summaryrefslogtreecommitdiffstats
path: root/ipaserver/install
Commit message (Collapse)AuthorAgeFilesLines
* Sort LDAP updates properlyMartin Kosek2013-01-111-19/+16
| | | | | | | | | | | | LDAP updates were sorted by number of RDNs in DN. This, however, sometimes caused updates to be executed before cn=schema updates. If the update required an objectClass or attributeType added during the cn=schema update, the update operation failed. Fix the sorting so that the cn=schema updates are always run first and then the other updates sorted by RDN count. https://fedorahosted.org/freeipa/ticket/3342
* Allow PKI-CA Replica Installs when CRL exceeds default maxber valueJR Aquino2013-01-081-0/+1
| | | | https://fedorahosted.org/freeipa/ticket/3314
* Use DN objects for Dogtag configurationPetr Viktorin2012-12-101-6/+12
| | | | | Use our DN objects for generating DNs, instead of relying on string operations.
* Configuring CA with ConfigParser.Endi Sukma Dewata2012-12-101-78/+82
| | | | | | | | | The configuration code has been modified to use the ConfigParser to set the parameters in the CA section in the deployment configuration. This allows IPA to define additional PKI subsystems in the same configuration file. PKI Ticket #399 (https://fedorahosted.org/pki/ticket/399)
* Add OCSP and CRL URIs to certificatesMartin Kosek2012-12-072-26/+186
| | | | | | | | | | | | | | | | | Modify the default IPA CA certificate profile to include CRL and OCSP extensions which will add URIs to IPA CRL&OCSP to published certificates. Both CRL and OCSP extensions have 2 URIs, one pointing directly to the IPA CA which published the certificate and one to a new CNAME ipa-ca.$DOMAIN which was introduced as a general CNAME pointing to all IPA replicas which have CA configured. The new CNAME is added either during new IPA server/replica/CA installation or during upgrade. https://fedorahosted.org/freeipa/ticket/3074 https://fedorahosted.org/freeipa/ticket/1431
* Make ipa-csreplica-manage work with both merged and non-merged DBsPetr Viktorin2012-11-231-13/+11
| | | | | | | | | | | | The ipa-csreplica-manage tool often assumed that the port numbers are the same on both sides of a replication agreement. This assumption doesn't hold in a cluster with both old-style hosts and ones with merged DBs. When managing agreements, determine the port with the PKI (or merged) DS on each master, and use it. Also, in CSReplicationManager, always use starttls rather than ldaps://.
* Filter suffix in replication management toolsMartin Kosek2012-11-231-7/+30
| | | | | | | | | With the new unified Dogtag10 LDAP database, PKI-CA data and the agreements themselves are now in the main LDAP instance. Replication management tools now need to properly filter replication agreements based on the suffix to avoid clashing of agreements of different types.
* Properly stop tracking certificates on uninstallPetr Viktorin2012-11-231-15/+23
| | | | | | | | | | Stopping certificate tracking was done as part of the PKI DS uninstall. Since with the merged DB, thePKI DS is not used any more, this step was skipped. Move certificate untracking to a separate step and call it separately. Also, the post-uninstall check for tracked certificates used the wrong set of Dogtag constants. Fix the issue.
* Update certmap.conf on IPA upgradesPetr Viktorin2012-11-231-1/+1
| | | | | | | | This brings /etc/dirsrv/slapd-REALM/certmap.conf under IPA control. The file is overwritten on upgrades. This ensures that the cert for the ipaca user is recognized when ipa-ca-install is run on older masters.
* Use correct Dogtag configuration in get_pin and get_ca_certchainPetr Viktorin2012-11-231-12/+12
| | | | | | Some install utilities used Dogtag configuration before Dogtag was configured. Fix by passing the relevant dogtag_constants where they're needed.
* Fix schema replication from old mastersPetr Viktorin2012-11-231-0/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new merged database will replicate with both the IPA and CA trees, so all DS instances (IPA and CA on the existing master, and the merged one on the replica) need to have the same schema. Dogtag does all its schema modifications online. Those are replicated normally. The basic IPA schema, however, is delivered in ldif files, which are not replicated. The files are not present on old CA DS instances. Any schema update that references objects in these files will fail. The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is replicated as a blob. If we updated the old master's CA schema dynamically during replica install, it would conflict with updates done during the installation: the one with the lower CSN would get lost. Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'. Turning it off tells Dogtag to create its schema in the clone, where the IPA modifications are taking place, so that it is not overwritten by the IPA schema on replication. The patch solves the problems by: - In __spawn_instance, turning off the pki_clone_replicate_schema flag. - Providing a script to copy the IPA schema files to the CA DS instance. The script needs to be copied to old masters and run there. - At replica CA install, checking if the schema is updated, and failing if not. The --skip-schema-check option is added to ipa-{replica,ca}-install to override the check. All pre-3.1 CA servers in a domain will have to have the script run on them to avoid schema replication errors. https://fedorahosted.org/freeipa/ticket/3213
* Changes to use a single database for dogtag and IPAAde Lee2012-11-234-31/+115
| | | | | | | | | | | | New servers that are installed with dogtag 10 instances will use a single database instance for dogtag and IPA, albeit with different suffixes. Dogtag will communicate with the instance through a database user with permissions to modify the dogtag suffix only. This user will authenticate using client auth using the subsystem cert for the instance. This patch includes changes to allow the creation of masters and clones with single ds instances.
