summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Vault: port key wrapping to python-cryptographyChristian Heimes2017-03-022-90/+92
| | | | | | | https://fedorahosted.org/freeipa/ticket/6650 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server install: do not attempt to issue PKINIT cert in CA-lessJan Cholasta2017-03-023-23/+46
| | | | | | | | | | | | Require the user to provide the PKINIT cert with --pkinit-cert-file or disable PKINIT with --no-pkinit in CA-less ipa-server-install, ipa-replica-prepare and ipa-replica-install. Do not attempt to issue the PKINIT cert in CA-less ipa-server-upgrade. https://pagure.io/freeipa/issue/5678 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix CA-less upgradeStanislav Laznicka2017-03-011-1/+1
| | | | | | | | | | In CA-less mode there's no /etc/pki/pki-tomcat/password.conf so it does not make sense to try to create a password file for an NSS database from it (the NSS database does not exist either). https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSPRError exception from platform tasksChristian Heimes2017-03-012-5/+4
| | | | | | | | | | ipalib.x509 no longer raises NSPRError. PyCA cryptography raises ValueError for invalid certs. https://fedorahosted.org/freeipa/ticket/5695 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Provide basic integration tests for built-in AD trust installerMartin Babinsky2017-03-012-5/+59
| | | | | | | | | | | A couple of tests were added to server/replica install integration suite to test AD trust install w/ various combinations of other optional components. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Update server/replica installer man pagesMartin Babinsky2017-03-012-0/+108
| | | | | | | | | | | Since AD trust installer is now a part of composite installers, their man pages were updated with separate section documenting relevant AD trust-related option descriptions. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix erroneous short name options in ipa-adtrust-install man pageMartin Babinsky2017-03-011-2/+2
| | | | | | | | | | | `--rid-base` and `--secondary-rid-base` had `-U` option assigned by error in the man page. Remove it as these options have not short alias. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Merge AD trust configurator into replica installerMartin Babinsky2017-03-011-1/+11
| | | | | | | | | | | | | | | `ipa-replica-install` is now able to configure Samba and winbind services in order to manage Active Directory trusts. `--add-agents` option is exposed in replica installer, while `--add-sids` now defaults to `False` since adding a first AD trust controller to an existing sizeable deployment can result in stuck installation as sidgen tasks can take a long time to complete. That's why adding SIDs should be a conscious decision in this case. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Merge AD trust configurator into server installerMartin Babinsky2017-03-011-9/+18
| | | | | | | | | | | | | | | | | | ipa-server-install is now able to configure Samba and winbind services and manage trusts to Active Directory right off the bat with following alterations from standalone installer: * sidgen task is always triggered since there are only a few entries to tag in the beginning * the `--add-agents` option is hardcoded to False, as there are no potential agents to resolve and addd when setting up the first master in topology https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* expose AD trust related knobs in composite installersMartin Babinsky2017-03-011-1/+15
| | | | | Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add AD trust installer interface for composite installerMartin Babinsky2017-03-011-0/+50
| | | | | | | | | | This interface is to be used to provide AD trust-related options in server and replica installer. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* check for installed dependencies when *not* in standalone modeMartin Babinsky2017-03-011-1/+1
| | | | | | | | | | | | The condition that controls when to check for samba dependencies was misformulated. The check should be run when the installer is *not* run as standalone. In standalone mode the check is already made in different place so the original code triggered it twice. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* print the installation info only in standalone modeMartin Babinsky2017-03-012-3/+3
| | | | | | | | | | There is no point in emitting this message during server/replica install. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* adtrust.py: Use logging to emit error messagesMartin Babinsky2017-03-011-10/+10
| | | | | | | | | | Plain print messages are a) not logged into files and b) get lost in the output from composite installer. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor the code searching and presenting missing trust agentsMartin Babinsky2017-03-011-90/+106
| | | | | | | | | | Use newly implemented APIs for searching and presenting potential trust agents. https://fedorahosted.org/freeipa/ticket/6639 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* only check for netbios name when LDAP backend is connectedMartin Babinsky2017-03-011-10/+19
| | | | | | | | | | This is to prevent errors due to non-existent LDAP connection such as when installing first IPA master. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor the code checking for missing SIDsMartin Babinsky2017-03-011-43/+64
| | | | | | | | | | Decompose the individual sub-tasks into separate functions. Also perform the lookup only when LDAP is connected. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix replica with --setup-ca issuesStanislav Laznicka2017-03-011-3/+3
| | | | | | | | nolog argument of ipautil.run requires tuple, not a string. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove import nss from test_ldapChristian Heimes2017-03-011-2/+0
| | | | | | | | test_ldap just imported nss.nss to call nss_init_nodb(). It should be safe to remove the call. Let's see what CI has to say. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dogtag: remove redundant property definitionFraser Tweedale2017-03-011-20/+0
| | | | | | | | | | | The dogtag `ra' backend defines a `ca_host' property, which is also defined (identically) by the `RestClient' class, which recently became a superclass of `ra'. Remove the redundant property definition. Part of: https://pagure.io/freeipa/issue/3473 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Limit sessions to 30 minutes by defaultSimo Sorce2017-03-011-0/+1
| | | | | | | | | | When we changed the session handling code we unintentinally extended sessions expiraion time to the whole ticket lifetime of 24h. Related to https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certdb: Don't restore_context() of new NSSDBChristian Heimes2017-03-011-5/+1
