summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Enumerate available options in IPA installerAbhijeet Kasurde2017-01-032-3/+8
| | | | | | | | | | Fix adds enumerated list of available options in IPA server installer and IPA CA installer help options Fixes https://fedorahosted.org/freeipa/ticket/5435 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* spec file: revert to the previous Release tagJan Cholasta2017-01-021-1/+1
| | | | | | | | | | | | | | | Revert from the current Release tag value `upstream` to the previously used `0%{?dist}`, because: * `0` sorts before `1`, which is usually used as the initial release number in downstream packages, * the information provided by `%{?dist}` is useful, as packages built on one OS are not always installable on another OS. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* x509: use PyASN1 to parse PKCS#7Jan Cholasta2016-12-221-17/+31
| | | | | | | | | | Use PyASN1 with the PKCS#7 definitions from `pyasn1_modules` to parse PKCS#7 in `pkcs7_to_pems()` instead of calling `openssl pkcs7` in a subprocess. https://fedorahosted.org/freeipa/ticket/6550 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Remove "Request Certificate with SubjectAltName" permissionFraser Tweedale2016-12-213-22/+1
| | | | | | | | | | | | | | | | | | subjectAltName is required or relevant in most certificate use cases (esp. TLS, where carrying DNS name in Subject DN CN attribute is deprecated). Therefore it does not really make sense to have a special permission for this, over and above "request certificate" permission. Furthermore, we already do rigorously validate SAN contents again the subject principal, and the permission is waived for self-service requests or if the operator is a host principal. So remove the permission, the associated virtual operation, and the associated code in cert_request. Fixes: https://fedorahosted.org/freeipa/ticket/6526 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use the tar Posix option for tarballsSimo Sorce2016-12-211-1/+1
| | | | | | | | | | | | | | This is necessary to be able to successfully build archives in environments controlled by an IPA domain which may have large uidNumbers for user accounts. tar-ustar allows UID/GID numbers only up to 2 million and by default a new IPA installation can assigne UIDs in the billion range. https://fedorahosted.org/freeipa/ticket/6418 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* server install: fix KRA agent PEM file not being createdJan Cholasta2016-12-203-1/+4
| | | | | | | | | | | | In commit 822e1bc82af3a6c1556546c4fbe96eeafad45762 the call to create the KRA agent PEM file was accidentally removed from the server installer. Call into the KRA installer from the server installer to create the file again. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix DL1 replica installation in CA-less topologyFraser Tweedale2016-12-201-1/+1
| | | | | | | | | | | | | | | | Commit dbb98765d73519289ee22f3de1a5ccde140f6f5d changed certmonger requests for DS and HTTP certificates during installation to raise on error (https://fedorahosted.org/freeipa/ticket/6514). This introduced a regression in DL1 replica installation in CA-less topology. A certificate was requested, but prior to the aforementioned commit this would fail silently and installation continued, whereas now installation fails. Guard the certificate request with a check that the topology is CA-ful. Fixes: https://fedorahosted.org/freeipa/ticket/6573 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* spec file: do not define with_lint inside a commentJan Cholasta2016-12-191-1/+1
| | | | | | | | | | | RPM expands macros even inside comments in spec files, so the with_lint macro is unintentionally always defined. Escape the percent sign in '%global' in the comment to prevent this. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Remove named-pkcs11 workarounds from DNSSEC tests.Petr Spacek2016-12-191-82/+0
| | | | | | | | | | As far as I can tell the tests are passing for some time in Jenkins so maybe a bug in some underlying component was fixed. Let's remove workarounds to make tests actually test real setups. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add a basic test suite for `kadmin.local` interfaceMartin Babinsky2016-12-161-0/+125
| | | | | | | | | | This small integration suite tests some basic operations using kadmin.local interface on services in both kerberos and services subtree. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Make `kadmin` family of functions return the result of ipautil.runMartin Babinsky2016-12-161-5/+8
| | | | | | | | | | This allows for diagnose the output and error code of these operations. Otherwise there is no way to infer their success or failure apart from inspecting logs post-mortem. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* ipa-kdb: search for password policies globallyAlexander Bokovoy2016-12-151-1/+1
