summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* adtrust: remove nttrustpartner parameterAlexander Bokovoy2016-06-105-68/+5
| | | | | | | | | | | | | | | MS-ADTS spec requires that TrustPartner field should be equal to the commonName (cn) of the trust. We used it a bit wrongly to express trust relationship between parent and child domains. In fact, we have parent-child relationship recorded in the DN (child domains are part of the parent domain's container). Remove the argument that was never used externally but only supplied by trust-specific code inside the IPA framework. Part of https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Revert "adtrust: remove nttrustpartner parameter"Martin Basti2016-06-104-3/+66
| | | | | | | | | | This reverts commit 185806432d6dfccc5cdd73815471ce60a575b073. The wrong version of patch has been pushed. https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Basti <mbasti@redhat.com>
* adtrust: remove nttrustpartner parameterAlexander Bokovoy2016-06-104-66/+3
| | | | | | | | | | | | | MS-ADTS spec requires that TrustPartner field should be equal to the commonName (cn) of the trust. We used it a bit wrongly to express trust relationship between parent and child domains. In fact, we have parent-child relationship recorded in the DN (child domains are part of the parent domain's container). Remove the argument that was never used externally but only supplied by trust-specific code inside the IPA framework. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Add support for an external trust to Active Directory domainAlexander Bokovoy2016-06-093-28/+86
| | | | | | | | | | | | | | | External trust is a trust that can be created between Active Directory domains that are in different forests or between an Active Directory domain. Since FreeIPA does not support non-Kerberos means of communication, external trust to Windows NT 4.0 or earlier domains is not supported. The external trust is not transitive and can be established to any domain in another forest. This means no access beyond the external domain is possible via the trust link. Resolves: https://fedorahosted.org/freeipa/ticket/5743 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix resolve_rrsets: RRSet is not hashableMartin Basti2016-06-091-2/+2
| | | | | | | | | We cannot use set() with RRSet objects, because RRSet object is not hashable. A set was replaced by list. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* add context to exception on LdapEntry decode errorFlorence Blanc-Renaud2016-06-091-2/+10
| | | | | | | | | | | | | When reading the content of an invalid LDAP entry, the exception only displays the attribute name and value, but not the DN of the entry. Because of this, it is difficult to identify the root cause of the problem. The fix raises a ValueError exception which also contains the entry DN. https://fedorahosted.org/freeipa/ticket/5434 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* extdom: add certificate requestSumit Bose2016-06-092-8/+27
| | | | | | | Related to https://fedorahosted.org/freeipa/ticket/4955 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* Add lists of hosts allowed to create or retrieve keytabsPavel Vomacka2016-06-092-0/+128
| | | | | | | | Attributes tables are added on host and service pages. https://fedorahosted.org/freeipa/ticket/5931 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNS Locations: WebUI partPavel Vomacka2016-06-092-3/+252
| | | | | | | | WebUI part of DNS Location feature. https://fedorahosted.org/freeipa/ticket/5905 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add adapter attribute for choosing recordPavel Vomacka2016-06-091-2/+9
| | | | | | | | | The new attribute of the adapter contains the name of record which will be extracted from API call result. Part of: https://fedorahosted.org/freeipa/ticket/5905 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix bad searching of reverse DNS zonePavel Vomacka2016-06-091-14/+14
| | | | | | | | | | | There was a problem with finding correct DNS zone. It found a first substring match. Therefore when there was location 0.10.10.in-addr.arpa. and 110.10.10.in-addr.arpa the location for IP address 10.10.110.1 was the first one, which is incorrect. Now it finds the second one, because it finds the longest match. https://fedorahosted.org/freeipa/ticket/5796 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* man: Decribe ipa-client-install workaround for broken D-Bus enviroment.David Kupka2016-06-091-0/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/5694 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* spec file: require correct packages to get API pluginsJan Cholasta2016-06-091-7/+7
| | | | | | | | | | Since ipalib.plugins was split into ipaserver.plugins and ipaclient.plugins, require python-ipaserver and/or python-ipaclient instead of python-ipalib where appropriate. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: fix typoJan Cholasta2016-06-091-1/+1
| | | | | | | | This fixes summary lines for commands in the help command. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: fix topic command outputJan Cholasta2016-06-092-5/+13
| | | | | | | | | | Return topic names as text instead of binary blob. This fixes ipa help topic display. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* replica install: use remote server API to create service entriesJan Cholasta2016-06-094-73/+48
| | | | | | | | | | | Use the existing remote server API to create service entries instead of a client API. This fixes a crash during replica promotion due to unavailable schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: do not validate unrequested params in command_defaultsJan Cholasta2016-06-092-5/+6