* Enable transactions by default, make password and modrdn TXN-awareRob Crittenden2012-11-212-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | The password and modrdn plugins needed to be made transaction aware for the pre and post operations. Remove the reverse member hoop jumping. Just fetch the entry once and all the memberof data is there (plus objectclass). Fix some unit tests that are failing because we actually get the data now due to transactions. Add small bit of code in user plugin to retrieve the user again ala wait_for_attr but in the case of transactions we need do it only once. Deprecate wait_for_attr code. Add a memberof fixup task for roles. https://fedorahosted.org/freeipa/ticket/1263 https://fedorahosted.org/freeipa/ticket/1891 https://fedorahosted.org/freeipa/ticket/2056 https://fedorahosted.org/freeipa/ticket/3043 https://fedorahosted.org/freeipa/ticket/3191 https://fedorahosted.org/freeipa/ticket/3046
* Provide explicit user name for Dogtag installation scriptsPetr Viktorin2012-11-151-0/+3
| | | | | Dogtag 10 is changing its defaults, so we need to explicitly provide the 'admin' user name to keep current functionality.
* Do not require resolvable nameserver in DNS installMartin Kosek2012-11-091-7/+5
| | | | | | | | As named.conf and bind-dyndb-plugin is not set up yet during DNS configuration phase, IPA hostname (i.e. the nameserver) should not be required be to resolvable in this phase. https://fedorahosted.org/freeipa/ticket/3248
* ipa-adtrust-install: allow to reset te NetBIOS domain nameSumit Bose2012-11-081-3/+21
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3192
* Process relative nameserver DNS record correctlyMartin Kosek2012-11-061-11/+14
| | | | | | | | | | | | | | | | | | | | | | | Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
* Make sure the CA is running when starting servicesPetr Viktorin2012-10-231-0/+8
| | | | | | | | | | | | | | | | - Provide a function for determinig the CA status using Dogtag 10's new getStatus endpoint. This must be done over HTTPS, but since our client certificate may not be set up yet, we need HTTPS without client authentication. Rather than copying from the existing http_request and https_request function, shared code is factored out to a common helper. - Call the new function when restarting the CA service. Since our Service can only be extended in platform-specific code, do this for Fedora only. Also, the status is only checked with Dogtag 10+. - When a restart call in cainstance failed, users were refered to the installation log, but no info was actually logged. Log the exception. https://fedorahosted.org/freeipa/ticket/3084
* Make service naming in ipa-server-install consistentTomas Babej2012-10-2210-27/+86
| | | | | | | | | | | | | Forces more consistency into ipa-server-install output. All descriptions of services that are not instances of SimpleServiceInstance are now in the following format: <Description> (<Service Name>) Furthermore, start_creation method has been modified to support custom start and end messages. See documentation for more info. https://fedorahosted.org/freeipa/ticket/3059
* Remove bogus check for smbpasswdAlexander Bokovoy2012-10-161-2/+2
| | | | | | | | We don't use smbpasswd when configuring IPA for AD trusts anymore because we switched to use Kerberos authentication in IPA passdb backend based on CIFS service keytab. https://fedorahosted.org/freeipa/ticket/3181
* Use TLS for CA replicationRob Crittenden2012-10-151-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/3162
* Explicitly disable betxn plugins for the time being.Rob Crittenden2012-10-101-0/+4
| | | | | | | | This should work with 389-ds-base 1.2.x and 1.3.0. Without other plugin changes 389-ds-base can deadlock. https://fedorahosted.org/freeipa/ticket/3046
* Configure the initial CA as the CRL generator.Rob Crittenden2012-10-091-1/+18
| | | | | | | | Any installed clones will have CRL generation explicitly disabled. It is a manual process to make a different CA the CRL generator. There should be only one. https://fedorahosted.org/freeipa/ticket/3051
* Create Firefox extension on upgrade and replica-installPetr Viktorin2012-10-101-20/+43
| | | | | | | | If the signing cert is not available, create an unsigned extension. Add a zip dependency to the specfile. https://fedorahosted.org/freeipa/ticket/3150
* Add cifs principal to S4U2Proxy targets only when running ipa-adtrust-installAlexander Bokovoy2012-10-091-6/+40
| | | | | | | | | | | Since CIFS principal is generated by ipa-adtrust-install and is only usable after setting CIFS configuration, there is no need to include it into default setup. This should fix upgrades from 2.2 to 3.0 where CIFS principal does not exist by default. https://fedorahosted.org/freeipa/ticket/3041
* Fix CS replication management.Rob Crittenden2012-10-091-5/+17
| | | | | | | | | | | | | | | | | The master side should be on the local side, replica1, not the remote. This required reversing a few master variables. This impacts the naming of the replication agreements. When deleting an agreement pass in the DN of that agreement rather than trying to calculate what it is on-the-fly. We cannot be sure which side is the master/clone and since we search for it anyway to determine if the agreement exists it is more correct to use what we find. The force flag wasn't being passed into del_link so there was no way to force a deletion. https://fedorahosted.org/freeipa/ticket/2858
