summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
...
* ipalib, ipaserver: migrate all plugins to Registry-based registrationJan Cholasta2016-05-2516-71/+87
| | | | | | | | Do not use the deprecated API.register method. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: replace API.import_plugins with new API.add_packageJan Cholasta2016-05-251-1/+5
| | | | | | | | | | | | | | | Replace API.import_plugins with a new method API.add_package which allows loading plugin packages into an API object from a package object. This makes loading of plugin packages loading consistent with loading of plugin modules and classes. Rename API.modules to API.packages and use package objects where implemented to reflect the change. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: include structured error information in responsesJan Cholasta2016-05-251-0/+1
| | | | | | | | | | | | | | Include keyword arguments of exceptions in RPC responses. This is limited to JSON-RPC, as XML-RPC does not support additional data in error responses. Include keyword arguments of messages in RPC responses. Include keyword arguments of exceptions in batch command result. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* replica install: do not set CA renewal master flagJan Cholasta2016-05-243-4/+28
| | | | | | | | | | | | | The CA renewal master flag was uncoditionally set on every replica during replica install. This causes the Dogtag certificates initially shared among all replicas to differ after renewal. Do not set the CA renewal master flag in replica install anymore. On upgrade, remove the flag from all but one IPA masters. https://fedorahosted.org/freeipa/ticket/5902 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Incorrect message when KRA already installedPatrice Duc-Jacquet2016-05-201-0/+5
| | | | | | | | | | | | | | | | | When trying to install a second time KRA, in case domain-level=0 the error lessage is not correct. It mentions : "ipa-kra-install: error: A replica file is required." Note that this behavior is not observed if domain-level=1 The subject of the fix consist in checking that KRA is not already installed before going ahead in the installation process. Tests done: I have made the following tests in bot domain-level=0 and domain-level=1 : - Install KRA (check it is correctly installed), - Install KRA a second time (check that the correct error message is raised) - uninstall KRA (check that it is correctly uninstalled) - Install KRA again (check that it is correctly installed) Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Detect and repair incorrect caIPAserviceCert configFraser Tweedale2016-05-192-3/+49
| | | | | | | | | | | A regression caused replica installation to replace the FreeIPA version of caIPAserviceCert with the version shipped by Dogtag. During upgrade, detect and repair occurrences of this problem. Part of: https://fedorahosted.org/freeipa/ticket/5881 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Prevent replica install from overwriting cert profilesFraser Tweedale2016-05-191-6/+12
| | | | | | | | | | | | | | An earlier change that unconditionally triggers import of file-based profiles to LDAP during server or replica install results in replicas overwriting FreeIPA-managed profiles with profiles of the same name shipped with Dogtag. ('caIPAserviceCert' is the affected profile). Avoid this situation by never overwriting existing profiles during the LDAP import. Fixes: https://fedorahosted.org/freeipa/ticket/5881 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added exception handling for mal-formatted XML ParsingAbhijeet Kasurde2016-05-111-2/+7
| | | | | | | | | | In order to handle mal-formatted XML returned from Dogtag, added exception handling around etree.fromstring function. https://fedorahosted.org/freeipa/ticket/5885 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Replaced find_hostname with api.env.hostAbhijeet Kasurde2016-05-101-21/+1
| | | | | | | Fixes: https://fedorahosted.org/freeipa/ticket/5841 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix remaining relative import and enable Pylint checkPetr Viktorin2016-05-101-1/+1
| | | | | | | | Relative imports are not supported in Python 3. Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: Fix upgrade - master to forward zone transformationPetr Spacek2016-05-101-1/+3
| | | | | | | | | | | | | | | This happens when upgrading from IPA <= 4.0 to versions 4.3+. DNS caching might cause false positive in code which replaces master zone with forward zone. This will effectivelly delete the master zone without adding a replacement forward zone. Solution is to use skip_overlap_check option for dnsforwardzone_add command so zone existence check is skipped and the upgrade can proceed. https://fedorahosted.org/freeipa/ticket/5851 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Auto-detect default value for --forward-policy option in installersPetr Spacek2016-04-282-1/+12
| | | | | | | | | | | | | Forward policy defaults to 'first' if no IP address belonging to a private or reserved ranges is detected on local interfaces (RFC 6303). Defaults to only if a private IP address is detected. This prevents problems with BIND automatic empty zones because conflicting zones cannot be disabled unless forwarding policy == only. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Extend installers with --forward-policy optionPetr Spacek2016-04-284-6/+19
