summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
* Fix ipa-adtrust-install to always generate SRV records with FQDNsPetr Spacek2016-02-021-7/+2
| | | | | | | | | | | Previous code failed in following setup: * IPA domain = ipa.example.com * IPA master = vm1.example.com * IPA replica = vm2.example.com https://fedorahosted.org/freeipa/ticket/5663 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* always start certmonger during IPA server configuration upgradeMartin Babinsky2016-02-021-28/+5
| | | | | | | | | | | | This patch fixes a regression introduced by commit bef0f4c5c38e7ff6415e8f8c96dc306ef7f0ce56. Instead of checking whether there is CA installed in the topology, we should always start certmonger service during upgrade regardless when CA was configured. https://fedorahosted.org/freeipa/ticket/5655 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Listing and cleaning RUV extended for CA suffixStanislav Laznicka2016-02-021-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* reset ldap.conf to point to newly installer replica after promotionMartin Babinsky2016-02-011-0/+44
| | | | | | | | | | | | When promoting a client to replica reset openldap client config so that it no longer uses remote master as default LDAP hosts but uses local connection to replica. Also make sure that the behavior regarding editing of user-customized config is consistent with the client installer. https://fedorahosted.org/freeipa/ticket/5488 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* replica install: validate DS and HTTP server certificatesJan Cholasta2016-02-011-1/+30
| | | | | | | | | Validate the DS and HTTP certificates from the replica info file early in ipa-replica-install to prevent crashes later. https://fedorahosted.org/freeipa/ticket/5598 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use HTTPD_USER in dogtaginstance.pyTimo Aaltonen2016-01-271-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5587 Reviewed-By: David Kupka <dkupka@redhat.com>
* disable RA plugins when promoting a replica from CA-less masterMartin Babinsky2016-01-271-7/+17
| | | | | | | | | | There is no point in setting 'enable_ra' to True in IPA config when the replica is promoted from CA-less master. The installer should set 'enable_ra' to False and unset 'ra_plugin' directive in this case. https://fedorahosted.org/freeipa/ticket/5626 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* stop installer when setup-ds.pl failPetr Vobornik2016-01-251-1/+1
| | | | | | | | | | DS instance install should fail immediately after setup-ds.pl fail. tickets: #2539, #3720, #5607 https://fedorahosted.org/freeipa/ticket/2539 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* correctly set LDAP bind related attributes when setting up replicationMartin Babinsky2016-01-211-7/+15
| | | | | | | | | | | | | | when CA replica configures 'cn=replica,cn=o\=ipaca,cn=mapping tree,cn=config' entry on remote master during replica installation, the 'nsds5replicabinddn' and 'nsds5replicabinddngroup' attributes are not correctly updated when this entry already existed on the master (e.g. when existing domain-level 0 topology was promoted to domain level 1). This patch ensures that these attributes are always set correctly regardless of existence of the replica entry. https://fedorahosted.org/freeipa/ticket/5412 Reviewed-By: Martin Basti <mbasti@redhat.com>
* uninstallation: more robust check for master removal from topologyMartin Babinsky2016-01-211-4/+36
| | | | | | | | | | | | When uninstalling IPA master in domain level 1 topology, the code that checks for correct removal from topology will now consider failures to lookup host entry in local LDAP and to obtain host TGT as a sign that the master entry was already removed. https://fedorahosted.org/freeipa/ticket/5584 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipapython: port p11helper C code to PythonJan Cholasta2016-01-212-2/+2
| | | | | | | | This replaces the binary _ipap11helper module with cffi-based Python code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Alias "unicode" to "str" under Python 3Petr Viktorin2016-01-202-0/+10
| | | | | | | | | | | | | | Follow-up to commit 23507e6124041ed17f39db211e802495e37520e7 The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use print_function future definition wherever print() is usedPetr Viktorin2016-01-201-0/+2
| | | | | | | | | | | | Pylint considers `print` a statement if the __future__ import is not present, even if it's used like a function with one argument. Add the __future__ import to files `pylint --py3k` complains about. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use explicit truncating divisionPetr Viktorin2016-01-201-2/+2
| | | | | | | | | | In Python 3, the truncating division operator, //, is needed to get C-style "int division". https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* logger: Use warning instead of warnTomas Babej2016-01-184-4/+4
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Warn about potential loss of CA, KRA, DNSSEC during uninstallMartin Basti2016-01-141-1/+11
| | | | | | | | | | If connection do LDAP failed (or LDAP server is down) we cannot verify if there is any additonal instance of CA, KRA, DNSSEC master. In this case a user is warned and promted to confirm uninstallation. https://fedorahosted.org/freeipa/ticket/5544 Reviewed-By: David Kupka <dkupka@redhat.com>