* Set renewal time for the CA audit certificate to 720 days.Rob Crittenden2012-10-091-0/+33
| | | | | | | | The initial certificate is issued for two years but renewals are for six months for some reason. This fixes it for new and updated IPA installs. https://fedorahosted.org/freeipa/ticket/2951
* Move CRL publish directory to IPA owned directoryMartin Kosek2012-10-091-9/+40
| | | | | | | | | | | | | | | | | | | | | | | Currently, CRL files are being exported to /var/lib/pki-ca sub-directory, which is then served by httpd to clients. However, this approach has several disadvantages: * We depend on pki-ca directory structure and relevant permissions. If pki-ca changes directory structure or permissions on upgrade, IPA may break. This is also a root cause of the latest error, where the pki-ca directory does not have X permission for others and CRL publishing by httpd breaks. * Since the directory is not static and is generated during ipa-server-install, RPM upgrade of IPA packages report errors when defining SELinux policy for these directories. Move CRL publish directory to /var/lib/ipa/pki-ca/publish (common for both dogtag 9 and 10) which is created on RPM upgrade, i.e. SELinux policy configuration does not report any error. The new CRL publish directory is used for both new IPA installs and upgrades, where contents of the directory (CRLs) is first migrated to the new location and then the actual configuration change is made. https://fedorahosted.org/freeipa/ticket/3144
* Minor fixes for default SMB groupMartin Kosek2012-10-091-2/+2
| | | | | | | | This patch contains additional minor fixes which were proposed during review but were not pushed (accidentaly). Also amends a name of the default SMB group in a list of protected groups in group.py. https://fedorahosted.org/freeipa/ticket/3147
* ipa-adtrust-install: create fallback group with ldif fileSumit Bose2012-10-091-30/+11
| | | | | | | | | | Currently the framework is used to add the group but we want to avoid that users are added explicitly to the group by removing the objectclasses groupofnames, ipausergroup and nestedgroup and we want to use a name with spaces in it. Both it not easy possible with the framework, a LDIF file is used instead to create the group. Fixes https://fedorahosted.org/freeipa/ticket/3147
* ipa-adtrust-install: print list of needed SRV recordsSumit Bose2012-10-041-9/+13
| | | | | | | If --no-msdcs is given on the command line all needed SRV records will be printed. Fixes https://fedorahosted.org/freeipa/ticket/3019
* Avoid ldapmodify error messages during ipa-adtrust-installSumit Bose2012-10-041-13/+34
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3012
* Add SIDs for existing users and groups at the end of ipa-adtrust-installSumit Bose2012-10-041-1/+18
| | | | Fixes https://fedorahosted.org/freeipa/ticket/3104
* ipa-adtrust-install: replace print with self.print_msgSumit Bose2012-10-041-14/+14
| | | | https://fedorahosted.org/freeipa/ticket/3019
* ipa-adtrust-install: Add fallback groupSumit Bose2012-10-041-12/+96
| | | | https://fedorahosted.org/freeipa/ticket/2955
* Build and installation of Kerberos authentication extensionPetr Vobornik2012-10-041-1/+20
| | | | | | | | | | | | This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
* Fill ipakrbprincipalalias on upgradesMartin Kosek2012-10-022-0/+96
| | | | | | | | | | | | | | From IPA 3.0, services have by default ipakrbprincipal objectclass which allows ipakrbprincipalalias attribute used for case-insensitive principal searches. However, services created in previous version do not have this objectclass (and attribute) and thus case-insensitive searches may return inconsistent results. Fill ipakrbprincipalalias on upgrades for all 2.x services. Also treat Treat the ipakrbprincipal as optional to avoid missing services in service-find command if the upgrade fails for any reason. https://fedorahosted.org/freeipa/ticket/3106
* Fix NS records in installationPetr Viktorin2012-09-271-1/+3
| | | | | | | | Our installation added two final dots to the NS records, so the records were invalid, Bind ignored the entire zone, and name resolution didn't work. Fix this error and add a check for empty DNS labels to the validator
* Use custom zonemgr for reverse zonesMartin Kosek2012-09-261-49/+12
| | | | | | | | | | | | | | When DNS is being installed during ipa-{server,dns,replica}-install, forward and reverse zone is created. However, reverse zone was always created with default zonemgr even when a custom zonemgr was passed to the installer as this functionality was missing in function creating reverse zone. Consolidate functions creating forward and reverse zones to avoid code duplication and errors like this one. Reverse zones are now created with custom zonemgr (when entered by user). https://fedorahosted.org/freeipa/ticket/2790
* Update krb5.conf during ipa-adtrust-installSumit Bose2012-09-191-0/+62
| | | | https://fedorahosted.org/freeipa/ticket/2515
* Use correct Dogtag port in ipaserver.install.certsPetr Viktorin2012-09-201-2/+2
| | | | | On an instance upgraded from Dogtag 9 to Dogtag 10, ipa-replica-prepare used the wrong port number. Fix that.
