summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Always check and create anonymous principal during KDC installMartin Babinsky2017-03-301-4/+13
| | | | | | | | | | | The anonymous principal will now be checked for presence and created on both server and replica install. This fixes errors caused during replica installation against older master that do not have anonymous principal present. https://pagure.io/freeipa/issue/6799 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Hide PKI Client database password in log fileAbhijeet Kasurde2017-03-302-4/+10
| | | | | Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix ipatests.util doc testsChristian Heimes2017-03-301-14/+14
| | | | | | | | | | | | | Doctests of ipatests.util fail under Python 3. The old test scenario does no longer work on Python 3 since u'how are you' and 'how are you' have identical type, but u'how are you' != b'how are you'. It works with int / float on all Python versions. Python 2 has <type 'int'> while Python 3 uses <class 'int'>. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow erasing ipaDomainResolutionOrder attributeFabiano Fidêncio2017-03-301-0/+5
| | | | | | | | | | | | | | Currently when trying to erase the ipaDomainResolutionOrder attribute we hit an internal error as the split() method is called on a None object. By returning early in case of empty string we now allow removing the ipaDomainResolutionOrder attribute by both calling delattr or setting its value to an empty string. https://pagure.io/freeipa/issue/6825 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* adtrust: make sure that runtime hostname result is consistent with the ↵Alexander Bokovoy2017-03-301-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | configuration FreeIPA's `ipasam` module to Samba uses gethostname() call to identify own server's host name. This value is then used in multiple places, including construction of cifs/host.name principal. `ipasam` module always uses GSSAPI authentication when talking to LDAP, so Kerberos keys must be available in the /etc/samba/samba.keytab. However, if the principal was created using non-FQDN name but system reports FQDN name, `ipasam` will fail to acquire Kerberos credentials. Same with FQDN principal and non-FQDN hostname. Also host name and principal name must have the same case. Report an error when configuring ADTrust instance with inconsistent runtime hostname and configuration. This prevents errors like this: [20/21]: starting CIFS services ipa : CRITICAL CIFS services failed to start where samba logs have this: [2017/03/20 06:34:27.385307, 0] ipa_sam.c:4193(bind_callback_cleanup) kerberos error: code=-1765328203, message=Keytab contains no suitable keys for cifs/ipatrust@EXAMPLE.COM [2017/03/20 06:34:27.385476, 1] ../source3/lib/smbldap.c:1206(get_cached_ldap_connect) Connection to LDAP server failed for the 16 try! Fixes https://pagure.io/freeipa/issue/6786 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Ensure KDC is propery configured after upgradeMartin Babinsky2017-03-301-5/+5
| | | | | | https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Split out anonymous PKINIT test to a separate methodMartin Babinsky2017-03-301-0/+2
| | | | | | | | This allows for more flexibility in the whole PKINIT setup process. https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove unused variable from failed anonymous PKINIT handlingMartin Babinsky2017-03-301-1/+1
| | | | | | https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Upgrade: configure PKINIT after adding anonymous principalMartin Babinsky2017-03-301-1/+1
| | | | | | | | | | In order to set up PKINIT, the anonymous principal must already be created, otherwise the upgrade with fail when trying out anonymous PKINIT. Switch the order of steps so that this issue does not occur. https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Use with statement for opening fileAbhijeet Kasurde2017-03-303-15/+10
| | | | | Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* server: make sure we test for sss_nss_getlistbycertAlexander Bokovoy2017-03-291-0/+5
| | | | | | | Fixes https://pagure.io/freeipa/issue/6828 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* spec file: bump libsss_nss_idmap-devel BuildRequiresJan Cholasta2017-03-291-2/+2
| | | | | | | | | | | | | Bump BuildRequires on libsss_nss_idmap-devel to the version which introduces the sss_nss_getlistbycert function. This fixes RPM build failure when an older version of libsss_nss_idmap-devel was installed. https://pagure.io/freeipa/issue/6828 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: improve cert requestSumit Bose2017-03-283-19/+143
| | | | | | | | | | | | | | | Certificates can be assigned to multiple user so the extdom plugin must use sss_nss_getlistbycert() instead of sss_nss_getnamebycert() and return a list of fully-qualified user names. Due to issues on the SSSD side the current version of lookups by certificates didn't work at all and the changes here won't break existing clients. Related to https://pagure.io/freeipa/issue/6826 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* extdom: do reverse search for domain separatorSumit Bose2017-03-281-3/+3
