summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* webui: add Deferred/Promise API to rpc.commandPetr Vobornik2015-11-271-1/+20
| | | | | | | | so that commands could be easily chained prerequisite for: https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica promotion: modify default.conf even if DS configuration failsMartin Babinsky2015-11-271-25/+30
| | | | | | | | | | | When we promote an IPA client to replica, we need to write master-like default.conf once we start configuring directory server instance. This way even if DS configuration fails for some reason the server uninstall code can work properly and clean up partially configured replica. https://fedorahosted.org/freeipa/ticket/5417 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* mod_auth_gssapi: Remove ntlmssp support and restrict mechanism to krb5Christian Heimes2015-11-262-1/+2
| | | | | | | | | | | | | | | | By default mod_auth_gssapi allows all locally available mechanisms. If the gssntlmssp package is installed, it also offers ntlmssp. This has the annoying side effect that some browser will pop up a username/password request dialog if no Krb5 credentials are available. The patch restricts the mechanism to krb5 and removes ntlmssp and iakerb support from Apache's ipa.conf. The new feature was added to mod_auth_gssapi 1.3.0. https://fedorahosted.org/freeipa/ticket/5114 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-client-automount: Leverage IPAChangeConf to configure the domain for idmapdTomas Babej2015-11-261-5/+15
| | | | | | | | | | | | | Simple regexp substitution caused that the domain directive fell under an inapprorpiate section, if the domain directive was not present. Hence the idmapd.conf file was not properly parsed. Use IPAChangeConf to put the directive in its correct place even if it the domain directive is missing. https://fedorahosted.org/freeipa/ticket/5069 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* ipachangeconf: Add ability to preserve section caseTomas Babej2015-11-261-1/+4
| | | | | | | | | | The IPAChangeConf normallizes section names to lower case. There are cases where this behaviour might not be desirable, so provide a way to opt out. https://fedorahosted.org/freeipa/ticket/5069 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* fix a typo in replica DS creation codeMartin Babinsky2015-11-261-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* KRA: do not stop certmonger during standalone uninstallMartin Basti2015-11-261-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5477 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Compare objectclasses as case insensitive in baseuser.pyMartin Basti2015-11-251-4/+7
| | | | | | | | Objectclasses must be handled as case insensitive. https://fedorahosted.org/freeipa/ticket/5456 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-getkeytab: do not return error when translations cannot be loadedMartin Basti2015-11-251-1/+1
| | | | | | | | Only warning is shown https://fedorahosted.org/freeipa/ticket/5483 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use absolute domain in detection of A/AAAA recordsMartin Basti2015-11-252-6/+5
| | | | | | | | | | | | Python dns resolver append configured domain to queries which may lead to false positive answer. Exmaple: resolving "ipa.example.com" may return records for "ipa.example.com.example.com" if domain is configured as "example.com" https://fedorahosted.org/freeipa/ticket/5421 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Return default TL_DATA is krbExtraData is missingSimo Sorce2015-11-251-1/+10
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/937 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Call directly function is_host_resolvable instead do call via frameworkMartin Basti2015-11-251-3/+1
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Make command dns-resolve deprecated.Martin Basti2015-11-252-3/+24
| | | | | | | | | | | | | | | | | To debug DNS issues other commands should be used like 'dig', 'host', 'nslookup' instead of command 'ipa dns-resolve'. This command is executed on server side, what may not be helpful with debugging clients. 'ipa dns-resolve' command is worse copy of host command, users should use 'host' command instead. dns-resolve is removed from CLI https://fedorahosted.org/freeipa/ticket/5466 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Remove invalid error messages from topology upgradeMartin Basti2015-11-252-6/+3
| | | | | | | | | Return False does not mean that update failed, it mean that nothing has been updated, respectively ldap is up to date. https://fedorahosted.org/freeipa/ticket/5482 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* private_ccache: Harden the removal of KRB5CCNAME env variableTomas Babej2015-11-251-1/+1
| | | | | | | | | | If the code within the private_ccache contextmanager does not set/removes the KRB5CCNAME, the pop method will raise KeyError, which will cause unnecessary termination of the code flow. Make sure the KRB5CCNAME is popped out of os.environ only if present. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix upgrade of forwardzones when zone is in realmdomainsMartin Basti2015-11-251-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5472 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-2531-820/+297
