to fail authentication due to kernel->userspace upcall interface restrictions. Until we have additional support in IPA to indivdually mark principals to opt out of getting PACs attached we always prevent PACs from being attached to TGTs or Tickets where NFS is involved.
* Update SELinux policy for dogtag10Martin Kosek2012-11-302-37/+13
| | | | | | | | | | | | | | | Incorporate SELinux policy changes introduced in Dogtag 10 in IPA SELinux policy: - dogtag10 now runs with pki_tomcat_t context instead of pki_ca_t - certmonger related rule are now integrated in system policy and can be removed from IPA policy Also remove redundant SELinux rules for connection of httpd_t, krb5kdc_t or named_t to DS socket. The socket has different target type anyway (dirsrv_var_run_t) and the policy allowing this is already in system. https://fedorahosted.org/freeipa/ticket/3234
* Editable sshkey, mac address field after upgradePetr Vobornik2012-11-292-3/+17
| | | | | | | | | | After upgrade, sshkeys of existing users and hosts or mac address are not editable because attribute level rights are not send to Web UI due to lack of ipasshuser/ieee802device object classes. 'w_if_no_aci' attribute flag was introduced to bypass this issue. It makes attribute writable when AttributeLevelRights for the attribute are not present and only when user posses rights for modifying object class attribute. The flag was set for sshkeys_field and mac address field. https://fedorahosted.org/freeipa/ticket/3260
* WebUI: Change of default value of type of new group back to POSIXPetr Vobornik2012-11-291-1/+1
| | | | | | In FreeIPA 2.2, the default for group type was 'POSIX', in 3.0 it's 'normal' (non-posix). CLI's default is 'POSIX', Web UI should use 'POSIX' as well. https://fedorahosted.org/freeipa/ticket/3270
* Propagate kinit errors with trust accountAlexander Bokovoy2012-11-271-0/+4
| | | | | | | | | | When using Global Catalog for resolving users and groups, one needs to authenticate against Active Directory DC using GSSAPI. Obtaining Kerberos ticket might fail. Make sure the failure message is actually returned to the user so that decision can be made about the source of issue. https://fedorahosted.org/freeipa/ticket/3265
* Make ipa-csreplica-manage work with both merged and non-merged DBsPetr Viktorin2012-11-232-34/+83
| | | | | | | | | | | | The ipa-csreplica-manage tool often assumed that the port numbers are the same on both sides of a replication agreement. This assumption doesn't hold in a cluster with both old-style hosts and ones with merged DBs. When managing agreements, determine the port with the PKI (or merged) DS on each master, and use it. Also, in CSReplicationManager, always use starttls rather than ldaps://.
* Provide 'protocol' argument to IPAdminPetr Viktorin2012-11-231-11/+27
| | | | | | | | | | | The ancient IPAdmin class used some heuristics to determine the protocol to connect with (ldap, ldaps, or ldapi). In turn, some calling code used questionable mechanisms to get the correct protocol: in ipaserver/install/replication.py, the CA cert was either passed to the constructor or added to the class afterwards, to get ldap:// or ldaps://. Add an explicit protocol argument and only fall back to backwards-compatible guessing if it is not given.
* Filter suffix in replication management toolsMartin Kosek2012-11-232-8/+31
| | | | | | | | | With the new unified Dogtag10 LDAP database, PKI-CA data and the agreements themselves are now in the main LDAP instance. Replication management tools now need to properly filter replication agreements based on the suffix to avoid clashing of agreements of different types.
* Properly stop tracking certificates on uninstallPetr Viktorin2012-11-232-17/+26
| | | | | | | | | | Stopping certificate tracking was done as part of the PKI DS uninstall. Since with the merged DB, thePKI DS is not used any more, this step was skipped. Move certificate untracking to a separate step and call it separately. Also, the post-uninstall check for tracked certificates used the wrong set of Dogtag constants. Fix the issue.
* Update certmap.conf on IPA upgradesPetr Viktorin2012-11-233-3/+22
| | | | | | | | This brings /etc/dirsrv/slapd-REALM/certmap.conf under IPA control. The file is overwritten on upgrades. This ensures that the cert for the ipaca user is recognized when ipa-ca-install is run on older masters.
* Use correct Dogtag configuration in get_pin and get_ca_certchainPetr Viktorin2012-11-233-16/+20
| | | | | | Some install utilities used Dogtag configuration before Dogtag was configured. Fix by passing the relevant dogtag_constants where they're needed.
