summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Become IPA 3.1.2release-3-1-2Rob Crittenden2013-01-231-1/+1
|
* Update anonymous access ACI to protect secret attributes.Rob Crittenden2013-01-233-1/+83
| | | | | | | Update anonymous access ACI so that no users besides Trust Admins users can read AD Trust key attributes (ipaNTTrustAuthOutgoing, ipaNTTrustAuthIncoming). The change is applied both for updated IPA servers and new installations.
* Don't initialize NSS if we don't have to, clean up unused cert refsRob Crittenden2013-01-232-13/+30
| | | | | | | | | | | Check to see if NSS is initialized before trying to do so again. If we are temporarily creating a certificate be sure to delete it in order to remove references to it and avoid NSS shutdown issues. In the certificate load validator shut down NSS if we end up initializing it. I'm not entirely sure why but this prevents a later shutdown issue if we are passed the --ca-cert-file option.
* Use secure method to acquire IPA CA certificateJohn Dennis2013-01-236-56/+465
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Major changes ipa-client-install: * Use GSSAPI connection to LDAP server to download CA cert (now the default method) * Add --ca-cert-file option to load the CA cert from a disk file. Validate the file. If this option is used the supplied CA cert is considered definitive. * The insecure HTTP retrieval method is still supported but it must be explicitly forced and a warning will be emitted. * Remain backward compatible with unattended case (except for aberrant condition when preexisting /etc/ipa/ca.crt differs from securely obtained CA cert, see below) * If /etc/ipa/ca.crt CA cert preexists the validate it matches the securely acquired CA cert, if not: - If --unattended and not --force abort with error - If interactive query user to accept new CA cert, if not abort In either case warn user. * If interactive and LDAP retrieval fails prompt user if they want to proceed with insecure HTTP method * If not interactive and LDAP retrieval fails abort unless --force * Backup preexisting /etc/ipa/ca.crt in FileStore prior to execution, if ipa-client-install fails it will be restored. Other changes: * Add new exception class CertificateInvalidError * Add utility convert_ldap_error() to ipalib.ipautil * Replace all hardcoded instances of /etc/ipa/ca.crt in ipa-client-install with CACERT constant (matches existing practice elsewhere). * ipadiscovery no longer retrieves CA cert via HTTP. * Handle LDAP minssf failures during discovery, treat failure to check ldap server as a warninbg in absebce of a provided CA certificate via --ca-cert-file or though existing /etc/ipa/ca.crt file. Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Rob Crittenden <rcritten@redhat.com>
* Do SSL CA verification and hostname validation.Rob Crittenden2013-01-231-2/+2
|
* Update plugin to upload CA certificate to LDAPAlexander Bokovoy2013-01-231-0/+56
| | | | | | Define post-update plugin to upload public CA certificate to IPA LDAP server. The plugin includes also update file that creates default container for the certificate.
* Upload CA cert in the directory on installSimo Sorce2013-01-233-1/+24
| | | | | This will later allow clients to securely download the CA cert by performaing mutual auth using LDAP with GSSAPI
* Installer should not connect to 127.0.0.1Martin Kosek2013-01-212-3/+3
| | | | | | | | | | | | | IPA installer sometimes tries to connect to the Directory Server via loopback address 127.0.0.1. However, the Directory Server on pure IPv6 systems may not be listening on this address. This address may not even be available. Rather use the FQDN of the server when connecting to the DS to fix this issue and make the connection consistent ldapmodify calls which also use FQDN instead of IP address. https://fedorahosted.org/freeipa/ticket/3355
* Upgrade process should not crash on named restartMartin Kosek2013-01-151-2/+9
