summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
* Have all the scripts run in python 3 by defaultStanislav Laznicka2018-02-154-4/+4
| | | | | | | | | The Python 3 refactoring effort is finishing, it should be safe to turn all scripts to run in Python 3 by default. https://pagure.io/freeipa/issue/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Unified ldap_initialize() functionChristian Heimes2018-02-153-9/+10
| | | | | | | | | | | Replace all ldap.initialize() calls with a helper function ldap_initialize(). It handles cacert and cert validation correctly. It also provides a unique place to handle python-ldap 3.0 bytes warnings in the future. Fixes: https://pagure.io/freeipa/issue/7411 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix multiple uninstallation of serverChristian Heimes2018-02-151-8/+12
| | | | | | | | | | "ipa-server-install --uninstall" no longer fails with error message "'Env' object has no attribute 'basedn'" when executed on a system that has no freeIPA server installation. Fixes: https://pagure.io/freeipa/issue/7063 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Generate same API.txt under Python 2 and 3Christian Heimes2018-02-153-50/+55
| | | | | | | | | Use Python 3's reprlib with customizations to create same API.txt under Python 2 and 3. Some plugins have been slightly altered to use stable sorting for dynamically created parameter lists. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa host-add --ip-address: properly handle NoNameserversFlorence Blanc-Renaud2018-02-121-1/+8
| | | | | | | | | | | | | | | | When ipa host-add --ip-address is called but no DNS server is able to answer for the reverse zone, get_reverse_zone raises a NoNameservers exception. The exception is not managed by add_records_for_host_validation, and this leads to the command exiting on failure with an InternalError: $ ipa host-add testhost.ipadomain.com --ip-address 172.16.30.22 ipa: ERROR: an internal error has occurred A traceback is also logged in httpd error_log. This commit properly handles the exception, and adds a test. https://pagure.io/freeipa/issue/7397 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Enable and start oddjobd after ipa-restore if it's not running.Aleksei Slaikovskii2018-02-091-0/+6
| | | | | | | | | | | | | | If after ipa-restore the service oddjobd is not running, domain-level1 replica installation will fail during ipa-replica-conncheck because this step is using oddjob to start the process ipa-replica-conncheck on the master. This patch fixes it. Also added regression test. https://pagure.io/freeipa/issue/7234 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* ipaplatform, ipa.conf: Use paths variables in ipa.conf.templateTimo Aaltonen2018-02-091-0/+5
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Move config templates from install/conf to install/shareTimo Aaltonen2018-02-093-6/+13
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ldap2: fix implementation of can_addFraser Tweedale2018-02-092-11/+31
| | | | | | | | | | | | | | | | | | | | | ldap2.can_add checks for add permission of a given entry. It did not work properly due to a defect in 389 DS. Now that the defect has been fixed, we also need to update can_add to work with the mechanism 389 DS provides for checking add permission for entries where ACIs are in effect. Update the ldap2.can_add implementation to perform the add permission check properly. Also update call sites accordingly. Update the spec file to require 389-ds-base-1.3.7.9-1 which is the first release containing the fix. This version of 389-ds-base also resolves a couple of other issues related to replication and connection management. Fixes: https://pagure.io/freeipa/issue/6609 Fixes: https://pagure.io/freeipa/issue/7165 Fixes: https://pagure.io/freeipa/issue/7228 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaldap: allow GetEffectiveRights on individual operationsFraser Tweedale2018-02-091-17/+1
| | | | | | | | | | Allow caller to specify that the GetEffectiveRights server control should be used on a per-operation basis. Also update ldap2.get_effective_rights to use this new API. Part of: https://pagure.io/freeipa/issue/6609 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Check if replication agreement exist before enable/disable itFelipe Barreto2018-02-091-0/+11
| | | | | | | | | If the replication agreement does not exist, a custom exception is raised explaining the problem. https://pagure.io/freeipa/issue/7201 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Replace wsgi package conflict with config fileChristian Heimes2018-02-092-1/+13