| | | | | | | | | To avoid issues which @-signs in the short user or group names it is better to search for the domain separator starting at the end of the fully-qualified name. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not ↵David Kupka2017-03-281-3/+11
| | | | | | | | | | | | | | available Server installation failed when attmpting to disable module 'Root Certs' and the module was not available in HTTP_ALIAS_DIR. When the module is not available there's no need to disable it and the error may be treated as success. https://pagure.io/freeipa/issue/6803 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Generate PIN for PKI to help Dogtag in FIPSStanislav Laznicka2017-03-282-2/+10
| | | | | | | | | | Dogtag is currently unable to generate a PIN it could use for an NSS database creation in FIPS. Generate it for them so that we don't fail. https://pagure.io/freeipa/issue/6824 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* spec file: bump krb5-devel BuildRequires for certauthJan Cholasta2017-03-281-4/+2
| | | | | | | | | | | | Bump BuildRequires on krb5-devel to the version which introduces the certauth pluggable interface. This fixes RPM build failure when an older version of krb5-devel was installed. https://pagure.io/freeipa/issue/4905 Reviewed-By: David Kupka <dkupka@redhat.com>
* Use Custodia 0.3.1 featuresChristian Heimes2017-03-289-9/+50
| | | | | | | | | | | | | | | | | | | | | * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* spec file: Bump requires to make Certificate Login in WebUI workDavid Kupka2017-03-281-5/+8
| | | | | | | | | | | | gssproxy >= 0.7.0-2 - fixes impersonator checking mod_lookup_identity >= 0.9.9 - adds support for single certificate assigned to multiple users mod_nss >= 1.0.14-3 - no longer sets remote user in fixup hook sssd-dbus >= 1.15.2 - adds FindByNameAndCertificate DBus method https://pagure.io/freeipa/issue/6823 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Prevent churn on ccachesSimo Sorce2017-03-281-1/+16
| | | | | | | | | | | | | | | | | | | | We slice down the received cookie so that just the content that matter is preserved. Thi is ok because servers can't trust anything else anyway and will accept a cookie with the ancillary data missing. By removing variable parts like the expiry component added by mod_session or the Expiration or Max-Age metadata we keep only the part of the cookie that changes only when a new session is generated. This way when storing the cookie we actually add a new entry in the ccache only when the session actually changes, and this prevents churn on FILE based ccaches. Related https://pagure.io/freeipa/issue/6775 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Work around issues fetching session dataSimo Sorce2017-03-281-23/+190
| | | | | | | | | | | | | | | | | | | | | Unfortunately the MIT krb5 library has a severe limitation with FILE ccaches when retrieving config data. It will always only search until the first entry is found and return that one. For FILE caches MIT krb5 does not support removing old entries when a new one is stored, and storage happens only in append mode, so the end result is that even if an update is stored it is never returned with the standard krb5_cc_get_config() call. To work around this issue we simply implement what krb5_cc_get_config() does under the hood with the difference that we do not stop at the first match but keep going until all ccache entries have been checked. Related https://pagure.io/freeipa/issue/6775 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Handle failed authentication via cookieSimo Sorce2017-03-281-20/+32
| | | | | | | | | | | | | | If cookie authentication fails and we get back a 401 see if we tried a SPNEGO auth by checking if we had a GSSAPI context. If not it means our session cookie was invalid or expired or some other error happened on the server that requires us to try a full SPNEGO handshake, so go ahead and try it. Fixes https://pagure.io/freeipa/issue/6775 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Avoid growing FILE ccaches unnecessarilySimo Sorce2017-03-281-0/+6
| | | | | | | | Related https://pagure.io/freeipa/issue/6775 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Backup CA cert from kerberos folderStanislav Laznicka2017-03-281-0/+1
| | | | | | https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com>
* git-commit-template: update ticket url to use pagure.io instead of ↵Florence Blanc-Renaud2017-03-281-1/+1
| | | | | | | | | | | | | fedorahosted.org After the migration to pagure.io, tickets are accessed through another URL. In order to use the commit template: git config commit.template .git-commit-template https://pagure.io/freeipa/issue/6822 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* rpcserver.login_x509: Actually return reply from __call__ methodDavid Kupka2017-03-281-1/+1
| | | | | | | | | | __call__ didn't return causing internal error in wsgi application. Previously this bug was hidden by some other error and the code worked even though it shouldn't. https://pagure.io/freeipa/issue/6819 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Simplify KRA transport cert cacheChristian Heimes2017-03-281-48/+55
