freeipa.git/ipaserver/secrets, branch fix_ber_scanf

Fix CustodiaClient ccache handling

2019-06-18T00:36:24+00:00

A CustodiaClient object has to the process environment a bit, e.g. set
up GSSAPI credentials. To reuse the credentials in libldap connections,
it is also necessary to set up a custom ccache store and to set the
environment variable KRBCCNAME temporarily.

Fixes: https://pagure.io/freeipa/issue/7964
Co-Authored-By: Fraser Tweedale 
Signed-off-by: Christian Heimes 
Reviewed-By: Christian Heimes 
Reviewed-By: Fraser Tweedale

Move Custodia secrets handler to scripts

2019-04-26T10:09:22+00:00

Implement the import and export handlers for Custodia keys as external
scripts. It's a prerequisite to drop DAC override permission and proper
SELinux rules for ipa-custodia.

Except for DMLDAP,  handlers no longer run as root but as handler
specific users with reduced privileges. The Dogtag-related handlers run
as pkiuser, which also help with HSM support.

The export and import handles are designed to be executed by sudo, too.
In the future, ipa-custodia could be executed as an unprivileged process
that runs the minimal helper scripts with higher privileges.

Fixes: https://pagure.io/freeipa/issue/6888
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Py3: Replace six.moves imports

2018-10-05T10:06:19+00:00

Replace six.moves and six.StringIO/BytesIO imports with cannonical
Python 3 packages.

Note: six.moves.input behaves differently than builtin input function.
Therefore I left six.moves.input for now.

See: https://pagure.io/freeipa/issue/7715
Signed-off-by: Christian Heimes 
Reviewed-By: Fraser Tweedale

Py3: Remove subclassing from object

2018-09-27T09:49:04+00:00

Python 2 had old style and new style classes. Python 3 has only new
style classes. There is no point to subclass from object any more.

See: https://pagure.io/freeipa/issue/7715
Signed-off-by: Christian Heimes 
Reviewed-By: Florence Blanc-Renaud

Fix pylint 2.0 return-related violations

2018-07-11T08:11:38+00:00

Aiming to support pylint 2.0 some functions and methods must have their
return statements updated in order to fix two new violations:

- `useless-return` (R1711):
  Useless return at end of function or method Emitted when a single
  "return" or "return None" statement is found at the end of function
  or method definition. This statement can safely be removed because
  Python will implicitly return None

- `inconsistent-return-statements` (R1710):
  Either all return statements in a function should return an
  expression, or none of them should. According to PEP8, if any return
  statement returns an expression, any return statements where no value
  is returned should explicitly state this as return None, and an
  explicit return statement should be present at the end of the
  function (if reachable)

Issue: https://pagure.io/freeipa/issue/7614

Signed-off-by: Armando Neto 
Reviewed-By: Christian Heimes

Add absolute_import future imports

2018-04-20T07:43:37+00:00

Add absolute_import from __future__ so that pylint
does not fail and to achieve python3 behavior in
python2.

Reviewed-By: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Unified ldap_initialize() function

2018-02-15T17:32:17+00:00

Replace all ldap.initialize() calls with a helper function
ldap_initialize(). It handles cacert and cert validation correctly. It
also provides a unique place to handle python-ldap 3.0 bytes warnings in
the future.

Fixes: https://pagure.io/freeipa/issue/7411
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Fix multiple uninstallation of server

2018-02-15T13:02:03+00:00

"ipa-server-install --uninstall" no longer fails with error message
"'Env' object has no attribute 'basedn'" when executed on a system that
has no freeIPA server installation.

Fixes: https://pagure.io/freeipa/issue/7063
Signed-off-by: Christian Heimes 
Reviewed-By: Felipe Volpone

LGTM: Fix multiple use before assignment

2018-01-09T06:53:28+00:00

- Move assignment before try/finally block
- Add raise to indicate control flow change
- Add default value

https://pagure.io/freeipa/issue/7344

Signed-off-by: Christian Heimes 
Reviewed-By: Fraser Tweedale

Custodia uninstall: Don't fail when LDAP is down

2017-12-20T08:55:46+00:00

The Custodia instance is removed when LDAP is already shut down. Don't
fail and only remove the key files from disk. The server_del command
takes care of all Custodia keys in LDAP.

https://pagure.io/freeipa/issue/7318

Signed-off-by: Christian Heimes 
Reviewed-By: Florence Blanc-Renaud