summaryrefslogtreecommitdiffstats
path: root/install/share
Commit message (Collapse)AuthorAgeFilesLines
* krb5conf: use 'true' instead of 'yes' for forwardable optionMartin Basti2016-03-091-1/+1
| | | | | | | | | 'yes' is also valid value in krb5.conf but we should be consistent and use only 'true' as we do for other options. https://fedorahosted.org/freeipa/ticket/5518 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow to specify Kerberos authz data type per userSimo Sorce2016-03-091-1/+1
| | | | | | | | | | | | Like for services setting the ipaKrbAuthzData attribute on a user object will allow us to control exactly what authz data is allowed for that user. Setting NONE would allow no authz data, while setting MS-PAC would allow only Active Directory compatible data. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2579 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* fix permission: Read Replication AgreementsMartin Basti2016-02-252-0/+14
| | | | | | | | | | | | | | This permission cannot be MANAGED permission because it is located in nonreplicating part of the LDAP tree. As side effect, the particular ACI has not been created on all replicas. This commit makes Read Replication Agreements non managed permission and also fix missing ACI on replicas. https://fedorahosted.org/freeipa/ticket/5631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use only AES enctypes by defaultSimo Sorce2016-01-131-2/+0
| | | | | | | | | | | | Remove des3 and arcfour from the defaults for new installs. NOTE: the ipasam/dcerpc code sill uses arcfour Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/4740 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Upgrade: Fix upgrade of NIS Server configurationMartin Basti2016-01-112-0/+39
| | | | | | | | | | | | | Former upgrade file always created the NIS Server container, that caused the ipa-nis-manage did not set all required NIS maps. Default creation of container has been removed. Updating of NIS Server configuration and NIS maps is done only if the NIS Server container exists. https://fedorahosted.org/freeipa/ticket/5507 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove unused importsMartin Basti2015-12-231-1/+1
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* aci: merge domain and CA suffix replication agreement ACIsJan Cholasta2015-12-142-9/+3
| | | | | | | | | | | | | Merge the two identical sets of replication agreement permission ACIs for the domain and CA suffixes into a single set suitable for replication agreements for both suffixes. This makes the replication agreement permissions behave correctly during CA replica install, so that any non-admin user with the proper permissions (such as members of the ipaservers host group) can set up replication for the CA suffix. https://fedorahosted.org/freeipa/ticket/5399 Reviewed-By: Martin Basti <mbasti@redhat.com>
* aci: replace per-server ACIs with ipaserver-based ACIsJan Cholasta2015-12-071-11/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/3416 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* aci: add IPA servers host group 'ipaservers'Jan Cholasta2015-12-071-0/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/3416 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* rename topology suffixes to "domain" and "ca"Petr Vobornik2015-12-042-4/+4
| | | | | | | https://www.redhat.com/archives/freeipa-devel/2015-November/msg00485.html Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Sync kerberos LDAP schema with upstream.Simo Sorce2015-12-031-2/+12
| | | | | | | | | | All the new attributes are unused for now, but this allows us to keep tailing upstream in case of other useful changes later on. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2086 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add profiles and default CA ACL on migrationFraser Tweedale2015-11-242-12/+0
| | | | | | | | | | | | | | | | | | | | Profiles and the default CA ACL were not being added during replica install from pre-4.2 servers. Update ipa-replica-install to add these if they are missing. Also update the caacl plugin to prevent deletion of the default CA ACL and instruct the administrator to disable it instead. To ensure that the cainstance installation can add profiles, supply the RA certificate as part of the instance configuration. Certmonger renewal setup is avoided at this point because the NSSDB gets reinitialised later in installation procedure. Also move the addition of the default CA ACL from dsinstance installation to cainstance installation. Fixes: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Drop configure.jarMartin Basti2015-11-132-91/+0
| | | | | | | | | Configure.jar used to be used with firefox version < 10 which is not supported anymore, thus this can be removed. https://fedorahosted.org/freeipa/ticket/5144 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Allow to setup the CA when promoting a replicaSimo Sorce2015-10-151-0/+5
| | | | | | | | | This patch makes --setup-ca work to set upa clone CA while creating a new replica. The standalone ipa-ca-install script is not converted yet though. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* handle multiple managed suffixesLudwig Krispenz2015-10-152-1/+4