| | | | | | | | | | In-memory cache causes problem in forking servers. A file based cache is good enough. It's easier to understand and avoids performance regression and synchronization issues when cert becomes out-of-date. https://pagure.io/freeipa/issue/6787 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() functionFlorence Blanc-Renaud2017-03-281-1/+1
| | | | | | | | | | | | | | | dogtag-ipa-ca-renew-agent-submit behaves differently depending on the certificate it needs to renew. For instance, some certificates (such as IPA RA) are the same on all the hosts and the renewal is actually done only on the renewal master. On other nodes, the new cert is downloaded from LDAP. The function is_replicated() is returning the opposite as what it should. If the cert nickname is IPA RA, it should return that the cert is replicated but it doesn't, and this leads to a wrong code path to renew the cert. https://pagure.io/freeipa/issue/6813 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Create temporaty directories at the begining of uninstallDavid Kupka2017-03-281-0/+4
| | | | | | | | | | | | Since commit 38c6689 temporary directories are no longer created at package install time. Instead they're created at server install time. Some steps in uninstall also assume that temporary direcories exist. Creating the directories in the begining of server uninstall ensure that the uninstall will go through. https://pagure.io/freeipa/issue/6715 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow renaming of the sudorule objectsStanislav Laznicka2017-03-274-2/+18
| | | | | | | | | | The recent changes allow the sudorule objects to be renamed. https://pagure.io/freeipa/issue/2466 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow renaming of the HBAC rule objectsStanislav Laznicka2017-03-274-3/+20
| | | | | | | | | | The recent changes allow HBAC rule objects to be renamed. https://pagure.io/freeipa/issue/6784 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Reworked the renaming mechanismStanislav Laznicka2017-03-2713-26/+34
| | | | | | | | | | | | | | | | | | | The rename operation on *_mod commands was only allowed when the primary key of an entry was also its RDN. With these changes, it should be possible to rename the rest of the entries as well. An attribute to the base LDAPObject was added to whitelist the objects we want to allow to be renamed. It replaced an old attribute rdn_is_primary_key which was used for the very same purpose but the name was confusing because it was not set correctly for certain objects. https://pagure.io/freeipa/issue/2466 https://pagure.io/freeipa/issue/6784 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Bump samba version for FIPS and priv. separationStanislav Laznicka2017-03-271-2/+4
| | | | | | | | | | | With the latest Samba, adding trusts to AD under FIPS should now work as well as adding trusts as a whole after the privilege separation rework. https://pagure.io/freeipa/issue/6671 https://pagure.io/freeipa/issue/6697 Reviewed-By: Martin Basti <mbasti@redhat.com>
* WebUI: Allow to add certs to certmapping with CERT LINES aroundPavel Vomacka2017-03-271-2/+11
| | | | | | | | | | | | | | The certificate to the certmapping might be inserted as base64 encoded blob. This patch allows to also insert the certificate blob with surrounding "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" lines. This behavior is the same in widget for assigning certificates to users, so the change helps WebUI to be more consistent. https://pagure.io/freeipa/issue/6772 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Set "KDC:Disable Last Success" by defaultMartin Basti2017-03-271-0/+1
| | | | | | | | | | | | | | In big deployments enabled recording of the last sucesfull login this creates a huge changelog on DS side and cause performance issues even if this is excluded from replication. Actually this is not used directly by FreeIPA so it is safe to remove in new installations. User who need this must manually remove "KDC:Disable Last Success" using `ipa config-mod` command or WebUI. https://pagure.io/freeipa/issue/5313 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: Fix showing vault in selfservice viewPavel Vomacka2017-03-272-3/+6
| | | | | | | | | | | | | Vaults menu item was shown even when the KRA service was not installed. That was caused by different path to the menu item in admin's view and in selfservice view. The path is now set correctly for both situations. 'network_service/vault' for admin's view and 'vault' for selfservice view. https://pagure.io/freeipa/issue/6812 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: suppress truncation warning in select widgetPavel Vomacka2017-03-271-1/+2
| | | | | | | | | | | | | | This widget is used on details pages and dialogs. When the size limit is set to lower number the warning about truncation was shown every time the details page was open. Now, with support for suppressing warning messages from server according to its code, we are able to disable warning with 13017 code (truncation warning) https://pagure.io/freeipa/issue/6618 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add support for suppressing warningsPavel Vomacka2017-03-271-0/+7