| | | | | | | | | | | | | | | | With the CoS templates now used to create additional password policies per object type that are placed under the object subtrees, DAL driver needs to search for the policies in the whole tree. Individual policies referenced by the krbPwdPolicyReference attribute are always searched by their full DN and with the base scope. However, when KDC asks a DAL driver to return a password policy by name, we don't have any specific base to search. The original code did search by the realm subtree. Fixes https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certprofile-mod: correctly authorise config updateFraser Tweedale2016-12-141-0/+5
| | | | | | | | | | | | | | | | | | Certificate profiles consist of an FreeIPA object, and a corresponding Dogtag configuration object. When updating profile configuration, changes to the Dogtag configuration are not properly authorised, allowing unprivileged operators to modify (but not create or delete) profiles. This could result in issuance of certificates with fraudulent subject naming information, improper key usage, or other badness. Update certprofile-mod to ensure that the operator has permission to modify FreeIPA certprofile objects before modifying the Dogtag configuration. https://fedorahosted.org/freeipa/ticket/6560 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add compatibility code to retrieve headersSimo Sorce2016-12-141-1/+5
| | | | | | | | | | Python3 removed the getheaders() function and replaced it with a get_all() one. Add compat code. https://fedorahosted.org/freeipa/ticket/6558 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: Expect krbpwdpolicyreference in result of {host,service}-{find,show} ↵David Kupka2016-12-144-2/+58
| | | | | | | | | | | --all Result of {host,service}-{find,show} commands with option '--all' always contains krbpwpolicyreference attributes. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* password policy: Add explicit default password policy for hosts and servicesDavid Kupka2016-12-143-0/+135
| | | | | | | | | | | | | | | | Set explicitly krbPwdPolicyReference attribute to all hosts (entries in cn=computers,cn=accounts), services (entries in cn=services,cn=accounts) and Kerberos services (entries in cn=$REALM,cn=kerberos). This is done using DS's CoS so no attributes are really added. The default policies effectively disable any enforcement or lockout for hosts and services. Since hosts and services use keytabs passwords enforcements doesn't make much sense. Also the lockout policy could be used for easy and cheap DoS. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* ipaclient.plugins: Use api_version from internally called commandsDavid Kupka2016-12-143-0/+24
| | | | | | | | | | | | In client plugins make sure the api_version is 'inherited' from server command that is internally called. Otherwise the api_version is obtained from client API instance. When calling server command from client command 'version' is passed in options and it overrides the right one. Server then refuses to handle such call. https://fedorahosted.org/freeipa/ticket/6539 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: forbid builds in working directories containing white spacesPetr Spacek2016-12-141-0/+8
| | | | | | | | | | | | Spaces are causing problems in libtool, makefiles, autoconf itself, gettextize framework etc. so this issue cannot be easily fixed. Return on investment is too small to invest into this. Let's detect the whitespace early and error out with descriptive error message. https://fedorahosted.org/freeipa/ticket/6537 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix regression in test suiteFraser Tweedale2016-12-131-4/+10
| | | | | | | | | | | | | 32b1743e5fb318b226a602ec8d9a4b6ef2a25c9d introduced a regression in test_serverroles.py, caused by ca_find attempting to log into the Dogtag REST API. (ca_find is called by cert_find which is called by server_del during cleanup). Avoid logging into Dogtag in cert_find unless something actually needs to be retrieved. Fixes: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Build: always use Pylint from Python version used for rest of the buildPetr Spacek2016-12-132-10/+13
| | | | | | | | | | | | configure option --with/without-pylint was replaced by --enable/disable-pylint. Pylint is always called as $(PYTHON) -m python. If you need to override Pylint version, use command "make pylint PYTHON=xxx". https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: specify BuildRequires for Python 3 pylintPetr Spacek2016-12-131-1/+40
| | | | | | | | | | | python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: makerpms.sh generates Python 2 & 3 packages at the same timePetr Spacek2016-12-131-55/+103
| | | | | | | | | | | | | | | | | | | | | Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* fix: regression in API version comparisonMartin Basti2016-12-131-2/+1
| | | | | | | | | | | Commint 2cbaf156045769b54150e4d4c3c1071f164a16fb introduced a regression in API version comparison. In case that newer client is trying to call older server an error is returned, but it should work. This commit fixes it. https://fedorahosted.org/freeipa/ticket/6468 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Check for conflict entries before raising domain levelLudwig Krispenz2016-12-131-0/+28
| | | | | | | | | Checking of conflicts is not only done in topology container as tests showed it can occurs elsewhere https://fedorahosted.org/freeipa/ticket/6534 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* WebUI: Hide incorrectly shown buttons on hosts tab in ID ViewsPavel Vomacka2016-12-121-0/+1
