summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Minor typo fixesAbhijeet Kasurde2017-04-121-5/+5
| | | | | | | Fixes https://pagure.io/freeipa/issue/6865 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Minor typo in details.jsAbhijeet Kasurde2017-04-121-1/+1
| | | | | | | Fixes: https://pagure.io/freeipa/issue/6863 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Replace hard-coded kdcproxy path with WSGI scriptChristian Heimes2017-04-124-2/+9
| | | | | | | | | | | | mod_wsgi has no way to import a WSGI module by dotted module name. A new kdcproxy.wsgi script is used to import kdcproxy from whatever Python version mod_wsgi is compiled against. This will simplify moving FreeIPA to Python 3 and solves an import problem on Debian. Resolves: https://pagure.io/freeipa/issue/6834 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* server-install: remove broken no-pkinit checkStanislav Laznicka2017-04-121-5/+0
| | | | | | | | | | | Don't check for no-pkinit option in case pkinit cert file was provided. Setting no-pkinit is prohibited in this case, so without this fix we have an impossible option-check if we want to provide an own pkinit certificate and private key. https://pagure.io/freeipa/issue/6807 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix PKCS11 helperMartin Basti2017-04-128-26/+118
| | | | | | | | | | | | | | | | | | | | | | | Slots in HSM are not assigned statically, we have to chose proper slot from token label. Softhsm i2.2.0 changed this behavior and now slots can change over time (it is allowed by pkcs11 standard). Changelog: * created method get_slot() that returns slot number from used label * replaces usage of slot in __init__ method of P11_Helper with label * slot is dynamically detected from token label before session is opened * pkcs11-util --init-token now uses '--free' instead '--slot' which uses first free slot (we don't care about slot numbers anymore) https://pagure.io/freeipa/issue/6692 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix s4u2self with adtrustSimo Sorce2017-04-121-4/+10
| | | | | | | | | | | | When ADtrust is installed we add a PAC to all tickets, during protocol transition we need to generate a new PAC for the requested user ticket, not check the existing PAC on the requestor ticket. https://pagure.io/freeipa/issue/6862 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Create system users for FreeIPA services during package installationDavid Kupka2017-04-1111-147/+11
| | | | | | | | | | | | | | | | | | | | Previously system users needed by FreeIPA server services was created during ipa-server-install. This led to problem when DBus policy was configured during package installation but the user specified in the policy didn't exist yet (and potentionally similar ones). Now the users will be created in package %pre section so all users freeipa-server package needs exist before any installation or configuration begins. Another possibility would be using systemd-sysusers(8) for this purpose but given that systemd is not available during container build the traditional approach is superior. Also dirsrv and pkiuser users are no longer created by FreeIPA instead it depends on 389ds and dogtag to create those users. https://pagure.io/freeipa/issue/6743 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: cert login: Configure name of parameter used to pass usernameDavid Kupka2017-04-111-0/+1
| | | | | | | | | | | | Directive LookupUserByCertificateParamName tells mod_lookup_identity module the name of GET parameter that is used to provide username in case certificate is mapped to multiple user accounts. Without this directive login with certificate that's mapped to multiple users doesn't work. https://pagure.io/freeipa/issue/6860 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* trust: always use oddjobd helper for fetching trust informationAlexander Bokovoy2017-04-111-33/+10
| | | | | | | | | | | | | | Since introduction of privilege separation in IPA framework none of the operations that require direct access to the framework's credentials can be done. All authentication has to be performed with GSSAPI. As result, we cannot obtain TGT for HTTP/.. principal with kinit anymore, so it is better to re-route all types of trust to oddjobd helper and get rid of casing out two-way trust. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1438366 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver/dcerpc: unify error processingAlexander Bokovoy2017-04-111-6/+17
