summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* httpinstance: add start_tracking_certificates methodDavid Kupka2016-02-262-4/+20
| | | | | | | | Configure certmonger to start tracking certificate for httpd. https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dsinstance: add start_tracking_certificates methodDavid Kupka2016-02-262-2/+24
| | | | | | | | Configure certmonger to start tracing certificate for DS. https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: Match whole pre/post command not just basename.David Kupka2016-02-261-26/+20
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipatests: extend permission plugin test with new expected outputMilan Kubík2016-02-252-0/+32
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix permission: Read Replication AgreementsMartin Basti2016-02-256-64/+90
| | | | | | | | | | | | | | This permission cannot be MANAGED permission because it is located in nonreplicating part of the LDAP tree. As side effect, the particular ACI has not been created on all replicas. This commit makes Read Replication Agreements non managed permission and also fix missing ACI on replicas. https://fedorahosted.org/freeipa/ticket/5631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Pylint: add missing attributes of errors to definitionsMartin Basti2016-02-251-0/+36
| | | | | | | | | | Attributes are added to IPA error objects dynamicaly and pylint is not able to handle it itself. Add missing attributes to definitions in pylint plugin. https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com>
* Remove duplicated exceptMartin Basti2016-02-253-9/+0
| | | | | | Both exceptions have been catched before, so it is bacically dead code Reviewed-By: David Kupka <dkupka@redhat.com>
* CI tests: use old schema when testing hostmask-based sudo rulesMartin Babinsky2016-02-252-1/+69
| | | | | | | | | | | | Newer versions of sssd use native IPA schema to process sudo rules. However, this schema currently has no support for hostmask-based rules and causes some sudo CI tests to fail. We have to temporarily set sssd.conf to use ou=sudoers,$SUFFIX as a sudo rule search base when executing them. https://fedorahosted.org/freeipa/ticket/5625 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Revert "test: Temporarily increase timeout in vault test."Martin Basti2016-02-241-1/+1
| | | | | | This reverts commit 8112ac69ccf56dd98c5eb6e77ea131b4665bd1cf. Reviewed-By: Martin Basti <mbasti@redhat.com>
* client: stop using /etc/pki/nssdbJan Cholasta2016-02-248-89/+36
| | | | | | | | | | Don't put any IPA certificates to /etc/pki/nssdb - IPA itself uses /etc/ipa/nssdb and IPA CA certificates are provided to the system using p11-kit. Remove leftovers on upgrade. https://fedorahosted.org/freeipa/ticket/5592 Reviewed-By: David Kupka <dkupka@redhat.com>
* CI: Make double circle topology python3 compatibleDavid Kupka2016-02-242-2/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* cacert install: fix trust chain validationJan Cholasta2016-02-241-0/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5612 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fixes minor issuesStanislav Laznicka2016-02-243-7/+13
| | | | | | | | | | | | | Fixes issues discovered by Coverity plugins/baseldap.py: possible undefined value in return certmonger.py: possible dereference of None value i18n.py: fixed always True bug (+ cosmetic change) https://fedorahosted.org/freeipa/ticket/5661 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Cosmetic changes to the codeStanislav Laznicka2016-02-245-6/+5
| | | | | | | | | | | | | | | Fixes some Coverity issues ipadiscovery.py: added assert should universe break plugins/dns.py: removed dead code dnssec/ldapkeydb.py: attribute assert in the proper object test_automount_plugin.py: fixed possible close() on None xmlrpc_test.py: Coverity does not like accessing None.__class__ https://fedorahosted.org/freeipa/ticket/5661 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix upgrade: wait for proper DS socket after DS restartMartin Basti2016-02-231-3/+1
| | | | | | | | | | | DS restart executed by upgrade plugin causes that upgrade framework is waiting for the improper socket. It leads to TimeoutError because DS is not listening on 389 port during upgrade. This commit fixes the issue. Required for: https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Warn user if trust is brokenMartin Basti2016-02-232-0/+52
| | | | | | | | | | Detect missing ipaNTSecurityIdentifier and print message for a user, that the trust is broken as result of trust-show and trust-find commands. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* trusts: use ipaNTTrustPartner attribute to detect trust entriesMartin Basti2016-02-232-3/+6
| | | | | | | | | | | | | | Trust entries were found by presence of ipaNTSecurityIdentifier attribute. Unfortunately this attribute might not be there due the bug. As replacement for this, attribute ipaNTTrustPartner can be used. Note: other non trust entries located in cn=trusts subtree can be cross-realm principals. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* upgrade: fix config of sidgen and extdom pluginsMartin Basti2016-02-234-8/+163
