summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
...
* use DM credentials to retrieve service keytab only in DLOMartin Babinsky2016-11-111-1/+2
| | | | | | | | | | | | | | | In DL0 directory manager password is bundled in the supplied replica file and the replica installer can use it to authenticate against master when retrieving service keytabs. In DL1, however, DM credentials are generated randomly and used during local DS instance creation. The proper DM password is imported by custodia much later to the process. We must not allow the installer to contact the remote master using this random password since it would fail. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Service: common method for service keytab requestsMartin Babinsky2016-11-111-0/+54
| | | | | | | | | | | Since creation of service principals and keytab retrieval are common operations, Service class should provide means to add service entry to LDAP, retrieve its keytab to designated destination and change the owner to service user. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Turn Kerberos-related properties to Service class membersMartin Babinsky2016-11-119-74/+95
| | | | | | | | | | | | | The Service class now accepts keytab path and service name part of Kerberos principal as members. Kerberos principal is turned into a property computed from service prefix, FQDN and realm. the handling of Kerberos principals and keytabs in service installers was changed to use class members instead of copy-pasted constants. This shall aid in the future refactoring of principal/keytab handling code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Make service user name a class member of ServiceMartin Babinsky2016-11-117-22/+27
| | | | | | | | | This will aid further refactoring of service installers, since the user will be defined only once during parent class initialization. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* service installers: clean up the inheritanceMartin Babinsky2016-11-1111-72/+51
| | | | | | | | | | | | Instead of delegating handling of some parameters like fstore to the parent class, the *Instance installers had the logic copy-pasted in their constructors. Some other members were also moved to the Service class and the parent class constructors in children were fixed to modern standards of initializing parent class in Python. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Offer more general way to check domain level in replicainstallStanislav Laznicka2016-11-111-59/+49
| | | | | | | | | | | | Domain levels 0 and 1 use the same mechanism of checking domain level correctness. Group them together and make it more general should there be more domain levels in the future (although lets hope there won't be). https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use same means of checking replication agreements on both DLsStanislav Laznicka2016-11-111-14/+7
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replicainstall: move common checks to common_check()Stanislav Laznicka2016-11-111-53/+34
| | | | | | | | | | install_check() and promote_check() have some common checks that can be safely moved to common grounds. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Take advantage of the ca/kra code cleanup in replica installationStanislav Laznicka2016-11-111-27/+11
| | | | | | | | | | | | | | The recent cleanup of ca/kra installation code can be used to greatly reduce the number of differences between DL0 and DL1 in replica installation. This change also allows to move Custodia instance creation after Kerberos and httpd instances installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use updated CA certs in replica installationStanislav Laznicka2016-11-111-25/+21
| | | | | | | | | | | | DL0 updated its CA certificate file prior to installing a DS but would not use it for the installation. Update the file on both domain levels and use it to setup DS and HTTP replica instances. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use os.path.join instead of concatenationStanislav Laznicka2016-11-111-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove redundant CA cert file existance checkStanislav Laznicka2016-11-111-3/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use host keytab to connect to remote server on DL0Stanislav Laznicka2016-11-111-11/+15
| | | | | | | | | | | | Since host enrollment was implemented in DL0, use the host keytab to connect to remote api and perform certain actions to merge DL1 and DL0 replica install workflows. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Split install_http_certs() into two functionsStanislav Laznicka2016-11-111-5/+12
| | | | | | | | | | | | install_http_certs() was actually installing http service keytab and actually installing certificates after that. Split it into two so that the names of the new functions better reflect what's actually happening. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* First step of merging replica installation of both DLsStanislav Laznicka2016-11-111-177/+120
| | | | | | | | | | | | The installation steps of replica installation on DL0 and DL1 don't differ too much and should be merged. When host enrollment on DL0 is finished, most of the code will be the same. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Properly bootstrap replica promotion apiStanislav Laznicka2016-11-111-10/+6
| | | | | | | | | | Properly bootstrap api in replica promote_check() so that it can be used later in the installation for setting up dns. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move the pki-tomcat restart to cainstance creationStanislav Laznicka2016-11-113-6/+13
| | | | | | | | | | | pki-tomcat would have been restarted in install and replicainstall for backward compatibility reasons. As Dogtag 9 is not supported anymore, we can move this restart only for DL0 replica installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move httpd restart to DNS installationStanislav Laznicka2016-11-113-8/+2