| | | | | | | | | | | | When either dirsrv or krb5kdc is down, named service restart in ipa-upgradeconfig will fail and cause a crash of the whole upgrade process. Rather only report a failure to restart the service and continue with the upgrade as it does not need the named service running. Do the same precaution for pki-ca service restart. https://fedorahosted.org/freeipa/ticket/3350
* Raise ValidationError for incorrect subtree option.Ana Krivokapic2013-01-141-1/+4
| | | | Ticket: https://fedorahosted.org/freeipa/ticket/3233
* Sort LDAP updates properlyMartin Kosek2013-01-111-19/+16
| | | | | | | | | | | | LDAP updates were sorted by number of RDNs in DN. This, however, sometimes caused updates to be executed before cn=schema updates. If the update required an objectClass or attributeType added during the cn=schema update, the update operation failed. Fix the sorting so that the cn=schema updates are always run first and then the other updates sorted by RDN count. https://fedorahosted.org/freeipa/ticket/3342
* Avoid CRL migration error messageMartin Kosek2013-01-111-3/+7
| | | | | | | | | | | | | | When CRL files are being migrated to a new directory, the upgrade log may contain an error message raised during MasterCRL.bin symlink migration. This is actually being caused by `chown' operation which tried to chown a symlinked file that was not migrated yet. Sort migrated files before the migration process and put symlinks at the end of the list. Also do not run chown on the symlinks as it is a redundant operation since the symlinked file will be chown'ed on its own. https://fedorahosted.org/freeipa/ticket/3336
* permission-find no longer crashes with --targetgroupMartin Kosek2013-01-112-2/+26
| | | | | | | | Target Group parameter was not processed correctly which caused permission-find to always crash when this search parameter was used. Fix the crash and create a unit test case to avoid future regression. https://fedorahosted.org/freeipa/ticket/3335
* Convert uniqueMember members into DN objects.Rob Crittenden2013-01-111-3/+9
| | | | | | | We were asserting that they should be DN objects but weren't converting them anywhere. https://fedorahosted.org/freeipa/ticket/3339
* Become IPA 3.1.1release-3-1-1Rob Crittenden2013-01-081-1/+1
|
* Allow PKI-CA Replica Installs when CRL exceeds default maxber valueJR Aquino2013-01-081-0/+1
| | | | https://fedorahosted.org/freeipa/ticket/3314
* Do not crash when Kerberos SRV record is not foundMartin Kosek2013-01-021-2/+3
| | | | | | | | ipa-client-install crashed when IPA server realm TXT record was configured, but the referred domain (lower-case realm value) did not contain any Kerberos SRV record (_kerberos._udp.<realm>.) https://fedorahosted.org/freeipa/ticket/3316
* Cookie Expires date should be locale insensitiveJohn Dennis2012-12-202-37/+20
| | | | | | | | | | | | | | | | | | | | | | | The Expires attribute in a cookie is supposed to follow the RFC 822 (superseded by RFC 1123) date format. That format includes a weekday abbreviation (e.g. Tue) which must be in English according to the RFC's. ipapython/cookie.py has methods to parse and format the Expires attribute but they were based on strptime() and strftime() which respects the locale. If a non-English locale is in effect the wrong date string will be produced and/or it won't be able to parse the date string. The fix is to use the date parsing and formatting functions from email.utils which specifically follow the RFC's and are not locale sensitive. This patch also updates the unit test to use email.utils as well. The patch should be applied to the following branches: Ticket: https://fedorahosted.org/freeipa/ticket/3313
* Fix delegation-find command --group handlingMartin Kosek2012-12-192-1/+41
| | | | | | | | A wrong way of handling --group DN object caused Internal Error for this command. Fix that and also provide unit tests to avoid another regression. https://fedorahosted.org/freeipa/ticket/3311
* Log info on failure to connectSimo Sorce2012-12-191-0/+2
| | | | | | When multiple servers are avilable we were simply suppressing information on why a connection failed. Log it as 'info' so that it is possible to diagnose issues more easily.
