summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/plugins
Commit message (Collapse)AuthorAgeFilesLines
* DNS Locations: dnsserver: put server_id option into named.confMartin Basti2016-06-171-0/+52
| | | | | | | | | | The option server_id is required for DNS location feature, otherwise it will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: move server-side plugins to ipaserverJan Cholasta2016-06-032-3/+3
| | | | | | | | | | Move the remaining plugin code from ipalib.plugins to ipaserver.plugins. Remove the now unused ipalib.plugins package. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* DNS upgrade: change global forwarding policy in named.conf to "only" if ↵Petr Spacek2016-05-301-3/+4
| | | | | | | | | | | | | private IPs are used This change is necessary to override automatic empty zone configuration in latest BIND and bind-dyndb-ldap 9.0+. This upgrade has to be done on each IPA DNS server independently. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS upgrade: change global forwarding policy in LDAP to "only" if private ↵Petr Spacek2016-05-301-0/+16
| | | | | | | | | | | | | | IPs are used This change is necessary to override automatic empty zone configuration in latest BIND and bind-dyndb-ldap 9.0+. This procedure is still not complete because we need to handle global forwarders in named.conf too (independently on each server). https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS upgrade: change forwarding policy to = only for conflicting forward zonesPetr Spacek2016-05-301-0/+78
| | | | | | | | | | | | This change is necessary to override automatic empty zone configuration in latest BIND and bind-dyndb-ldap 9.0+. This procedure is still not complete because we need to handle global forwarders too (in LDAP and in named.conf on each server). https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS upgrade: separate backup logic to make it reusablePetr Spacek2016-05-301-72/+73
| | | | | | https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add ipaDNSVersion option to dnsconfig* commands and use new attributePetr Spacek2016-05-301-17/+60
| | | | | | | | | | | | | | | | | | | | Ad-hoc LDAP calls in DNS upgrade code were hard to maintain and ipaConfigString was bad idea from the very beginning as it was hard to manipulate the number in it. To avoid problems in future we are introducing new ipaDNSVersion attribute which is used on cn=dns instead of ipaConfigString. Original value of ipaConfigString is kept in the tree for now so older upgraders see it and do not execute the upgrade procedure again. The attribute can be changed only by installer/upgrade so it is not exposed in dnsconfig_mod API. Command dnsconfig_show displays it only if --all option was used. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipalib, ipaserver: migrate all plugins to Registry-based registrationJan Cholasta2016-05-2512-47/+60
| | | | | | | | Do not use the deprecated API.register method. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* replica install: do not set CA renewal master flagJan Cholasta2016-05-241-2/+22
| | | | | | | | | | | | | The CA renewal master flag was uncoditionally set on every replica during replica install. This causes the Dogtag certificates initially shared among all replicas to differ after renewal. Do not set the CA renewal master flag in replica install anymore. On upgrade, remove the flag from all but one IPA masters. https://fedorahosted.org/freeipa/ticket/5902 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* DNS: Fix upgrade - master to forward zone transformationPetr Spacek2016-05-101-1/+3
| | | | | | | | | | | | | | | This happens when upgrading from IPA <= 4.0 to versions 4.3+. DNS caching might cause false positive in code which replaces master zone with forward zone. This will effectivelly delete the master zone without adding a replacement forward zone. Solution is to use skip_overlap_check option for dnsforwardzone_add command so zone existence check is skipped and the upgrade can proceed. https://fedorahosted.org/freeipa/ticket/5851 Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix permission: Read Replication AgreementsMartin Basti2016-02-251-61/+72
| | | | | | | | | | | | | | This permission cannot be MANAGED permission because it is located in nonreplicating part of the LDAP tree. As side effect, the particular ACI has not been created on all replicas. This commit makes Read Replication Agreements non managed permission and also fix missing ACI on replicas. https://fedorahosted.org/freeipa/ticket/5631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* trusts: use ipaNTTrustPartner attribute to detect trust entriesMartin Basti2016-02-231-1/+1
