summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins/service.py
Commit message (Collapse)AuthorAgeFilesLines
* Require that hosts be resolvable in DNS. Use --force to ignore warnings.Rob Crittenden2010-08-061-14/+6
| | | | | | | | | | | | | This also requires a resolvable hostname on services as well. I want people to think long and hard about adding things that aren't resolvable. The cert plugin can automatically create services on the user's behalf when issuing a cert. It will always set the force flag to True. We use a lot of made-up host names in the test system, all of which require the force flag now. ticket #25
* Fix replacing a certificate in a service.Rob Crittenden2010-08-061-11/+14
| | | | | | | | | | | | When a service has a certificate and the CA backend doesn't support revocation (like selfsign) then we simply drop the old certificate in preparation for adding a new one. We weren't setting the usercertificate attribute to None so there was nothing to do in ldap_update(). Added a test case for this situation to ensure that re-issuing a certificate works. ticket #88
* Clean up crypto code, take advantage of new nss-python capabilitiesRob Crittenden2010-07-151-20/+5
| | | | | | | | This patch does the following: - drops our in-tree x509v3 parser to use the python-nss one - return more information on certificates - make an API change, renaming cert-get to cert-show - Drop a lot of duplicated code
* Add API to delete a service principal key, service-disable.Rob Crittenden2010-07-131-7/+77
| | | | | | | | | | | | I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
* First pass at per-command documentationRob Crittenden2010-06-221-0/+33
|
* localize doc stringsJohn Dennis2010-03-081-1/+1
| | | | | | | | | | | | A number of doc strings were not localized, wrap them in _(). Some messages were not localized, wrap them in _() Fix a couple of failing tests: The method name in RPC should not be unicode. The doc attribute must use the .msg attribute for comparison. Also clean up imports of _() The import should come from ipalib or ipalib.text, not ugettext from request.
* Code cleanup: remove unused stuff, take 1.Pavel Zuna2010-03-011-6/+0
|
* Don't try to revoke a cert that is already revoked.Rob Crittenden2010-02-261-2/+8
| | | | | We get a bit of an unusual error message back from dogtag when trying to revoke a revoked cert so check its status first.
* Translatable Param.label, Param.docJason Gerard DeRose2010-02-241-4/+4
|
* Use the Output tuple to determine the order of outputRob Crittenden2010-02-151-0/+4
| | | | | | | | | | | | | | The attributes displayed is now dependant upon their definition in a Param. This enhances that, giving some level of control over how the result is displayed to the user. This also fixes displaying group membership, including failures of adding/removing entries. All tests pass now though there is still one problem. We need to return the dn as well. Once that is fixed we just need to comment out all the dn entries in the tests and they should once again pass.
* Add Object.label class attribute, enable in webUIJason Gerard DeRose2010-02-121-0/+2
|
* Be more careful when base64-decoding certificatesRob Crittenden2010-02-021-6/+3
| | | | | Only decode certs that have a BEGIN/END block, otherwise assume it is in DER format.
* Add --all to LDAPCreate and make LDAP commands always display default ↵Pavel Zuna2010-01-111-1/+1
| | | | attributes.
* Handle base64-encoded certificates better, import missing functionRob Crittenden2009-12-181-0/+5
|
* Take 2: Extensible return values and validation; steps toward a single ↵Jason Gerard DeRose2009-12-101-2/+1
| | | | output_for_cli(); enable more webUI stuff
* rebase dogtag clean-up patchJohn Dennis2009-12-091-2/+3
|
* Add NotImplementedError type so CA plugins can return client-friendly errorsRob Crittenden2009-12-011-3/+10
| | | | | | | | Ignore NotImplementedError when revoking a certificate as this isn't implemented in the selfsign plugin. Also use the new type argument in x509.load_certificate(). Certificates are coming out of LDAP as binary instead of base64-encoding.
