freeipa.git/ipaclient/install, branch fix_ber_scanf

Enable krb5 snippet updates on client update

2019-09-10T09:33:21+00:00

Signed-off-by: Robbie Harwood 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Use tasks to configure automount nsswitch settings

2019-08-29T02:15:50+00:00

authselect doesn't allow one to directly write to
/etc/nsswitch.conf. It will complain bitterly if it
detects it and will refuse to work until reset.

Instead it wants the user to write to
/etc/authselect/user-nsswitch.conf and then it will handle
merging in any differences.

To complicate matters some databases are not user configurable
like passwd, group and of course, automount. There are some
undocumented options to allow one to override these though so
we utilize that.

tasks are used so that authselect-based installations can still
write directly to /etc/nsswitch.conf and operate as it used to.

Reviewed-By: Francois Cami 
Reviewed-By: Rob Crittenden

Move ipachangeconf from ipaclient.install to ipapython

2019-08-29T02:15:50+00:00

This will let us call it from ipaplatform.

Mark the original location as deprecated.

Reviewed-By: Francois Cami 
Reviewed-By: Rob Crittenden

ipa-client-automount: always restore nsswitch.conf at uninstall time

2019-08-29T02:15:50+00:00

ipa-client-automount used to only restore nsswitch.conf when sssd was not
used. However authselect's default profile is now sssd so always restore
nsswitch.conf's automount configuration to 'files sssd'.
Note that the behavior seen before commit:
a0e846f56c8de3b549d1d284087131da13135e34
would always restore nsswitch.conf to the previous state which in some cases
was wrong.

Fixes: https://pagure.io/freeipa/issue/8038
Signed-off-by: François Cami 
Reviewed-By: Francois Cami 
Reviewed-By: Rob Crittenden

ipa-client-samba: remove state on uninstall

2019-07-26T08:49:54+00:00

The "domain_member" state was not removed at uninstall time.
Remove it so that future invocations of ipa-client-samba work.

Fixes: https://pagure.io/freeipa/issue/8021
Signed-off-by: François Cami 

https://pagure.io/freeipa/issue/8021

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Sergey Orlov

ipa-client-samba: remove and restore smb.conf only on first uninstall

2019-07-26T08:49:54+00:00

Fixes: https://pagure.io/freeipa/issue/8019
Signed-off-by: François Cami 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Sergey Orlov

ipa-client-samba: a tool to configure Samba domain member on IPA client

2019-06-29T08:00:28+00:00

Introduces new utility to configure Samba on an IPA domain member.

The tool sets up Samba configuration and internal databases, creates
cifs/... Kerberos service and makes sure that a keytab for this service
contains the key with the same randomly generated password that is set
in the internal Samba databases.

Samba configuration is created by querying an IPA master about details
of trust to Active Directory configuration. All known identity ranges
added to the configuration to allow Samba to properly handle them
(read-only) via idmap_sss.

Resulting configuration allows connection with both NTLMSSP and Kerberos
authentication for IPA users. Access controls for the shared content
should be set by utilizing POSIX ACLs on the file system under a
specific share.

The utility is packaged as freeipa-client-samba package to allow pulling
in all required dependencies for Samba and cifs.ko (smb3.ko) kernel
module. This allows an IPA client to become both an SMB server and an
SMB client.

Fixes: https://pagure.io/freeipa/issue/3999
Signed-off-by: Alexander Bokovoy 
Reviewed-By: Rob Crittenden 
Reviewed-By: Christian Heimes

ipa_client_automount.py and ipactl.py: fix codestyle

2019-06-28T08:53:07+00:00

Updating ipa_client_automount.py and ipactl.py's codestyle is
mandatory to make pylint pass as these are considered new files.

Fixes: https://pagure.io/freeipa/issue/7984
Signed-off-by: François Cami 
Reviewed-By: Christian Heimes 
Reviewed-By: Rob Crittenden

Move ipa-client-automount.in and ipactl into modules

2019-06-28T08:53:07+00:00

Fixes: https://pagure.io/freeipa/issue/7984
Signed-off-by: François Cami 
Reviewed-By: Christian Heimes 
Reviewed-By: Rob Crittenden

Return 0 on uninstall when on_master for case of not installed

2019-06-07T09:24:45+00:00

This is to suppress the spurious error message:

The ipa-client-install command failed.

when the client is not configured.

This is managed by allowing a ScriptError to return SUCCESS (0)
and have this ignored in log_failure().

https://pagure.io/freeipa/issue/7836

Signed-off-by: Rob Crittenden 
Reviewed-By: Florence Blanc-Renaud