summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* WIP: IPA certauth plugincertauthSumit Bose2017-02-236-3/+405
|
* ipa-kdb: add ipadb_fetch_principals_with_extra_filter()Sumit Bose2017-02-232-13/+56
| | | | Additionally make ipadb_find_principal public.
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-02-2315-13/+862
| | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542
* Update Contributors.txtMartin Kosek2017-02-232-2/+13
| | | | | | | | Update mailmap with the new mistyped authors and generate a new Contributors list. Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix ipa-server-upgradeStanislav Laznicka2017-02-231-1/+2
| | | | | | | | | Running ipa-server-upgrade would fail to stop ipa_memcached if it's already uninstalled. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use newer Certificate.serial_number in krainstance.pyStanislav Laznicka2017-02-231-1/+1
| | | | Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* use the methods of the parent class to retrieve CIFS kerberos keysMartin Babinsky2017-02-221-19/+11
| | | | | | | | | | | | adtrustinstance will now use parent's methods to retrieve keys for CIFS principal. Since the keys are appended to the host keytab (/etc/krb5.keytab) we need to make sure that only the stale CIFS keys are purged from the file and that we do not re-set its ownership. https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* httpinstance: re-use parent's methods to retrieve anonymous keytabMartin Babinsky2017-02-221-1/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make request_service_keytab into a public methodMartin Babinsky2017-02-223-5/+5
| | | | | | | | | | a cosmetic change: we had private method comprising of calls to public ones, which did not make much sense in our case https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* allow for more flexibility when requesting service keytabMartin Babinsky2017-02-221-15/+26
| | | | | | | | | | | | | The service installers can now override the methods for cleaning up stale keytabs and changing file ownership of the newly acquired keytabs. The default actions should be usable by most installers without specific overriding. https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove non-sensical kdestroy on https stopSimo Sorce2017-02-224-3/+3
| | | | | | | | | | | | | | This kdestroy runs as root and wipes root's own ccachs ... this is totally inappropriate. Use a file ccache that ends up in the private tmp, so that if the service is restarted the file is automatically removed. https://fedorahosted.org/freeipa/ticket/6673 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add --without-ipatests optionChristian Heimes2017-02-222-10/+28
| | | | | | | | | | --without-ipatests skips building and installation of the ipatests package. By default the ipatests package is always build and installed by make install. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add missing include of stdint.h for uint8_tChristian Heimes2017-02-221-0/+1
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa_pwd: remove unnecessary dependency on dirsrv pluginsLukas Slebodnik2017-02-222-1/+3
| | | | | | | | "dirsrv/slapi-plugin.h" is unnecessary for build of ipa_pwd. This patch allow us to move DIRSRV to daemon only dependencies Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Client-only builds with --disable-serverChristian Heimes2017-02-223-127/+172
| | | | | | | https://fedorahosted.org/freeipa/ticket/6517 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix session logoutSimo Sorce2017-02-222-5/+5
| | | | | | | | | | | There were 2 issues with session logouts, one is that the logout_cookie was checked and acted on in the wrong place, the other is that the wrong value was set in the IPASESSION header. Fixes https://fedorahosted.org/freeipa/ticket/6685 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* scripts, tests: explicitly set confdir in the rest of server codeJan Cholasta2017-02-2213-15/+37
| | | | | | | | | | | Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir setting to api.bootstrap() calls of a randomly selected portion of server-side scripts and tests. This commit adds it to the rest of server-side code for consistency. https://fedorahosted.org/freeipa/ticket/6389 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* FIPS: perform replica installation checkTomas Krizek2017-02-211-0/+22
| | | | | | | | | | | Check status of remote server's FIPS mode and proceed with installation only if it matches the current replica's FIPS mode. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replicainstall: add context manager for rpc clientTomas Krizek2017-02-211-11/+22
| | | | | | | | Abstract creating rpc client into a context manager to allow re-use. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* check_remote_version: update exception and docstringTomas Krizek2017-02-211-1/+8
| | | | | | | | Refactor function to use ScriptError exception and provide docstring. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* test_config: fix tests for env.fips_modeTomas Krizek2017-02-211-0/+1
| | | | | | | | | | Add optional key fips_mode to Env object in tests. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add fips_mode variable to envTomas Krizek2017-02-211-0/+8