| | | | | | | | | | | | Each command can have specified an array of warning codes which will be suppressed and won't be shown. For specifying this it is necessary to set command property 'supressed_warnings: [codes_of_warning]' Part of: https://pagure.io/freeipa/issue/6618 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* pytest 3.x compatibilityChristian Heimes2017-03-277-20/+28
| | | | | | | pytest 3.x does no longer support plain pytest.skip() on module level. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-kdb: do not depend on certauth_plugin.hSumit Bose2017-03-273-0/+12
| | | | | | Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* configure: fix --disable-server with certauth pluginSumit Bose2017-03-272-5/+12
| | | | | | Resolves https://pagure.io/freeipa/issue/6816 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* IPA certauth pluginSumit Bose2017-03-279-1/+450
| | | | | | | | | | | | This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa-kdb: add ipadb_fetch_principals_with_extra_filter()Sumit Bose2017-03-272-13/+56
| | | | | | | | | Additionally make ipadb_find_principal public. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* cert: do not limit internal searches in cert-findJan Cholasta2017-03-271-18/+10
| | | | | | | | | | | | Instead, apply the limits on the combined result. This fixes (absence of) `--sizelimit` leading to strange behavior, such as `cert-find --users user` returning a non-empty result only with `--sizelimit 0`. https://pagure.io/freeipa/issue/6716 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: Add support for login for AD usersPavel Vomacka2017-03-277-30/+108
| | | | | | | | | | | | | | | | | | | | | | | After login, method user-find --whoami was called which cannot be called for AD users. That method was replaced by ipa whoami command and sequential command according to result of ipa whoami. AD user can now be logged in. AD users have new menu definition which contains only list of IPA users and profile page of AD user - "User ID Override". This commit also fixes several places where IPA.whoami object was used, because its structure was also changed. It now contains two objects. First one is stored in 'metadata' property and stores result from ipa whoami (type of object, command which should be called for showing detailed data about currently logged entity, etc). The second one is stored in 'data' property which stores result of _show command for currently logged entity. https://pagure.io/freeipa/issue/3242 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* WebUI: add method for disabling item in user dropdown menuPavel Vomacka2017-03-272-6/+40
| | | | | | | | | | | | | AD user can do only several things. One of those which are not allowed is to reset password to itself. Therefore we need to be able to turn of a item in dropdown menu. In our case 'Password reset' item. Function which disable menu item and detach the listener on click from the item specified by its name was added. Part of: https://pagure.io/freeipa/issue/3242 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* WebUI: check principals in lowercasePavel Vomacka2017-03-271-1/+2
| | | | | | | | | | | | | WebUI checks whether principal name of logged user and principal name in each command is equal. As KDC for our principals is case insensitive - it does make sense to switch this check also into case insensitive. So both principals are reformated to lower case and then compared. Part of: https://pagure.io/freeipa/issue/3242 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Backup ipa-specific httpd unit-fileStanislav Laznicka2017-03-232-0/+3
| | | | | | | | | | | | On backup-restore, the ipa unit file for httpd was not backed up. This file however contains setting for httpd to communicate with gssproxy so not backing it up will result in httpd not knowing how to get credentials. https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ldap2: use LDAP whoami operation to retrieve bind DN for current connectionAlexander Bokovoy2017-03-221-4/+3
| | | | | | | | | | | | | For external users which are mapped to some DN in LDAP server, we wouldn't neccesary be able to find a kerberos data in their LDAP entry. Instead of searching for Kerberos principal use actual DN we are bound to because for get_effective_rights LDAP control we only need the DN itself. Fixes https://pagure.io/freeipa/issue/6797 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* replica prepare: fix wrong IPA CA nickname in replica fileHEADmasterJan Cholasta2017-03-221-3/+4
| | | | | | | | | | | | | Lookup IPA CA subject and pass it to CertDB when creating dscert.p12 and httpcert.p12, otherwise a generic nickname will be used for the IPA CA certificate instead of "$REALM IPA CA". This fixes replica install on domain level 0 from a replica file created using ipa-replica-install on IPA 4.5. https://pagure.io/freeipa/issue/6777 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 18:37:39 +0000