summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Have all the scripts run in python 3 by defaultStanislav Laznicka2018-02-151-1/+1
| | | | | | | | | The Python 3 refactoring effort is finishing, it should be safe to turn all scripts to run in Python 3 by default. https://pagure.io/freeipa/issue/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix multiple uninstallation of serverChristian Heimes2018-02-151-0/+10
| | | | | | | | | | "ipa-server-install --uninstall" no longer fails with error message "'Env' object has no attribute 'basedn'" when executed on a system that has no freeIPA server installation. Fixes: https://pagure.io/freeipa/issue/7063 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Generate same API.txt under Python 2 and 3Christian Heimes2018-02-153-4/+46
| | | | | | | | | Use Python 3's reprlib with customizations to create same API.txt under Python 2 and 3. Some plugins have been slightly altered to use stable sorting for dynamically created parameter lists. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Improve warning message for malformed certificatesFraser Tweedale2018-02-061-1/+1
| | | | | | | | | | | | The 'CertificateInvalid' message is used for malformed certificates. The user error messages says "Invalid certificate...", but in X.509 "validity" has a specific meaning that does not encompass well-formedness. For clarify, change the user-visible message to say "Malformed". Part of: https://pagure.io/freeipa/issue/7390 Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Fixing translation problemsAleksei Slaikovskii2018-01-311-1/+3
| | | | | | | | | | | | | | | | | | | ipa rpc server did set the LANG environment variable on each request and it was not thread safe which led to unpredictable mixed languages output. Also, there were mistakes regarding setting the Accept-Language HTTP header. Now on each request we're setting the "languages" property in the context thread local variable and client is setting the Accept-Language HTTP header correctly. Also, as the server is caching the schema and the schema can be generated for several languages it's good to store different schema fingerprint for each language separately. pagure: https://pagure.io/freeipa/issue/7238 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Documenting kinit_lifetime in /etc/ipa/default.confamitkuma2018-01-121-5/+0
| | | | | | | Describing the parameter kinit_lifetime that allows to limit the lifetime of ticket obtained by users authenticating to the WebGUI using login/password. Removing session_auth_duration and session_duration_type since these parameters are not relevant anymore. Resolves: https://pagure.io/freeipa/issue/7333 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* LGTM: Use explicit string concatenationChristian Heimes2018-01-091-6/+6
| | | | | | | | | Implicit string concatenation is technically correct, too. But when combined in list, it's confusing for both human eye and static code analysis. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* LGTM: Membership test with a non-containerChristian Heimes2018-01-091-8/+12
| | | | | | | | | | | Silence false positive by using isinstance(value, dict). Also clean up and optimize most common cases. https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* LGTM: Use of exit() or quit()Christian Heimes2018-01-091-3/+3
| | | | | | | | | | Replace exit() with sys.exit(). exit() or quit() may fail if the interpreter is run with the -S option. https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Fix pylint warnings inconsistent-return-statementsChristian Heimes2017-12-188-24/+72
| | | | | | | | | | Add consistent return to all functions and methods that are covered by tox -e pylint[23]. I haven't checked if return None is always a good idea or if we should rather raise an error. See: https://pagure.io/freeipa/issue/7326 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* If the cafile is not present or readable then raise an exceptionRob Crittenden2017-12-041-0/+4
| | | | | | | | | | | | | | | This can happen on the API level if a user passes in None as cafile or if the value passed in does not exist or is not readable by the IPA framework user. This will also catch situations where /etc/ipa/ca.crt has incorrect permissions and will provide more useful information than just [Errno 13] Permission denied. https://pagure.io/freeipa/issue/7145 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Use the CA chain file from the RPC contextRob Crittenden2017-12-041-1/+1
| | | | | | | | | | | | | | The value can be passed in the create_connection() call but wasn't used outside that call. It already defaults to api.env.tls_ca_cert so the context.ca_certfile should be used instead so the caller can override the cert chain on a per-connection basis. This may be handy in the future when there is IPA-to-IPA trust, or for IPA-to-IPA migration. https://pagure.io/freeipa/issue/7145 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib/frontend.py output_for_cli loops optimizationAleksei Slaikovskii2017-11-231-4/+9