| | | | | | | | | | | | | Instead of a package conflict, freeIPA now uses an Apache config file to enforce the correct wsgi module. The workaround only applies to Fedora since it is the only platform that permits parallel installation of Python 2 and Python 3 mod_wsgi modules. RHEL 7 has only Python 2 and Debian doesn't permit installation of both variants. See: https://pagure.io/freeipa/issue/7161 Fixes: https://pagure.io/freeipa/issue/7394 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Restart named-pkcs11 after KRA installationChristian Heimes2018-02-081-0/+5
| | | | | | | | | | KRA installer restarts 389-DS, which disrupts named-pkcs11 bind-dyndb-ldap for a short while. Restart named-pkcs11 to fix DNS resolver. Fixes: https://pagure.io/freeipa/issue/5813 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Update existing 389-DS cn=RSA,cn=encryption configChristian Heimes2018-02-081-1/+5
| | | | | | | | | | | 389-DS >= 1.4.0 on Fedora 28 has a default entry for cn=RSA,cn=encryption,cn=config. The installer now updates the entry in case it already exists. This ensures that token and personality are correct for freeIPA Fixes: https://pagure.io/freeipa/issue/7393 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Update IPA CA issuer DN upon renewalFraser Tweedale2018-02-081-1/+25
| | | | | | | | | | | When renewing externally-signed CA or when switching from externally-signed to self-signed CA, the Issuer DN can change. Update the ipaCaIssuerDn field of the IPA CA entry upon renewal, to keep it in sync. Fixes: https://pagure.io/freeipa/issue/7316 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Fix detection of KRA installation so upgrades can succeedRob Crittenden2018-02-081-2/+2
| | | | | | | | | | | Use is_installed() instead of is_configured() because is_installed() does a config file check to see if the service is in use. https://pagure.io/freeipa/issue/7389 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Replace hard-coded paths with path constantsChristian Heimes2018-02-085-13/+22
| | | | | | | | | | | Several run() calls used hard-coded paths rather than pre-defined paths from ipaplatform.paths. The patch fixes all places that I was able to find with a simple search. The fix simplifies Darix's port of freeIPA on openSuSE. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-server-upgrade now checks custodia server keysChristian Heimes2018-02-081-1/+11
| | | | | | | | | | | | The ipa-server-upgrade command now checks for presence of ipa-custodia's config and server keys. In case any of the files is missing, it re-creates both files. Partly resolves https://pagure.io/freeipa/issue/6893. The upgrader does not auto-detect broken or mismatching keys yet. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* DNSSEC code cleanupChristian Heimes2018-02-071-25/+47
| | | | | | | Replace assert with proper check and exception. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* DNSSEC: Reformat lines to address PEP8 violationsChristian Heimes2018-02-074-12/+24
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* More DNSSEC house keepingChristian Heimes2018-02-072-30/+29
| | | | | | Related: https://pagure.io/freeipa/issue/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3 dnssec: convert hexlify to strTomas Krizek2018-02-072-19/+30
| | | | | | | | | | hexlify returns bytes and needs to be casted to string before printing it out. Related: https://pagure.io/freeipa/issue/4985 Signed-off-by: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3: bindmgr: fix bytes issuesTomas Krizek2018-02-071-6/+8
| | | | | | | | | | LDAP client returns values as bytes, thus bindmgr must work with bytes properly. https://pagure.io/freeipa/issue/4985 Signed-off-by: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3: bindmgr: fix iteration over bytesMartin Basti2018-02-071-10/+16
| | | | | | | | | In py3 iteration over bytes returns integers, in py2 interation over bytes returns string. https://pagure.io/freeipa/issue/4985 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3: ipa-dnskeysyncd: fix bytes issuesMartin Basti2018-02-071-13/+13
| | | | | | | | | LDAP client returns values as bytes, thus ipa-dnskeysyncd must work with bytes properly. https://pagure.io/freeipa/issue/4985 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-advise for smartcards updatedamitkuma2018-02-071-1/+2
| | | | | | | | | | | | ...... authconfig --enablesmartcard --smartcardmodule=sssd --updateall Advise is updated to: authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --smartcardaction=1 --updateall Resolves: https://pagure.io/freeipa/issue/7358 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix replica_promotion-domlevel0 test failuresAlexander Koksharov2018-02-061-8/+8