| | | | | | | | | | | | Request specific params when getting the defaults instead of getting defaults for all params and filtering the result. This fixes command_defaults failing with validation errors on unrequested params. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add custodia store for lightweight CA key replicationFraser Tweedale2016-06-092-0/+57
| | | | | | | | | | | | | | | Due to limitations in Dogtag's use of NSSDB, importing private keys must be done by the Dogtag Java process itself. This requires a PKIArchiveOptions format (signing key wrapped with host CA key) - PKCS #12 cannot be used because that would require decrypting the key in Dogtag's memory, albeit temporarily. Add a new custodia store that executes a 'pki' command to acquire the wrapped key. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Authorise CA Agent to manage lightweight CAsFraser Tweedale2016-06-092-5/+52
| | | | | | | | | Add Dogtag ACLs that authorise the CA Agent certificate to manage lightweight CAs. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Setup lightweight CA key retrieval on install/upgradeFraser Tweedale2016-06-0910-8/+119
| | | | | | | | | | | | | | | | | | Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Optionally add service name to Custodia key DNsFraser Tweedale2016-06-091-5/+22
| | | | | | | | | | | | | | | | | | | Lightweight CAs support introduces new service principals for Dogtag, with Custodia keys. The current Custodia key creation uses a DN that contains only they key type and the hostname, so keys for multiple services on the same host cannot be created. Add the 'generate_keys' method to generate keys for a host or an arbitrary service. When a service name is given, add the key entries in a nested container with RDN 'cn=<service name>'. (The container is assumed to exist). This change does not affect searching because subtree search is used, filtering on the ipaKeyUsage and memberPrincipal attributes. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add ACIs for Dogtag custodia clientFraser Tweedale2016-06-091-0/+8
| | | | | | | | | | | | | The "dogtag/$HOSTNAME@$REALM" service principal uses Custodia to retrieve lightweight CA signing keys, and therefore needs search and read access to Custodia keys. Add an ACI to permit this. Also add ACIs to allow host principals to manage Dogtag custodia keys for the same host. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* otptoken: support Python 3 for the qr codeAlexander Bokovoy2016-06-091-1/+1
| | | | | | | | | | | | | | | | | | | | | When IPA client is using Python 3, there is no str.decode() method anymore. ipa: ERROR: AttributeError: 'str' object has no attribute 'decode' Traceback (most recent call last): File "/usr/lib/python3.5/site-packages/ipalib/cli.py", line 1345, in run sys.exit(api.Backend.cli.run(argv)) File "/usr/lib/python3.5/site-packages/ipalib/cli.py", line 1110, in run rv = cmd.output_for_cli(self.api.Backend.textui, result, *args, **options) File "/usr/lib/python3.5/site-packages/ipaclient/plugins/otptoken.py", line 103, in output_for_cli qr = self._get_qrcode(output, uri, options['version']) File "/usr/lib/python3.5/site-packages/ipaclient/plugins/otptoken.py", line 61, in _get_qrcode qr_code = qr_output.getvalue().decode(encoding) AttributeError: 'str' object has no attribute 'decode' ipa: ERROR: an internal error has occurred Fixes https://fedorahosted.org/freeipa/ticket/5938 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Load server plugins in certmonger renewal helperFraser Tweedale2016-06-081-1/+1
| | | | | | | | The certmonger renewal helper needs to load server plugins to operate. Initialise the API with in_server=True. Fixes: https://fedorahosted.org/freeipa/ticket/5943 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow CustodiaClient to be used by arbitrary principalsFraser Tweedale2016-06-082-10/+24
| | | | | | | | | | | | | | | | | | | | | | | | | Currently CustodiaClient assumes that the client is the host principal, and it is hard-coded to read the host keytab and server keys. For the Lightweight CAs feature, Dogtag on CA replicas will use CustodiaClient to retrieve signing keys from the originating replica. Because this process runs as 'pkiuser', the host keys cannot be used; instead, each Dogtag replica will have a service principal to use for Custodia authentication. Update CustodiaClient to require specifying the client keytab and Custodia keyfile to use, and change the client argument to be a full GSS service name (instead of hard-coding host service) to load from the keytab. Update call sites accordingly. Also pass the given 'ldap_uri' argument through to IPAKEMKeys because without it, the client tries to use LDAPI, but may not have access. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Auth Indicators WebUI partPavel Vomacka2016-06-075-169/+233
| | | | | | | | | | Add custom_checkbox_widget on service page. The old aci.attribute_widget now inherits from the new base class custom_checkboxes_widget and overrides the populate method. https://fedorahosted.org/freeipa/ticket/5872 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Exclude unneeded dirs and files from pylint checkMartin Basti2016-06-071-1/+6
| | | | | | | | | | Generated files or paths that does not contain src files should be skipped: * yacctab.py - autogenerated * lextab.py - autogenerated * dist/* - doesn't contain usefule src files Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* test: test_cli: Do not expect defaults in kwargs.David Kupka2016-06-061-80/+46
| | | | | | | | Client is no longer forwarding in arguments with default values to the server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add the culprit line when a configuration file has an incorrect formatFlorence Blanc-Renaud2016-06-061-1/+5