| | | | | | | | | | | | | | | | | | | Samba error code reporting changes from version to version but we also did not provide proper input into DCE RPC error processing method we have. Unify error processing and add few more fallback entries. With Samba 4.7 we'll have to change it again because error code processing for Samba Python modules will change with introduction of samba.ntstatus and samba.werror modules. Note that this commit also changes a message returned for error code -1073741772 (NT_STATUS_OBJECT_NOT_FOUND) because it is more general one. Fixes https://pagure.io/freeipa/issue/6859 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use entry_points for ipa CLIChristian Heimes2017-04-113-4/+22
| | | | | | | | | | | | | | | | | | | | | Fix problem with hard-coded shebang in ipa command line tool by using a proper setuptools entry point for the console script. ipaclient is now an executable Python package, too. ``` $ python -m ipaclient ping ``` is equivalent to ``` $ ipa ping ``` Related: https://pagure.io/freeipa/issue/6653 Closes: https://pagure.io/freeipa/issue/6850 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove surplus 'the' in output of ipa-adtrust-installMartin Basti2017-04-111-1/+1
| | | | | | | | Fixing the typo https://pagure.io/freeipa/issue/6864 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* renew agent, restart scripts: connect to LDAP after kinitJan Cholasta2017-04-073-6/+12
| | | | | | | | | Connect to LDAP after kinit is done, otherwise GSSAPI authentication will fail. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* renew agent: revert to host keytab authenticationJan Cholasta2017-04-071-1/+7
| | | | | | | | | | | Fixes an issue where the renew agent uses GSSAPI for LDAP connection but fails because it is not authenticated. This reverts commit 7462adec13c5b25b6868d2863dc38062c97d0ff7. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* install: request service certs after host keytab is set upJan Cholasta2017-04-073-24/+16
| | | | | | | | | | | | | The certmonger renew agent and restart scripts use host keytab for authentication. When they are executed during a certmonger request before the host keytab is set up, the authentication will fail. Make sure all certmonger requests in the installer are done after the host keytab is set up. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dsinstance, httpinstance: consolidate certificate request codeJan Cholasta2017-04-074-99/+43
| | | | | | | | | | | | A different code path is used for DS and httpd certificate requests in replica promotion. This is rather unnecessary and makes the certificate request code not easy to follow. Consolidate the non-promotion and promotion code paths into one. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* httpinstance: avoid httpd restart during certificate requestJan Cholasta2017-04-071-3/+4
| | | | | | | | | | | | httpd is restarted by certmonger in the restart_httpd script after the httpd certificate is saved if it was previously running. The restart will fail because httpd is not properly configured at this point. Stop httpd at the beginning of httpd install to avoid the restart. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dsinstance: reconnect ldap2 after DS is restarted by certmongerJan Cholasta2017-04-072-1/+5
| | | | | | | | | | | | | | DS is restarted by certmonger in the restart_dirsrv script after the DS certificate is saved. This breaks the ldap2 backend and makes any operation fail with NetworkError until it is reconnected. Reconnect ldap2 after the DS certificate request is finished to fix the issue. Make sure restart_dirsrv waits for the ldapi socket so that the reconnect does not fail. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* tests: add non-reg for idrange-addFlorence Blanc-Renaud2017-04-071-1/+48
| | | | | | | | | | Add non regression test for issue 6404: when idrange-add is called with empty dom-name, the command returns ipa: ERROR: an internal error has occurred https://pagure.io/freeipa/issue/6404 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Upgrade: add gidnumber to trusted domain entryFlorence Blanc-Renaud2017-04-072-0/+57
| | | | | | | | | | | The trusted domain entries created in earlier versions are missing gidnumber. During upgrade, a new plugin will read the gidnumber of the fallback group cn=Default SMB Group and add this value to trusted domain entries which do not have a gidNumber. https://pagure.io/freeipa/issue/6827 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-sam: create the gidNumber attribute in the trusted domain entryFlorence Blanc-Renaud2017-04-071-3/+37
| | | | | | | | | | | | | | | | | | | When a trusted domain entry is created, the uidNumber attribute is created but not the gidNumber attribute. This causes samba to log Failed to find a Unix account for DOM-AD$ because the samu structure does not contain a group_sid and is not put in the cache. The fix creates the gidNumber attribute in the trusted domain entry, and initialises the group_sid field in the samu structure returned by ldapsam_getsampwnam. This ensures that the entry is put in the cache. Note that this is only a partial fix for 6660 as it does not prevent _netr_ServerAuthenticate3 from failing with the log _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client VM-AD machine account dom-ad.example.com. https://pagure.io/freeipa/issue/6827 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* collect audit.log for easier selinux investigationMartin Basti2017-04-062-0/+4