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* Install: Force service add during replica promotionMartin Basti2015-11-242-2/+4
| | | | | | | | | Replica does not need to have A/AAAA records during install, so we cannot enforce it and service must be added with --force option. https://fedorahosted.org/freeipa/ticket/5420 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* do not disconnect when using existing connection to check default CA ACLsMartin Babinsky2015-11-241-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* disconnect ldap2 backend after adding default CA ACL profilesMartin Babinsky2015-11-241-0/+3
| | | | | | | | | | ensure_default_caacl() was leaking open api.Backend.ldap2 connection which could crash server/replica installation at later stages. This patch ensures that after checking default CA ACL profiles the backend is disconnected. https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add profiles and default CA ACL on migrationFraser Tweedale2015-11-249-56/+90
| | | | | | | | | | | | | | | | | | | | Profiles and the default CA ACL were not being added during replica install from pre-4.2 servers. Update ipa-replica-install to add these if they are missing. Also update the caacl plugin to prevent deletion of the default CA ACL and instruct the administrator to disable it instead. To ensure that the cainstance installation can add profiles, supply the RA certificate as part of the instance configuration. Certmonger renewal setup is avoided at this point because the NSSDB gets reinitialised later in installation procedure. Also move the addition of the default CA ACL from dsinstance installation to cainstance installation. Fixes: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Do not erroneously reinit NSS in Dogtag interfaceFraser Tweedale2015-11-241-1/+2
| | | | | | | | | | The Dogtag interface always attempts to (re)init NSS, which can fail with SEC_ERROR_BUSY. Do not reinitialise NSS when it has already been initialised with the given dbdir. Part of: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-otptoken-import: Fix connection to ldap.David Kupka2015-11-231-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5475 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-cacert-renew: Fix connection to ldap.David Kupka2015-11-231-17/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/5468 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipasam: fix a use-after-free issueSumit Bose2015-11-231-1/+2
| | | | | | | Since endptr points to a location inside of dummy, dummy should be freed only after dereferencing endptr. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipasam: use more restrictive search filter for group lookupSumit Bose2015-11-231-1/+3
| | | | | | | | | | | Since we are interested in looking up the SID of a group it makes sense to include the objectclass which contains the SID attribute in the search filter. This makes sure the group is not accidentally found a second time in the compat tree. Related to https://fedorahosted.org/freeipa/ticket/5457 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipasam: fix wrong usage of talloc_new()Sumit Bose2015-11-231-1/+1
| | | | | | Fixes https://fedorahosted.org/freeipa/ticket/5457 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Check if IPA is configured before attempting a winsync migrationGabe2015-11-231-1/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5470 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* update idrange tests to reflect disabled modification of local ID rangesMartin Babinsky2015-11-231-24/+10
| | | | | | | | Fix for https://fedorahosted.org/freeipa/ticket/4826 temporarily disallowed modification of local ID ranges via API calls The corresponding XMLRPC tests were updated to reflect this change. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* remove forgotten print in DNS pluginMartin Basti2015-11-231-1/+0
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Avoid race condition caused by profile delete and recreateFraser Tweedale2015-11-231-2/+1
| | | | | | | | | | | | | | | When importing IPA-managed certificate profiles into Dogtag, profiles with the same name (usually caIPAserviceCert) are removed, then immediately recreated with the new profile data. This causes a race condition - Dogtag's LDAPProfileSystem profileChangeMonitor thread could observe and process the deletion after the profile was recreated, disappearing it again. Update the profile instead of deleting and recreating it to avoid this race condition. Fixes: https://fedorahosted.org/freeipa/ticket/5269 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* TLS and Dogtag HTTPS request logging improvementsFraser Tweedale2015-11-232-8/+4
| | | | | | | | | | | | Pretty printing the TLS peer certificate to logs on every request introduces a lot of noise; do not log it (subject name, key usage and validity are still logged). Fix and tidy up some HTTP logging messages for Dogtag requests. Part of: https://fedorahosted.org/freeipa/ticket/5269 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: fix migration of old dns forward zonesMartin Basti2015-11-201-24/+27
| | | | | | | | Plugins should call self.api not the global one during upgrade https://fedorahosted.org/freeipa/ticket/5472 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow multiple managers per user - CLI partMartin Basti2015-11-205-31/+113