| | | | | | | | | | | | | There was missing default value for evaluator adapter. In that case the adapter variable could be undefined and it crashes on building adapter. Therefore it did not evaluate all evaluators. That is the reason why 'Delete' and 'Add' buttons were incorrectly shown. Default value is now set to empty object. https://fedorahosted.org/freeipa/ticket/6546 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* adtrust: remove FILE: prefix from 'dedicated keytab file' in smb.confAlexander Bokovoy2016-12-122-1/+23
| | | | | | | | | | | | | | | | | | Samba 4.5 does not allow to specify access mode for the keytab (FILE: or WRFILE:) from external sources. Thus, change the defaults to a path (implies FILE: prefix) while Samba Team fixes the code to allow the access mode prefix for keytabs. On upgrade we need to replace 'dedicated keytab file' value with the path to the Samba keytab that FreeIPA maintains. Since the configuration is stored in the Samba registry, we use net utility to manipulate the configuration: net conf setparm global 'dedicated keytab file' /etc/samba/samba.keytab Fixes https://fedorahosted.org/freeipa/ticket/6551 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipactl: pass api as argument to servicesMartin Basti2016-12-121-7/+7
| | | | | | | Commit 6409abf1 removes hard dependency of ipalib in ipalatform to avoid cyclic dependenies, this commit updates ipactl accordingly Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Configure Anonymous PKINIT on server installSimo Sorce2016-12-1218-69/+325
| | | | | | | | | | | | Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add options to write lightweight CA cert or chain to fileFraser Tweedale2016-12-127-16/+172
| | | | | | | | | | | | | | Administrators need a way to retrieve the certificate or certificate chain of an IPA-managed lightweight CA. Add params to the `ca' object for carrying the CA certificate and chain (as multiple DER values). Add the `--chain' flag for including the chain in the result (chain is also included with `--all'). Add the `--certificate-out' option for writing the certificate to a file (or the chain, if `--chain' was given). Fixes: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* certdb: accumulate extracted certs as list of PEMsFraser Tweedale2016-12-121-7/+8
| | | | | | | | | | | | certdb.NSSDatabase.import_files currently accumulates certificates extracted from input files as a string, which is ugly. Accumulate a list of PEMs instead, and join() them just in time for PKCS #12 creation. Part of: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add function for extracting PEM certs from PKCS #7Fraser Tweedale2016-12-123-41/+49
| | | | | | | | | | | Add a single function for extracting X.509 certs in PEM format from a PKCS #7 object. Refactor sites that execute ``openssl pkcs7`` to use the new function. Part of: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* gracefully handle setting replica bind dn group on old mastersMartin Babinsky2016-12-121-16/+32
| | | | | | | | | | | | Pre-3.3 masters do not support setting 'nsds5replicabinddngroup' attribute on existing replica entry during setup of initial replication. In this case UNWILLING_TO_PERFORM is returned. The code can interpret this error as an indication of old master and fall back to just adding its LDAP principal to entry's 'nsds5replicabinddn' attribute. https://fedorahosted.org/freeipa/ticket/6532 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* certdb: fix PKCS#12 import with empty passwordJan Cholasta2016-12-121-1/+1
| | | | | | | | | | | | Since commit f919ab4ee0ec26d77ee6978e75de5daba4073402, a temporary file is used to give passwords to pk12util. When a password is empty, the temporary will be empty as well, which pk12util does not like. Add new line after the password in the temporary file to please pk12util. https://fedorahosted.org/freeipa/ticket/6541 Reviewed-By: David Kupka <dkupka@redhat.com>
* replicainstall: give correct error message on DL mismatchStanislav Laznicka2016-12-091-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6510 Reviewed-By: Martin Basti <mbasti@redhat.com>
* add missing attribute to ipaca replica during CA topology updateMartin Babinsky2016-12-091-0/+22
| | | | | | | | | | 'nsds5replicabinddngroupcheckinterval' attribute was not properly added to 'o=ipaca' replica attribute during upgrade. The CA topology update plugin should now add it to the entry if it exists. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Revert "upgrade: add replica bind DN group check interval to CA topology config"Martin Babinsky2016-12-091-1/+0
| | | | | | | | | This reverts commit 8c6a10ceddb4fce9a3dd4a334e6804800b5c89f9 since it leads to errors in upgrade of first master. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Lowered the version of gettextPavel Vomacka2016-12-093-59/+2
| | | | | | | | | The lower version is needed while building on RHEL. Also po/Rules-quot file is deleted and added to .gitignore. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Test: uniqueness of certificate renewal masterOleg Fayans2016-12-081-0/+42