| | | | | | Audit log contains useful information about selinux issues Reviewed-By: Milan Kubik <mkubik@redhat.com>
* idrange-add: properly handle empty --dom-name optionFlorence Blanc-Renaud2017-04-051-1/+1
| | | | | | | | | | | | | When idrange-add is called with --dom-name=, the CLI exits with ipa: ERROR: an internal error has occurred This happens because the code checks if the option is provided but does not check if the value is None. We need to handle empty dom-name as if the option was not specified. https://pagure.io/freeipa/issue/6404 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add pki_pin only when neededStanislav Laznicka2017-04-052-6/+14
| | | | | | | | | | If both the pki-tomcat NSS database and its password.conf have been created, don't try to override the password.conf file. https://pagure.io/freeipa/issue/6839 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* IPA-KDB: use relative path in ipa-certmap config snippetSumit Bose2017-04-052-9/+5
| | | | | | | | | | | Architecture specific paths should be avoided in the global Kerberos configuration because it is read e.g. by 32bit and 64bit libraries they are installed in parallel. Resolves https://pagure.io/freeipa/issue/6833 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* httpinstance: make sure NSS database is backed upJan Cholasta2017-04-041-1/+2
| | | | | | | | | | | | | The NSS database at /etc/httpd/alias is not properly initialized and backed up in CA-less replica promotion. This might cause the install to fail after previous install and uninstall. Make sure the NSS database is initialized and backed up even in CA-less replica promotion to fix the issue. https://pagure.io/freeipa/issue/4639 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove publish_ca_cert() method from NSSDatabaseStanislav Laznicka2017-04-032-12/+0
| | | | | | | | NSSDatabase.publish_ca_cert() is not used anymore, remove it. https://pagure.io/freeipa/issue/6806 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Get correct CA cert nickname in CA-lessStanislav Laznicka2017-04-031-1/+6
| | | | | | | | | | | | During CA-less installation, we initialize the HTTPD alias database from a pkcs12 file. This means there's going to be different nicknames to the added certificates. Store the CA certificate nickname in HTTPInstance__setup_ssl() to be able to correctly export it later. https://pagure.io/freeipa/issue/6806 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* certdb: fix `AttributeError` in `verify_ca_cert_validity`Jan Cholasta2017-04-031-1/+1
| | | | | | | | | `NSSDatabase.verify_ca_cert_validity` tries to access a property of basic constraints extension on the extension object itself rather than its value. Access the attribute on the correct object to fix the issue. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Don't hard-code with_wheelsChristian Heimes2017-04-031-4/+1
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add an option to build ipaserver wheelsChristian Heimes2017-04-036-15/+28
| | | | | | | | | | | | | | To create a wheel bundle with ipaserver and its dependencies: make wheel_bundle IPA_SERVER_WHEELS=1 To include additional dependencies: make wheel_bundle IPA_EXTRA_WHEELS=ipatests[webui] Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add extra_requires for additional dependenciesChristian Heimes2017-04-031-6/+8
| | | | | | | | ipaserver did not have extra_requires to state additional dependencies. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Conditionally import pyhbacChristian Heimes2017-04-033-90/+105
| | | | | | | | | | | | | | | | | | | | | | | | The pyhbac module is part of SSSD. It's not available as stand-alone PyPI package. It would take a lot of effort to package it because the code is deeply tight into SSSD. Let's follow the example of other SSSD Python packages and make the import of pyhbac conditionally. It's only necessary for caacl and hbactest plugins. I renamed convert_to_ipa_rule() to _convert_to_ipa_rule() because it does not check for presence of pyhbac package itself. The check is performed earlier in execute(). The prefix indicates that it is an internal function and developers have to think twice before using it in another place. This makes it much easier to install ipaserver with instrumented build of Python with a different ABI or in isolated virtual envs to profile and debug the server. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Beginnings of NSS database supportBen Lipton2017-04-031-1/+26
