freeipa.git/client, branch fix_ber_scanf

Replace replication_wait_timeout with certmonger_wait_timeout

2019-09-04T12:52:14+00:00

The variable is intended to control the timeout for replication
events. If someone had significantly reduced it via configuration
then it could have caused certmogner requests to fail due to timeouts.

Add replication_wait_timeout, certmonger_wait_timeout and
http_timeout to the default.conf man page.

Related: https://pagure.io/freeipa/issue/7971
Reviewed-By: Florence Blanc-Renaud

ipa-client-samba: a tool to configure Samba domain member on IPA client

2019-06-29T08:00:28+00:00

Introduces new utility to configure Samba on an IPA domain member.

The tool sets up Samba configuration and internal databases, creates
cifs/... Kerberos service and makes sure that a keytab for this service
contains the key with the same randomly generated password that is set
in the internal Samba databases.

Samba configuration is created by querying an IPA master about details
of trust to Active Directory configuration. All known identity ranges
added to the configuration to allow Samba to properly handle them
(read-only) via idmap_sss.

Resulting configuration allows connection with both NTLMSSP and Kerberos
authentication for IPA users. Access controls for the shared content
should be set by utilizing POSIX ACLs on the file system under a
specific share.

The utility is packaged as freeipa-client-samba package to allow pulling
in all required dependencies for Samba and cifs.ko (smb3.ko) kernel
module. This allows an IPA client to become both an SMB server and an
SMB client.

Fixes: https://pagure.io/freeipa/issue/3999
Signed-off-by: Alexander Bokovoy 
Reviewed-By: Rob Crittenden 
Reviewed-By: Christian Heimes

Introduce minimal ipa-client-automount.in and ipactl.in

2019-06-28T08:53:07+00:00

Now that ipa-client-automount and ipactl main logic has been
moved into modules, introduce minimal executables.

Fixes: https://pagure.io/freeipa/issue/7984
Signed-off-by: François Cami 
Reviewed-By: Christian Heimes 
Reviewed-By: Rob Crittenden

Move ipa-client-automount.in and ipactl into modules

2019-06-28T08:53:07+00:00

Fixes: https://pagure.io/freeipa/issue/7984
Signed-off-by: François Cami 
Reviewed-By: Christian Heimes 
Reviewed-By: Rob Crittenden

ipa-client-automount: fix '--idmap-domain DNS' logic

2019-06-26T10:55:06+00:00

Previously '--idmap-domain DNS' would assume the Domain
parameter of idmapd.conf was already absent. With this
fix, the Domain parameter is always removed and the
configuration file is always backuped.

Related-to: https://pagure.io/freeipa/issue/7918
Fixes: https://pagure.io/freeipa/issue/7988
Signed-off-by: François Cami fcami@redhat.com
Reviewed-By: Christian Heimes

Increase default debug level of certmonger

2019-06-24T08:00:37+00:00

By default certmonger does not log operations. With debug level 2,
certmonger logs errors and operations to journald. An increased debug
level makes it easier to investigate problems.

Fixes: https://pagure.io/freeipa/issue/7986
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Rob Crittenden

Replace PYTHONSHEBANG with valid shebang

2019-06-24T07:35:57+00:00

Replace the @PYTHONSHEBANG@ substitution with a valid #!/usr/bin/python3
shebang. This turns Python .in files into valid Python files. The files
can now be checked with pylint and IDEs recognize the files as Python
files.

The shebang is still replaced with "#!$(PYTHON) -E" to support
platform-python.

Related: https://pagure.io/freeipa/issue/7984
Signed-off-by: Christian Heimes 
Reviewed-By: Francois Cami

ipa-client-automount: add knob to configure NFSv4 Domain (idmapd.conf)

2019-05-06T15:46:19+00:00

ipa-client-automount assumes the NFS domain to be the same as the IPA domain.
This is not always the case.
This commit adds a --idmap-domain knob with the following behavior:
- if not present, default to IDM domain (current behavior)
- if equal to DNS (magic value), set nothing and let idmapd autodetect domain
- otherwise set Domain in idmap.conf to the value passed by this parameter

Fixes: https://pagure.io/freeipa/issue/7918
Signed-off-by: François Cami 
Reviewed-By: Rob Crittenden

Deprecate ipa-client-install --request-cert

2019-04-24T14:23:17+00:00

Mark the --request-cert option for ipa-client-install as deprecated.
Users are encouraged to request a PEM certificate with certmonger
instead. The option and /etc/ipa/nssdb will be removed in a future
version.

Related: https://pagure.io/freeipa/issue/7492
Signed-off-by: Christian Heimes 
Reviewed-By: Rob Crittenden

automount: rmtree temp directory

2019-04-09T09:48:22+00:00

ipa-client-automount uses the host keytab to acquire a TGT. The script
sets up a temporary directory for its ccache. At the end of the script
it removes the ccache and temp directory again.

In case of a failed kinit, the ccache is not created and the removal of
the ccache causes an exception. The automount installer now uses
shutil.rmtree() to remove the temporary directory and all its content.

Fixes: https://pagure.io/freeipa/issue/7862
Signed-off-by: Christian Heimes 
Reviewed-By: François Cami