summaryrefslogtreecommitdiffstats
path: root/freeipa.spec.in
Commit message (Collapse)AuthorAgeFilesLines
* client: add support for pre-schema serversJan Cholasta2016-07-011-0/+3
| | | | | | | | | | | | | | | Bundle remote plugin interface definitions for servers which lack API schema support. These server API versions are included: * 2.49: IPA 3.1.0 on RHEL/CentOS 6.5+, * 2.114: IPA 4.1.4 on Fedora 22, * 2.156: IPA 4.2.0 on RHEL/CentOS 7.2 and IPA 4.2.4 on Fedora 23, * 2.164: IPA 4.3.1 on Fedora 23. For servers with other API versions, the closest lower API version is used. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix `Conflicts` with ipa-pythonPetr Spacek2016-06-301-2/+2
| | | | | | | | | The conflicts should have constant version in it because it is related to package split. https://fedorahosted.org/freeipa/ticket/6004 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Set default OCSP URI on install and upgradeFraser Tweedale2016-06-281-3/+3
| | | | | | | | | | | | | | Dogtag has been updated to support a default OCSP URI when the profile includes AuthInfoAccess with URI method but does not specify the URI (instead of constructing one based on Dogtag's hostname and port). Add the pkispawn config to ensure that the OCSP URI is set before issuing CA and system certificates, and add the config to existing CA instances on upgrade. Fixes: https://fedorahosted.org/freeipa/ticket/5956 Reviewed-By: Martin Basti <mbasti@redhat.com>
* mod_auth_gssapi: enable unique credential caches namesPetr Vobornik2016-06-241-1/+1
| | | | | | | | | | | | | | | | | mod_auth_gssapi > 1.4.0 implements support for unique ccaches names. Without it ccache name is derived from pricipal name. It solves a race condition in two concurrent request of the same principal. Where first request deletes the ccache and the second tries to use it which then fails. It may lead e.g. to a failure of two concurrent ipa-client-install. With this feature there are two ccaches so there is no clash. https://fedorahosted.org/freeipa/ticket/5653 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* ipapwd_extop should use TARGET_DN defined by a pre-extop pluginThierry Bordaz2016-06-241-1/+1
| | | | | | | | | | | | | | ipapwd_extop allows to update the password on a specific entry, identified by its DN. It can be usefull to support virtual DN in the extop so that update of a virtual entry would land into the proper real entry. If a pre-extop sets the TARGET_DN, ipapwd_extop sets ORIGINAL_DN with the value of TARGET_DN, instead of using the original one (in the ber req) There is a dependency on slapi-nis >= 0.56-0.1 (https://fedorahosted.org/freeipa/ticket/5955) https://fedorahosted.org/freeipa/ticket/5946 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Require Dogtag >= 10.3.3Fraser Tweedale2016-06-231-3/+3
| | | | | | | | | | Dogtag 10.3.3 fixes a lightweight CA initialisation issue that caused existing lightweight CAs to not be initialised on CA replicas on first run (see https://fedorahosted.org/pki/ticket/2359). Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: dnsserver: put server_id option into named.confMartin Basti2016-06-171-1/+1
| | | | | | | | | | The option server_id is required for DNS location feature, otherwise it will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Require 389-ds-base >= 1.3.5.6Petr Spacek2016-06-161-3/+3
| | | | | | | | | Old DS handles LDAP filters incorrectly and breaks bind-dyndb-ldap. See https://www.redhat.com/archives/freeipa-devel/2016-June/msg00477.html https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use python2 for ipa cliMartin Basti2016-06-141-0/+5
| | | | | | | | | Switch 'ipa' command to py3 has been done prematurely, this commit sets python2 as interpreter for ipa cli. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Revert "Switch /usr/bin/ipa to Python 3"Martin Basti2016-06-141-11/+0
| | | | | | | | | | | | | This reverts commit 1ebd8334bc7da95f1edd64fc930e9cd6e3650534. Switch 'ipa' command to py3 has been done prematurely, thus this commit reverts it from IPA 4.3.2 and temporarily from master because it is blocker for developing of the new features. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* spec file: require correct packages to get API pluginsJan Cholasta2016-06-091-7/+7
| | | | | | | | | | Since ipalib.plugins was split into ipaserver.plugins and ipaclient.plugins, require python-ipaserver and/or python-ipaclient instead of python-ipalib where appropriate. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Setup lightweight CA key retrieval on install/upgradeFraser Tweedale2016-06-091-3/+4
| | | | | | | | | | | | | | | | | | Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove dangling RUVs even if replicas are offlineStanislav Laznicka2016-06-031-3/+3
| | | | | | | | | | | Previously, an offline replica would mean the RUVs cannot be removed otherwise the task would be hanging in the DS. This is fixed in 389-ds 1.3.5. https://fedorahosted.org/freeipa/ticket/5396 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Ludwig Krispenz <lkrispen@redhat.com>
* ipaclient: implement thin clientJan Cholasta2016-06-031-0/+3
| | | | | | | | | | Dynamically create plugin package for the remote server with modules and commands based on the API schema when client API is finalizes. For in-tree API instances, use ipalib.plugins directly. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipaclient: introduce ipaclient.pluginsJan Cholasta2016-06-031-0/+3