| | | | | | | https://fedorahosted.org/freeipa/ticket/6504 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* server install: fix external CA installJan Cholasta2016-12-086-67/+54
| | | | | | | | | | | | | Replace the dual definitions of domain_name, dm_password and admin_password knobs in server install with single definitions using the original names without the 'new_' prefix. This fixes the options read from the installer option cache in step 2 of external CA install to use the correct knob names. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Properly handle multiple cookies in rpc lib.Simo Sorce2016-12-081-3/+11
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Properly handle multiple cookies in rpcclientSimo Sorce2016-12-081-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Increase the timeout waiting for certificate issuance in installerFlorence Blanc-Renaud2016-12-071-1/+2
| | | | | | | | | | | | | During the server installation, the installer requests certificates through certmonger. The current timeout is 60s and is too low. Increase this timeout to api.env.startup_timeout as done in ipa_cacert_manage or ipa_certupdate.py (the code checks the status each 5s up to the timeout value). https://fedorahosted.org/freeipa/ticket/6433 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipautil: check for open ports on all resolved IPsTomas Krizek2016-12-072-12/+37
| | | | | | | | | | When a hostname is provided to host_port_open, it should check if ports are open for ALL IPs that are resolved from the hostname, instead of checking whether the port is reachable on at least one of the IPs. https://fedorahosted.org/freeipa/ticket/6522 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix permission-find with sizelimit setStanislav Laznicka2016-12-071-0/+7
| | | | | | | | | | | If permission-find is fired with an argument and sizelimit set a message about truncation will be sent along with the result as the search in post_callback() does general search instead of having its filter properly set. https://fedorahosted.org/freeipa/ticket/5640 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Generalize filter generation in LDAPSearchStanislav Laznicka2016-12-071-20/+34
| | | | | | | | | Make it easier to generate search filters properly and in a unified way in any inheriting method https://fedorahosted.org/freeipa/ticket/5640 Reviewed-By: Martin Basti <mbasti@redhat.com>
* bindinstance: use data in named.conf to determine configuration statusMartin Babinsky2016-12-071-0/+7
| | | | | | | | | | Instead of checking sysrestore status which leads to incorrect evaluation of DNS configuration status during 4.2 -> 4.4 upgrade, look into named.conf to see whther it was already modified by IPA installer. https://fedorahosted.org/freeipa/ticket/6503 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use ipa-docker-test-runner to run tests in Travis CIMartin Babinsky2016-12-071-4/+32
| | | | | | | | | | | | | | | | | | | | | https://github.com/martbab/ipa-docker-test-runner is now used to run the following tasks in Travis CI: * pull in a FreeIPA test runner Docker image * configure/make lint/make rpms * install rpms * install FreeIPA server and KRA * run out-of-tree tests For performance reasons (last two steps are very time-consuming) the available tests were split roughly in half and are run as two separate jobs to speed up the process. AD trust is not installed as part of tests since the enabled compat plugin causes false negative errors. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Configuration file for ipa-docker-test-runnerMartin Babinsky2016-12-071-0/+50
| | | | | | | | | | | | | | | | | | | Prepare a configuration file for https://github.com/martbab/ipa-docker-test-runner. The latest freeipa-fedora-test-runner Docker image (F25 as of time of writing this message) will be used to run tests. Some of them will be purposefuly excluded from the test suite, namely: * test_integration and test_webui: for obvious reasons, CI tests require complicated multi-host setup which is currently not achievable in Travis CI * test_ipapython/test_keyring: Docker can not cope with storing and retrieving secrets from Kernel keyring, that is a known issue * test_xmlrpc/test_dns_plugin.py:test_dns_soa: There are 2-3 non-deterministic failures in this suite in Travis CI, this suite was disabled until the root cause is discovered and fixed/workarounded Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* cert-request: match names against principal aliasesFraser Tweedale2016-12-062-40/+158
| | | | | | | | | | | | | | | Currently we do not check Kerberos principal aliases when validating a CSR. Enhance cert-request to accept the following scenarios: - for hosts and services: CN and SAN dnsNames match a principal alias (realm and service name must be same as nominated principal) - for all principal types: UPN or KRB5PrincipalName othername match any principal alias. Fixes: https://fedorahosted.org/freeipa/ticket/6295 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* fix missing translation stringshanyin2016-12-061-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 19:38:18 +0000