* Use default reverse zone consistentlyMartin Kosek2012-09-191-18/+2
| | | | | | | | | | | | When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
* Only stop the main DS instance when upgrading itPetr Viktorin2012-09-171-5/+10
| | | | | | | | | | | | | | We've been stopping both DS instances (main and PKI) when upgrading. This can happen while the CA is running. In some cases stopping the PKI DS also killed the CA. Only stop the specific instance for upgrades. Also, wait for open ports after the upgrade is complete. The wait was skipped previously. This can prevent bugs if scripts that need a DS are run after the upgrade. https://fedorahosted.org/freeipa/ticket/3083
* Use Dogtag 10 only when it is availablePetr Viktorin2012-09-175-71/+310
| | | | | | | | | | | Put the changes from Ade's dogtag 10 patch into namespaced constants in dogtag.py, which are then referenced in the code. Make ipaserver.install.CAInstance use the service name specified in the configuration. Uninstallation, where config is removed before CA uninstall, also uses the (previously) configured value. This and Ade's patch address https://fedorahosted.org/freeipa/ticket/2846
* Modifications to install scripts for dogtag 10Ade Lee2012-09-173-200/+150
| | | | | | | Dogtag 10 uses a new installer, new directory layout and new default ports. This patch changes the ipa install code to integrate these changes. https://fedorahosted.org/freeipa/ticket/2846
* Run the CLEANALLRUV task when deleting a replication agreement.Rob Crittenden2012-09-171-0/+68
| | | | | | | | | | | | This adds two new commands to ipa-replica-manage: list-ruv & clean-ruv list-ruv can be use to list the update vectors the master has configugured clean-ruv can be used to fire off the CLEANRUV task to remove a replication vector. It should be used with caution. https://fedorahosted.org/freeipa/ticket/2303
* Expand Referential Integrity checksMartin Kosek2012-09-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
* Run index task in ldap updater only when neededMartin Kosek2012-09-161-6/+9
| | | | | | | | | | | | | When LDAP updater detected an update instruction in indexing tree, it run an indexing task and waited until it ends. However, the task was run regardless of the update instruction result. This lead to unnecessary index tasks being defined and waited for which makes the whole LDAP last longer. Execute indexing task only when an index add/update instruction is successful. https://fedorahosted.org/freeipa/ticket/2866
* Add attributeTypes to safe schema updaterMartin Kosek2012-09-161-29/+39
| | | | | | | | | | | AttributeType updates are sensitive to case, whitespace or X-ORIGIN mismatch just like ObjectClass attribute which is already being normalized before an update value is compared with update instructions. Expand safe schema updater routine to cover both ObjectClasses and AttributeTypes updates. https://fedorahosted.org/freeipa/ticket/2440
* Fix some restart script issues found with certificate renewal.Rob Crittenden2012-09-061-0/+1
| | | | | | | | | | | | | | The restart_dirsrv script wasn't initializing the api so the startup_timeout wasn't available. The subsystemCert cert-pki-ca definition was missing so we didn't know which certificate to update in CS.cfg. Add some documentation and a pause between restarts for the renew_ca_cert script so that when the CA subsystem certs are renewed they don't all try to restart the CA at the same time. https://fedorahosted.org/freeipa/ticket/3006
generated by cgit (git 2.34.1) at 2025-09-06 11:21:59 +0000