| | | | | | | | | This option specified forward policy for global forwarders. The value is put inside /etc/named.conf. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added fix for notifying user about locked user account in WebUIAbhijeet Kasurde2016-04-281-1/+11
| | | | | | | | | | | | User in now notified about "Locked User account" message instead of "The password or username you entered is incorrect" or any generic error message Fixes : https://fedorahosted.org/freeipa/ticket/5076 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Remove unused hostname variablesMartin Basti2016-04-261-3/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Always set hostnameMartin Basti2016-04-261-17/+6
| | | | | | | | | | | This prevents cases when hostname on system is set inconsistently (transient and static hostname differs) and may cause IPA errors. This commit ensures that all hostnames are set properly. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Configure httpd service from installer instead of directly from RPMMartin Basti2016-04-222-0/+11
| | | | | | | | | | | | | | File httpd.service was created by RPM, what causes that httpd service may fail due IPA specific configuration even if IPA wasn't installed or was uninstalled (without erasing RPMs). With this patch httpd service is configured by httpd.d/ipa.conf during IPA installation and this config is removed by uninstaller, so no residual http configuration related to IPA should stay there. https://fedorahosted.org/freeipa/ticket/5681 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica-prepare: do not add PTR records if there is no IPA managed reverse zoneMartin Babinsky2016-04-191-0/+5
| | | | | | | | | | | ipa-replica-prepare could crash during addition of replica's PTR records if there was no reverse zone managed by IPA and 'bindinstance.find_reverse_zone' returns an unhandled None. The code will now issue a warning and skip the PTR record addition in this case. https://fedorahosted.org/freeipa/ticket/5740 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added fix for notifying user about Kerberos principal expiration in WebUIAbhijeet Kasurde2016-04-151-2/+11
| | | | | | | | | | | | - User is now notified about "Kerberos Principal expiration" message instead of "Wrong username or password" message. - User is also notified about "Invalid password" message instead of generic error message. https://fedorahosted.org/freeipa/ticket/5077 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* differentiate between limit types when LDAP search exceeds configured limitsMartin Babinsky2016-04-131-2/+3
| | | | | | | | | | | When LDAP search fails on exceeded limits, we should raise an specific exception for the type of limit raised (size, time, administrative) so that the consumer can distinguish between e.g. searches returning too many entries and those timing out. https://fedorahosted.org/freeipa/ticket/5677 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Look up HTTPD_USER's UID and GID during installation.David Kupka2016-03-231-1/+5
| | | | | | | | | Those values differ among distributions and there is no guarantee that they're reserved. It's better to look them up based on HTTPD_USER's name. https://fedorahosted.org/freeipa/ticket/5712 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix kdc.conf.template to use ipaplatform.paths.Timo Aaltonen2016-03-231-1/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
* Use ODS_USER/ODS_GROUP in opendnssec_conf.templateTimo Aaltonen2016-03-231-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipaplatform: Move remaining user/group constants to ipaplatform.constants.Timo Aaltonen2016-03-237-18/+20
| | | | | | | | | Use ipaplatform.constants in every corner instead of importing other bits or calling some platform specific things, and remove most of the remaining hardcoded uid's. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa_restore: Import only FQDN from ipalib.constantsTimo Aaltonen2016-03-231-4/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/5619 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move user/group constants for PKI and DS into ipaplatformChristian Heimes2016-03-228-29/+35
| | | | | | | https://fedorahosted.org/freeipa/ticket/5619 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Pylint: remove unnecessary-semicolonMartin Basti2016-03-221-1/+1
| | | | | Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: import max one module per lineMartin Basti2016-03-223-3/+6
| | | | | Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: use list comprehension instead of iterationMartin Basti2016-03-221-4/+1
| | | | | | | | | Iteration over indexes without calling enumeration fuction is not pythonic and should not be used. In this case iteration can be replaced by list comprehension. Fixing this allows to enable pylint consider-using-enumerate check. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: enable reimported checkMartin Basti2016-03-223-5/+2
| | | | | | | Fixes current reimports and enables pylint check for them Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: fix definition of global variablesMartin Basti2016-03-221-0/+3
| | | | | | | | | | Global variables should be defined in the outer space, not just marked as global inside functions. Removes unused global variables Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* pylint: remove bare exceptMartin Basti2016-03-228-12/+12
| | | | | | | Bare except should not be used. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Remove redundant parameters from CS.cfg in dogtaginstanceMartin Basti2016-03-161-8/+0