| | | | | | | | | | | Integration test is failing due to wrong message being displayed by ipa. This issue was most probably introduced by PR: https://github.com/freeipa/freeipa/commit/f51869bf5214e2d2322f85bf72b7ae86b6893974 Error messages for domain level 0 and >=1 cases were basically swapped. This PR is swapping them back. Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* cert-request: avoid internal error when cert malformedFraser Tweedale2018-02-061-1/+13
| | | | | | | | | | When executing cert-request, if Dogtag successfully issues a certificate but python-cryptography cannot parse the certificate, an unhandled exception occurs. Handle the exception by notifying about the malformed certificate in the response messages. Fixes: https://pagure.io/freeipa/issue/7390 Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Fixing translation problemsAleksei Slaikovskii2018-01-312-12/+15
| | | | | | | | | | | | | | | | | | | ipa rpc server did set the LANG environment variable on each request and it was not thread safe which led to unpredictable mixed languages output. Also, there were mistakes regarding setting the Accept-Language HTTP header. Now on each request we're setting the "languages" property in the context thread local variable and client is setting the Accept-Language HTTP header correctly. Also, as the server is caching the schema and the schema can be generated for several languages it's good to store different schema fingerprint for each language separately. pagure: https://pagure.io/freeipa/issue/7238 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* preventing ldap principal to be deletedAlexander Koksharov2018-01-311-3/+19
| | | | | | | | | | | | | | | | | | | | ipa-server-install --uninstall command is calling server-del to delete replica. This scenario does not work since server-del is also deleting all principals from and ldap breaking ldap replication. As a result, only part of deletions are propagated to the other replicals leaving a lot of orphaned data there. https://pagure.io/freeipa/issue/7371 This patch won't fully fix the issue with left-over data but more data is cleaned up and only ldap principal is left thus ending in a better state. Issue will be fully fixed only when topology plugin is patched as well. The following pagure ticket is created to track topology plugin change: https://pagure.io/freeipa/issue/7359 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fixing vault-add-member to be compatible with py3Felipe Barreto2018-01-241-1/+1
| | | | | | | | | Changing from iteritems() to values() in order to be compatible with python3. https://pagure.io/freeipa/issue/7373 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Custom ca-subject loggingamitkuma2018-01-231-1/+2
| | | | | | | | | | | | | Present Situation: Logging is a bit incomplete when using a custom CA subject passed in via --ca-subject. If there is a problem finding the IPA CA certificate then the installer will log: ERROR IPA CA certificate not found in /tmp/servercert.pem, /tmp/cacert.pem After the Fix this sort of log is seen: ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): DEBUG The ipa-server-install command failed, exception: ScriptError: IPA CA certificate with subject 'CN=Certificate Authority,O=GSSLAB.PNQ2.REDHAT.COM' was not found in /root/ipa.cert, /root/rootCA.crt. Resolves: https://pagure.io/freeipa/issue/7245 Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* replica_prepare: Remove the correct NSS DB filesStanislav Laznicka2018-01-161-1/+1
| | | | | | | | | | Mistake in recent fixes made the ipa-replica-prepare include some extra files in the info file should the legacy format of NSS databases be used. https://pagure.io/freeipa/issue/7049 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add a helpful comment to ca.py:install_check()Stanislav Laznicka2018-01-161-0/+1
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Sort external schema filesChristian Heimes2018-01-101-1/+1
| | | | | | | | | get_all_external_schema_files() now returns schema files sorted. Fixes: https://pagure.io/freeipa/issue/7338 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Idviews: fix objectclass violation on idview-addFlorence Blanc-Renaud2018-01-091-4/+11
| | | | | | | | | | | | | | | | | | | | When the option --domain-resolution-order is used with the command ipa idview-add, the resulting LDAP object stores the value in ipadomainresolutionorder attribute. The issue is that the add command does not add the needed object class (ipaNameResolutionData) because it is part of possible_objectclasses but not of object_class. The fix makes sure to add the objectclass when the option --domain-resolution-order is used, and adds a non-regression test. Note that idview-mod does not have any issue as it correctly handles the addition of missing possible objectclasses. Fixes: https://pagure.io/freeipa/issue/7350 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* LGTM: unnecessary else in for loopChristian Heimes2018-01-092-8/+8