| | | | | | | | | | | Variable fips_mode indicating whether machine is running in FIPS-enabled mode was added to env. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Minor typo fix in DNS install pluginAbhijeet Kasurde2017-02-211-2/+2
| | | | | Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix error in ca_cert_files validatorStanislav Laznicka2017-02-211-0/+4
| | | | | | | | | ClientInstall expects a single ca_cert_file as a string but the framework gives it a list. https://fedorahosted.org/freeipa/ticket/6694 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Don't prepend option names with additional '--'Stanislav Laznicka2017-02-211-1/+1
| | | | | | | | | The options now have '--' prepended by their names already, don't add it. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* server upgrade: uninstall ipa_memcached properlyJan Cholasta2017-02-201-4/+2
| | | | | | | | | Make sure ipa_memcached is not running and no stale state is left in the sysupgrade state file on server upgrade. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server upgrade: always upgrade KRA agent PEM fileJan Cholasta2017-02-202-3/+5
| | | | | | | | | | | | | | Before the KRA agent PEM file is exported in server upgrade, the sysupgrade state file is consulted. This causes the KRA agent PEM file not to be exported to the new location if the upgrade was executed in the past. Do not consult the sysupgrade state file to decide whether to upgrade the KRA agent PEM file or not, the existence of the file is enough to make this decision. https://fedorahosted.org/freeipa/ticket/6675 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server upgrade: fix upgrade from pre-4.0Jan Cholasta2017-02-203-2/+3
| | | | | | | | | | | | | | update_ca_renewal_master uses ipaCert certmonger tracking information to decide whether the local server is the CA renewal master or not. The information is lost when migrating from /etc/httpd/alias to /var/lib/ipa/radb in update_ra_cert_store. Make sure update_ra_cert_store is executed after update_ca_renewal_master so that correct information is used. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server upgrade: fix upgrade in CA-lessJan Cholasta2017-02-202-1/+6
| | | | | | | | | | | | | Use /etc/httpd/alias instead of /var/lib/ipa/radb in upload_cacrt, as /var/lib/ipa/radb is not populated in CA-less. Do not migrate ipaCert from /etc/httpd/alias to /var/lib/ipa/radb in CA-less, as it might be an incorrect certificate from previous CA-ful install, and is not necessary anyway. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client install: create /etc/ipa/nssdb with correct modeJan Cholasta2017-02-202-3/+9
| | | | | | | | | | | | The NSS database directory is created with mode 640, which causes the IPA client to fail to connect to any IPA server, because it is unable to read trusted CA certificates from the NSS database. Create the directory with mode 644 to fix the issue. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: fix incorrect behavior of ESC button on comboboxPavel Vomacka2017-02-171-3/+8
| | | | | | | | | | | | | | When combobox is opened then ESC key should close it. There was a bug that ESC key closed also the dialog. It was caused by bad keyboard event handling. The CB was closed by keydown event and the dialog by keyup. Therefore the propagating of keyup and keydown event is stopped when CB is opened (when the event is fired on CB element). https://fedorahosted.org/freeipa/ticket/6388 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* WebUI: add default on_cancel function in adder_dialogPavel Vomacka2017-02-171-0/+2
| | | | | | | | | | | | | | | Adder dialog is mixed with confirmation_mixin. That mixin calls on_cancel method when closing dialog using ESC key. Previously the on_cancel method was not defined, therefore dialog was not correctly closed. This was the root cause of the bug, that adder dialog cannot be opened after closing it using ESC. Now the default function for on_cancel is dialog.close. So dialog is correctly closed. https://fedorahosted.org/freeipa/ticket/6388 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use RemoveOnStop to cleanup systemd socketsNathaniel McCallum2017-02-171-1/+1
| | | | Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Do not configure PKI ajp redirection to use "::1"Florence Blanc-Renaud2017-02-172-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | When ipa-server-install configures PKI, it provides a configuration file with the parameter pki_ajp_host set to ::1. This parameter is used to configure Tomcat redirection in /etc/pki/pki-tomcat/server.xml: <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="::1" /> ie all requests to port 8009 are redirected to port 8443 on address ::1. If the /etc/hosts config file does not define ::1 for localhost, then AJP redirection fails and replica install is not able to request a certificate for the replica. Since PKI has been fixed (see PKI ticket 2570) to configure by default the AJP redirection with "localhost", FreeIPA does not need any more to override this setting. The code now depends on pki 10.3.5-11 which provides the fix in the template and the upgrade. https://fedorahosted.org/freeipa/ticket/6575 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Move AD trust installation code to a separate moduleMartin Babinsky2017-02-172-342/+389
