summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add autodiscovery section in ipa-client-install man pagesMartin Kosek2013-02-191-6/+28
| | | | | | | Explain how autodiscovery and failover works and which options are important for these elements. https://fedorahosted.org/freeipa/ticket/3383
* Run interactive_prompt callbacks after CSV values are split.Jan Cholasta2013-02-192-8/+36
| | | | https://fedorahosted.org/freeipa/ticket/3334
* ipasam: use base scope when fetching domain information about own domainAlexander Bokovoy2013-02-191-1/+1
| | | | | | | | | Since we use associatedDomain attribute to store information about UPN suffixes and our own domain, searching subtree is going to return more than one entry. Limit search for own domain by base scope as we only need to fetch our own domain information here, not UPN suffixes. Required for https://fedorahosted.org/freeipa/ticket/2945
* Add list of domains associated to our realm to cn=etcAna Krivokapic2013-02-199-1/+369
| | | | | | | | | Add new LDAP container to store the list of domains associated with IPA realm. Add two new ipa commands (ipa realmdomains-show and ipa realmdomains-mod) to allow manipulation of the list of realm domains. Unit test file covering these new commands was added. https://fedorahosted.org/freeipa/ticket/2945
* In topic help text, mention how to get help for commandsPetr Viktorin2013-02-181-0/+3
| | | | | | | This should prevent user confusion when topic help is requested unintentionally, for example with `ipa help ping`. See https://fedorahosted.org/freeipa/ticket/3247
* Add tests for the help command & --help optionsPetr Viktorin2013-02-182-3/+136
| | | | | | | | | Move the parser setup from bootstrap_with_global_options to bootstrap, so all API objects have access to it. Add some CLI tests for the help system. Part of the effort for https://fedorahosted.org/freeipa/ticket/3060
* Parse command arguments before creating a contextPetr Viktorin2013-02-181-1/+1
| | | | | | | This allows users to run `ipa COMMAND --help` even without Kerberos credentials. Part of the effort for https://fedorahosted.org/freeipa/ticket/3060
* Mention `ipa COMMAND --help` as the preferred way to get command helpPetr Viktorin2013-02-182-2/+5
| | | | | | | | | This avoids the problem with ambiguous command/topic names. No functionality is changed; `ipa help <COMMAND>` still works as before if there's no topic with the same name. https://fedorahosted.org/freeipa/ticket/3247
* Add command summary to `ipa COMMAND --help` outputPetr Viktorin2013-02-181-2/+2
| | | | | | This makes the output identical to `ipa help COMMAND`. Part of the effort for https://fedorahosted.org/freeipa/ticket/3060
* Simplify `ipa help topics` outputPetr Viktorin2013-02-181-10/+3
| | | | | | | This brings the output closer to `ipa help commands` and removes extraneous information. Part of the effort for https://fedorahosted.org/freeipa/ticket/3060
* Store the OptionParser in the API, use it to print unified help messagesPetr Viktorin2013-02-182-7/+5
| | | | | | | | | Make `ipa -h` and `ipa help` output the same message. Since `ipa -h` output is generated by the OptionParser, we need to make the parser available. Store it in `api.parser`. Part of the effort for https://fedorahosted.org/freeipa/ticket/3060
* Print help to stderr on errorPetr Viktorin2013-02-181-30/+46
| | | | | | | | | | | Whenever a command is used incorrectly, it should output an error message (and possibly additional help) to stderr. This patch adds a parameter to a bunch of places to allow selecting either stdout or stderr for help output, and makes badly called commands output to stderr only. Part of the effort for https://fedorahosted.org/freeipa/ticket/3060
* Improve `ipa --help` outputPetr Viktorin2013-02-181-7/+30
| | | | | | | | | | | | | | | Fix the usage string to match actual usage. Add command description. Put information about `ipa help topics` etc. to the epilog, instead of using empty option groups. Use a custom formatter to preserve newlines. Add the -h/--help option manually to ensure consistent case (capital S). Part of the effort for https://fedorahosted.org/freeipa/ticket/3060
* Allow ipa-replica-conncheck and ipa-adtrust-install to read krb5 includedirJakub Hrozek2013-02-182-2/+2
| | | | https://fedorahosted.org/freeipa/ticket/3132
* Add option to specify SID using domain name to idrange-add/modTomas Babej2013-02-183-15/+95
| | | | | | | | | | When adding/modifying an ID range for a trusted domain, the newly added option --dom-name can be used. This looks up SID of the trusted domain in LDAP and therefore the user is not required to write it down in CLI. If the lookup fails, error message asking the user to specify the SID manually is shown. https://fedorahosted.org/freeipa/ticket/3133
* ipa-kdb: Free talloc autofree context when module is closedsbose2013-02-141-0/+3
| | | | | | | | | | | | | | | Currently kdb5kdc crashes on exit if the ipadb KDB modules is loaded and trusts are configured. The reason is the talloc autofree context which get initialised during the ndr_push_union_blob() call. On exit the KDC module is unloaded an later on atexit() tries to free the context, but all related symbols are already unloaded with the module. This patch frees the talloc autofree context during the cleanup routine of the module. Since this is called only at exit and not during normal operations this is safe even if other KDC plugins use the talloc autofree context, e.g. via some Samba libraries, as well. Fixes https://fedorahosted.org/freeipa/ticket/3410
