freeipa.git/ipapython, branch clisesshandling

Work around issues fetching session data

2017-03-24T15:50:37+00:00

Unfortunately the MIT krb5 library has a severe limitation with FILE
ccaches when retrieving config data. It will always only search until
the first entry is found and return that one.

For FILE caches MIT krb5 does not support removing old entries when a
new one is stored, and storage happens only in append mode, so the end
result is that even if an update is stored it is never returned with the
standard krb5_cc_get_config() call.

To work around this issue we simply implement what krb5_cc_get_config()
does under the hood with the difference that we do not stop at the first
match but keep going until all ccache entries have been checked.

Related https://pagure.io/freeipa/issue/6775

Signed-off-by: Simo Sorce

Avoid growing FILE ccaches unnecessarily

2017-03-23T20:11:11+00:00

Related https://pagure.io/freeipa/issue/6775

Signed-off-by: Simo Sorce

httpinstance: clean up /etc/httpd/alias on uninstall

2017-03-22T13:58:18+00:00

Restore cert8.db, key3.db, pwdfile.txt and secmod.db in /etc/httpd/alias
from backup on uninstall.

Files modified by IPA are kept with .ipasave suffix.

https://pagure.io/freeipa/issue/4639

Reviewed-By: Martin Babinsky

ipapython.ipautil.nolog_replace: Do not replace empty value

2017-03-21T08:46:44+00:00

When provided empty value in nolog parameter nolog_replace added 'XXXXXXXX'
three (once for plain value, once for http quoted value and last time for shell
quoted value) times before every character (including terminating '\0') in the string.

https://pagure.io/freeipa/issue/6738

Reviewed-By: Pavel Vomacka

Python 3: Fix session storage

2017-03-15T18:12:17+00:00

ctypes can only handle bytes, not text. Encode and decode all incoming
and outgoing text from UTF-8 to bytes.

Signed-off-by: Christian Heimes 
Reviewed-By: Simo Sorce

Fix Python 3 pylint errors

2017-03-15T18:11:32+00:00

************* Module ipaserver.install.ipa_kra_install
ipaserver/install/ipa_kra_install.py:25: [W0402(deprecated-module), ] Uses of a deprecated module 'optparse')
************* Module ipapython.install.core
ipapython/install/core.py:163: [E1101(no-member), _knob] Module 'types' has no 'TypeType' member)
************* Module ipatests.test_ipapython.test_dn
ipatests/test_ipapython/test_dn.py:1205: [W1505(deprecated-method), TestDN.test_x500_text] Using deprecated method assertEquals())
************* Module ipa-ca-install
install/tools/ipa-ca-install:228: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member)
install/tools/ipa-ca-install:232: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member)

Signed-off-by: Christian Heimes 
Reviewed-By: Simo Sorce 
Reviewed-By: Stanislav Laznicka

install: re-introduce option groups

2017-03-13T09:12:40+00:00

Re-introduce option groups in ipa-client-install, ipa-server-install and
ipa-replica-install.

https://pagure.io/freeipa/issue/6392

Reviewed-By: Stanislav Laznicka

install CLI: remove magic option groups

2017-03-13T09:12:40+00:00

Do not automatically create the "basic options" and "uninstall options"
option groups in the CLI code.

https://pagure.io/freeipa/issue/6392

Reviewed-By: Stanislav Laznicka

pylint_plugins: add forbidden import checker

2017-03-10T12:04:59+00:00

Add new pylint AST checker plugin which implements a check for imports
forbidden in IPA. Which imports are forbidden is configurable in pylintrc.

Provide default forbidden import configuration and disable the check for
existing forbidden imports in our code base.

Reviewed-By: Martin Basti

Store session cookie in a ccache option

2017-03-10T11:40:08+00:00

Instead of using the kernel keyring, store the session cookie within the
ccache. This way kdestroy will really wipe away all credentials.

Ticket: https://pagure.io/freeipa/issue/6661

Signed-off-by: Simo Sorce 
Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes