freeipa.git, branch fixlogout FreeIPA patches Fix session logout 2017-02-20T17:40:57+00:00 Simo Sorce simo@redhat.com 2017-02-20T17:38:11+00:00 85eb3103c04e6e125bdb1d09caed6a94580a7592 There were 2 issues with session logouts, one is that the logout_cookie was checked and acted on in the wrong place, the other is that the wrong value was set in the IPASESSION header. Fixes https://fedorahosted.org/freeipa/ticket/6685 Signed-off-by: Simo Sorce <simo@redhat.com> 
There were 2 issues with session logouts, one is that the logout_cookie
was checked and acted on in the wrong place, the other is that the wrong
value was set in the IPASESSION header.

Fixes https://fedorahosted.org/freeipa/ticket/6685

Signed-off-by: Simo Sorce <simo@redhat.com>
server upgrade: uninstall ipa_memcached properly 2017-02-20T13:00:50+00:00 Jan Cholasta jcholast@redhat.com 2017-02-20T07:24:47+00:00 6d34c2169fcd520cc726e58e01d008ae3637aad4 Make sure ipa_memcached is not running and no stale state is left in the sysupgrade state file on server upgrade. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> 
Make sure ipa_memcached is not running and no stale state is left in the
sysupgrade state file on server upgrade.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
server upgrade: always upgrade KRA agent PEM file 2017-02-20T13:00:50+00:00 Jan Cholasta jcholast@redhat.com 2017-02-16T10:19:09+00:00 0862e320916e0123df7e8505ba61229db0cb1e4a Before the KRA agent PEM file is exported in server upgrade, the sysupgrade state file is consulted. This causes the KRA agent PEM file not to be exported to the new location if the upgrade was executed in the past. Do not consult the sysupgrade state file to decide whether to upgrade the KRA agent PEM file or not, the existence of the file is enough to make this decision. https://fedorahosted.org/freeipa/ticket/6675 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> 
Before the KRA agent PEM file is exported in server upgrade, the sysupgrade
state file is consulted. This causes the KRA agent PEM file not to be
exported to the new location if the upgrade was executed in the past.

Do not consult the sysupgrade state file to decide whether to upgrade the
KRA agent PEM file or not, the existence of the file is enough to make this
decision.

https://fedorahosted.org/freeipa/ticket/6675

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
server upgrade: fix upgrade from pre-4.0 2017-02-20T13:00:50+00:00 Jan Cholasta jcholast@redhat.com 2017-02-16T10:13:13+00:00 97e838e10da3b42e3605d230e0b8e01b9148876f update_ca_renewal_master uses ipaCert certmonger tracking information to decide whether the local server is the CA renewal master or not. The information is lost when migrating from /etc/httpd/alias to /var/lib/ipa/radb in update_ra_cert_store. Make sure update_ra_cert_store is executed after update_ca_renewal_master so that correct information is used. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> 
update_ca_renewal_master uses ipaCert certmonger tracking information to
decide whether the local server is the CA renewal master or not. The
information is lost when migrating from /etc/httpd/alias to
/var/lib/ipa/radb in update_ra_cert_store.

Make sure update_ra_cert_store is executed after update_ca_renewal_master
so that correct information is used.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
server upgrade: fix upgrade in CA-less 2017-02-20T13:00:50+00:00 Jan Cholasta jcholast@redhat.com 2017-02-16T10:09:04+00:00 ba8a10fbdb39cab672038e1a6dc9c7507070cdf9 Use /etc/httpd/alias instead of /var/lib/ipa/radb in upload_cacrt, as /var/lib/ipa/radb is not populated in CA-less. Do not migrate ipaCert from /etc/httpd/alias to /var/lib/ipa/radb in CA-less, as it might be an incorrect certificate from previous CA-ful install, and is not necessary anyway. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> 
Use /etc/httpd/alias instead of /var/lib/ipa/radb in upload_cacrt, as
/var/lib/ipa/radb is not populated in CA-less.

Do not migrate ipaCert from /etc/httpd/alias to /var/lib/ipa/radb in
CA-less, as it might be an incorrect certificate from previous CA-ful
install, and is not necessary anyway.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
client install: create /etc/ipa/nssdb with correct mode 2017-02-20T13:00:50+00:00 Jan Cholasta jcholast@redhat.com 2017-02-16T09:57:14+00:00 b4fa354f500bcf3ac23ee3805f2c166c6a635b92 The NSS database directory is created with mode 640, which causes the IPA client to fail to connect to any IPA server, because it is unable to read trusted CA certificates from the NSS database. Create the directory with mode 644 to fix the issue. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> 
The NSS database directory is created with mode 640, which causes the IPA
client to fail to connect to any IPA server, because it is unable to read
trusted CA certificates from the NSS database.