| | | | | | Trivial fix which removes unnecessary for loops. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Require UTF-8 fs encodingChristian Heimes2017-11-212-0/+17
| | | | | | | | | http://blog.dscpl.com.au/2014/09/setting-lang-and-lcall-when-using.html https://pagure.io/freeipa/issue/5887 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* View plugin/command help in pagerAleksei Slaikovskii2017-11-162-33/+113
| | | | | | | | | ipa help code invokes pager if help lines length is more then current terminal height. https://pagure.io/freeipa/issue/7225 Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Use namespace-aware meta importer for ipaplatformChristian Heimes2017-11-153-13/+8
| | | | | | | | | | | | | | | | Instead of symlinks and build-time configuration the ipaplatform module is now able to auto-detect platforms on import time. The meta importer uses the platform 'ID' from /etc/os-releases. It falls back to 'ID_LIKE' on platforms like CentOS, which has ID=centos and ID_LIKE="rhel fedora". The meta importer is able to handle namespace packages and the ipaplatform package has been turned into a namespace package in order to support external platform specifications. https://fedorahosted.org/freeipa/ticket/6474 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Prevent installation with single label domainsAleksei Slaikovskii2017-11-092-1/+12
| | | | | | | | | Adds validation to prevent user to install ipa with single label domain. https://pagure.io/freeipa/issue/7207 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: remove subject_base() functionStanislav Laznicka2017-11-011-13/+0
| | | | | | | | | | | The x509.subject_base() function is only used in tests. During the recent certificate refactoring, we had to get rid of the ipalib.x509 import from the module scope so that there were no circular dependecies and add it exactly to this funcion which is not used in the production code. Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* x509: remove the strip_header() functionStanislav Laznicka2017-11-011-15/+0
| | | | | | | | We don't need the strip_header() function, to load an unknown x509 certificate, load_unknown_x509_certificate() should be used. Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Remove pkcs10 module contentsStanislav Laznicka2017-10-253-55/+24
| | | | | | | This removes pkcs10 module contents and adds a warning message about its future removal. https://pagure.io/freeipa/issue/7131
* parameters: introduce CertificateSigningRequestStanislav Laznicka2017-10-253-6/+68
| | | | | | | | | | Previously, CSRs were handled as a Str parameter which brought trouble to Python 3 because of its more strict type requirements. We introduce a CertificateSigningRequest parameter which allows to use python-cryptography x509.CertificateSigningRequest to represent CSRs in the framework. https://pagure.io/freeipa/issue/7131
* parameters: relax type checksStanislav Laznicka2017-10-251-3/+8
| | | | | | | | | | The type checks in ipalib.parameters were too strict. An object that inherits from a type should implement its public interface. This should allow us checking for types of objects whose class implementations are private to a module but they implement a certain public interface (which is typical for e.g. python-cryptography). https://pagure.io/freeipa/issue/7131
* Fixing tox and pylint errorsFelipe Barreto2017-10-231-6/+6
| | | | | | | | | | | Fixing import errors introduced by commits icac3475a0454b730d6e5b2093c2e63d395acd387 and 0b7d9c5. https://pagure.io/freeipa/issue/7132 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Use os.path.isfile() and isdir()Christian Heimes2017-10-201-1/+1
| | | | | | | | | | | Replace custom file_exists() and dir_exists() functions with proper functions from Python's stdlib. The change also gets rid of pylint's invalid bad-python3-import error, https://github.com/PyCQA/pylint/issues/1565 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Increase dbus client timeouts during CA installJohn Morris2017-10-182-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | When running on memory-constrained systems, the `ipa-server-install` program often fails during the "Configuring certificate server (pki-tomcatd)" stage in FreeIPA 4.5 and 4.6. The memory-intensive dogtag service causes swapping on low-memory systems right after start-up, and especially new certificate operations requested via certmonger can exceed the dbus client default 25 second timeout. This patch changes dbus client timeouts for some such operations to 120 seconds (from the default 25 seconds, IIRC). See more discussion in FreeIPA PR #1078 [1] and FreeIPA container issue #157 [2]. Upstream ticket at [3]. [1]: https://github.com/freeipa/freeipa/pull/1078 [2]: https://github.com/freeipa/freeipa-container/issues/157 [3]: https://pagure.io/freeipa/issue/7213 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* p11-kit: add serial number in DER formatStanislav Laznicka2017-10-171-0/+7