| | | | | | | | Load plugins from ipaclient.plugins in client API instances. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Added pyusb as a dependencyStanislav Laznicka2016-05-281-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5886 Reviewed-By: Martin Basti <mbasti@redhat.com>
* build: fix client-only buildJan Cholasta2016-05-191-1/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/5889 Reviewed-By: Martin Basti <mbasti@redhat.com>
* spec file: bump minimum required pki-core versionJan Cholasta2016-05-191-2/+2
| | | | | | | | | | | | Require pki-core >= 10.2.6-19, which contains fixes for the following PKI tickets: * https://fedorahosted.org/pki/ticket/2022 * https://fedorahosted.org/pki/ticket/2247 * https://fedorahosted.org/pki/ticket/2255 https://fedorahosted.org/freeipa/ticket/5602 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Switch /usr/bin/ipa to Python 3Petr Viktorin2016-05-061-0/+11
| | | | | | | | | | | | | When building RPMs with Python 3 support, /usr/bin/ipa will now use Python 3. The in-tree ipa command will also run on Python 3. When building with make install, $(PYTHON) is honored and it will still default to Python 2. Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* spec: Add python-sssdconfig dependency for python-ipatests packageMilan Kubík2016-04-291-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5843 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Configure httpd service from installer instead of directly from RPMMartin Basti2016-04-221-2/+1
| | | | | | | | | | | | | | File httpd.service was created by RPM, what causes that httpd service may fail due IPA specific configuration even if IPA wasn't installed or was uninstalled (without erasing RPMs). With this patch httpd service is configured by httpd.d/ipa.conf during IPA installation and this config is removed by uninstaller, so no residual http configuration related to IPA should stay there. https://fedorahosted.org/freeipa/ticket/5681 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Use netifaces module instead of 'ip' commandMartin Basti2016-04-141-2/+3
| | | | | | | | | Netifaces allows to get addresses from local interfaces of the host in safer way than parsing output of the ip command. https://fedorahosted.org/freeipa/ticket/5591 Reviewed-By: David Kupka <dkupka@redhat.com>
* spec file: rename the python-polib dependency name to python2-polibMilan Kubík2016-03-231-2/+4
| | | | | | | | | | | | | | Trying to install the package depending on python-polib breaks when the system has newer (and renamed) version python2-polib. *This patch is an workaround* for the issue described in [1]. If a renamed package's provides is equal to an older package's name, dnf tries to install the older package. When the newer package is in the system, this leads to a conflict. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1096506 Reviewed-By: Martin Basti <mbasti@redhat.com>
* SPEC: do not run upgrade when ipa server is not installedMartin Basti2016-03-221-7/+10
| | | | | | | | Running upgrade when IPA is not installed produces false positive errors https://fedorahosted.org/freeipa/ticket/5704 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* spec: require python-cryptography newer than 0.9Martin Babinsky2016-03-211-2/+2
| | | | | | | | | | | When generating keys for custodia service, the key material is stored in python-cryptography's OpenSSL backend encoded as DER. This only works in python-cryptography 0.9 and newer so we need to make sure this version pulled in during RPM build and install. https://fedorahosted.org/freeipa/ticket/5744 Reviewed-By: Martin Basti <mbasti@redhat.com>
* spec: add conflict with bind-chroot to freeipa-server-dnsMartin Babinsky2016-03-181-0/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5696 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* spec: Add missing dependencies to python*-ipalib packageMartin Basti2016-03-181-0/+8
| | | | | | | | | Standalone instalation of python*-ipalib packages does not pull all required packages and results into import errors. https://fedorahosted.org/freeipa/ticket/5680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* SPEC: Remove unused build dependency on libwbclientLukas Slebodnik2016-03-091-1/+0
| | | | | | | | The string "wbclient" is not mentioned anywhere in source code and there isn't any issue with building freeipa packages without this package. Reviewed-By: Sumit Bose <sbose@redhat.com>
* configure DNA plugin shared config entries to allow connection with GSSAPIThierry Bordaz2016-03-021-2/+2
| | | | | | | | | | | | | | | https://fedorahosted.org/freeipa/ticket/4026 When a replica needs to extend its DNA range, it selects the remote replica with the larger available range. If there is no replica agreement to that remote replica, the shared config entry needs to contain the connection method/protocol. This fix requires 389-ds * https://fedorahosted.org/389/ticket/47779 * https://fedorahosted.org/389/ticket/48362 That are both fixed in 1.3.4.6 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* spec: Bump required sssd version to 1.13.3-5Tomas Babej2016-03-011-1/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/4403 https://fedorahosted.org/freeipa/ticket/4436 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* slapi-nis: update configuration to allow external members of IPA groupsAlexander Bokovoy2016-03-011-1/+1