* Fix schema replication from old mastersPetr Viktorin2012-11-238-0/+161
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new merged database will replicate with both the IPA and CA trees, so all DS instances (IPA and CA on the existing master, and the merged one on the replica) need to have the same schema. Dogtag does all its schema modifications online. Those are replicated normally. The basic IPA schema, however, is delivered in ldif files, which are not replicated. The files are not present on old CA DS instances. Any schema update that references objects in these files will fail. The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is replicated as a blob. If we updated the old master's CA schema dynamically during replica install, it would conflict with updates done during the installation: the one with the lower CSN would get lost. Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'. Turning it off tells Dogtag to create its schema in the clone, where the IPA modifications are taking place, so that it is not overwritten by the IPA schema on replication. The patch solves the problems by: - In __spawn_instance, turning off the pki_clone_replicate_schema flag. - Providing a script to copy the IPA schema files to the CA DS instance. The script needs to be copied to old masters and run there. - At replica CA install, checking if the schema is updated, and failing if not. The --skip-schema-check option is added to ipa-{replica,ca}-install to override the check. All pre-3.1 CA servers in a domain will have to have the script run on them to avoid schema replication errors. https://fedorahosted.org/freeipa/ticket/3213
* Changes to use a single database for dogtag and IPAAde Lee2012-11-2314-115/+251
| | | | | | | | | | | | New servers that are installed with dogtag 10 instances will use a single database instance for dogtag and IPA, albeit with different suffixes. Dogtag will communicate with the instance through a database user with permissions to modify the dogtag suffix only. This user will authenticate using client auth using the subsystem cert for the instance. This patch includes changes to allow the creation of masters and clones with single ds instances.
* trusts: replace use of python-crypto by m2cryptoAlexander Bokovoy2012-11-212-5/+8
| | | | | | | | | python-crypto package is not available everywhere, use m2crypto instead. Originally we thought to extend python-krbV to provide krb5_c_encrypt() wrapper but m2crypto is readily available. https://fedorahosted.org/freeipa/ticket/3271
* Enable transactions by default, make password and modrdn TXN-awareRob Crittenden2012-11-2127-116/+186
| | | | | | | | | | | | | | | | | | | | | | | | | | The password and modrdn plugins needed to be made transaction aware for the pre and post operations. Remove the reverse member hoop jumping. Just fetch the entry once and all the memberof data is there (plus objectclass). Fix some unit tests that are failing because we actually get the data now due to transactions. Add small bit of code in user plugin to retrieve the user again ala wait_for_attr but in the case of transactions we need do it only once. Deprecate wait_for_attr code. Add a memberof fixup task for roles. https://fedorahosted.org/freeipa/ticket/1263 https://fedorahosted.org/freeipa/ticket/1891 https://fedorahosted.org/freeipa/ticket/2056 https://fedorahosted.org/freeipa/ticket/3043 https://fedorahosted.org/freeipa/ticket/3191 https://fedorahosted.org/freeipa/ticket/3046
* ipasam: better Kerberos error handling in ipasamAlexander Bokovoy2012-11-211-3/+5
| | | | | | | If time is moved back on the IPA server, ipasam does not invalidate the existing ticket. https://fedorahosted.org/freeipa/ticket/3183
* Provide explicit user name for Dogtag installation scriptsPetr Viktorin2012-11-151-0/+3
| | | | | Dogtag 10 is changing its defaults, so we need to explicitly provide the 'admin' user name to keep current functionality.
* Prepare spec file for Fedora 18Martin Kosek2012-11-151-137/+49
| | | | | | | | | | | | | | | | FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
* Make enabling the autofs service more robustJakub Hrozek2012-11-141-7/+12
|
* Web UI: disable global forwarding per zonePetr Vobornik2012-11-093-0/+10
| | | | | | | | Web UI part of 'disable global forwaring per zone' effort. Option "Forwarding disabled" was added to 'DNS global config' and 'DNS zone' forwarding policy. It corresponds to 'none' value of idnsforwardpolicy. https://fedorahosted.org/freeipa/ticket/3209
* Disable global forwarding per-zoneMartin Kosek2012-11-094-8/+27
| | | | | | | | | | | bind-dyndb-ldap allows disabling global forwarder per-zone. This may be useful in a scenario when we do not want requests to delegated sub-zones (like sub.example.com. in zone example.com.) to be routed through global forwarder. Few lines to help added to explain the feature to users too. https://fedorahosted.org/freeipa/ticket/3209
* Do not require resolvable nameserver in DNS installMartin Kosek2012-11-091-7/+5
| | | | | | | | As named.conf and bind-dyndb-plugin is not set up yet during DNS configuration phase, IPA hostname (i.e. the nameserver) should not be required be to resolvable in this phase. https://fedorahosted.org/freeipa/ticket/3248
* ipa-adtrust-install: allow to reset te NetBIOS domain nameSumit Bose2012-11-083-22/+117
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3192
generated by cgit (git 2.34.1) at 2024-09-30 21:31:18 +0000