* ipa-kdb: fix retry logic in ipadb_deref_searchMartin Kosek2013-02-141-1/+1
| | | | | | | | This function retried an LDAP search when the result was OK due to flawed logic of retry detection (ipadb_need_retry function which returns true when we need retry and not 0). https://fedorahosted.org/freeipa/ticket/3413
* ipa-kdb: remove memory leaksMartin Kosek2013-02-144-2/+25
| | | | | | | | All known memory leaks caused by unfreed allocated memory or unfreed LDAP results (which should be also done after unsuccessful searches) are fixed. https://fedorahosted.org/freeipa/ticket/3413
* Fix hbachelp examples formattingMartin Kosek2013-02-141-23/+23
| | | | | | Add correct labeling of matched/nonmatched output attributes. Also make sure that "\" is not interpreted as newline escape character but really as a "\" character.
* Add support for AD users to hbactest commandMartin Kosek2013-02-142-10/+187
| | | | | | | | | | | | | | | | | | | | | How this works: 1. When a trusted domain user is tested, AD GC is searched for the user entry Distinguished Name 2. The user entry is then read from AD GC and its SID and SIDs of all its assigned groups (tokenGroups attribute) are retrieved 3. The SIDs are then used to search IPA LDAP database to find all external groups which have any of these SIDs as external members 4. All these groups having these groups as direct or indirect members are added to hbactest allowing it to perform the search LIMITATIONS: - only Trusted Admins group members can use this function as it uses secret for IPA-Trusted domain link - List of group SIDs does not contain group memberships outside of the trusted domain https://fedorahosted.org/freeipa/ticket/2997
* Do not hide SID resolver error in group-add-memberMartin Kosek2013-02-141-3/+0
| | | | | | | | | When group-add-member does not receive any resolved trusted domain object SID, it raises an exception which hides any useful error message passed by underlying resolution methods. Remove the exception to reveal this error messages to user. https://fedorahosted.org/freeipa/ticket/2997
* Generalize AD GC searchMartin Kosek2013-02-142-54/+100
| | | | | | | | | | | | | | Modify access methods to AD GC so that callers can specify a custom basedn, filter, scope and attribute list, thus allowing it to perform any LDAP search. Error checking methodology in these functions was changed, so that it rather raises an exception with a desription instead of simply returning a None or False value which would made an investigation why something does not work much more difficult. External membership method in group-add-member command was updated to match this approach. https://fedorahosted.org/freeipa/ticket/2997
* Test NetBIOS name clash before creating a trustMartin Kosek2013-02-131-0/+6
| | | | | | | Give a clear message about what is wrong with current Trust settings before letting AD to return a confusing error message. https://fedorahosted.org/freeipa/ticket/3193
* ipa-adtrust-install should ask for SID generationMartin Kosek2013-02-121-6/+42
| | | | | | | | When ipa-adtrust-install is run, check if there are any objects that need have SID generated. If yes, interactively ask the user if the sidgen task should be run. https://fedorahosted.org/freeipa/ticket/3195
* ipa-sam: Fill SID blacklist when trust is addedMartin Kosek2013-02-121-1/+13
| | | | | | | Fill incoming and outgoing trust LDAP entry with default SID blacklist value. https://fedorahosted.org/freeipa/ticket/3289
* ipa-kdb: read SID blacklist from LDAPMartin Kosek2013-02-123-54/+136
| | | | | | | | | | | | SIDs in incoming MS-PAC were checked and filtered with a fixed list of well-known SIDs. Allow reading the SID blacklist from LDAP (ipaNTSIDBlacklistIncoming and ipaNTSIDBlacklistOutgoing) and add the list to mspac adtrust structure. Use the hardcoded SID list only if the LDAP SID list is not configured. LIMITATION: SID blacklist list is not used yet. https://fedorahosted.org/freeipa/ticket/3289
* Add SID blacklist attributesMartin Kosek2013-02-126-13/+65
| | | | | | | | Update our LDAP schema and add 2 new attributes for SID blacklist definition. These new attributes can now be set per-trust with trustconfig command. https://fedorahosted.org/freeipa/ticket/3289
* ipa-kdb: reinitialize LDAP configuration for known realmsMartin Kosek2013-02-121-12/+45
| | | | | | | | | | | | | ipa-kdb did not reinitialize trusted domain configuration when it was loaded to ipa-kdb. However, admin then would have to restart krb5kdc if he wanted to apply the change to running krb5kdc service. Run ipadb_reinit_mspac unconditionally every time when trusted domain is loaded. Among the already configured 1 minute grace time, also add a quick check if there is at least one configured trusted domain before reinitializing the mspac structure. https://fedorahosted.org/freeipa/ticket/3289
* ipa-kdb: avoid ENOMEM when all SIDs are filtered outMartin Kosek2013-02-121-4/+14
| | | | | | | | | When all SIDs in info3.sids structure were filtered out, we tried to talloc_realloc to zero memory size. talloc_realloc then returned NULL pointer and filter_login_info returned with ENOMEM. The code now rather frees the SID array and set info3.sidcount to correct value.