| | | | | | | | | | | | Web service needs restarting after bindinstance is created to pick up changes done to /etc/resolv.conf. This change should be included anytime DNS is installed therefore it makes sense to move it to the common code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: use ldaps for pkispawn in ipa-ca-installJan Cholasta2016-11-112-2/+7
| | | | | | | | | | | | | Commit 822e1bc82af3a6c1556546c4fbe96eeafad45762 undone the fix from commit 276d16775a4ce8af5d39ca8a7bf5bcd638df343f, breaking ipa-ca-install on servers with hardened DS configuration. Put the fix back to make ipa-ca-install work on hardened DS configuration again. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica install: fix DS restart failure during replica promotionJan Cholasta2016-11-111-2/+6
| | | | | | | | | | | | | | Since commit 0914a3aeb778986dea4020ddf8ca550ebef02bad, ipa config file is created before DS certificate is requested, which makes certmonger request the certificate from the local system rather than the remote master. This causes the request to fail, as local httpd is not yet configured at the time of the request. Move ipa config file creation to its original place to fix the issue. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Import just IPAChangeConf instead of the whole moduleStanislav Laznicka2016-11-111-4/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added file permissions option to IPAChangeConf.newConf()Stanislav Laznicka2016-11-111-1/+3
| | | | | | | | | Also added information about why os.chmod is called sometimes after newConf() calls. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replicainstall: Unify default.conf file creationStanislav Laznicka2016-11-111-72/+53
| | | | | | | | | | | | In domain level 0, the default.conf file was created using just file operations. Unified this with domain level 1 where IPAChangeConf is used. Also moved the creation of the file to promote_check in DL1. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix incorrect invocation of ipa-getkeytab during DL0 host enrollmentMartin Babinsky2016-11-111-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6434 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* do partial host enrollment in domain level 0 replica installMartin Babinsky2016-11-112-3/+57
| | | | | | | | | | | | | | | | | In order to unify domain-level specific replica installers to a single workflow some kind of host enrollment must be done also in domain level 0 replica installation. Here the enrollment is done by directory manager using one-time password and only krb5.conf is configured to point to master KDC. Since host keytab is fetched during enrollment KDC installer no longer needs to request it during replica install. https://fedorahosted.org/freeipa/ticket/6434 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* certs: do not re-create NSS database when requesting service certMartin Babinsky2016-11-112-1/+1
| | | | | | | | | | | `CertDB.request_service_cert` could re-create NSSDB files if the supplied CA certificate was not found in database. This could cause subtle bugs since the files were recreated with wrong permissions. This behavior was removed so that there are no destructive operations performed by the method. https://fedorahosted.org/freeipa/ticket/6429 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: merge KRA agent cert export into KRA installJan Cholasta2016-11-115-56/+67
| | | | | | | | | Merge all KRA agent cert export code paths into a single code path in KRA install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: merge RA cert import into CA installJan Cholasta2016-11-115-96/+103
| | | | | | | | Merge all RA cert import code paths into a single code path in CA install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server install: do not restart httpd during CA installJan Cholasta2016-11-111-2/+3
| | | | | | | | At this point, httpd is not configured and the restart fails. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: merge all KRA install code paths into oneJan Cholasta2016-11-113-130/+50
| | | | | | | | | Merge KRA install code paths use in ipa-replica-install in either domain level and ipa-kra-install into one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: merge all CA install code paths into oneJan Cholasta2016-11-113-240/+108
| | | | | | | | | Merge CA install code paths use in ipa-server-install, ipa-replica-install in either domain level and ipa-ca-install into one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: use one remote KRA host name everywhereJan Cholasta2016-11-113-8/+8
| | | | | | | | | Remote master and KRA host names may differ. Always use the remote KRA host name and never the remote master host name in KRA replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: use one remote CA host name everywhereJan Cholasta2016-11-113-6/+8
| | | | | | | | | Remote master and CA host names may differ. Always use the remote CA host name and never the remote master host name in CA replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* initialize empty /etc/http/alias during server/replica installMartin Babinsky2016-11-114-58/+42
| | | | | | | | | | In order to reduce coupling between httpinstance and other service installers, the HTTP installer is now tasked with initialization of /etc/httpd/alias (RA agent database) in the beginning of server/replica installation Part of https://fedorahosted.org/freeipa/ticket/6429 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* CertDB: add API for non-destructive initialization from PKCS#12 bundleMartin Babinsky2016-11-111-0/+8