| | | | | | | | | | | | | | Trust entries were found by presence of ipaNTSecurityIdentifier attribute. Unfortunately this attribute might not be there due the bug. As replacement for this, attribute ipaNTTrustPartner can be used. Note: other non trust entries located in cn=trusts subtree can be cross-realm principals. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* upgrade: fix config of sidgen and extdom pluginsMartin Basti2016-02-231-0/+153
| | | | | | | | | | | | | | | During upgrade to IPA 4.2, literally "$SUFFIX" value was added to configuration of sidgen and extdom plugins. This cause that SID are not properly configured. Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task against IPA domain (if exists). All trusts added when plugins configuration was broken must be re-added. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Upgrade: Fix upgrade of NIS Server configurationMartin Basti2016-01-111-0/+86
| | | | | | | | | | | | | Former upgrade file always created the NIS Server container, that caused the ipa-nis-manage did not set all required NIS maps. Default creation of container has been removed. Updating of NIS Server configuration and NIS maps is done only if the NIS Server container exists. https://fedorahosted.org/freeipa/ticket/5507 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* update_uniqueness plugin: fix referenced before assigment errorMartin Basti2016-01-071-2/+2
| | | | | | | This error may potentially happen when plugin migration is skipped due an error. In that case variable 'update' was undefined. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Remove wildcard importsMartin Basti2015-12-235-5/+5
| | | | | | | | | | | Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-233-7/+0
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replica install: add remote connection check over APIJan Cholasta2015-12-111-21/+0
| | | | | | | | | | Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Remove invalid error messages from topology upgradeMartin Basti2015-11-251-3/+2
| | | | | | | | | Return False does not mean that update failed, it mean that nothing has been updated, respectively ldap is up to date. https://fedorahosted.org/freeipa/ticket/5482 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-251-3/+2
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* topology: manage ca replication agreementsPetr Vobornik2015-10-151-0/+34
| | | | | | | | | | | | | Configure IPA so that topology plugin will manage also CA replication agreements. upgrades if CA is congigured: - ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX - ipaReplTopoManagedSuffix: o=ipaca is added to master entry - binddngroup is added to o=ipaca replica entry Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use byte literals where appropriateJan Cholasta2015-09-171-1/+1
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Alias "unicode" to "str" under Python 3Jan Cholasta2015-09-172-0/+11
| | | | | | | | | The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Modernize use of range()Petr Viktorin2015-09-011-2/+2
| | | | | | | | | | | | In Python 3, range() behaves like the old xrange(). The difference between range() and xrange() is usually not significant, especially if the whole result is iterated over. Convert xrange() usage to range() for small ranges. Use modern idioms in a few other uses of range(). Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use Python3-compatible dict method namesPetr Viktorin2015-09-012-3/+3
| | | | | | | | | | | | | | | | | | | | | | Python 2 has keys()/values()/items(), which return lists, iterkeys()/itervalues()/iteritems(), which return iterators, and viewkeys()/viewvalues()/viewitems() which return views. Python 3 has only keys()/values()/items(), which return views. To get iterators, one can use iter() or a for loop/comprehension; for lists there's the list() constructor. When iterating through the entire dict, without modifying the dict, the difference between Python 2's items() and iteritems() is negligible, especially on small dicts (the main overhead is extra memory, not CPU time). In the interest of simpler code, this patch changes many instances of iteritems() to items(), iterkeys() to keys() etc. In other cases, helpers like six.itervalues are used. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-126-17/+17
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* upgrade: Enable and start oddjobd if adtrust is availableTomas Babej2015-07-081-0/+24
| | | | | | | If ipa-adtrust-install has already been run on the system, enable and start the oddjobd service. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Server Upgrade: use debug log level for upgrade instead of infoMartin Basti2015-07-035-19/+19