| | | | | | | | for/else makes only sense when the for loop uses break, too. If the for loop simply returns on success, then else is not necessary. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* LGTM: Use explicit string concatenationChristian Heimes2018-01-091-14/+16
| | | | | | | | | Implicit string concatenation is technically correct, too. But when combined in list, it's confusing for both human eye and static code analysis. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* LGTM: raise handle_not_found()Christian Heimes2018-01-0925-145/+205
| | | | | | | | | | | | | | Turn calls "handle_not_found()" into "raise handle_not_found()" to indicate control flow chance. It makes the code easier to understand, the control flow more obvious and helps static analyzers. It's OK to raise here because handle_not_found() always raises an exception. https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* LGTM: Fix multiple use before assignmentChristian Heimes2018-01-096-9/+16
| | | | | | | | | | | - Move assignment before try/finally block - Add raise to indicate control flow change - Add default value https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* LGTM: Fix exception in permission_delChristian Heimes2018-01-091-1/+1
| | | | | | | | | Instantiating an exception, but not raising it, has no effect. https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* LGTM: Use of exit() or quit()Christian Heimes2018-01-091-1/+1
| | | | | | | | | | Replace exit() with sys.exit(). exit() or quit() may fail if the interpreter is run with the -S option. https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* LGTM: Silence unmatchable dollarChristian Heimes2018-01-091-1/+5
| | | | | | | | | Silence false positive "unmatchable dollar in regular expression". https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Don't manually generate default.conf in server, use IPAChangeConfRob Crittenden2018-01-041-17/+38
| | | | | | | Related: https://pagure.io/freeipa/issue/7218 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Custodia uninstall: Don't fail when LDAP is downChristian Heimes2017-12-203-7/+36
| | | | | | | | | | | The Custodia instance is removed when LDAP is already shut down. Don't fail and only remove the key files from disk. The server_del command takes care of all Custodia keys in LDAP. https://pagure.io/freeipa/issue/7318 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Use pylint 1.7.5 with fix for bad python3 importChristian Heimes2017-12-191-1/+1
| | | | | | Closes: https://pagure.io/freeipa/issue/7315 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com>
* Enable ephemeral KRA requestsRob Crittenden2017-12-154-29/+58
| | | | | | | | | | | | Enabling ephemeral KRA requests will reduce the amount of LDAP write operations and improve overall performance. Re-order some imports and shorten some lines to make pep8 happy. Fixes: https://pagure.io/freeipa/issue/6703 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Make the path to CS.cfg a class variableRob Crittenden2017-12-155-29/+45
| | | | | | | | | | | | | | Rather than passing around the path to CS.cfg for the CA and KRA set it at object creation and use everywhere. Make update_cert_config() a real class method instead of a static method. It wasn't being called that way in any case and makes it possible to use the class config file. Related: https://pagure.io/freeipa/issue/6703 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Don't use admin cert during KRA installationFraser Tweedale2017-12-121-3/+7
| | | | | | | | | | | KRA installation currently imports the admin cert. FreeIPA does not track this cert and it may be expired, causing installation to fail. Do not import the existing admin cert, and discard the new admin cert that gets created during KRA installation. Part of: https://pagure.io/freeipa/issue/7287 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add safe DirectiveSetter context managerChristian Heimes2017-12-122-58/+138
| | | | | | | | | | | | | | | installutils.set_directive() is both inefficient and potentially dangerous. It does not ensure that the whole file is written and properly synced to disk. In worst case it could lead to partially written or destroyed config files. The new DirectiveSetter context manager wraps everything under an easy to use interface. https://pagure.io/freeipa/issue/7312 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 12:16:57 +0000