| | | | | | | | | | | | | | | | | | | | Added commands: * user-add-manager * user-remove-manager * stageuser-add-manager * stageuser-remove-manager Commit contains override of convert_attribute_members method in baseuser class that ensures the managers will be returned in 'manager' attribute due to backward compatibility instead of 'manager_user' as would be expected. https://fedorahosted.org/freeipa/ticket/5344 This patch also fixes: https://fedorahosted.org/freeipa/ticket/5387 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move common code of user and stageuser to baseuser postcallbackMartin Basti2015-11-203-6/+4
| | | | | | | usser-add and stageuser-add contains common code that can be exported to baseuser common postcallback Reviewed-By: David Kupka <dkupka@redhat.com>
* client install: do not corrupt OpenSSH config with Match sectionsJan Cholasta2015-11-201-2/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/5461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* fix caching in get_ipa_configMartin Basti2015-11-191-1/+1
| | | | | | | | | Different opbject types were compared thus always result of comparation was False and caching does not work. https://fedorahosted.org/freeipa/ticket/5463 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* suppress errors arising from adding existing LDAP entries during KRA installMartin Babinsky2015-11-192-3/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/5346 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert renewal: make renewal of ipaCert atomicJan Cholasta2015-11-195-4/+26
| | | | | | | | | This prevents errors when renewing other certificates during the renewal of ipaCert. https://fedorahosted.org/freeipa/ticket/5436 Reviewed-By: David Kupka <dkupka@redhat.com>
* install: export KRA agent PEM file in ipa-kra-installJan Cholasta2015-11-191-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5462 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* CI test: Fix installation of KRA on a replicaMartin Basti2015-11-181-1/+2
| | | | | | | | With domain level 1 installation of KRA has been changed on replica. https://fedorahosted.org/freeipa/ticket/5379 Reviewed-By: Ales 'alich' Marecek <amarecek@redhat.com>
* Fix CI tests domain_level env configMartin Basti2015-11-182-1/+3
| | | | Reviewed-By: Ales 'alich' Marecek <amarecek@redhat.com>
* ipa_kdb_tests: Fix test with default krb5.confLukas Slebodnik2015-11-181-0/+4
| | | | | | | Default krb5.conf needn't have defined default_realm. Unit tests should not rely on existing default value. Reviewed-By: Martin Basti <mbasti@redhat.com>
* cmocka_tests: Do not use deprecated cmocka interfaceLukas Slebodnik2015-11-183-25/+36
| | | | | | | | The cmocka-1.0 introduced new interface for tests which is not compatible with the old one. And the old interface is deprecated which caused compiled warnings. Reviewed-By: Martin Basti <mbasti@redhat.com>
* BUILD: provide check target in custom MakefilesLukas Slebodnik2015-11-183-0/+9
| | | | | | | | | The automake generated makefiles have already a target check. We need to provide this target also to non-generated Makefiles so we can recursively call make check from top level Makefile Reviewed-By: Martin Basti <mbasti@redhat.com>
* SPEC: Run cmocka based unit test in %check phaseLukas Slebodnik2015-11-181-1/+7
| | | | | | | This patch also consolidate build dependencies for c based unit tests Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-extdom-extop: Fix warning WformatLukas Slebodnik2015-11-131-1/+1
| | | | | | | | | | | | | | | In file included from ipa_extdom_extop.c:41:0: ipa_extdom_extop.c: In function ‘ipa_extdom_init_ctx’: ipa_extdom_extop.c:203:9: warning: format ‘%d’ expects argument of type ‘int’, but argument 4 has type ‘size_t {aka long unsigned int}’ [-Wformat=] LOG("Maximal nss buffer size set to [%d]!\n", ctx->max_nss_buf_size); ^ ../common/util.h:53:21: note: in definition of macro ‘LOG_PLUGIN_NAME’ fmt, ##__VA_ARGS__) ^ ipa_extdom_extop.c:203:5: note: in expansion of macro ‘LOG’ Reviewed-By: Martin Basti <mbasti@redhat.com>
* topology: Fix warning WshadowLukas Slebodnik2015-11-131-1/+0
| | | | | | | | | | | | topology_pre.c: In function ‘ipa_topo_pre_add’: topology_pre.c:509:15: warning: declaration of ‘errtxt’ shadows a previous local [-Wshadow] char *errtxt; ^ topology_pre.c:494:11: note: shadowed declaration is here char *errtxt = NULL; ^ Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb_tests: Fix warning Wmissing-bracesLukas Slebodnik2015-11-131-2/+2
| | | | | | | | | | | | | | | | tests/ipa_kdb_tests.c:254:9: warning: missing braces around initializer [-Wmissing-braces] {3, {BLACKLIST_SID"-1000", BLACKLIST_SID"-1001", BLACKLIST_SID"-1002"}, ^ tests/ipa_kdb_tests.c:254:9: note: (near initialization for ‘test_data[6]’) tests/ipa_kdb_tests.c:256:9: warning: missing braces around initializer [-Wmissing-braces] {0, NULL, 0 , NULL} ^ tests/ipa_kdb_tests.c:256:9: note: (near initialization for ‘test_data[7]’) tests/ipa_kdb_tests.c:234:21: warning: missing braces around initializer [-Wmissing-braces] } test_data[] = { ^ Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb_tests: Remove unused variablesLukas Slebodnik2015-11-131-4/+0
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-20 18:32:57 +0000