* Enable SSSD on client installMartin Kosek2012-12-181-0/+18
| | | | | | | | | | | authconfig component changed its behavior. It no longer starts and enables SSSD daemon when --enablesssd and --enablesssdauth options are used. It only enables the PAM module and adds SSSD to nsswitch. Enable SSSD on new client/server installs manually. Also make sure that we stop&disable SSSD when we delete the configuration. https://fedorahosted.org/freeipa/ticket/3307
* Forbid overlapping rid ranges for the same id rangeTomas Babej2012-12-172-18/+103
| | | | | | | | | Creating an id range with overlapping primary and secondary rid range using idrange-add or idrange-mod command now raises ValidationError. Unit tests have been added to test_range_plugin.py. https://fedorahosted.org/freeipa/ticket/3171
* Relax restriction for leading/trailing whitespaces in *-find commandsTomas Babej2012-12-113-5/+5
| | | | | | | | All *-find commands now enable leading/trailing whitespaces in the search phrase. Behaviour has been implemented directly into crud.Search class. IPA_API_VERSION_MINOR incremented to 45. https://fedorahosted.org/freeipa/ticket/2981
* Raise ValidationError when CSR does not have a subject hostnameLynn Root2012-12-111-0/+4
| | | | | | Raise ValidationError when CSR does not have a subject hostname. Ticket: https://fedorahosted.org/freeipa/ticket/3123
* Fixed the catch of the hostname option during ipa-server-installLynn Root2012-12-111-1/+1
| | | | | | Originally ipa-server-install would still prompt for the hostname even if it's supplied in the initial installation command. Ticket: https://fedorahosted.org/freeipa/ticket/2692
* Add Lynn Root to Contributors.txtMartin Kosek2012-12-111-0/+1
|
* Become IPA 3.1.0release-3-1-0Rob Crittenden2012-12-101-2/+2
|
* Compliant client side session cookie behaviorJohn Dennis2012-12-107-80/+1435
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In summary this patch does: * Follow the defined rules for cookies when: - receiving a cookie (process the attributes) - storing a cookie (store cookie + attributes) - sending a cookie + validate the cookie domain against the request URL + validate the cookie path against the request URL + validate the cookie expiration + if valid then send only the cookie, no attribtues * Modifies how a request URL is stored during a XMLRPC request/response sequence. * Refactors a bit of the request/response logic to allow for making the decision whether to send a session cookie instead of full Kerberous auth easier. * The server now includes expiration information in the session cookie it sends to the client. The server always had the information available to prevent using an expired session cookie. Now that expiration timestamp is returned to the client as well and now the client will not send an expired session cookie back to the server. * Adds a new module and unit test for cookies (see below) Formerly we were always returning the session cookie no matter what the domain or path was in the URL. We were also sending the cookie attributes which are for the client only (used to determine if to return a cookie). The attributes are not meant to be sent to the server and the previous behavior was a protocol violation. We also were not checking the cookie expiration. Cookie library issues: We need a library to create, parse, manipulate and format cookies both in a client context and a server context. Core Python has two cookie libraries, Cookie.py and cookielib.py. Why did we add a new cookie module instead of using either of these two core Python libaries? Cookie.py is designed for server side generation but can be used to parse cookies on the client. It's the library we were using in the server. However when I tried to use it in the client I discovered it has some serious bugs. There are 7 defined cookie elements, it fails to correctly parse 3 of the 7 elements which makes it unusable because we depend on those elements. Since Cookie.py was designed for server side cookie processing it's not hard to understand how fails to correctly parse a cookie because that's a client side need. (Cookie.py also has an awkward baroque API and is missing some useful functionality we would have to build on top of it). cookielib.py is designed for client side. It's fully featured and obeys all the RFC's. It would be great to use however it's tightly coupled with another core library, urllib2.py. The http request and response objects must be urllib2 objects. But we don't use urllib2, rather we use httplib because xmlrpclib uses httplib. I don't see a reason why a cookie library should be so tightly coupled to a protocol library, but it is and that means we can't use it (I tried to just pick some isolated entrypoints for our use but I kept hitting interaction/dependency problems). I decided to solve the cookie library problems by writing a minimal cookie library that does what we need and no more than that. It is a new module in ipapython shared by both client and server and comes with a new unit test. The module has plenty of documentation, no need to repeat it here. Request URL issues: We also had problems in rpc.py whereby information from the request which is needed when we process the response is not available. Most important was the requesting URL. It turns out that the way the class and object relationships are structured it's impossible to get this information. Someone else must have run into the same issue because there was a routine called reconstruct_url() which attempted to recreate the request URL from other available information. Unfortunately reconstruct_url() was not callable from inside the response handler. So I decided to store the information in the thread context and when the request is received extract it from the thread context. It's perhaps not an ideal solution but we do similar things elsewhere so at least it's consistent. I removed the reconstruct_url() function because the exact information is now in the context and trying to apply heuristics to recreate the url is probably not robust. Ticket https://fedorahosted.org/freeipa/ticket/3022
* Use DN objects for Dogtag configurationPetr Viktorin2012-12-101-6/+12
| | | | | Use our DN objects for generating DNs, instead of relying on string operations.