* ipa-kdb: add sentinel for LDAPDerefSpec allocationMartin Kosek2013-02-121-5/+6
| | | | | Without sentinel in place, ldap_create_deref_control_value executed an invalid read in unallocated memory.
* Add trusconfig-show and trustconfig-mod commandsMartin Kosek2013-02-115-8/+377
| | | | | | | | | | | | Global trust configuration is generated ipa-adtrust-install script is run. Add convenience commands to show auto-generated options like SID or GUID or options chosen by user (NetBIOS). Most of these options are not modifiable via trustconfig-mod command as it would break current trusts. Unit test file covering these new commands was added. https://fedorahosted.org/freeipa/ticket/3333
* Fix permission_find test errorMartin Kosek2013-02-081-1/+0
| | | | | Remove extraneous memberindirect_role attribute from permission_find unit test to avoid false negative test result.
* Prevent a crash when no entries are successfully migrated.Rob Crittenden2013-02-081-0/+1
| | | | | | | It would fail in _update_default_group() because migrate_cnt wasn't defined in context. https://fedorahosted.org/freeipa/ticket/3386
* Prevent integer overflow when setting krbPasswordExpirationTomas Babej2013-02-085-13/+50
| | | | | | | | | | | | | | | | Since in Kerberos V5 are used 32-bit unix timestamps, setting maxlife in pwpolicy to values such as 9999 days would cause integer overflow in krbPasswordExpiration attribute. This would result into unpredictable behaviour such as users not being able to log in after password expiration if password policy was changed (#3114) or new users not being able to log in at all (#3312). The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver. https://fedorahosted.org/freeipa/ticket/3312 https://fedorahosted.org/freeipa/ticket/3114
* Raise ValidationError on invalid CSV values.Jan Cholasta2013-02-082-3/+14
| | | | https://fedorahosted.org/freeipa/ticket/3323
* Add LDAP server fallback to client installerRob Crittenden2013-02-074-61/+101
| | | | | | | | | | | | | | Change the discovery code to validate all servers, regardless of where the originated (either via SRV records or --server). This will prevent the client installer from failing if one of those records points to a server that is either not running or is not an IPA server. If a server is not available it is not removed from the list of configured servers, simply moved to the end of the list. If a server is not an IPA server it is removed. https://fedorahosted.org/freeipa/ticket/3388
* Take into consideration services when deleting replicasAna Krivokapic2013-02-061-0/+23
| | | | | | | | When deleting a replica from IPA domain: * Abort if the installation is about to be left without CA * Warn if the installation is about to be left without DNS Ticket: https://fedorahosted.org/freeipa/ticket/2879
* Don't add another nsDS5ReplicaId on updates if one already existsPetr Viktorin2013-02-061-3/+3
| | | | | | | | | | Modify update file to use default: rather than add: in cn=replication,cn=etc,$SUFFIX. Drop quotes around nsDS5ReplicaRoot because default: values are not parsed as CSV. https://fedorahosted.org/freeipa/ticket/3394
* Improve migration performanceRob Crittenden2013-02-051-8/+88
| | | | | | | | | | | | | | | | | | | Add new users to the default users group in batches of 100. The biggest overhead of migration is in calculating the modlist when managing the default user's group and applying the changes. A significant amount of time can be saved by not doing this on every add operation. Some other minor improvements include: Add a negative cache for groups not found in the remote LDAP server. Replace call to user_mod with a direct LDAP update. Catch some occurances of LimitError and handle more gracefully. I also added some debug logging to report on migration status and performance. https://fedorahosted.org/freeipa/ticket/3386
* Make ipapython.dogtag log requests at debug level, not infoPetr Viktorin2013-02-011-1/+1
|
* Port ipa-replica-prepare to the admintool frameworkPetr Viktorin2013-02-013-489/+512
| | | | | | | | | | | | | Break the script into several smaller methods. Use modern idioms: os.path.join instead of string addition; the with statement for closing files. Add --quiet, --verbose, and --log-file options. Use logging instead of print statements. (http://freeipa.org/page/V3/Logging_and_output) Part of: https://fedorahosted.org/freeipa/ticket/2652 Fixes: https://fedorahosted.org/freeipa/ticket/3285