| | | | | | | | | | | | `create_from_pkcs12` method of CertDB was re-creating NSS database files during PKCS#12 bundle import. This may cause bugs because the file permissions could be re-set to wrong values causing subtle bugs. Modify the class API so that the server cert chain can be imported while preserving existing FS attributes. https://fedorahosted.org/freeipa/ticket/6429 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Moved update of DNA plugin among update pluginsStanislav Laznicka2016-11-115-115/+125
| | | | | | | | | | | | | | | | | To make the code more general, moved the update_dna_shared_config among other update plugins. Bugfix: DNA shared config connection protocol was compared to a method string which would result in a try to always update it even if there was no need to. https://fedorahosted.org/389/ticket/48373 causes that two shared DNA config entries are created instead of one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move ds.replica_populate to an update pluginStanislav Laznicka2016-11-113-21/+38
| | | | | | | | | Replica populate can be applied with other update plugins. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove redundant dsinstance restartStanislav Laznicka2016-11-111-5/+2
| | | | | | | | | | | Removed a redundant restart in server install which was there only so other methods of dsinstance would not fail as they would use the wrong connection mentioned above. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Ensure correct IPA CA nickname in DS and HTTP NSSDBsFraser Tweedale2016-11-112-2/+2
| | | | | | | | | | | | | | | | | | | | | During replica installation, if the IPA deployment has a custom subject_base, the routines that create the DS and HTTP NSSDBs erroneously compare the subject of CA certs to the *default* subject base. This causes the IPA CA cert to be added to the NSSDBs with a nickname derived from the subject name, instead of "{REALM} IPA CA". At a later stage of installation, the `upload_cacrt` plugin reads certs from the HTTP NSSDB in order to update the cn=certificates LDAP certstore. The NSSDB nickname of the cert is used as the CN for the entry. Because the IPA CA cert was not installed in the HTTP NSSDB with the "{REALM} IPA CA", this causes a spurious entry for the IPA CA to be added to the certstore. To avoid this scenario, use the deployment's actual subject base when deciding if a cert is the IPA CA cert. Fixes: https://fedorahosted.org/freeipa/ticket/6415 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipaldap: remove do_bind from LDAPClientTomas Krizek2016-11-102-3/+2
| | | | | | | | | Remove do_bind() method that was a relict used in IPAdmin. Replace its uses with simple / external binds. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Refactor installer code requesting certificatesFlorence Blanc-Renaud2016-11-105-182/+124
| | | | | | | | | | | | | | | | | | | | - Temporary modify certmonger dogtag-ipa-ca-renew helper to request the IPA RA agent cert, using the temp cert created during pkispawn. The cert request is now processed through certmonger, and the helper arguments are restored once the agent cert is obtained. - Modify the installer code creating HTTP and LDAP certificates to use certmonger's IPA helper with temporary parameters (calling dogtag-submit instead of ipa-submit) - Clean-up for the integration tests: sometimes ipa renewal.lock is not released during ipa-server-uninstall. Make sure that the file is removed to allow future installations. https://fedorahosted.org/freeipa/ticket/6433 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-108-144/+146
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: avoid use of nss.data_to_hexFraser Tweedale2016-11-102-6/+8
| | | | | | | | | | | Avoid use of the nss.data_to_hex function for formatting certificate fingerprints. Add our own helper functions to format the fingerprints as hex (with colons). Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pkcs10: use python-cryptography for CSR processingFraser Tweedale2016-11-101-52/+43
| | | | | | | | | | Update ``ipalib.pkcs10`` module to use python-cryptography for CSR processing instead of NSS. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Build: Makefiles for Python packagesPetr Spacek2016-11-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | This version builds only one version of Python packages. If you want to build for Python 2 & 3 call configure twice using different --with-python or specify PYTHON variable when calling make. dist-hook is using SOURCES.txt file from egg-info. According to Petr Viktorin this should be enough for our purposes and avoids need to create plugins for setuptools. Currently VPATH builds do not work for various reasons. This should be fixed later on. Most credit goes to these guys: Christian Heimes <cheimes@redhat.com> Petr Viktorin <pviktori@redhat.com> Kevin Brown <kevin@kevin-brown.com> https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix module name in ipaserver/setup.pyPetr Spacek2016-11-091-1/+1
| | | | | | | | | | The name in setup.py should match real name of the module. It will be used by the build system later on. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* server-del: fix incorrect check for one IPA masterMartin Babinsky2016-11-071-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6417 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ldap2: modify arguments for create_connectionTomas Krizek2016-11-073-22/+14
| | | | | | | | | | | | | | * Remove unused and obsolete function arguments: * tls_certfile * tls_keyfile * debug_level * Rename tls_cacertfile to cacert (same as name in LDAPClient) * Set cacert to constants.CACERT by default. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replicainstall: use ldap_uri in ReplicationManagerTomas Krizek2016-11-071-7/+6
| | | | | | | | | Use conn.ldap_uri everywhere. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replicainstall: correct hostname in ReplicationManagerTomas Krizek2016-11-071-7/+7
| | | | | | | | | Use self.hostname instead of self.conn.host. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 20:06:09 +0000