summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ipa-kdb: map_groups() consider all resultsSumit Bose2016-02-021-52/+56
| | | | | | | Resolves https://fedorahosted.org/freeipa/ticket/5573 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fixed typo in service-addThorsten Scherf2016-02-021-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* always start certmonger during IPA server configuration upgradeMartin Babinsky2016-02-021-28/+5
| | | | | | | | | | | | This patch fixes a regression introduced by commit bef0f4c5c38e7ff6415e8f8c96dc306ef7f0ce56. Instead of checking whether there is CA installed in the topology, we should always start certmonger service during upgrade regardless when CA was configured. https://fedorahosted.org/freeipa/ticket/5655 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Automatically detect and remove dangling RUVsStanislav Laznicka2016-02-022-0/+163
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Listing and cleaning RUV extended for CA suffixStanislav Laznicka2016-02-022-16/+30
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Updated connect/disconnect replica to work with both domainlevelsOleg Fayans2016-02-011-6/+23
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* reset ldap.conf to point to newly installer replica after promotionMartin Babinsky2016-02-011-0/+44
| | | | | | | | | | | | When promoting a client to replica reset openldap client config so that it no longer uses remote master as default LDAP hosts but uses local connection to replica. Also make sure that the behavior regarding editing of user-customized config is consistent with the client installer. https://fedorahosted.org/freeipa/ticket/5488 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* replica install: validate DS and HTTP server certificatesJan Cholasta2016-02-011-1/+30
| | | | | | | | | Validate the DS and HTTP certificates from the replica info file early in ipa-replica-install to prevent crashes later. https://fedorahosted.org/freeipa/ticket/5598 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Convert ipa-sam to use the new getkeytab controlSimo Sorce2016-02-013-52/+33
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/5495 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Improve keytab code to select the right principal.Simo Sorce2016-02-014-9/+20
| | | | | | | | | | | | Whe requesting a keytab the salt used is the NORMAL type (for backwards and AD compatibility), however since we added alias support we need to search for the krbCanonicalName in preference, hen nothing is specified, and for the requested principal name when a getkeytab operation is performed. This is so that the correct salt can be applied. (Windows AD uses some peculiar aliases for some special accounts to generate the salt). Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: Remove unused macroLukas Slebodnik2016-01-291-2/+0
| | | | | | | Last usage of the macre SSSD_SYSDB_SID_STR was removed in the commit 0ee8fe11aea9811c724182def3f50960d5dd87b3 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Enabled recreation of test directory in apply_common_fixes functionOleg Fayans2016-01-292-2/+1
| | | | | | | | | | | Without it any test comprized of more than one cycle of installing-uninstalling of ipa would fail due to the fact that test folder on the remote machine gets deleted during ipa uninstallation. Also removed duplicate call of apply_common fixes and added unapply_fixes to uninstall_replica Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC CI: fix zone delegationsMartin Basti2016-01-291-1/+8
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* fix standalone installation of externally signed CA on IPA masterMartin Babinsky2016-01-281-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5636 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-getkeytab: Handle the possibility of not obtaining a resultTomas Babej2016-01-271-0/+4
| | | | | | | | | The ldap_result operation can time out, returning a NULL result, which in turn causes the parsing operation to crash. https://fedorahosted.org/freeipa/ticket/5642 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: remove moot error from webui buildPetr Vobornik2016-01-271-1/+2
| | | | | | | | | | add module 'libs/d3' to a list of modules provided by third party libraries it is provided by d3 library in libs directory https://fedorahosted.org/freeipa/ticket/5641 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* ipa-kdb: get_authz_data_types() make sure entry can be NULLSumit Bose2016-01-272-1/+9
| | | | | | | | | | | | This function determines which type of authorization data should be added to the Kerberos ticket. There are global default and it is possible to configure this per service as well. The second argument is the data base entry of a service. If no service is given it makes sense to return the global defaults and most parts of get_authz_data_types() handle this case well and this patch fixes the remain issue and adds a test for this as well. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use HTTPD_USER in dogtaginstance.pyTimo Aaltonen2016-01-271-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5587 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert renewal: import all external CA certs on IPA CA cert renewalJan Cholasta2016-01-271-19/+9
| | | | | | | | | | Import all external CA certs to the Dogtag NSS database on IPA CA cert renewal. This fixes Dogtag not being able to connect to DS which uses 3rd party server cert after ipa-certupdate. https://fedorahosted.org/freeipa/ticket/5595 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: crash nicely if sessionStorage is not availablePetr Vobornik2016-01-272-6/+19
| | | | | | https://fedorahosted.org/freeipa/ticket/5643 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add support for the 'user' url parameter for the reset_password.htmlPavel Vomacka2016-01-271-0/+4
| | | | | | | | The /ipa/ui/reset_password.html page is now able to use url paramater 'user'. The value of this parameter is used for pre-filling the username field. https://fedorahosted.org/freeipa/ticket/5001 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add tool tips for Revert, Refresh, Undo, and Undo AllPavel Vomacka2016-01-274-2/+12
| | | | | | | | | | | | Add tool tips for buttons in detail view. New tooltips: Reload - Reload current settings from the server. Revert - Undo all unsaved changes. Undo - Undo this change. Undo all - Undo all changes in this field. https://fedorahosted.org/freeipa/ticket/5428 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipatests: fix the install of external caMilan Kubík2016-01-271-1/+3
| | | | | | | | | Fixes the install invocation in the test to use domain and realm correctly. Also makes the test aware of domain levels. https://fedorahosted.org/freeipa/ticket/5605 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Warn user when ipa *-find reach limitMartin Basti2016-01-272-1/+17
| | | | | | | | | Truncated entries were silently ignored, now a user receives warning. https://fedorahosted.org/freeipa/ticket/4022 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Split ipa-client/ into ipaclient/ (Python library) and client/ (C, scripts)Petr Viktorin2016-01-2738-235/+111
| | | | | | | | | | | | | | | | Make ipaclient a Python library like ipapython, ipalib, etc. Use setup.py instead of autotools for installing it. Move C client tools, Python scripts, and man pages, to client/. Remove old, empty or outdated, boilerplate files (NEWS, README, AUTHORS). Remove /setup-client.py (ipalib/setup.py should be used instead). Update Makefiles and the spec file accordingly. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* disable RA plugins when promoting a replica from CA-less masterMartin Babinsky2016-01-271-7/+17
| | | | | | | | | | There is no point in setting 'enable_ra' to True in IPA config when the replica is promoted from CA-less master. The installer should set 'enable_ra' to False and unset 'ra_plugin' directive in this case. https://fedorahosted.org/freeipa/ticket/5626 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor test_attrFilip Skola2016-01-261-388/+281
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Refactor test_replaceFilip Skola2016-01-261-126/+48
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Refactor test_user_plugin, use UserTracker for testsFilip Skola2016-01-252-1520/+1026
| | | | | Reviewed-By: Ales 'alich' Marecek <amarecek@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* stop installer when setup-ds.pl failPetr Vobornik2016-01-251-1/+1
| | | | | | | | | | DS instance install should fail immediately after setup-ds.pl fail. tickets: #2539, #3720, #5607 https://fedorahosted.org/freeipa/ticket/2539 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix DNSSEC test: add glue recordMartin Basti2016-01-251-1/+8
| | | | | | | Missing glue record causes test failure in cases when DNS zone was not managed by IPA DNS Reviewed-By: Petr Spacek <pspacek@redhat.com>
* spec file: package python-ipalib as noarchJan Cholasta2016-01-251-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* correctly set LDAP bind related attributes when setting up replicationMartin Babinsky2016-01-211-7/+15
| | | | | | | | | | | | | | when CA replica configures 'cn=replica,cn=o\=ipaca,cn=mapping tree,cn=config' entry on remote master during replica installation, the 'nsds5replicabinddn' and 'nsds5replicabinddngroup' attributes are not correctly updated when this entry already existed on the master (e.g. when existing domain-level 0 topology was promoted to domain level 1). This patch ensures that these attributes are always set correctly regardless of existence of the replica entry. https://fedorahosted.org/freeipa/ticket/5412 Reviewed-By: Martin Basti <mbasti@redhat.com>
* uninstallation: more robust check for master removal from topologyMartin Babinsky2016-01-212-4/+37
| | | | | | | | | | | | When uninstalling IPA master in domain level 1 topology, the code that checks for correct removal from topology will now consider failures to lookup host entry in local LDAP and to obtain host TGT as a sign that the master entry was already removed. https://fedorahosted.org/freeipa/ticket/5584 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove workaround for CA running checkFraser Tweedale2016-01-213-48/+4