| | | | | | | | trigger topology updaet if suffix entry is added trigger topology update if managedSuffix is modified in host entry Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* topology: manage ca replication agreementsPetr Vobornik2015-10-152-0/+16
| | | | | | | | | | | | | Configure IPA so that topology plugin will manage also CA replication agreements. upgrades if CA is congigured: - ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX - ipaReplTopoManagedSuffix: o=ipaca is added to master entry - binddngroup is added to o=ipaca replica entry Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add ipa-custodia serviceSimo Sorce2015-10-153-0/+35
| | | | | | | | | | Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* schema: do not derive ipaVaultPublicKey from ipaPublicKeyJan Cholasta2015-10-121-1/+2
| | | | | | | | | This is a workaround for DS bug: https://bugzilla.redhat.com/show_bug.cgi?id=1267782 https://fedorahosted.org/freeipa/ticket/5359 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Replace StandardError with ExceptionRobert Kuska2015-09-301-1/+1
| | | | | | | | StandardError was removed in Python3 and instead Exception should be used. Signed-off-by: Robert Kuska <rkuska@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: support KRA updateJan Cholasta2015-09-173-39/+30
| | | | | | https://fedorahosted.org/freeipa/ticket/5250 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* vault: update access controlJan Cholasta2015-09-171-8/+14
| | | | | | | | | Do not allow vault and container owners to manage owners. Allow adding vaults and containers only if owner is set to the current user. https://fedorahosted.org/freeipa/ticket/5250 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Added CLI param and ACL for vault service operations.Endi S. Dewata2015-08-171-0/+1
| | | | | | | | | | | | | The CLIs to manage vault owners and members have been modified to accept services with a new parameter. A new ACL has been added to allow a service to create its own service container. https://fedorahosted.org/freeipa/ticket/5172 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-122-2/+2
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add profile for DNP3 / IEC 62351-8 certificatesFraser Tweedale2015-08-112-0/+115
| | | | | | | | | | | The DNP3 smart-grid standard uses certificate with the IEC 62351-8 IECUserRoles extension. Add a profile for DNP3 certificates which copies the IECUserRoles extension from the CSR, if present. Also update cert-request to accept CSRs containing this extension. Fixes: https://fedorahosted.org/freeipa/ticket/4752 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Modernize number literalsPetr Viktorin2015-07-311-1/+1
| | | | | | | | | | | | | | Use Python-3 compatible syntax, without breaking compatibility with py 2.7 - Octals literals start with 0o to prevent confusion - The "L" at the end of large int literals is not required as they use long on Python 2 automatically. - Using 'int' instead of 'long' for small numbers is OK in all cases except strict type checking checking, e.g. type(0). https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS: Consolidate DNS RR types in API and schemaMartin Basti2015-07-212-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | * Remove NSEC3, DNSKEY, TSIG, TKEY, TA records from API: These records never worked, they dont have attributes in schema. TSIG and TKEY are meta-RR should not be in LDAP TA is not supported by BIND NSEC3, DNSKEY are DNSSEC records generated by BIND, should not be in LDAP. *! SIG, NSEC are already defined in schema, must stay in API. * Add HINFO, MINFO, MD, NXT records to API as unsupported records These records are already defined in LDAP schema * Add schema for RP, APL, IPSEC, DHCID, HIP, SPF records These records were defined in IPA API as unsupported, but schema definition was missing. This causes that ACI cannot be created for these records and dnszone-find failed. (#5055) https://fedorahosted.org/freeipa/ticket/4934 https://fedorahosted.org/freeipa/ticket/5055 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* copy-schema-to-ca: allow to overwrite schema filesMartin Basti2015-07-151-3/+26
| | | | | | | | | If content of source and target file differs, the script will ask user for permission to overwrite target file. https://fedorahosted.org/freeipa/ticket/5034 Reviewed-By: David Kupka <dkupka@redhat.com>
* Added vault access control.Endi S. Dewata2015-07-082-5/+13
| | | | | | | | | | | New LDAP ACIs have been added to allow vault owners to manage the vaults and to allow members to access the vaults. New CLIs have been added to manage the owner and member list. The LDAP schema has been updated as well. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added ipaVaultPublicKey attribute.Endi S. Dewata2015-07-071-1/+2
| | | | | | | | | A new attribute ipaVaultPublicKey has been added to replace the existing ipaPublicKey used to store the vault public key. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added symmetric and asymmetric vaults.Endi S. Dewata2015-07-071-1/+3
| | | | | | | | | | | The vault plugin has been modified to support symmetric and asymmetric vaults to provide additional security over the standard vault by encrypting the data before it's sent to the server. The encryption functionality is implemented using the python-cryptography library. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix indicies ntUserDomainId, ntUniqueIdMartin Basti2015-06-291-2/+4