Create the directory with mode 644 to fix the issue.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
WebUI: fix incorrect behavior of ESC button on combobox 2017-02-17T16:50:32+00:00 Pavel Vomacka pvomacka@redhat.com 2017-01-04T11:28:55+00:00 6c6c68df544ac1046741d91dfdc59ef8d96b863c When combobox is opened then ESC key should close it. There was a bug that ESC key closed also the dialog. It was caused by bad keyboard event handling. The CB was closed by keydown event and the dialog by keyup. Therefore the propagating of keyup and keydown event is stopped when CB is opened (when the event is fired on CB element). https://fedorahosted.org/freeipa/ticket/6388 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> 
When combobox is opened then ESC key should close it. There was a bug
that ESC key closed also the dialog. It was caused by bad keyboard event
handling. The CB was closed by keydown event and the dialog by keyup.

Therefore the propagating of keyup and keydown event is stopped when CB
is opened (when the event is fired on CB element).

https://fedorahosted.org/freeipa/ticket/6388

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
WebUI: add default on_cancel function in adder_dialog 2017-02-17T16:50:32+00:00 Pavel Vomacka pvomacka@redhat.com 2017-01-04T11:21:57+00:00 1a96e7f9e737941480436269668ccde0a50395f9 Adder dialog is mixed with confirmation_mixin. That mixin calls on_cancel method when closing dialog using ESC key. Previously the on_cancel method was not defined, therefore dialog was not correctly closed. This was the root cause of the bug, that adder dialog cannot be opened after closing it using ESC. Now the default function for on_cancel is dialog.close. So dialog is correctly closed. https://fedorahosted.org/freeipa/ticket/6388 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> 
Adder dialog is mixed with confirmation_mixin. That mixin calls on_cancel method
when closing dialog using ESC key. Previously the on_cancel method
was not defined, therefore dialog was not correctly closed. This was the root
cause of the bug, that adder dialog cannot be opened after closing it using ESC.

Now the default function for on_cancel is dialog.close. So dialog
is correctly closed.

https://fedorahosted.org/freeipa/ticket/6388

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Use RemoveOnStop to cleanup systemd sockets 2017-02-17T14:19:07+00:00 Nathaniel McCallum npmccallum@redhat.com 2017-02-17T14:10:14+00:00 d05d1115e409962fee3576a4bfc5cecfacef4fd3 Reviewed-By: Christian Heimes <cheimes@redhat.com> 
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Do not configure PKI ajp redirection to use "::1" 2017-02-17T13:58:06+00:00 Florence Blanc-Renaud flo@redhat.com 2017-01-12T17:17:15+00:00 eaa87c75b9f57500265b2dc9480b996b2b92e1e3 When ipa-server-install configures PKI, it provides a configuration file with the parameter pki_ajp_host set to ::1. This parameter is used to configure Tomcat redirection in /etc/pki/pki-tomcat/server.xml: <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="::1" /> ie all requests to port 8009 are redirected to port 8443 on address ::1. If the /etc/hosts config file does not define ::1 for localhost, then AJP redirection fails and replica install is not able to request a certificate for the replica. Since PKI has been fixed (see PKI ticket 2570) to configure by default the AJP redirection with "localhost", FreeIPA does not need any more to override this setting. The code now depends on pki 10.3.5-11 which provides the fix in the template and the upgrade. https://fedorahosted.org/freeipa/ticket/6575 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> 
When ipa-server-install configures PKI, it provides a configuration file
with the parameter pki_ajp_host set to ::1. This parameter is used to configure
Tomcat redirection in /etc/pki/pki-tomcat/server.xml:
    <Connector port="8009"
            protocol="AJP/1.3"
            redirectPort="8443"
            address="::1" />
ie all requests to port 8009 are redirected to port 8443 on address ::1.

If the /etc/hosts config file does not define ::1 for localhost, then AJP
redirection fails and replica install is not able to request a certificate
for the replica.

Since PKI has been fixed (see PKI ticket 2570) to configure by default the AJP
redirection with "localhost", FreeIPA does not need any more to override
this setting.
The code now depends on pki 10.3.5-11 which provides the fix in the template
and the upgrade.

https://fedorahosted.org/freeipa/ticket/6575

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>