| | | | | | | | | | | | | | | During upgrade to IPA 4.2, literally "$SUFFIX" value was added to configuration of sidgen and extdom plugins. This cause that SID are not properly configured. Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task against IPA domain (if exists). All trusts added when plugins configuration was broken must be re-added. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* CI: Add test for double-circle topology generator.David Kupka2016-02-231-0/+63
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: Add replication test utilizing double-circle topology.David Kupka2016-02-231-0/+18
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: Add double circle topology.David Kupka2016-02-231-0/+52
| | | | | | | Every site consist of at least two replicas and is connected to two other sites. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: add empty topology test for 2-connected topology generatorDavid Kupka2016-02-231-0/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* CI: Fix pep8 errors in 2-connected topology generatorDavid Kupka2016-02-231-5/+6
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Py3: do not use dict.iteritems()Martin Basti2016-02-231-2/+2
| | | | | | | | | | Py3 does not support iter* methods, this commit replaces 2 occurencies of iteritems() to items(). The dictionaries there are not big, this is sufficient we do not need to use six. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Disable new pylint checksMartin Basti2016-02-231-1/+14
| | | | | | | | | | | | | | New checks have been introduced in pylint 1.5 and many of them are not compatible with IPA code or produce false positives. Disable them all. Note: due older versions of pylint, new checks cannot be disabled locally, must be disabled globally. https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com>
* upgrade: unconditional import of certificate profiles into LDAPMartin Babinsky2016-02-232-3/+9
| | | | | | | | | | | | | | During IPA server upgrade, the migration of Dogtag profiles into LDAP backend was bound to the update of CS.cfg which enabled the LDAP profile subsystem. If the subsequent profile migration failed, the subsequent upgrades were not executing the migration code leaving CA subsystem in broken state. Therefore the migration code path should be executed regardless of the status of the main Dogtag config file. https://fedorahosted.org/freeipa/ticket/5682 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* webui: fixed showing of success message after password change on loginPetr Vobornik2016-02-231-1/+1
| | | | | | | | | | similar issue and cause as in https://fedorahosted.org/freeipa/ticket/5567 root cause is that binding triggers validation which clears messages in validation summary. Maybe it could be refactored in a future to not use the same validation summary field for API calls and fields. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: use API call ca_is_enabled instead of enable_ra env variable.Petr Vobornik2016-02-233-1/+15
| | | | | | | | To be consistent with backend code. https://fedorahosted.org/freeipa/ticket/5622 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* WebUI tests: fix failing of tests due to unclicable labelLenka Doudova2016-02-231-5/+1
| | | | | | | | | | | | Checkbox label is no longer clickable, most tests fail with error like this: AssertionError: Can't click on checkbox label: table.table Message: Element is not clickable at point (37, 340.3999938964844). Other element would receive the click: <input class="standalone" id="cn18" value="itest-group" name="cn" type="checkbox"> The checkbox is clickable directly without the label, this patch provides according fix. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* cli: Don't encode/decode for stdin/stdout on Python 3Petr Viktorin2016-02-171-17/+24
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* p11helper: Port to Python 3Petr Viktorin2016-02-171-6/+5
| | | | | | | | | - Use binascii.hexlify instead of encode('hex') - Keep the library name as a text string instead of encoding to bytes https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* test_util: str/bytes check fixes for Python 3Petr Viktorin2016-02-171-6/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipautil: Use mode 'w+' in write_tmp_filePetr Viktorin2016-02-171-1/+1
| | | | | | | | | Python defaults to 'w+b', but all callers in IPA write use text (as opposed to bytes). https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* tests: Use absolute importsPetr Viktorin2016-02-172-6/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipautil.run, kernel_keyring: Encoding fixes for Python 3Petr Viktorin2016-02-173-6/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap, ldapupdate: Encoding fixes for Python 3Petr Viktorin2016-02-172-4/+18
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix bytes/string handling in rpcMichael Simacek2016-02-171-7/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* test_parameters: Ignore specific error messagePetr Viktorin2016-02-171-2/+1
| | | | | | | | | | | | | In Python 3, the error message from the decimal module is less clear than before. (It's apparently the price to pay for speed -- Python3 uses libmpdec as its Decimal implementation by default.) Don't check for the exact error message. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* CI: Add test for 2-connected topology generator.David Kupka2016-02-121-0/+19