| | | | | | | | | | | | | A workaround was introduced for ticket #4676 that used wget to perform an (unauthenticated) https request to check the CA status. Later, wget was changed to curl (the request remained unauthenticated). Remove the workaround and use an http request (no TLS) to check the CA status. Also remove the now-unused unauthenticated_http_request method, and update specfile to remove ipalib dependency on curl. Reviewed-By: Martin Basti <mbasti@redhat.com>
* prevent moving of topology entries out of managed scope by modrdn operationsLudwig Krispenz2016-01-213-0/+56
| | | | | | Ticket: https://fedorahosted.org/freeipa/ticket/5536 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Exclude o=ipaca subtree from Retro Changelog (syncrepl)Martin Basti2016-01-211-0/+1
| | | | | | | | | | CA and DS have issues with Retro Changelog plugin. CA subtree should be excluded from syncrepl. This should improve speed of CA related operations too. https://fedorahosted.org/freeipa/ticket/5538 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipapython: use python-cryptography instead of libcrypto in p11helperJan Cholasta2016-01-211-232/+108
| | | | | | | | Replace CFFI calls to libcrypto with equivalent python-cryptography code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipapython: port p11helper C code to PythonJan Cholasta2016-01-2116-2492/+1873
| | | | | | | | This replaces the binary _ipap11helper module with cffi-based Python code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Set close button type attribute to 'button'.James Groffen2016-01-201-0/+1
| | | | | | Stops IE10 from closing the dialog on an enter keypress. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fixed login error message box in LoginScreen pageAbhijeet Kasurde2016-01-201-4/+4
| | | | | | | | | | | Fix added for showing error message returned from server to client browser. User is now notified with proper error messages returned by server. https://bugzilla.redhat.com/show_bug.cgi?id=1293870 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: dislay server suffixes in server search pagePetr Vobornik2016-01-202-1/+12
| | | | | | | | | | | | | | There was a change where suffixes in server are not longer returned as DNs but rather a cn of related topology suffix. I.e. they share "memberof" logic. This caused that search page doesn't get the data because it uses "no_member: true" option by default. This patch overrides the behavior because it is OK for server search page to fetch also member data - it is not so costly as e.g. in users. https://fedorahosted.org/freeipa/ticket/5609 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Added kpasswd_server directive in client krb5.confAbhijeet Kasurde2016-01-201-0/+4
| | | | | | | | | | While configuring ipa client using ipa-client-install can configure kpasswd_server explicitly using directive in client's krb5.conf https://fedorahosted.org/freeipa/ticket/5547 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* spec: do not require arch specific ipalib package from noarch packagesPetr Vobornik2016-01-201-7/+7
| | | | | | | | | | | noarch packages should not contain: Requires: some-package-{?_isa} because then they are not the same for each arch - are not noarch https://fedorahosted.org/freeipa/ticket/5568 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* make-lint: Allow running pylint --py3k to detect Python3 issuesPetr Viktorin2016-01-201-13/+26
| | | | | | | | | | | | | | | Pylint can be run with the --py3k switch to detect porting issues. This is not compatible with regular checking (i.e. to do all checks, pylint must be run twice, with and without --py3k). So, do an additional run of pylint in a subprocess for the py3k checks. Add a --no-py3k switch to skip the additional py3k run. Also add a --no-lint switch to allow only running the py3 checks. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove deprecated contrib/RHEL4Petr Viktorin2016-01-207-1010/+0
| | | | | | | | | This code is no longer maintained. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* dnsutil: Rename __nonzero__ to __bool__Petr Viktorin2016-01-201-1/+3
| | | | | | | | | | In Python 3, this special method got renamed. Set both to the same function to keep compatibility. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Avoid builtins that were removed in Python 3Petr Viktorin2016-01-203-3/+3
| | | | | | | | | | | | - `file` was removed in favor of `open`. Switch to the new spelling. - `buffer` was removed in favor of a buffer protocol (and memoryview), and `reload` was moved to importlib. Both are used in py2-only blocks, so just placate PyLint. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Alias "unicode" to "str" under Python 3Petr Viktorin2016-01-206-0/+27
| | | | | | | | | | | | | | Follow-up to commit 23507e6124041ed17f39db211e802495e37520e7 The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use print_function future definition wherever print() is usedPetr Viktorin2016-01-203-0/+5
| | | | | | | | | | | | Pylint considers `print` a statement if the __future__ import is not present, even if it's used like a function with one argument. Add the __future__ import to files `pylint --py3k` complains about. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-29 04:34:49 +0000