* Configuring CA with ConfigParser.Endi Sukma Dewata2012-12-102-79/+86
| | | | | | | | | The configuration code has been modified to use the ConfigParser to set the parameters in the CA section in the deployment configuration. This allows IPA to define additional PKI subsystems in the same configuration file. PKI Ticket #399 (https://fedorahosted.org/pki/ticket/399)
* Fix sshd feature checkMartin Kosek2012-12-101-4/+8
| | | | | | | | | | | OpenSSH server included in Fedora 18 raises a validation error when the tested AuthorizedKeysCommand/PubKeyAgent option is tested with an empty value. It requires a command with an absolute path to be passed. Due to this issue, sshd support is never configured on Fedora 18. Pass the real agent we will use later to the testing command to avoid this error.
* ipa-kdb: Support Windows 2012 ServerAlexander Bokovoy2012-12-071-15/+253
| | | | | | | | | | | Windows 2012 Server changed procedure how KERB_VALIDATION_INFO ([MS-PAC] section 2.5) is populated. Detailed description is available in [MS-KILE] version 25.0 and above. Refactor KERB_VALIDATION_INFO verification and ensure we filter out extra SIDs in case they belong to our domain. https://fedorahosted.org/freeipa/ticket/3231
* Stop and disable conflicting time&date servicesMartin Kosek2012-12-079-5/+146
| | | | | | | | | | | | | | | | | | | | Fedora 16 introduced chrony as default client time&date synchronization service: http://fedoraproject.org/wiki/Features/ChronyDefaultNTP Thus, there may be people already using chrony as their time and date synchronization service before installing IPA. However, installing IPA server or client on such machine may lead to unexpected behavior, as the IPA installer would configure ntpd and leave the machine with both ntpd and chronyd enabled. However, since the OS does not allow both chronyd and ntpd to be running concurrently and chronyd has the precedence, ntpd would not be run on that system at all. Make sure, that user is warned when trying to install IPA on such system and is given a possibility to either not to let IPA configure ntpd at all or to let the installer stop and disable chronyd. https://fedorahosted.org/freeipa/ticket/2974
* Add OCSP and CRL URIs to certificatesMartin Kosek2012-12-077-40/+256
| | | | | | | | | | | | | | | | | Modify the default IPA CA certificate profile to include CRL and OCSP extensions which will add URIs to IPA CRL&OCSP to published certificates. Both CRL and OCSP extensions have 2 URIs, one pointing directly to the IPA CA which published the certificate and one to a new CNAME ipa-ca.$DOMAIN which was introduced as a general CNAME pointing to all IPA replicas which have CA configured. The new CNAME is added either during new IPA server/replica/CA installation or during upgrade. https://fedorahosted.org/freeipa/ticket/3074 https://fedorahosted.org/freeipa/ticket/1431
* Reorder XML-RPC initialization in ipa-join to avoid segfault.Rob Crittenden2012-12-071-7/+12
| | | | | | | | | | | There were a number of code paths where we would try to call xmlrpc_env_clean() without having first called xmlrpc_env_init() Re-order the code so we always initialize the XML-RPC client first. I also noticed a place where the return value of strdup() was not being checked for NULL. https://fedorahosted.org/freeipa/ticket/3275
* Bump 389-ds-base minimum in our spec fileMartin Kosek2012-12-072-3/+6
| | | | | Our code needs both Requires and BuildRequires set to 389-ds-base which supports transactions. Also add the requires to configure.ac.