| | | | | | | | | | | | | | For instance if /etc/nsswitch.conf contains an incorrect line sudoers file sss (Note the missing : after sudoers) ipa-client-install exits with a SyntaxError traceback but does not state which line caused the issue. With the fix, the filename and the line are displayed in the SyntaxError message. https://fedorahosted.org/freeipa/ticket/5811 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Extend the certificate request dialogPavel Vomacka2016-06-063-2/+13
| | | | | | | | | The command for requesting certificate for hosts and services is extended. There is added how to add DNS name as subjectAltName. https://fedorahosted.org/freeipa/ticket/5645 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Removed dead code from LDAP{Remove,Add}ReverseMemberStanislav Laznicka2016-06-061-16/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5892 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Upgrade mod_wsgi socket-timeout on existing installationMartin Basti2016-06-061-1/+1
| | | | | | | | The original fix was efective only on new installations. https://fedorahosted.org/freeipa/ticket/5833 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove service and host cert issuer validationFraser Tweedale2016-06-064-36/+1
| | | | | | | | | | | When adding certifiates to a host or service entry, we currently check that the issuer matches the issuer DN of the IPA CA. Now that sub-CAs have been implemented, this check is no longer valid and will cause false negatives. Remove it and update call sites. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added krb5.conf.d/ to included dirs in krb5.confStanislav Laznicka2016-06-053-1/+4
| | | | | | | | | The include of /etc/krb5.conf.d/ is required for crypto-policies to work properly https://fedorahosted.org/freeipa/ticket/5912 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Change 'Restore' to 'Remove Hold'Pavel Vomacka2016-06-033-19/+25
| | | | | | | | | To be consistent with CLI the restoring certificate is renamed to removing certificate hold in all WebUI components. https://fedorahosted.org/freeipa/ticket/5878 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Change lang.hitch to javascript bind methodPavel Vomacka2016-06-0320-145/+134
| | | | | | | | Also remove the dojo/_base/lang module in cases it is not needed any more. https://fedorahosted.org/freeipa/ticket/5702 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add option to stage user from details pagePavel Vomacka2016-06-034-3/+39
| | | | | | | | Add 'stage' option to the activity dropdown menu on preserved user details page. https://fedorahosted.org/freeipa/ticket/5371 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add ability to stage multiple usersPavel Vomacka2016-06-034-0/+39
| | | | | | | | Add 'Stage' button on search page where preserved users are listed. https://fedorahosted.org/freeipa/ticket/5371 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNS Locations: extend tests with server-* commandsMartin Basti2016-06-034-7/+240
| | | | | | | https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: when removing location remove it from servers firstMartin Basti2016-06-032-0/+9
| | | | | | | | | | | | Locations should be removed from server by using server-mod during location-del (future patches will handle DNS records in server-mod) Referint plugin is configured to remove references of deleted locations. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Location: location-show: return list of servers in locationMartin Basti2016-06-036-5/+110
| | | | | | | | | location-show returns list of servers curently assigned to the location https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: extend server-* command with locationsMartin Basti2016-06-034-9/+121
| | | | | | | | | Server find, server show, server mod should work with IPA locations. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow to use non-Str attributes as keys for membersMartin Basti2016-06-031-6/+8
| | | | | | | | | | | Locations use DNSNameParam as pkey_value, but implementation of searches for members was able to use only Str param. This commit allows to use other param classes for search. Required for: https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: API testsMartin Basti2016-06-032-0/+232
| | | | | | | | | Tests for location-* commands https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: location-* commandsMartin Basti2016-06-038-2/+230
| | | | | | | | | http://www.freeipa.org/page/V4/DNS_Location_Mechanism https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: add new attributes and objectclassesMartin Basti2016-06-031-0/+4
| | | | | | | | | http://www.freeipa.org/page/V4/DNS_Location_Mechanism https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: Always create DNS related privilegesMartin Basti2016-06-034-16/+32
| | | | | | | | | | | DNS privileges are important for handling DNS locations which can be created without DNS servers in IPA topology. We will also need this privileges presented for future feature 'External DNS support' https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix minor typoYuri Chornoivan2016-06-031-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove dangling RUVs even if replicas are offlineStanislav Laznicka2016-06-033-7/+4
| | | | | | | | | | | Previously, an offline replica would mean the RUVs cannot be removed otherwise the task would be hanging in the DS. This is fixed in 389-ds 1.3.5. https://fedorahosted.org/freeipa/ticket/5396 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Ludwig Krispenz <lkrispen@redhat.com>
* fixes premature sys.exit in ipa-replica-manage delStanislav Laznicka2016-06-031-6/+5
| | | | | | | | | | | | Deletion of a replica would fail should there be no RUVs on the server. Also removed some dead code in del_master_managed which might cause premature exit if RuntimeError occurs. https://fedorahosted.org/freeipa/ticket/5307 Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 08:11:52 +0000