summaryrefslogtreecommitdiffstats
path: root/ipaserver/plugins/service.py
Commit message (Collapse)AuthorAgeFilesLines
* cryptography has deprecated serial in favor of serial_numberChristian Heimes2017-02-101-2/+2
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-101-10/+10
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: avoid use of nss.data_to_hexFraser Tweedale2016-11-101-2/+4
| | | | | | | | | | | Avoid use of the nss.data_to_hex function for formatting certificate fingerprints. Add our own helper functions to format the fingerprints as hex (with colons). Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Remove unused variables in the codeMartin Basti2016-09-271-1/+1
| | | | | | | | | | | This commit removes unused variables or rename variables as "expected to be unused" by using "_" prefix. This covers only cases where fix was easy or only one unused variable was in a module Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix cert revocation when removing all certs via host/service-modFraser Tweedale2016-09-231-1/+2
| | | | | | | | | | | When removing all host/service certificates via host/service-mod --certificate=, the removed certificates should be revoked, but they are not. Examine whether the --certificate option was provided to determine whether certs should be revoked, instead of looking for a cert list in the options (which in this case is empty). Fixes: https://fedorahosted.org/freeipa/ticket/6305 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make host/service cert revocation aware of lightweight CAsFraser Tweedale2016-09-071-28/+28
| | | | | | | | | | Revocation of host/service certs on host/service deletion or other operations is broken when cert is issued by a lightweight (sub)CA, causing the delete operation to be aborted. Look up the issuing CA and pass it to 'cert_revoke' to fix the issue. Fixes: https://fedorahosted.org/freeipa/ticket/6221 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* service: add flag to allow S4U2SelfAlexander Bokovoy2016-08-171-0/+7
| | | | | | Prerequisite for: https://fedorahosted.org/freeipa/ticket/5764 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix ipa-caalc-add-service error messageTomas Krizek2016-08-091-1/+1
| | | | | | | | | When service is not found in ipa-caalc-add-service command, return the entire principal name of the service instead of the first character. https://fedorahosted.org/freeipa/ticket/6171 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Unify display of principal names/aliases across entitiesMartin Babinsky2016-07-011-2/+4
| | | | | | | | | | | | Since now users, hosts, and service all support assigning multiple principal aliases to them, the display of kerberos principal names should be consistent across all these objects. Principal aliases and canonical names will now be displayed in all add, mod, show, and find operations. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Provide API for management of host, service, and user principal aliasesMartin Babinsky2016-07-011-12/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | New commands (*-{add,remove}-principal [PKEY] [PRINCIPAL ...]) were added to manage principal aliases. 'add' commands will check the following: * the correct principal type is supplied as an alias * the principals have correct realm and the realm/alternative suffix (e.g. e-mail) do not overlap with those of trusted AD domains If the entry does not have canonical principal name, the first returned principal name will be set as one. This is mostly to smoothly operate on entries created on older servers. 'remove' commands will check that there is at least one principal alias equal to the canonical name left on the entry. See also: http://www.freeipa.org/page/V4/Kerberos_principal_aliases https://fedorahosted.org/freeipa/ticket/1365 https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make framework consider krbcanonicalname as service primary keyMartin Babinsky2016-07-011-4/+80
| | | | | | | | | | | | | | The framework does not allow single param to appear as both positional argument and option in a single command, or to represent two different positional arguments for that matter. Since principal aliases shall go to krbprincipalname attribute, the framework has to be tricked to believe krbcanonicalname is the service's primary key. The entry DN stored in LDAP remains the same. https://fedorahosted.org/freeipa/ticket/1365 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow for commands that use positional parameters to add/remove attributesMartin Babinsky2016-07-011-3/+5
| | | | | | | | | | | | | | | Commands that modify a single multivalued attribute of an entry should use positional parameters to specify both the primary key and the values to add/remove. Named options are redundant in this case. The `--certificate option` of `*-add/remove-cert` commands was turned mandatory to avoid EmptyModlist when it is omitted. https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Migrate management framework plugins to use Principal parameterMartin Babinsky2016-07-011-62/+39
| | | | | | | | | | | | All plugins will now use this parameter and common code for all operations on Kerberos principals. Additional semantic validators and normalizers were added to determine or append a correct realm so that the previous behavior is kept intact. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* service: Added permissions for auth. indicators read/modifyStanislav Laznicka2016-06-301-2/+2
| | | | | | | Added permissions for Kerberos authentication indicators reading and modifying to service objects. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* server: define missing virtual attributesJan Cholasta2016-06-301-27/+36
| | | | | | | | | | | Move virtual attributes defined in output params of methods into params of the related object. This fixes the virtual attributes being ommited in CLI output. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* keep setting ipakrbprincipal objectclass on new service entriesMartin Babinsky2016-06-271-0/+9
| | | | | | | | | | | | | this is required for replica promotion to work, since the ACI allowing hosts to add their own services uses this objectclass as target filter. This partially reverts changes from commit 705f66f7490c64de1adc129221b31927616c485d https://fedorahosted.org/freeipa/ticket/5996 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* IPA API: set krbcanonicalname instead of ipakrbprincipalalias on new entitiesMartin Babinsky2016-06-231-8/+2
| | | | | | | | | | | Hosts, services, and (stage)-users will now have krbcanonicalname attribute set to the same value as krbprincipalname on creation. Moreover, new services will not have ipakrbprincipalalias set anymore. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* host/service-show/find shouldn't fail on invalid certificateStanislav Laznicka2016-06-221-3/+31
| | | | | | | | | | | host/service-show/find methods would have failed if the first certificate they had in userCertificate attribute were invalid. Expected behavior is that they just show the rest of the reqested attributes. https://fedorahosted.org/freeipa/ticket/5797 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replica install: use remote server API to create service entriesJan Cholasta2016-06-091-1/+1
| | | | | | | | | | | Use the existing remote server API to create service entries instead of a client API. This fixes a crash during replica promotion due to unavailable schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Remove service and host cert issuer validationFraser Tweedale2016-06-061-4/+0
| | | | | | | | | | | When adding certifiates to a host or service entry, we currently check that the issuer matches the issuer DN of the IPA CA. Now that sub-CAs have been implemented, this check is no longer valid and will cause false negatives. Remove it and update call sites. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: move server-side plugins to ipaserverJan Cholasta2016-06-031-0/+889
Move the remaining plugin code from ipalib.plugins to ipaserver.plugins. Remove the now unused ipalib.plugins package. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-29 01:35:20 +0000