| | | | | | | | | | | This causes Firefox to report our CA certificate as not-trustworthy. We were previously doing this correctly, however it slipped as an error due to certificate refactoring. https://pagure.io/freeipa/issue/7210 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove the `message` attribute from exceptionsStanislav Laznicka2017-10-062-6/+1
| | | | | | | | | This is causing python2 tests print ugly warnings about the deprecation of the `message` attribute in python2.6. https://pagure.io/freeipa/issue/7131 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* ipa-cacert-manage: avoid some duplicate string definitionsFraser Tweedale2017-10-041-0/+1
| | | | | | Part of: https://pagure.io/freeipa/issue/6858 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* certmonger: add support for MS V2 templateFraser Tweedale2017-10-041-3/+18
| | | | | | | | | | | | Update certmonger.resubmit_request() and .modify() to support specifying the Microsoft V2 certificate template extension. This feature was introduced in certmonger-0.79.5 so bump the minimum version in the spec file. Part of: https://pagure.io/freeipa/issue/6858 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* certmonger: refactor 'resubmit_request' and 'modify'Fraser Tweedale2017-10-041-17/+18
| | | | | | | | | | | certmonger.resubmit_request() and .modify() contain a redundant if statement that means more lines of code must be changed when adding or removing a function argument. Perform a small refactor to improve these functions. Part of: https://pagure.io/freeipa/issue/6858 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* py3: fix pkcs7 file processingFraser Tweedale2017-09-221-1/+1
| | | | | | https://pagure.io/freeipa/issue/7131 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* rpc: don't decode cookie_string if it's NoneStanislav Laznicka2017-09-201-0/+2
| | | | | | This removes an ugly debug message from client installation Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Don't write p11-kit EKU extension object if no EKUStanislav Laznicka2017-09-191-1/+4
| | | | | | | | | | | | | | | b5732efd introduced a regression because it tries to write EKU that's actually in the CA cert instead of using the LDAP information. However, when no EKU is available, IPACertificate.extended_key_usage_bytes still returned at least EKU_PLACEHOLDER OID to keep the behavior the same as in previous versions. This caused the EKU_PLACEHOLDER to be written in the ipa.p11-kit file which made Firefox report FreeIPA Web UI as improperly configured. https://pagure.io/freeipa/issue/7119 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* pylint: disable __hash__ for some classesStanislav Laznicka2017-09-082-0/+3
| | | | | | | | | | pylint requires all classes implementing __eq__ to also implement __hash__. We disable hashing for the classes that miss the ability, should they ever be required to use it, it can be implemented then. https://pagure.io/freeipa/issue/6874 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pylint: make unsupported-assignment-operation check localStanislav Laznicka2017-09-082-0/+4
| | | | | | | | | unsupported-assignment-operation is useful at times, make it only local, not global. https://pagure.io/freeipa/issue/6874 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* parameters: convert Decimal.precision to intStanislav Laznicka2017-09-081-1/+1
| | | | | | | | | | | Explicitly convert Decimal.precision to int for unary `-` to make sure int is passed to it. Fixes pylint warning. https://pagure.io/freeipa/issue/6874 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix ipa-server-upgrade: This entry already existsFlorence Blanc-Renaud2017-08-301-0/+19
| | | | | | | | | | | | | | | | | | | ipa-server-upgrade fails when running the ipaload_cacrt plugin. The plugin finds all CA certificates in /etc/httpd/alias and uploads them in LDAP below cn=certificates,cn=ipa,cn=etc,$BASEDN. The issue happens because there is already an entry in LDAP for IPA CA, but with a different DN. The nickname in /etc/httpd/alias can differ from $DOMAIN IPA CA. To avoid the issue: 1/ during upgrade, run a new plugin that removes duplicates and restarts ldap (to make sure that uniqueness attr plugin is working after the new plugin) 2/ modify upload_cacert plugin so that it is using $DOMAIN IPA CA instead of cn=$nickname,cn=ipa,cn=etc,$BASEDN when uploading IPA CA. https://pagure.io/freeipa/issue/7125 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* rpc: don't encode bytesStanislav Laznicka2017-08-301-1/+1