| | | | | | Upgrade contains too many unnecessary info logs. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: Load ipaserver plugins when api.env.in_server is TrueJan Cholasta2015-07-011-1/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/3090 https://fedorahosted.org/freeipa/ticket/5073 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add Domain Level featureTomas Babej2015-05-261-1/+10
| | | | | | | https://fedorahosted.org/freeipa/ticket/5018 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* install part - manage topology in shared treeLudwig Krispenz2015-05-261-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* User life cycle: Stage user Administrators permission/priviledgeThierry Bordaz2015-05-181-2/+10
| | | | | | | | Creation of stage user administrator https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Allow base64 encoded valuesMartin Basti2015-05-116-21/+29
| | | | | | | | | | | | | | This patch allows to use base64 encoded values in update files. Double colon ('::') must be used as separator between attribute name and base64 encoded value. add:attr::<base64-value> replace:attr::<old-base64-value>::<new-base64-value> https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Server Upgrade: remove CSV from upgrade filesMartin Basti2015-05-111-4/+2
| | | | | | | | | | | | | | | | | CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* rename_managed: Remove use of EditableDNPetr Viktorin2015-04-231-20/+32
| | | | | | This was the last use of EditableDN in IPA; the class can now be removed. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Server Upgrade: restart DS using ipaplatfom serviceMartin Basti2015-04-141-47/+0
| | | | | | | | Removes extra class DSRestart which do the same thing https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: use ldap2 connection in fix_replica_agreementsMartin Basti2015-04-141-3/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: plugins should use ldapupdater API instanceMartin Basti2015-04-148-28/+32
| | | | | | | | This is required to have proper LDAP connection in plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: specify order of plugins in update filesMartin Basti2015-04-1416-270/+50
| | | | | | | | | | | | * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Apply plugin updates immediatelyMartin Basti2015-04-1414-74/+67
| | | | | | | | | | Preparation to moving plugins executin into update files. * remove apply_now flag * plugins will return only (restart, modifications) https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Fix commentsMartin Basti2015-04-021-8/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* upload_cacrt: Fix empty cACertificate in cn=CAcertJan Cholasta2015-03-191-24/+30
| | | | | | https://fedorahosted.org/freeipa/ticket/4565 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: remove --test optionMartin Basti2015-03-191-12/+9
| | | | | | | | | As --test option is not used for developing, and it is not recommended to test if upgrade will pass, this path removes it copmletely. https://fedorahosted.org/freeipa/ticket/3448 Reviewed-By: David Kupka <dkupka@redhat.com>
* Revert "Server Upgrade: respect --test option in plugins"Tomas Babej2015-03-197-35/+0
| | | | This reverts commit c95c4849ae1ecc90ac926b8b7d61e153b42e7699.
* Server Upgrade: respect --test option in pluginsMartin Basti2015-03-197-0/+35
| | | | | | | | | Several plugins do the LDAP data modification directly. In test mode these plugis should not be executed. https://fedorahosted.org/freeipa/ticket/3448 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Update entries in order specified in fileMartin Basti2015-03-198-26/+17
| | | | | | | | | | | | Dictionary replaced with list. Particular upgrades are executed in the same order as they are specified in update a file. Different updates for the smae cn, are not merged into one upgrade https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Remove unused PRE_SCHEMA_UPDATEMartin Basti2015-03-193-16/+2
| | | | | | | This is not used anymore. Ticket: https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix uniqueness pluginsMartin Basti2015-03-051-91/+0
| | | | | | | | | | | | * add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users will not be forced to have unique uid * remove unneded update plugins -> update was moved to .update file * add uniqueness-across-all-subtrees required by user lifecycle management Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Migrate uniquess plugins configuration to new styleMartin Basti2015-03-051-1/+202
| | | | | | | New configuration style contains options required for user lifecycle management. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add anonymous read ACI for DUA profileMartin Kosek2015-01-211-0/+20
| | | | | | | | DUA profile(s) are consumed by Solaris clients. https://fedorahosted.org/freeipa/ticket/4850 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 18:06:06 +0000