summaryrefslogtreecommitdiffstats
path: root/client
Commit message (Collapse)AuthorAgeFilesLines
* Have all the scripts run in python 3 by defaultStanislav Laznicka2018-02-153-3/+3
| | | | | | | | | The Python 3 refactoring effort is finishing, it should be safe to turn all scripts to run in Python 3 by default. https://pagure.io/freeipa/issue/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Replace hard-coded paths with path constantsChristian Heimes2018-02-081-1/+1
| | | | | | | | | | | Several run() calls used hard-coded paths rather than pre-defined paths from ipaplatform.paths. The patch fixes all places that I was able to find with a simple search. The fix simplifies Darix's port of freeIPA on openSuSE. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Documenting kinit_lifetime in /etc/ipa/default.confamitkuma2018-01-121-6/+3
| | | | | | | Describing the parameter kinit_lifetime that allows to limit the lifetime of ticket obtained by users authenticating to the WebGUI using login/password. Removing session_auth_duration and session_duration_type since these parameters are not relevant anymore. Resolves: https://pagure.io/freeipa/issue/7333 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* ipa-getkeytab man page: add more details about the -r optionFlorence Blanc-Renaud2017-11-081-1/+34
| | | | | | | | | | | | The man page does not provide enough information about replicated environments and the use of the -r option. This fix adds an example how to use the same keytab on 2 different hosts, and points to ipa {service/host}-allow-retrieve-keytab. Fixes: https://pagure.io/freeipa/issue/7237 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Changing how commands handles error when it can't connect to IPA serverFelipe Volpone2017-08-111-2/+7
| | | | | | | | | Creating a method to check if ipa client is configured. Also, changing scripts to use it instead of duplicating the check. https://pagure.io/freeipa/issue/6261 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-25/+35
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* client install: fix client PKINIT configurationJan Cholasta2017-05-191-0/+1
| | | | | | | | | | | | | | | Set `pkinit_anchors` in `krb5.conf` to a CA certificate bundle of CAs trusted to issue KDC certificates rather than `/etc/ipa/ca.crt`. Set `pkinit_pool` in `krb5.conf` to a CA certificate bundle of all CAs known to IPA. Make sure both bundles are exported in all installation code paths. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* fix minor spelling mistakesRené Genz2017-05-192-3/+3
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* automount install: fix checking of SSSD functionality on uninstallPetr Vobornik2017-04-281-6/+10
| | | | | | | | | | | | | | | | | Change in 2d4d1a9dc0ef2bbe86751768d6e6b009a52c0dc9 no longer initializes api in `ipa-client-automount --uninstallation` Which caused error in wait_for_sssd which gets realm from initialized API. This patch initializes the API in a way that it doesn't download schema on uninstallation and on installation it uses host keytab for it so it no longer requires user's Kerberos credentials. Also fix call of xxx_service_class_factory which requires api as param. https://pagure.io/freeipa/issue/6861 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Clarify meaning of --domain and --realm in installersStanislav Laznicka2017-01-051-19/+12
| | | | | | | | Man pages need bigger overhaul. Take this as hot-fix for FAQ. https://fedorahosted.org/freeipa/ticket/6574 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Use env var IPA_CONFDIR to get confdirChristian Heimes2016-12-021-0/+4
| | | | | | | | | | | | | The environment variable IPA_CONFDIR overrides the default confdir path. The value of the environment variable must be an absolute path to an existing directory. The new variable makes it much simpler to use the 'ipa' command and ipalib with a local configuration directory. Some scripts (e.g. servers, installers, and upgrades) set the confdir explicitly and do not support the env var. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Revert "Add 'ipa localenv' subcommand"Martin Babinsky2016-12-021-5/+1
| | | | | | | | | | This reverts commit 1166fbc4946596fcc2ed51a1ec6990fc7dae8964. The proper fix is to restore pre-thin client behavior of commands inheriting from LocalOrRemote class. https://fedorahosted.org/freeipa/ticket/6490 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Set explicit confdir option for global contextsChristian Heimes2016-12-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Some API contexts are used to modify global state (e.g. files in /etc and /var). These contexts do not support confdir overrides. Initialize the API with an explicit confdir argument to paths.ETC_IPA. The special contexts are: * backup * cli_installer * installer * ipctl * renew * restore * server * updates The patch also corrects the context of the ipa-httpd-kdcproxy script to 'server'. https://fedorahosted.org/freeipa/ticket/6389 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaclient: move install modules to the install subpackageJan Cholasta2016-11-292-3/+3