| | | | | | | | | | | | | | Currently in an environment with trust to AD the compat tree does not show AD users as members of IPA groups. The reason is that IPA groups are read directly from the IPA DS tree and external groups are not handled. slapi-nis project has added support for it in 0.55, make sure we update configuration for the group map if it exists and depend on 0.55 version. https://fedorahosted.org/freeipa/ticket/4403 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Package python3-ipaclientPetr Viktorin2016-02-291-0/+39
| | | | | | Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move freeipa certmonger helpers to libexecdir.Timo Aaltonen2016-02-261-2/+2
| | | | | | | | | | | The scripts in this directory are simple python scripts, nothing arch-specific in them. Having them under libexec would simplify the code a bit too, since there would be no need to worry about lib vs lib64 (which also cause trouble on Debian). https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: stop using /etc/pki/nssdbJan Cholasta2016-02-241-9/+2
| | | | | | | | | | Don't put any IPA certificates to /etc/pki/nssdb - IPA itself uses /etc/ipa/nssdb and IPA CA certificates are provided to the system using p11-kit. Remove leftovers on upgrade. https://fedorahosted.org/freeipa/ticket/5592 Reviewed-By: David Kupka <dkupka@redhat.com>
* replica promotion: fix AVC denials in remote connection checkJan Cholasta2016-02-111-5/+2
| | | | | | | | Also move com.redhat.idm.trust-fetch-domains to /usr/libexec/ipa/oddjob. https://fedorahosted.org/freeipa/ticket/5550 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Split ipa-client/ into ipaclient/ (Python library) and client/ (C, scripts)Petr Viktorin2016-01-271-1/+2
| | | | | | | | | | | | | | | | Make ipaclient a Python library like ipapython, ipalib, etc. Use setup.py instead of autotools for installing it. Move C client tools, Python scripts, and man pages, to client/. Remove old, empty or outdated, boilerplate files (NEWS, README, AUTHORS). Remove /setup-client.py (ipalib/setup.py should be used instead). Update Makefiles and the spec file accordingly. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* spec file: package python-ipalib as noarchJan Cholasta2016-01-251-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Remove workaround for CA running checkFraser Tweedale2016-01-211-2/+0
| | | | | | | | | | | | | A workaround was introduced for ticket #4676 that used wget to perform an (unauthenticated) https request to check the CA status. Later, wget was changed to curl (the request remained unauthenticated). Remove the workaround and use an http request (no TLS) to check the CA status. Also remove the now-unused unauthenticated_http_request method, and update specfile to remove ipalib dependency on curl. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipapython: port p11helper C code to PythonJan Cholasta2016-01-211-10/+2
| | | | | | | | This replaces the binary _ipap11helper module with cffi-based Python code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Martin Basti <mbasti@redhat.com>
* spec: do not require arch specific ipalib package from noarch packagesPetr Vobornik2016-01-201-7/+7
| | | | | | | | | | | noarch packages should not contain: Requires: some-package-{?_isa} because then they are not the same for each arch - are not noarch https://fedorahosted.org/freeipa/ticket/5568 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipapython: remove default_encoding_utf8Jan Cholasta2016-01-151-2/+0
| | | | | | | | | Replace the "import default_encoding_utf8" in ipalib/cli.py with equivalent Python code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNSSEC CI: add missing ldns-utils dependencyMartin Basti2016-01-121-0/+2
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* use FFI call to rpmvercmp function for version comparisonMartin Babinsky2016-01-111-1/+1
| | | | | | | | | | | | | Stop using rpm-python to compare package versions since the implicit NSS initialization upon the module import breaks NSS handling in IPA code. Call rpm-libs C-API function via CFFI instead. Big thanks to Martin Kosek <mkosek@redhat.com> for sharing the code snippet that spurred this patch. https://fedorahosted.org/freeipa/ticket/5572 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Require Dogtag 10.2.6-13 to fix KRA uninstallChristian Heimes2016-01-061-2/+2
| | | | | | | | | | | | The combination of a bug in Dogtag's sslget command and a new feature in mod_nss causes an incomplete uninstallation of KRA. The bug has been fixed in Dogtag 10.2.6-13. https://fedorahosted.org/freeipa/ticket/5469 https://fedorahosted.org/pki/ticket/1704 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix version comparisonMartin Basti2015-12-221-0/+1
| | | | | | | | Use RPM library to compare vendor versions of IPA for redhat platform https://fedorahosted.org/freeipa/ticket/5535 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Package ipapython, ipalib, ipaplatform, ipatests for Python 3Petr Viktorin2015-12-171-0/+159
| | | | | | | | | | Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* spec file: Add dbus-python to BuildRequiresDavid Kupka2015-12-141-0/+1
| | | | | | Commit 8d7f67e introduced the need for dbus-python during build time. https://fedorahosted.org/freeipa/ticket/5497
* Migrate wget references and usage to curlGabe2015-12-111-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5458 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replica install: add remote connection check over APIJan Cholasta2015-12-111-1/+8
| | | | | | | | | | Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* build: put oddjob scripts into separate directoryJan Cholasta2015-12-111-0/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-09 05:13:21 +0000