* Enable pylint unpacking-non-sequence checkMartin Basti2016-01-141-6/+6
| | | | | | | Enables check and marks occurences of runtime error in dcerpc.py as false positive. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* py3: Remove py3 incompatible exception handlingTomas Babej2016-01-131-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5585 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* fix Py3 incompatible exception instantiation in replica install codeMartin Babinsky2016-01-131-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5585 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Do not decode HTTP reason phrase from DogtagFraser Tweedale2016-01-132-26/+25
| | | | | | | | | | | | | | The HTTP reason phrase sent by Dogtag is assumed to be encoded in UTF-8, but the encoding used by Tomcat is dependent on system locale, causing decode errors in some locales. The reason phrase is optional and will not be sent in a future version of Tomcat[1], so do not bother decoding and returning it. [1] https://github.com/apache/tomcat/commit/707ab1c77f3bc189e1c3f29b641506db4c8bce37 Fixes: https://fedorahosted.org/freeipa/ticket/5578 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix: Use unattended parameter instead of options.unattendedDavid Kupka2016-01-111-1/+1
| | | | | | | | | Attribute 'unattended' is not always present in 'options' so function parameter 'unattended' should be used. https://fedorahosted.org/freeipa/ticket/5563 Reviewed-By: Martin Basti <mbasti@redhat.com>
* installer: Change reverse zones question to better reflect reality.David Kupka2016-01-111-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5563 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-prepare: Add '--auto-reverse' and '--allow-zone-overlap' optionsDavid Kupka2016-01-111-0/+5
| | | | | | | | | Opiton should be added to ipa-replica-prepare when it was added to ipa-{server,replica,dns}-install but was forgotten. https://fedorahosted.org/freeipa/ticket/5563 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Upgrade: Fix upgrade of NIS Server configurationMartin Basti2016-01-111-0/+86
| | | | | | | | | | | | | Former upgrade file always created the NIS Server container, that caused the ipa-nis-manage did not set all required NIS maps. Default creation of container has been removed. Updating of NIS Server configuration and NIS maps is done only if the NIS Server container exists. https://fedorahosted.org/freeipa/ticket/5507 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* prevent crash of CA-less server upgrade due to absent certmongerMartin Babinsky2016-01-111-2/+28
| | | | | | | | | | | | | ipa-server-upgrade tests whether certmonger service is running before attempting to upgrade IPA master. This causes the upgrader to always fail when there is no CA installer and certmonger is not needed, effectively preventing CA-less IPA master to upgrade succefuly. This test is now skipped if CA is not enabled. https://fedorahosted.org/freeipa/ticket/5519 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow to used mixed case for sysrestoreMartin Basti2016-01-081-3/+3
| | | | | | | | | | | | | This commit allows to use mixed case of keys for sysrestore, before this commit all keys were saved in lowercase what prevents to accesing them. Original usage of mixed case for sysretore key in opendssecinstance had to be changed to lowercase to prevent issues on already installed systems. https://fedorahosted.org/freeipa/ticket/5574 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix DNS zone overlap check to allow ipa-replica-install to workPetr Spacek2016-01-081-15/+19
| | | | | | https://fedorahosted.org/freeipa/ticket/5564 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix --auto-reverse option in --unattended mode.Petr Spacek2016-01-081-1/+2
| | | | | | | | | | | | | Now the option correctly adds missing reverse zones even in unattended mode. Still, this is not sufficient in all cases because 'automatic empty zones' created by BIND (as specified in RFC 6303) can shadow the reverse zones hosted on other servers. This needs to be solved in a separate patch. https://fedorahosted.org/freeipa/ticket/5559 Reviewed-By: David Kupka <dkupka@redhat.com>
* update_uniqueness plugin: fix referenced before assigment errorMartin Basti2016-01-071-2/+2
| | | | | | | This error may potentially happen when plugin migration is skipped due an error. In that case variable 'update' was undefined. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Enable pylint unnecessary-pass checkMartin Basti2015-12-239-9/+1
| | | | | | Enables check and removes extra pass statement from code. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint missing-final-newline checkMartin Basti2015-12-231-1/+1
| | | | | | | | Enables check and fixes: ipaserver/install/otpdinstance.py:25: [C0304(missing-final-newline), ] Final newline missing) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint lost exception checkMartin Basti2015-12-231-2/+2
| | | | | | | | | Commit enables check and also fixes: ipaserver/dcerpc.py:718: [W0150(lost-exception), DomainValidator.__search_in_dc] return statement in finally block may swallow exception) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove wildcard importsMartin Basti2015-12-2319-20/+22
| | | | | | | | | | | Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-2328-62/+9