| | | | | | | | | bytes.encode() appeared in rpc.py by a mistake, should have been bytes.decode() https://pagure.io/freeipa/issue/4985 Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Unify storing certificates in LDAPStanislav Laznicka2017-08-251-9/+7
| | | | | | | | | | | Recent certificate refactoring left the system in a state where the certificates are somewhere converted to DER format, somewhere directly sent to ipaldap as IPACertificate objects. The latter is the desirable way, make sure it's the one commonly used. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Include the CA basic constraint in CSRs when renewing a CARob Crittenden2017-08-221-2/+11
| | | | | | | | | | | | | | | | | | The CSR generated by `ipa-cacert-manage renew --external-ca` did not include the CA basic constraint: X509v3 Basic Constraints: critical CA:TRUE Add a flag to certmonger::resubmit_request to specify that a CA is being requested. Note that this also sets pathlen to -1 which means an unlimited pathlen. Leave it up to the issuing CA to set this. https://pagure.io/freeipa/issue/7088 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Changing how commands handles error when it can't connect to IPA serverFelipe Volpone2017-08-112-0/+22
| | | | | | | | | Creating a method to check if ipa client is configured. Also, changing scripts to use it instead of duplicating the check. https://pagure.io/freeipa/issue/6261 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* client: make ipa-client-install py3 compatibleStanislav Laznicka2017-08-021-1/+1
| | | | | | | | | | This commit enables ipa-client-install to be installable in Python 3 and makes it run in Python 3 by default. https://pagure.io/freeipa/issue/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* py3: fixing zonemgr_callbackFelipe Volpone2017-07-271-1/+1
| | | | | | | | | Since OptionParser behaves differently in Python 2/3, zonemgr_callback now handles value as str in both version. https://pagure.io/freeipa/issue/5990 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Create a Certificate parameterStanislav Laznicka2017-07-275-45/+58
| | | | | | | | | | | | | | | | | | | | | | | | | Up until now, Bytes parameter was used for certificate parameters throughout the framework. However, the Bytes parameter does nothing special for certificates, like validation, so this had to be done for each of the parameters which were supposed to represent a certificate. This commit introduces a special Certificate parameter which takes care of certificate validation so this does not have to be done separately. It also makes sure that the certificates represented by this parameter are always converted to DER format so that we can work with them in a unified manner throughout the framework. This commit also makes it possible to pass bytes directly during instantiation of the Certificate parameter and they are still represented correctly after their conversion in the _convert_scalar() method. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* parameters: relax type checksStanislav Laznicka2017-07-271-9/+6
| | | | | | | | | | | | | | | | | | | Previously, the type check of the Param class did only allow the parameters to only have a value that's of a direct type. However, that's nonsensically restrictive. For example, if there's an interface implemented as an `ABCMeta` class then the check for type fails since the interface's type is `ABCMeta` instead of directly a `type`. Among others, this is the case for cryptography.x509.Certificate. Being a type is a transitive property of a Python object and we should respect that in our framework. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Introduce load_unknown_x509_certificate()Stanislav Laznicka2017-07-271-0/+14
| | | | | | | | | | | | load_unknown_x509_certificate() serves for the cases where we can't be sure what the format of its input certificate is. This is the case for installers, it should not be used anywhere else. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* x509: Make certificates represented as objectsStanislav Laznicka2017-07-272-225/+357
| | | | | | | | https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Split x509.load_certificate() into PEM/DER functionsStanislav Laznicka2017-07-272-24/+34
| | | | | | | | | | | | | Splitting the load_certificate() function into two separate helps us word the requirements for the input explicitly. It also makes our backend similar to the one of python-cryptography so eventually we can swap python-cryptography for IPA x509 module. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: make sure logging level is set to proper valueTomas Krizek2017-07-261-15/+1
| | | | | | | | During py.test initialization, the value 'debug' is passed instead of logging.DEBUG. Signed-off-by: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-147-77/+79
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-18 09:21:49 +0000