* Use pyasn1-based PKCS#10 and X509v3 parsers instead of pyOpenSSL.Rob Crittenden2009-11-301-6/+4
| | | | | | | | | The pyOpenSSL PKCS#10 parser doesn't support attributes so we can't identify requests with subject alt names. Subject alt names are only allowed if: - the host for the alt name exists in IPA - if binding as host principal, the host is in the services managedBy attr
* Use a new mechanism for delegating certificate issuance.Rob Crittenden2009-11-031-1/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | Using the client IP address was a rather poor mechanism for controlling who could request certificates for whom. Instead the client machine will bind using the host service principal and request the certificate. In order to do this: * the service will need to exist * the machine needs to be in the certadmin rolegroup * the host needs to be in the managedBy attribute of the service It might look something like: admin ipa host-add client.example.com --password=secret123 ipa service-add HTTP/client.example.com ipa service-add-host --hosts=client.example.com HTTP/client.example.com ipa rolegroup-add-member --hosts=client.example.com certadmin client ipa-client-install ipa-join -w secret123 kinit -kt /etc/krb5.keytab host/client.example.com ipa -d cert-request file://web.csr --principal=HTTP/client.example.com
* Require that a host exist before creating a service for it.Rob Crittenden2009-10-211-0/+5
|
* Make the service plugin use baseldap classes.Pavel Zuna2009-10-051-205/+66
|
* Add external CA signing and abstract out the RA backendRob Crittenden2009-09-151-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | External CA signing is a 2-step process. You first have to run the IPA installer which will generate a CSR. You pass this CSR to your external CA and get back a cert. You then pass this cert and the CA cert and re-run the installer. The CSR is always written to /root/ipa.csr. A run would look like: # ipa-server-install --ca --external-ca -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com -U [ sign cert request ] # ipa-server-install --ca --external-ca -p password -a password --external_cert_file=/tmp/rob.crt --external_ca_file=/tmp/cacert.crt -U -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com This also abstracts out the RA backend plugin so the self-signed CA we create can be used in a running server. This means that the cert plugin can request certs (and nothing else). This should let us do online replica creation. To handle the self-signed CA the simple ca_serialno file now contains additional data so we don't have overlapping serial numbers in replicas. This isn't used yet. Currently the cert plugin will not work on self-signed replicas. One very important change for self-signed CAs is that the CA is no longer held in the DS database. It is now in the Apache database. Lots of general fixes were also made in ipaserver.install.certs including: - better handling when multiple CA certificates are in a single file - A temporary directory for request certs is not always created when the class is instantiated (you have to call setup_cert_request())
* Fix service_mod and add a test caseRob Crittenden2009-08-261-8/+7
|
* Add a new objectclass, ipaObject, that will add a UUID to many IPA objectsRob Crittenden2009-08-101-1/+3
| | | | | | | | | ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
* Fix bug: number of found entries was reported incorrectly in some plugins.Pavel Zuna2009-07-021-1/+1
|
* Fix minor bugs, typos, etc. discovered by unit tests in plugins.Pavel Zuna2009-07-021-1/+1
|
* Rename *-create/*-delete commands to *-add/*-del respectively.Pavel Zuna2009-07-021-4/+4
|
* Rename plugins2 to plugins.Pavel Zuna2009-07-021-12/+12
|
* Rename plugins2 files (remove '2' suffix').Pavel Zuna2009-07-021-0/+362
|
* Delete plugins using old LDAP backend.Pavel Zuna2009-07-021-291/+0
|
* Remove all services when a host is removed Revoke certificate (if any) when ↵Rob Crittenden2009-05-131-13/+23
| | | | a service is removed
* Add validator and normalizer for service principals Add --certificate ↵Rob Crittenden2009-05-061-37/+98
| | | | argument Update default objectclasses Use the crud.Search method for service-find
* Rename errors2.py to errors.py. Modify all affected files.Pavel Zuna2009-04-231-5/+5
|
* Renamed remaining plugins still using f_* b_* conventionJason Gerard DeRose2009-04-011-0/+220
generated by cgit (git 2.34.1) at 2025-08-28 22:10:09 +0000