| | | | | | https://pagure.io/freeipa/issue/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Modify cert_get_requestdata to return a CertificationRequestInfoBen Lipton2017-04-034-61/+415
| | | | | | | | | Also modify cert_request to use this new format. Note, only PEM private keys are supported for now. NSS databases are not. https://pagure.io/freeipa/issue/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Change to pure openssl config format (no script)Ben Lipton2017-04-036-70/+15
| | | | | | https://pagure.io/freeipa/issue/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Remove helper abstractionBen Lipton2017-04-0317-255/+77
| | | | | | | | | All requests now use the OpenSSL formatter. However, we keep Formatter a separate class so that it can be changed out for tests. https://pagure.io/freeipa/issue/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Skip test_session_storage in ipaclient unittest modeChristian Heimes2017-03-311-0/+3
| | | | | | | The test class depends on a working Kerberos configuration and session. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add make devcheck for developersChristian Heimes2017-03-313-2/+42
| | | | | | | | | | | | | | | | | | | | | | Ticket 6604 makes pylint and jsl optional dependencies. The change is controversal, because some developers prefer that pylint and jsl should be required unless explicitly disabled. `make devcheck` is my answer to address the concerns. It's a superior solution to `make lint` as pre-commit check. It combines several additional checks under a single, easy rememberable and convenient make target: * build all * acilint, apiclient, jslint, polint * make check * pylint under Python 2 and 3 * subset of unit test suite https://fedorahosted.org/freeipa/ticket/6604 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Hide request_type doc string in cert-request helpAbhijeet Kasurde2017-03-311-1/+1
| | | | | | | | | | | | Fix hides description of request_type argument in cert-request command help Fixes https://pagure.io/freeipa/issue/6494 Fixes https://pagure.io/freeipa/issue/5734 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* setup, pylint, spec file: drop python-nss dependencyJan Cholasta2017-03-316-9/+2
| | | | | | Remove the unused python-nss dependency. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certdb: use certutil and match_hostname for cert verificationJan Cholasta2017-03-314-75/+94
| | | | | | | Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add --password-expiration to allow admin to force user password expirationGabe2017-03-317-18/+34
| | | | | | | - Allows an admin to easily force a user to expire their password forcing the user to change it immediately or at a specified time in the future Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* session storage parameters must be bytesChristian Heimes2017-03-311-2/+2
| | | | | | | Fixes TypeError: bytes or integer address expected instead of str instance Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-ca-install man page: Add domain level 1 helpFlorence Blanc-Renaud2017-03-311-3/+10
| | | | | | | | | In domain level 1 ipa-ca-install does not require a replica-file. Update the man page to distinguish the domain level 0 or 1 usage. https://pagure.io/freeipa/issue/5831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove redundant option check for cert filesStanislav Laznicka2017-03-301-9/+1
| | | | | | | | | | There was a redundant check for CA-less install certificate files for replicas but the same check is done for all installers before that. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replica-prepare man: remove pkinit option refsStanislav Laznicka2017-03-301-12/+0
| | | | | | | | | Remove the references to the pkinit options which was forgotten about in 46d4d534c0 https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Don't allow setting pkinit-related options on DL0Stanislav Laznicka2017-03-303-2/+23
| | | | | | | | | pkinit is not supported on DL0, remove options that allow to set it from ipa-{server,replica}-install. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix the order of cert-files checkStanislav Laznicka2017-03-301-5/+5
| | | | | | | | | | | | Without this patch, if either of dirsrv_cert_files, http_cert_files or pkinit_cert_files is set along with no-pkinit, the user is first requested to add the remaining options and when they do that, they are told that they are using 'no-pkinit' along with 'pkinit-cert-file'. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove duplicate functionality in upgradeMartin Babinsky2017-03-301-15/+1
| | | | | | | | | | Since krbinstance code can now handle all operations of the `enabled_anonymous_principal` function from upgrade we can remove extraneous function altogether. https://pagure.io/freeipa/issue/6799 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 14:02:52 +0000