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-dns-install: Do not check for zone overlap when DNS installed.David Kupka2015-12-223-19/+11
| | | | | | | | | | | When DNS is already installed somewhere in topology we should not check for zone overlap because it would always say that we are overlapping our own domain. ipa-replica-install already does that but ipa-dns-install did not. https://fedorahosted.org/freeipa/ticket/5564 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Remove unused code in server installer related to KRAMartin Basti2015-12-221-21/+3
| | | | | | The first instance of KRA system should be allowed to install only by ipa-kra-install. This commit removes TODO and unneeded parts in code. Reviewed-By: David Kupka <dkupka@redhat.com>
* installer: Fix logic of reading option values from cache.David Kupka2015-12-211-4/+3
| | | | | | | | | | Only options explicitly set must be stored before installer exits first step of external CA setup. When installer continues all stored option values must be restored. https://fedorahosted.org/freeipa/ticket/5556 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installer: Propagate option values from components instead of copying them.David Kupka2015-12-211-31/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5556 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* harden domain level 1 topology connectivity checksMartin Babinsky2015-12-211-8/+33
| | | | | | | | | this patch makes the check_last_link_managed() function more resistant to both orphaned topology suffixes and also to cases when there are IPA masters do not seem to manage any suffix. The function will now only complain loudly about these cases and not cause crashes. Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns: Handle SERVFAIL in check if domain already exists.Petr Spacek2015-12-162-3/+5
| | | | | | | | In cases where domain is already delegated to IPA prior installation we might get timeout or SERVFAIL. The answer depends on the recursive server we are using for the check. Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: Add --auto-reverse option.David Kupka2015-12-142-1/+18
| | | | | | | | Introducing '--auto-reverse' option. When specified reverse records for all server's IP addresses are checked and when record nor reverse zone does not exist reverse zone is created. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* dns: Check if domain already exists.David Kupka2015-12-143-59/+164
| | | | | | | | | Raise an error when the domain already exists. This can be overriden using --force or --allow-zone-overlap options. https://fedorahosted.org/freeipa/ticket/3681 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* replica promotion: let ipa-client-install validate enrollment optionsJan Cholasta2015-12-141-9/+0
| | | | | | | | | ipa-client-install output is redirected to standard output, so let it print its own error message for missing options. https://fedorahosted.org/freeipa/ticket/5542 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Explicitly call chmod on newly created directoriesMartin Basti2015-12-144-8/+13
| | | | | | | | | Without calling os.chmod(), umask is effective and may cause that directory is created with permission that causes failure. This can be related to https://fedorahosted.org/freeipa/ticket/5520 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNS: fix file permissionsMartin Basti2015-12-141-1/+3
| | | | | | | | With non default umask named-pkcs11 cannot access the softhsm token storage https://fedorahosted.org/freeipa/ticket/5520 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* server install: redirect ipa-client-install output to standard outputJan Cholasta2015-12-142-16/+15
| | | | | | https://fedorahosted.org/freeipa/ticket/5527 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* dogtaginstance: remove unused function 'check_inst'Fraser Tweedale2015-12-141-17/+0
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* replica promotion: notify user about ignoring client enrollment optionsJan Cholasta2015-12-141-0/+6
| | | | | | | | | When IPA client is already installed, notify the user that the enrollment options are ignored in ipa-replica-install. https://fedorahosted.org/freeipa/ticket/5530 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Install RA cert during replica promotionMartin Basti2015-12-142-4/+8
| | | | | | | | This cert is needed with KRA to be able store and retrieve secrets. https://fedorahosted.org/freeipa/ticket/5512 Reviewed-By: David Kupka <dkupka@redhat.com>
* Refactor ipautil.runPetr Viktorin2015-12-1410-97/+121
| | | | | | | | | | | | | | | | | | | | | The ipautil.run function now returns an object with returncode and output are accessible as attributes. The stdout and stderr of all commands are logged (unless skip_output is given). The stdout/stderr contents must be explicitly requested with a keyword argument, otherwise they are None. This is because in Python 3, the output needs to be decoded, and that can fail if it's not decodable (human-readable) text. The raw (bytes) output is always available from the result object, as is "leniently" decoded output suitable for logging. All calls are changed to reflect this. A use of Popen in cainstance is changed to ipautil.run. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2024-11-15 15:07:02 +0000