| | | | | | | | | | | | The ipa_certupdate, ipachangeconf, ipadiscovery and ntpconf modules depend on ipaplatform. Move them to ipaclient.install as they are used only from the client installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-291-1/+2
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-291-1/+1
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-251-1/+1
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add 'ipa localenv' subcommandChristian Heimes2016-11-181-1/+5
| | | | | | | | | | | | ipa local-env simply dumps all values from api.env as sorted key="value" pairs. It's a convenient helper for debugging and to write tests for e.g. PR #182. https://fedorahosted.org/freeipa/ticket/6490 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use xml.etree in ipa-client-automount scriptChristian Heimes2016-11-161-24/+23
| | | | | | | | The ipa-client-automount script used lxml.etree to modify /etc/autofs_ldap_auth.conf. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: remove incorrect use of MAINTAINERCLEANFILESPetr Spacek2016-11-162-29/+0
| | | | | | | | | | | | | Automake manual section 13 What Gets Cleaned says that make maintainer-clean should not remove files necessary for subsequent runs of ./configure. It practically means that all usage of MAINTAINERCLEANFILES were incorrect so I've removed them. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: move client directory handling from SPEC to Makefile.amPetr Spacek2016-11-151-0/+3
| | | | | | | | This is next step towards fully functional make install. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* install: migrate client install to the new class hierarchyJan Cholasta2016-11-111-228/+2
| | | | | | | | | Migrate ipa-client-install from the custom script to the new installer class hierarchy classes. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* client: use exceptions instead of return statesMartin Basti2016-11-111-10/+9
| | | | | | | | | | | Python has builtin exceptions which can be used very well to handling errors in python instead of returning error states (C style) Exception will allow better client-server integration in future https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move install part to else branchMartin Basti2016-11-111-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move install cleanup from ipa-client-install to moduleMartin Basti2016-11-111-17/+1
| | | | | | | | Cleanup should be part of installation function https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move clean CCACHE to moduleMartin Basti2016-11-111-5/+0
| | | | | | | | | | According 04b8575c52410bb6d31e0e55f1cf431d7cc9c7c3 cleaning CCACHE is needed after installation. This commit moves this cleanup from ipa-client-install to client.install() function https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: fix script executionMartin Basti2016-11-111-11/+12
| | | | | | | | | if __name__ == "__main__" should be first instead of try block. We want execute it only when file was executed as script https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: Remove useless except in ipa-client-installMartin Basti2016-11-111-2/+0
| | | | | | | | | SystemExit is raised by sys.exit() so catching and reraising it again is wasting of resources https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move custom env variable into client moduleMartin Basti2016-11-111-5/+3
| | | | | | | | | | | | | There is no need to have env as parameter because this is used only once, so it can eb safely moved to client.py module NOTE: PATH should be overwritten to safe values before we execute any command https://www.securecoding.cert.org/confluence/display/c/ENV03-C.+Sanitize+the+environment+when+invoking+external+programs https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: extract checks from uninstall to uninstall_checkMartin Basti2016-11-111-0/+4
| | | | | | | | Checks if uninstallation is possible should be moved to uninstall_check https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move checks to client.install_checkMartin Basti2016-11-111-16/+4
| | | | | | | | Move checks from ipa-client-install to clien.install_check https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: make statestore and fstore consistent with serverMartin Basti2016-11-111-6/+3
| | | | | | | | | | | | There should not be mixed statestore as global variable and as local function parameter. This commit fixes usage of sysrestore and statestore as local variables only. In future we may need to change default statestore and fstore depending on where the functions are called and this change makes it easier and less error prone. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-client-install: move client install to moduleMartin Basti2016-11-111-2885/+20
