summaryrefslogtreecommitdiffstats
path: root/ipa-server/ipaserver/dsinstance.py
Commit message (Collapse)AuthorAgeFilesLines
* Better detection of DS not starting.Rob Crittenden2008-04-141-3/+23
| | | | | | | The dirsrv init script always returns 0 on status checks, even if an instance is not started. So we have to look through the output instead. 442452
* Make the memberof task a public function.Rob Crittenden2008-03-271-9/+16
| | | | | | | | | | | | | | This is used when a new replica is created as well as whenever a replica is re-initialized from another master. In order for this to work when not creating an instance the __init__ function needs to be able to determine the suffix and the dm_password is needed. I've also added the time to the RDN of the member task to ensure uniqueness. 438222
* Fix boot.ldif generation, the domain name component must be derivedSimo Sorce2008-03-041-1/+1
| | | | | from the realm not the domain. One line fix.
* Make sure all entries are generated by us according to IPASimo Sorce2008-02-281-0/+21
| | | | | default tree. This patch make sure that the DS setup script does not add unwanted entries.
* Don't log passwords in ipaserver-install.logRob Crittenden2008-02-261-2/+4
| | | | 433509
* Make sure KrbPrincipalName is unique server-wideSimo Sorce2008-02-211-0/+4
|
* cosmetic fixesSimo Sorce2008-02-211-4/+5
|
* Verify current domain with user during installationRob Crittenden2008-02-151-2/+2
| | | | | | Use that domain when creating replicas Resolves 432066
* Set the license uniformly to GPLv2 only.Rob Crittenden2008-02-041-1/+1
|
* Use file to store the current CA serial numberRob Crittenden2008-02-051-2/+1
| | | | | | | No longer create a PKCS#12 file that contains the CA No longer send the entire CA to each replica, generate the SSL certs on master Fix number of bugs in ipa-replica-install and prepare Produce status output during replica creation
* Fix misspelling of the word indices.Rob Crittenden2008-01-251-3/+3
|
* Initialise DsInstance.pkcs12_infoMark McLoughlin2008-01-221-0/+1
| | | | | | | | DsInstance.pkcs12_info isn't currently initialised in the constructore so, e.g. __enable_ssl() assumes that create_instance() has initialised it. Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* Small refactor of dsinstance.config_dirname()Mark McLoughlin2008-01-221-11/+11
| | | | | | | | | | | | | If, in future, we change the server ID so that it's not derived from the realm name, there's a fair few places that need to be changed. Make that easier by having config_dirname() take the server ID rather than the realm name. That makes sense anyway so we don't have to realm_to_serverid() so much. Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* Remove questions from ipaserver.dsinstanceMark McLoughlin2008-01-221-22/+6
| | | | | | | | | | | | | Let's assume that all ipaserver.dsinstance could be used somewhere where asking questions on stdout/stdin is not approriate and re-factor the code to be suitable in those situations too. i.e. make check_existing_installation() return a list of server IDs and make check_ports() return an (unsecure, secure) tuple indication which ports are in use. Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* Fix issues reported by rpmlint.Rob Crittenden2008-01-181-1/+0
| | | | | | | | | | | | | | - Removing shebangs (#!) from a bunch of python libraries - Don't use a variable name in init scripts for the lock file - Keep the init script name consistent with the binary name, so renamed ipa-kpasswd.init to ipa_kpasswd.init - Add status option to the init scripts - Move most python scripts out of /usr/share/ipa and into the python site-packages directories (ipaserver and ipaclient) - Remove unnecessary sys.path.append("/usr/share/ipa") - Fix the license string in the spec files - Rename ipa-webgui to ipa_webgui everywhere - Fix a couple of issues reported by pychecker in ipa-python
* Add ipa-server-install --uninstallMark McLoughlin2008-01-111-0/+25
| | | | | | | | Add a --uninstall option to ipa-server-install which tries to restore the system to the way it was before ipa-server-install was run using the state backed up through sysrestore.py. Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* Backup system state in ipa-server-installRob Crittenden2008-01-141-1/+12
| | | | | | | | | | | | | This patch adds a sysrestore module which allows ipa-server-install code to backup any system state so that it can be restored again with e.g. ipa-server-install --uninstall. The idea is that any files ipa-server-install modifies gets backed up to /var/cache/ipa/sysrestore/ while any "meta" state, like whether a service is enabled with chkconfig, is saved to /var/cache/ipa/sysrestore.state. Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* Use service.py helpersMark McLoughlin2008-01-111-1/+1
| | | | | | | In dsinstance.py, there's one place we could use the service.py helpers where we don't currently. Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* Correct serial number for ds certs.Karl MacMillan2007-12-211-1/+1
|
* Convert replication to use the new cert infrastructure andKarl MacMillan2007-12-201-11/+14
| | | | | | correctly issue certs from the same authority. Also remove support for read-only replicas since that work will not be finished and tested for 1.0.