* Better logging for AdminTool and ipa-ldap-updaterPetr Viktorin2013-02-014-58/+116
| | | | | | | | | | | | | - Automatically add a "Logging and output options" group with the --quiet, --verbose, --log-file options. - Set up logging based on these options; details are in the setup_logging docstring and in the design document. - Don't bind log methods as individual methods of the class. This means one less linter exception. - Make the help for command line options consistent with optparse's --help and --version options. Design document: http://freeipa.org/page/V3/Logging_and_output
* Add support for RFC 6594 SSHFP DNS records.Jan Cholasta2013-02-013-3/+21
| | | | https://fedorahosted.org/freeipa/ticket/2642
* Drop ipapython.compat.Jan Cholasta2013-02-016-90/+7
|
* Use fully qualified CCACHE namesMartin Kosek2013-02-015-9/+21
| | | | | | | | | | | | | | Some parts of install scripts used only ccache name as returned by krbV.CCache.name attribute. However, when this name is used again to initialize krbV.CCache object or when it is used in KRB5CCNAME environmental variable, it fails for new DIR type of CCACHE. We should always use both CCACHE type and name when referring to them to avoid these crashes. ldap2 backend was also updated to accept directly krbV.CCache object which contains everything we need to authenticate with ccache. https://fedorahosted.org/freeipa/ticket/3381
* Remove unused krbV importsMartin Kosek2013-02-014-5/+0
| | | | https://fedorahosted.org/freeipa/ticket/3381
* Fix migration for openldap DSMartin Kosek2013-02-012-3/+22
| | | | | | | | | | | | | | | | | openldap server does not store its schema in cn=schema entry, but rather in cn=subschema. Add a fallback to ldap2 plugin to read from this entry when cn=schema is not found. ldap2 plugin uses the schema when doing some of the automatic encoding, like an automatic encoding of DN object. IPA migration plugin DN attribute processing is now also more tolerant when it finds that some DN attribute was not autoencoded. It tries to convert it to DN on its own and report a warning and continue with user processing when the conversion fails instead of crashing with AssertionError and thus abandoning the whole migration run. https://fedorahosted.org/freeipa/ticket/3372
* Fix a typo in ipa-adtrust-install helpTomas Babej2013-01-311-1/+1
| | | | | "Add SIDs for existing users andgroups as the final step" changed to "Add SIDs for existing users and groups as the final step".
* Use new certmonger locking to prevent NSS database corruption.Rob Crittenden2013-01-299-100/+274
| | | | | | | | | | | | | | | | | | | | | | | | dogtag opens its NSS database in read/write mode so we need to be very careful during renewal that we don't also open it up read/write. We basically need to serialize access to the database. certmonger does the majority of this work via internal locking from the point where it generates a new key/submits a rewewal through the pre_save and releases the lock after the post_save command. This lock is held per NSS database so we're save from certmonger. dogtag needs to be shutdown in the pre_save state so certmonger can safely add the certificate and we can manipulate trust in the post_save command. Fix a number of bugs in renewal. The CA wasn't actually being restarted at all due to a naming change upstream. In python we need to reference services using python-ish names but the service is pki-cad. We need a translation for non-Fedora systems as well. Update the CA ou=People entry when he CA subsystem certificate is renewed. This certificate is used as an identity certificate to bind to the DS instance. https://fedorahosted.org/freeipa/ticket/3292 https://fedorahosted.org/freeipa/ticket/3322
* Add the CA cert to LDAP after the CA installPetr Viktorin2013-01-292-2/+4
| | | | | | | | | | | | | The DS is installed before the CA cert is generated. Trying to add the cert to LDAP before it exists resulted in a nasty-looking error message. This moves the cert upload to after the CA cert is ready and the certdb is created. Move the cert upload to after thecertdb is generated. https://fedorahosted.org/freeipa/ticket/3375
generated by cgit (git 2.34.1) at 2025-09-02 08:04:30 +0000