| | | | | | | ntUserDomainId and ntUniqueId contained "eq,pres" index value, which is not valid. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Provide Kerberos over HTTP (MS-KKDCP)Christian Heimes2015-06-244-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* add DS index for userCertificate attributeMartin Babinsky2015-06-181-0/+9
| | | | | | | | | | 'eq' and 'pres' indices for userCertificate attribute allow for more efficient lookup and matching of binary certificates assigned to users, hosts, and services. Part of http://www.freeipa.org/page/V4/User_Certificates Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: add UnknownRecord to schemaMartin Basti2015-06-182-2/+3
| | | | | | | | defintion of UnknownRecord attributetype https://fedorahosted.org/freeipa/ticket/4939 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add CA ACL pluginFraser Tweedale2015-06-115-0/+43
| | | | | | | | | | | | | | | | | | | Implement the caacl commands, which are used to indicate which principals may be issued certificates from which (sub-)CAs, using which profiles. At this commit, and until sub-CAs are implemented, all rules refer to the top-level CA (represented as ".") and no ca-ref argument is exposed. Also, during install and upgrade add a default CA ACL that permits certificate issuance for all hosts and services using the profile 'caIPAserviceCert' on the top-level CA. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
* vault: Move vaults to cn=vaults,cn=kraJan Cholasta2015-06-102-0/+25
| | | | | | https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add usercertificate attribute to user pluginFraser Tweedale2015-06-041-0/+1
| | | | | | Part of: https://fedorahosted.org/freeipa/tickets/4938 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Import included profiles during install or upgradeFraser Tweedale2015-06-043-0/+124
| | | | | | | | | | | | Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add schema for certificate profilesFraser Tweedale2015-06-043-0/+16
| | | | | | | | | The certprofile object class is used to track IPA-managed certificate profiles in Dogtag and store IPA-specific settings. Part of: https://fedorahosted.org/freeipa/ticket/57 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add Domain Level featureTomas Babej2015-05-264-1/+20
| | | | | | | https://fedorahosted.org/freeipa/ticket/5018 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* install part - manage topology in shared treeLudwig Krispenz2015-05-263-0/+16
| | | | | | https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ds plugin - manage replication topology in the shared treeLudwig Krispenz2015-05-262-0/+16
| | | | | | | Implementation of ticket: https://fedorahosted.org/freeipa/ticket/4302 Design page: http://www.freeipa.org/page/V4/Manage_replication_topology Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Added vault plugin.Endi S. Dewata2015-05-251-0/+1
| | | | | | | | | A new plugin has been added to manage vaults. Test scripts have also been added to verify the functionality. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSSEC: update OpenDNSSEC KASP configurationMartin Basti2015-05-191-76/+3
| | | | | | | | | | | | | * remove unneeded parts * increase KSK key length to 3072 * increase KSK key lifetime to 2 years (see NIST SP 800-81-2 section 11.2) Update is not required, as template contains just recommended values which should by reviewed by administrators. https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Server Upgrade: Fix uniqueness pluginsMartin Basti2015-05-191-6/+6
| | | | | | | | | | | | | | | | | | | Due previous changes (in master branch only) the uniqueness plugins became misconfigured. After this patch: * whole $SUFFIX will be checked by unique plugins * just staged users are exluded from check This reverts some changes in commit 52b7101c1148618d5c8e2ec25576cc7ad3e9b7bb Since 389-ds-base 1.3.4.a1 new attribute 'uniqueness-exclude-subtrees' can be used. https://fedorahosted.org/freeipa/ticket/4921 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* User life cycle: Add 'Stage User Provisioning' permission/priviledgeThierry Bordaz2015-05-181-0/+8
| | | | | | | Add the ability for 'Stage user provisioning' priviledge to add stage users. Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: Stage user Administrators permission/priviledgeThierry Bordaz2015-05-182-1/+11
| | | | | | | | Creation of stage user administrator https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: remove CSV from upgrade filesMartin Basti2015-05-111-29/+29
| | | | | | | | | | | | | | | | | CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused disable-betxn.ldif fileMartin Basti2015-03-092-62/+0
| | | | Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix uniqueness pluginsMartin Basti2015-03-051-21/+9
| | | | | | | | | | | | * add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users will not be forced to have unique uid * remove unneded update plugins -> update was moved to .update file * add uniqueness-across-all-subtrees required by user lifecycle management Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-27 22:22:09 +0000