| | | | | | | | | | | | This facilitates calling the necessary checks and configuration code as a module from e.g. a composite installer. The code that checks for the admin credentials stays in the standalone installer as the code inside the adtrust module is expected to operate also without admin credentials. https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Update warning message for replica installAbhijeet Kasurde2017-02-171-1/+5
| | | | | | | | | | | New warning message in replica install describes more about "insufficient privilege" error Fixes https://fedorahosted.org/freeipa/ticket/6352 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipactl restart: log httplib failues as debugMartin Basti2017-02-171-1/+1
| | | | | | | | | | | There are several excerptions ConnectionRefusedError raised before ipactl is able to connect to dogtag after restart. These exception should be logged on debug level until timeout is reached. https://fedorahosted.org/freeipa/ticket/6674 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add fix for ipa plugins commandAbhijeet Kasurde2017-02-172-1/+5
| | | | | | | | | | Fix adds count of plugins loaded to return dict Fixes https://fedorahosted.org/freeipa/ticket/6513 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Bump python-cryptography version in ipasetup.py.inStanislav Laznicka2017-02-171-1/+1
| | | | | | | | | When bumping version of python-cryptography in freeipa.spec.in, ipasetup.py.in was forgotten about. https://fedorahosted.org/freeipa/ticket/6631 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* custodiainstance: don't use IPA-specific CertDBStanislav Laznicka2017-02-171-13/+8
| | | | | | | Replaced CertDB with NSSDatabase. Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add password to certutil calls in NSSDatabaseStanislav Laznicka2017-02-176-39/+42
| | | | | | | | | | NSSDatabases should call certutil with a password. Also, removed `password_filename` argument from `.create_db()`. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Tests: search for disabled usersMartin Basti2017-02-171-0/+41
| | | | | | | | | Add tests for searching disabled/enabled users. XFAIL: newly created users has no 'nsaccountlock' attribute set and user-find doesn't return them as active users. This should be fixed. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Explicitly remove support of SSLv2/3Stanislav Laznicka2017-02-173-4/+94
| | | | | | | | | | | | | | | It was possible to set tls_version_min/max to 'ssl2' or 'ssl3', even though newer versions of NSS will fail to set this as a valid TLS version. This patch explicitly checks for deprecated TLS versions prior to creating a TLS connection. Also, we don't allow tls_version_min/max to be set to a random string anymore. https://fedorahosted.org/freeipa/ticket/6607 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Deduplicate session cookies in headersSimo Sorce2017-02-171-0/+5
| | | | | | | | | This removes one of the 2 identical copies of the ipa_session cookie Fixes https://fedorahosted.org/freeipa/ticket/6676 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Change session logout to kill only the cookieSimo Sorce2017-02-172-36/+3
| | | | | | | | | | | Removing the ccache goes too far as it will cause unrelated sessions to fail as well, this is a problem for accounts used to do unattended operations and that may operate in parallel. Fixes https://fedorahosted.org/freeipa/ticket/6682 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Update man page of ipa-server-installAbhijeet Kasurde2017-02-171-2/+5
| | | | | | | | | | This fix adds information about --ignore-last-of-role in ipa-server-install man page Fixes https://fedorahosted.org/freeipa/ticket/6634 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* pkinit: make sure to have proper dictionary for Kerberos instance on upgradeAlexander Bokovoy2017-02-161-0/+12
| | | | | | | | | | | When running PKINIT upgrade we need to make sure full substitution dictionary is in place or otherwise executing LDAP updates will fail to find proper objects because $SUFFIX, $DOMAIN, and other variables will not be substituted. Fixes https://fedorahosted.org/freeipa/ticket/6670 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Add FIPS-token password of HTTPD NSS databaseStanislav Laznicka2017-02-151-7/+12
| | | | | | | | | This change is required for httpd to function properly in FIPS https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* New lite-server implementationChristian Heimes2017-02-155-162/+261
| | | | | | | | | | | | | | The new development server depends on werkzeug instead of paste. The werkzeug WSGI server comes with some additional features, most noticeable multi-processing server. The IPA framework is not compatible with threaded servers. Werkzeug can serve static files easily and has a fast auto-reloader. The new lite-server implementation depends on PR 314 (privilege separation). For Python 3 support, it additionally depends on PR 393. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Explain more performance tricks in doc stringChristian Heimes2017-02-151-2/+5
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-28 10:50:19 +0000