| | | | | | | | | | Bind DN is not used for client certificate authentication so they can be safely removed. https://fedorahosted.org/freeipa/ticket/5298 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Configure 389ds with "default" cipher suiteMartin Basti2016-03-091-2/+2
| | | | | | | | | nsSSLCiphers: "default" provides only secure ciphers that should be used when connecting to DS https://fedorahosted.org/freeipa/ticket/5684 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* adtrustinstance: Make sure smb.conf existsTomas Babej2016-03-031-0/+5
| | | | | | | | | | The 'net' command fails unless smb.conf exists. Touch the file prior to any 'net' call to make sure we do not crash for this very reason. https://fedorahosted.org/freeipa/ticket/5687 Reviewed-By: Martin Basti <mbasti@redhat.com>
* configure DNA plugin shared config entries to allow connection with GSSAPIThierry Bordaz2016-03-024-0/+117
| | | | | | | | | | | | | | | https://fedorahosted.org/freeipa/ticket/4026 When a replica needs to extend its DNA range, it selects the remote replica with the larger available range. If there is no replica agreement to that remote replica, the shared config entry needs to contain the connection method/protocol. This fix requires 389-ds * https://fedorahosted.org/389/ticket/47779 * https://fedorahosted.org/389/ticket/48362 That are both fixed in 1.3.4.6 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* pylint: supress false positive no-member errorsMartin Basti2016-03-024-6/+14
| | | | | | | | | pylint 1.5 prints many false positive no-member errors which are supressed by this commit. https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com>
* fix incorrect name of ipa-winsync-migrate command in helpPetr Vobornik2016-03-021-3/+3
| | | | | | | | Help and status text used incorrect name "ipa-migrate-winsync" https://fedorahosted.org/freeipa/ticket/5713 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix connections to DS during installationMartin Basti2016-03-021-0/+6
| | | | | | | | | Regression caused by commit 9818e463f5d0a91b300801ee7c8f31f25de402b2, admin_conn should be connected in method if there is no connection. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* use LDAPS during standalone CA/KRA subsystem deploymentMartin Babinsky2016-03-013-0/+11
| | | | | | | | | | The deployment descriptor used during CA/KRA install was modified to use LDAPS to communicate with DS backend. This will enable standalone CA/KRA installation on top of hardened directory server configuration. https://fedorahosted.org/freeipa/ticket/5570 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* advise: configure TLS in redhat_nss_pam_ldapd and redhat_nss_ldap pluginsPetr Vobornik2016-03-011-2/+2
| | | | | | | | | | | authconfig in config_redhat_nss_ldap and config_redhat_nss_pam_ldapd got new option --enableldaptls It should have effect primarily on el5 systems. https://fedorahosted.org/freeipa/ticket/5654 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-adtrust-install: Allow dash in the NETBIOS nameTomas Babej2016-02-291-6/+12
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Make PTR records check optional for IPA installationMartin Basti2016-02-291-8/+9
| | | | | | | | | PTR records are not mandratory for IPA, result fo checks should be only warning not hard error. https://fedorahosted.org/freeipa/ticket/5686 Reviewed-By: Oleg Fayans <ofayans@redhat.com>
* Move freeipa certmonger helpers to libexecdir.Timo Aaltonen2016-02-262-11/+3
| | | | | | | | | | | The scripts in this directory are simple python scripts, nothing arch-specific in them. Having them under libexec would simplify the code a bit too, since there would be no need to worry about lib vs lib64 (which also cause trouble on Debian). https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: David Kupka <dkupka@redhat.com>
* httpinstance: add start_tracking_certificates methodDavid Kupka2016-02-262-4/+20
| | | | | | | | Configure certmonger to start tracking certificate for httpd. https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dsinstance: add start_tracking_certificates methodDavid Kupka2016-02-262-2/+24
| | | | | | | | Configure certmonger to start tracing certificate for DS. https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: Match whole pre/post command not just basename.David Kupka2016-02-261-26/+20
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* fix permission: Read Replication AgreementsMartin Basti2016-02-251-61/+72
| | | | | | | | | | | | | | This permission cannot be MANAGED permission because it is located in nonreplicating part of the LDAP tree. As side effect, the particular ACI has not been created on all replicas. This commit makes Read Replication Agreements non managed permission and also fix missing ACI on replicas. https://fedorahosted.org/freeipa/ticket/5631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* client: stop using /etc/pki/nssdbJan Cholasta2016-02-242-19/+5
| | | | | | | | | | Don't put any IPA certificates to /etc/pki/nssdb - IPA itself uses /etc/ipa/nssdb and IPA CA certificates are provided to the system using p11-kit. Remove leftovers on upgrade. https://fedorahosted.org/freeipa/ticket/5592 Reviewed-By: David Kupka <dkupka@redhat.com>
* cacert install: fix trust chain validationJan Cholasta2016-02-241-0/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5612 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 05:10:02 +0000