* Refactor krbinstance and dsinstance creation stepsMark McLoughlin2007-12-131-49/+34
| | | | | | | | | | | | | | | | | | | | Creation steps are currently done with: self.start_creation(2, "Create foo") self.step("do foo") self.foo() self.step("do bar") self.bar() self.done_creation() This patch refactors that into the much more straightforward: self.step("do foo", self.foo) self.step("do bar", self.bar) self.start_creation("Create foo") Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* Don't template files which don't contain variablesMark McLoughlin2007-12-131-16/+25
| | | | | | | | | | | | The following files hav no template variables, so don't bother templating them: - memberof-conf.ldif - referint-conf.ldif - dna-conf.ldif - certmap.conf.template Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* Refactor dsinstance ldap modify codeMark McLoughlin2007-12-131-74/+23
| | | | | | | | | | | | | | Just a patch to refactor lots of similar code in dsinstance and krbinstance using a simple helper method. Note, there are some differences: - Some code used to call ldapmodify without -h 127.0.0.1 - Some of the code used to just print an error rather than using logging.critical() - Some code used to log some extra debug Signed-off-by: Mark McLoughlin <markmc@redhat.com>
* User provided certs.Karl MacMillan2007-12-121-1/+1
|
* Convert the setup of ssl from a shell script to aKarl MacMillan2007-12-061-7/+32
| | | | | python module. This is in preparation for user supplied certs.
* Add default e-mail domain to the IPA configurationRob Crittenden2007-12-101-1/+3
|
* Fix errors with ipautil.CalledProcessError and cleanup some imports.Karl MacMillan2007-12-041-38/+37
|
* Compatibility changes to work on RHEL 5 with python 2.4rcritten@redhat.com2007-11-301-14/+13
|
* Initial replication setup.Karl MacMillan2007-11-211-25/+79
| | | | | | | | | | | | | | | | | | | This add replication setup through two new commands: ipa-replica-prepare and ipa-replica-install. The procedure is to run ipa-replica-prepare on an existing master. This will collect information about the realm and the current master and create a file storing all of the information. After copying that file to the new replica, ipa-replica-install is run (with -r to create a read-only replica). This version of the patch also includes fixes for the sasl mappings on the replicas. Remaining features: - ssl for replication. - automatic configuration of mesh topology for master (or a simpler way to replicate multiple masters. - tool for view / configuring current replication.
* Enable group inactivation by using the Class of Service plugin.Rob Crittenden2007-11-201-1/+1
| | | | | | | | | | | | | | | | | | | | This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active.