| | | | | | | | | This commit only moves the code from ipa-client-install to module ipaclient/install/client.py and fixes PEP8. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-101-13/+14
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Build: do not compress manual pages at install timePetr Spacek2016-11-091-4/+0
| | | | | | | | | | | | | | | | | | | At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of client header filePetr Spacek2016-11-091-0/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix man page distributionPetr Spacek2016-11-091-2/+2
| | | | | | | | | | By default automake does not distribute man pages. This marks then with dist_ prefix to force their distribution in tarball. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix Makefile.am files to separate source and build directoriesPetr Spacek2016-11-091-7/+4
| | | | | | | | | | | | | This is step forward working VPATH builds which cleanly separate sources and build artifacts. It makes the system cleaner and easier to understand. Python and web UI likely require more work to make VPATH builds working. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* extend ipa-getkeytab to support other LDAP bind methodsMartin Babinsky2016-11-082-55/+161
| | | | | | | | | | | | | | | | | | | ipa-getkeytab command was augmented in a way that allows more flexible selection of bind mechanisms: * -H <LDAP_URI> option was added to specify full LDAP uri. By default the URI will be constructed from retrieved server name as is done now. Specifying this options precludes use of -s. * -Y <EXTERNAL|GSSAPI> specifes SASL bind mechanism if no bind DN was given (which implies simple bind) This allows the command to be used also locally via LDAPI, eliminating the need to provide any credentials at all as root (e.g. in installers) https://fedorahosted.org/freeipa/ticket/6409 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-getkeytab: expose CA cert path as optionMartin Babinsky2016-11-082-7/+24
| | | | | | | | | get rid of hardcoded CA cert path and allow the caller to use supplied custom paths instead https://fedorahosted.org/freeipa/ticket/6409 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipaldap: merge IPAdmin to LDAPClientTomas Krizek2016-11-071-1/+2
| | | | | | | | | | | | | | | | * move IPAdmin methods to LDAPClient * add extra arguments (cacert, sasl_nocanon) to LDAPClient.__init__() * add host, port, _protocol to LDAPClient (parsed from ldap_uri) * create get_ldap_uri() method to create ldap_uri from former IPAdmin.__init__() arguments * replace IPAdmin with LDAPClient + get_ldap_uri() * remove ununsed function argument hostname from enable_replication_version_checking() https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: merge gssapi_bind to LDAPClientTomas Krizek2016-11-071-1/+1
| | | | | | | | | * Rename do_sasl_gssapi_bind to gssapi_bind https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* client: remove unused libcurl build dependencyJan Cholasta2016-10-241-1/+0
| | | | | | | | | | The configure script checks for libcurl, but it is never actually used anywhere. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* pylint: enable the import-error checkJan Cholasta2016-10-241-0/+2
| | | | | | | | | | Check for import errors with pylint to make sure new python package dependencies are not overlooked. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: use libutil convenience library for clientPetr Spacek2016-10-241-2/+2
| | | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: merge client/configure.ac into top-level configure.acPetr Spacek2016-10-242-244/+3
| | | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: merge asn1/configure.ac to top-level configure.acPetr Spacek2016-10-242-3/+0
| | | | | | | | | | This broke ONLY_CLIENT option in SPEC file. It will be fixed later on. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Move ipa.1 man fileChristian Heimes2016-10-172-1/+206
| | | | | | | | setuptools does not support data_files any more. The ipa(1) man page is now handled like the remaining man pages. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* do not use keys() method when iterating through dictionariesMartin Babinsky2016-10-121-1/+1
| | | | | | | | | pylint-1.6.4-1.fc26.noarch reports "C0201(consider-iterating-dictionary)" when building FreeIPA, we have to fix these errors https://fedorahosted.org/freeipa/ticket/6391 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Pylint: remove unused variables from installers and scriptsMartin Basti2016-10-062-18/+11
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-28 22:15:13 +0000