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: Add simple replication test in 2-connected topology.David Kupka2016-02-121-0/+18
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: Add '2-connected' topology generator.David Kupka2016-02-121-0/+57
| | | | | | | | | | | If number of servers (master+replicas) is equal to 4 + SUM(1, n, 2^n*5) for any n >= 0: * every server has replication agreement with 2 - 4 other servers. * at least two agreements must fail in order to disconnect the topology. Otherwise there can be server(s) with single agreement on the edge of the topology. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Upgrade: log to ipaupgrade.log when IPA server is not installedMartin Basti2016-02-111-1/+1
| | | | | | | | | | Message was printed only to stdout and leaves ipaupgrade.log without any record that ipa-server-upgrade failed because ipa server is not installed. Now error is passed to logger which prints meassage to stderr and ipaupgrade.log. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica promotion: fix AVC denials in remote connection checkJan Cholasta2016-02-112-6/+3
| | | | | | | | Also move com.redhat.idm.trust-fetch-domains to /usr/libexec/ipa/oddjob. https://fedorahosted.org/freeipa/ticket/5550 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipatests: Add missing certificate profile fixtureMilan Kubík2016-02-111-1/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/5630 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* make lint: use config file and plugin for pylintMartin Basti2016-02-116-354/+312
| | | | | | | | | | | | | | | | | | | Our custom implementation of pylint checker is often broken by incompatible change on pylint side. Using supported solutions (config file, pylint plugins) should avoid this issue. The plugin adds missing (dynamic) member to classes in abstract syntax tree generated for pylint, instead of just ignoring missing members and all sub-members. This should improve pylint detection of typos and missing members in api. env and test config. make-lint python script has been removed, to run pylint execute 'make lint' https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modernize mod_nss's cipher suitesChristian Heimes2016-02-114-0/+220
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The list of supported TLS cipher suites in /etc/httpd/conf.d/nss.conf has been modernized. Insecure or less secure algorithms such as RC4, DES and 3DES are removed. Perfect forward secrecy suites with ephemeral ECDH key exchange have been added. IE 8 on Windows XP is no longer supported. The list of enabled cipher suites has been generated with the script contrib/nssciphersuite/nssciphersuite.py. TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_256_CBC_SHA https://fedorahosted.org/freeipa/ticket/5589 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Removed --ip-address option from replica installationOleg Fayans2016-02-041-7/+30
| | | | | | | | | | Explicitly specifying ip-address of the replica messes up with the current bind-dyndb-ldap logic, causing reverse zone not to be created. Enabled reverse-zone creation for the clients residing in different subnet from master Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add validation to Issue new certificate dialogPavel Vomacka2016-02-022-20/+45
| | | | | | | | | 'Issue new certificate' dialog now validates whether user fills 'principal' and 'csr' field. In case that one of these fields is empty then it does not allow to submit the dialog. https://fedorahosted.org/freeipa/ticket/5432 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* IPA-SAM: Fix build with samba 4.4Lukas Slebodnik2016-02-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | samba_util.h is not shipped with samba-4.4 and it was indirectly included by "ndr.h" Some functions have prototypes in different header file "util/talloc_stack.h" and other does not have declarations in other header file. But they are still part of libsamba-util.so sh$ objdump -T /usr/lib64/libsamba-util.so.0.0.1 | grep -E "trim_s|xstrdup" 0000000000022200 g DF .text 000000000000001f SAMBA_UTIL_0.0.1 smb_xstrdup 00000000000223b0 g DF .text 000000000000019d SAMBA_UTIL_0.0.1 trim_string ipa_sam.c: In function 'ldapsam_uid_to_sid': ipa_sam.c:836:24: warning: implicit declaration of function 'talloc_stackframe' [-Wimplicit-function-declaration] TALLOC_CTX *tmp_ctx = talloc_stackframe(); ^ ipa_sam.c: In function 'pdb_init_ipasam': ipa_sam.c:4493:2: warning: implicit declaration of function 'trim_string' [-Wimplicit-function-declaration] trim_string( uri, "\"", "\"" ); ^ ipa_sam.c:4580:26: warning: implicit declaration of function 'smb_xstrdup' [-Wimplicit-function-declaration] ldap_state->domain_dn = smb_xstrdup(dn); ^ Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix ipa-adtrust-install to always generate SRV records with FQDNsPetr Spacek2016-02-021-7/+2
| | | | | | | | | | | Previous code failed in following setup: * IPA domain = ipa.example.com * IPA master = vm1.example.com * IPA replica = vm2.example.com https://fedorahosted.org/freeipa/ticket/5663 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-28 16:47:11 +0000