* Minor fixes.Karl MacMillan2007-11-191-1/+1
|
* Fix installationSimo Sorce2007-11-181-0/+2
| | | | | Add missing schema for GUI Config, and missing objectclass for cn=accounts container
* Initialize memberof patch from Pete Rowley.Karl MacMillan2007-11-151-1/+15
|
* Add posix auto gen for single master casePete Rowley2007-11-061-0/+34
|
* Introduce service base class and clean up ipa-server-installKarl MacMillan2007-11-051-26/+28
| | | | | | | | | | | | 1) Add a base class for all of the instance objects. 2) Normalize usage of logging. 3) General cleanups of ipa-server-install. 4) Make better use of httpinstance. 5) Add webguiinstance. 6) Improve progress reporting during installation. Works Here (TM), but it would be nice to get someone else to test since this moves code around a bit.
* merge initial radius workJohn Dennis2007-11-031-0/+2
|
* Enable referential integrity plugin.Karl MacMillan2007-11-051-0/+10
|
* NTP configuration for client and server.Karl MacMillan2007-11-011-2/+0
| | | | | | | | Configure ipa servers as an ntp server and clients to (by default) us the ipa server as an ntp server. Also corrected the messages about which ports should be opened.
* Create LDAP indeces on installation for fields the web GUI searches againstRob Crittenden2007-10-301-0/+14
|
* Remove the use of uuid in the directory server instance name.Karl MacMillan2007-10-191-13/+1
| | | | | | | The use of a uuid for the DS instance name is overkill and it is a real pain. This patch will use ipa-realm-name instead (resulting in something like slapd-EXAMPLE-COM). All periods are converted to "-" because the DS can't handle periods in server ids.
* Enabled memberof pluginRob Crittenden2007-10-161-0/+13
|
* Add inetUser objectclass. Remove test-users ldif.Kevin McCarthy2007-10-111-9/+0
|
* Karl MacMillan wrote:Karl MacMillan2007-10-091-1/+5
| | | | | | | | | | | | | > > This largish patch makes the build and installation work on 64bit > > machines. The only catch here is that to get a 64bit build you need to > > set LIBDIR on make: > > > > make install LIBDIR=/usr/lib64 > > > > The spec file does this correctly. I couldn't find any reliable way to > > guess this that works both on real systems and in the almost entirely > > empty rpm build root (you can't, for example, check for the existence > > of /usr/lib64).
* Try to catch more error conditions during installationrcritten@redhat.com2007-10-031-13/+41
| | | | | | Modify the way we detect SELinux to use selinuxenabled instead of using a try/except. Handle SASL/GSSAPI authentication failures when getting a connection
* Misc small fixesKarl MacMillan2007-09-281-1/+1
| | | | | | | * Remove the rpmbuild tree with the dist-clean target. * Move ipa-server-setupssl from /usr/sbin to /usr/share/ipa * Check in requirement change for generated freeipa-python.spec * Fix interactive hostname in ipa-server-install.
* Fix dsinstance.py and krbinstance.py importsKevin McCarthy2007-09-061-1/+1
|
* Add password request for admin userSimo Sorce2007-08-311-8/+19
| | | | | | | | | Set password for admin user using the Directory Mangaer account and the mozldapldappaswd binary to get and SSL connection Fix some timeout problems with deploying keytabs Fix ipa_pwd_extop to actuallt correctly detect an SSL connection Do not ask for the user to use for the directory unless 'dirsrv' is an existing user which may clash, create it silently
* in F7 all directory names have changed from fedora-ds to dirsrvSimo Sorce2007-08-151-7/+7
| | | | which should also be the name used in DS 8.0, change all occurences
* - Abstracted client class to work directly or over RPCrcritten@redhat.com2007-08-061-1/+21
| | | | | | | | | | | - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires - Remove references to admin server in ipa-server-setupssl - Generate a client certificate for the XML-RPC server to connect to LDAP with - Create a keytab for Apache - Create an ldif with a test user - Provide a certmap.conf for doing SSL client authentication - Update tools to use kerberos - Add User class
* Fix typo / buglets in setup scripts.Karl MacMillan2007-08-011-10/+9
| | | | Add fallback to ds_newinst.pl.
generated by cgit (git 2.34.1) at 2025-09-04 14:34:52 +0000