* Password change in a transaction, ensure passwords are truly expiredRob Crittenden2012-12-073-4/+34
| | | | | | | | | | Wrap the password change extop in a transaction. Fix the case where a password is reset and then immediately used. If done fast enough then the KDC may not detect that the password is expired and grant access using the expired password rather than prompting for a reset. https://fedorahosted.org/freeipa/ticket/1064
* Better error message for login of users from other realmsPetr Vobornik2012-12-063-12/+43
| | | | | | | | | | | When user from other realm than FreeIPA's tries to use Web UI (login via forms-based auth or with valid trusted realm ticket), he gets an unauthorized error with X-Ipa-Rejection-Reason=denied. Web UI responds with showing login dialog with following error message: 'Sorry you are not allowed to access this service.'. Note: such users are not supported because they don't have a corresponding entry in LDAP which is needed for ACLs. https://fedorahosted.org/freeipa/ticket/3252 denied change
* Set min for selinux-policy to 3.11.1-60Rob Crittenden2012-12-061-1/+5
| | | | | | This fixes errors including sssd domain mapping in krb5.conf (#873429) https://fedorahosted.org/freeipa/ticket/3132
* Add the includedir to krb5.conf on upgradesJakub Hrozek2012-12-061-0/+16
| | | | https://fedorahosted.org/freeipa/ticket/3132
* Specify includedir in krb5.conf on new installsJakub Hrozek2012-12-063-2/+9
| | | | https://fedorahosted.org/freeipa/ticket/3132
* ipachangeconf: allow specifying non-default delimeter for optionsJakub Hrozek2012-12-061-12/+23
| | | | https://fedorahosted.org/freeipa/ticket/3132
* Add detection for users from trusted/invalid realmsTomas Babej2012-12-064-18/+55
| | | | | | | | | | | | When user from other realm than FreeIPA's tries to use Web UI (login via forms-based auth or with valid trusted realm ticket), the 401 Unauthorized error with X-Ipa-Rejection-Reason=denied is returned. Also, the support for usernames of the form user@SERVER.REALM or user@server.realm was added. https://fedorahosted.org/freeipa/ticket/3252
* Improve ipa-replica-prepare error messageMartin Kosek2012-12-061-4/+17
| | | | | | | | | When DNS zone/record manipulation commands fails for example due to a ValidationError, ipa-replica-prepapre reports a whole traceback which is difficult to read. Make sure our error error is more readable. https://fedorahosted.org/freeipa/ticket/3283
* Only update the list of running services in the installer or ipactl.Rob Crittenden2012-12-053-6/+25
| | | | | | | | The file is only present in the case of a server installation. It should only be touched by the server installer and ipactl. https://fedorahosted.org/freeipa/ticket/3277
* Honor the kdb options disabling KDC writes in ipa_lockout pluginRob Crittenden2012-12-051-1/+119
| | | | | | | | | | | | | Ther3 are two global ipaConfig options to disable undesirable writes that have performance impact. The "KDC:Disable Last Success" will disable writing back to ldap the last successful AS Request time (successful kinit) The "KDC:Disable Lockout" will disable completely writing back lockout related data. This means lockout policies will stop working. https://fedorahosted.org/freeipa/ticket/2734
* Better licensing information of 3rd party codePetr Vobornik2012-12-051-0/+566
| | | | | | | README-LICENSE.txt file with licensing information of third party code used by Web UI in production or development was added. https://fedorahosted.org/freeipa/ticket/3281
* Change network configuration fileMartin Kosek2012-12-057-18/+154
| | | | | | | | | | | Fedora+systemd changed deprecated /etc/sysconfig/network which was used by IPA to store static hostname for the IPA machine. See https://bugzilla.redhat.com/show_bug.cgi?id=881785 for details. Change Fedora platform files to store the hostname to /etc/hostname instead. https://fedorahosted.org/freeipa/ticket/3279
* Add Lubomir Rintel to Contributors.txtPetr Viktorin2012-12-041-0/+1
|
* Drop unused readline importLubomir Rintel2012-12-041-1/+1
| | | | | | | | | | | | | | | | | | | The actual readline usage was removed in commit f19218f7 (Remove duplicate and unused utility code, https://fedorahosted.org/freeipa/ticket/2650) and the import remained. Readline should not be initialized if the output is not to terminal (and it does no checks itself, so import in anything that would be useful to redirect should be conditional), since it may garble the output [1]: $ TERM=xterm python -c 'import readline' |hexdump -C 00000000 1b 5b 3f 31 30 33 34 68 |.[?1034h| 00000008 [1] https://bugzilla.redhat.com/show_bug.cgi?id=304181#c1 https://fedorahosted.org/freeipa/ticket/2691 https://fedorahosted.org/freeipa/ticket/3276
generated by cgit (git 2.34.1) at 2024-05-05 14:05:54 +0000