| | | | | | | | | | | It's not necesary to restore the context of newly created files. SELinux ensures that new files have the correct permission. An explicit restore_context() is only required when either policies have changed or the context was changed manually. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* test_config: fix fips_mode key in EnvTomas Krizek2017-03-011-2/+2
| | | | | | | | | Setting fips_mode to object would fail if ipaplatform.tasks module wasn't present. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Env __setitem__: replace assert with exceptionTomas Krizek2017-03-011-1/+2
| | | | | | Use exception to make debugging issues easier. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Finish port to PyCA cryptographyChristian Heimes2017-03-013-36/+60
| | | | | | | | | | * add missing default_backend * unpad encrypted data * use cryptography's hashes and HMAC construct * remove hard dependency on python-nss from setup.py Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Migrate OTP import script to python-cryptographyNathaniel McCallum2017-03-012-124/+80
| | | | | | https://fedorahosted.org/freeipa/ticket/5192 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Drop in-memory copy of schema zip fileChristian Heimes2017-03-011-31/+18
| | | | | | | | | | | The schema cache used a BytesIO buffer to read/write schema cache before it got flushed to disk. Since the schema cache is now loaded in one go, the temporary buffer is no longer needed. File locking has been replaced with a temporary file and atomic rename. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Speed up client schema cacheChristian Heimes2017-03-011-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | It's inefficient to open a zip file over and over again. By loading all members of the schema cache file at once, the ipa CLI script starts about 25 to 30% faster for simple cases like help and ping. Before: $ time for i in {1..20}; do ./ipa ping >/dev/null; done real 0m13.608s user 0m10.316s sys 0m1.121s After: $ time for i in {1..20}; do ./ipa ping >/dev/null; done real 0m9.330s user 0m7.635s sys 0m1.146s https://fedorahosted.org/freeipa/ticket/6690 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Define template version in certmap.confFlorence Blanc-Renaud2017-03-012-1/+8
| | | | | | | | | | | | | | | | | | | | A previous commit (ffb9a09a0d63f7edae2b647b5c1d503d1d4d7a6e) removed the definition of VERSION 2 in certmap.conf.template. ipa-server-upgrade tool compares the template version with the version in certmap.conf. As VERSION is not defined in either file, it concludes that version = 0 for both and does not make a backup of certmap.conf even though it prints that it will. The fix re-defines VERSION in the template and adapts the code because the template has changed (it is using $ISSUER_DN instead of CN=Certificate Authority,$SUBJECT_BASE). The fix also logs an error when a template file is not versioned. https://fedorahosted.org/freeipa/ticket/6354 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Tests: Basic coverage with tree root domainGanna Kaihorodova2017-03-011-1/+90
| | | | | | | | Extend existing legacy client tests to cover test cases with tree root domain. https://fedorahosted.org/freeipa/ticket/6489 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* C compilation fixes and hardeningChristian Heimes2017-03-012-0/+4
| | | | | | | | | | | | | | | | Fix "implicit declaration of function ‘strlen’" in ipa_pwd_ntlm.c, credits to Lukas. Add -Werror=implicit-function-declaration to CFLAGS to point developers to missing includes. It causes compilation to fail when a developer forgets to add a required include. The problem is no longer hidden in a massive wall of text from make. Silence a harmless error from 389-DS slapi.h until the bug is fixed in downstream, https://pagure.io/389-ds-base/issue/48979 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-0124-431/+347
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added a PEMFileHandler for Custodia storeStanislav Laznicka2017-03-011-0/+61
| | | | | | | | | This is a preparation step to be able to handle sending RA agent certificate over Custodia during domain level 1 replica installation. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor certmonger for OpenSSL certificatesStanislav Laznicka2017-03-016-97/+93
| | | | | | | | | | Currently, it was only possible to request an NSS certificate via certmonger. Merged start_tracking methods and refactored them to allow for OpenSSL certificates tracking. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Workaround for certmonger's "Subject" representationsStanislav Laznicka2017-03-012-1/+16
| | | | | | | | | | | | | | | | If an OpenSSL certificate is requested in Certmonger (CERT_STORAGE == "FILE") the "Subject" field of such Certificate is ordered as received. However, when an NSS certificate is requested, the "Subject" field takes the LDAP order (components get reversed). This is a workaround so that the behavior stays the same. The workaround should be removed when https://pagure.io/certmonger/issue/62 gets fixed. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove ipapython.nsslib as it is not used anymoreStanislav Laznicka2017-03-011-344/+0
| | | | | | | | | | Previous changes allowed the removal of nsslib. So long, and thanks for all the fish. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from otptoken pluginStanislav Laznicka2017-03-011-7/+6
| | | | | | | | | Replace NSSConnection with httplib.HTTPSConenction to be able to remove NSSConnection for good. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove pkcs12 handling functions from CertDBStanislav Laznicka2017-03-013-25/+24
| | | | | | | | | | These functions don't require anything from the CertDB instance, move them out so no needless instantiation of CertDB is performed in order to use them. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from DogtagStanislav Laznicka2017-03-015-63/+42
| | | | | | | | | | | | | Replaced NSSConnection with Python's httplib.HTTPSConnection. This class is OpenSSL-based. A client certificate with a private key is required to authenticate against the certificate server. We facilitate the RA_AGENT_PEM which already exists. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move publishing of CA cert to cainstance creation on masterStanislav Laznicka2017-03-012-6/+9
| | | | | | | | | IPAHTTPSConnection which is set up first time in certificate profiles migration to LDAP requires CA cert to be stored in a file. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Don't run kra.configure_instance if not necessaryStanislav Laznicka2017-03-012-41/+39
| | | | | | | | | | | | | | | | | | If kra should not be set up, don't run the code as it would only prolong the installations. Previously, krainstance configuration would be performed just to export the client certificate and private key to authenticate to certificate server. This is now performed somewhere else therefore there's no need to run KRAInstance.configure_instance. The kra.install() method still performs actions on replicas and we're keeping it in server installer to conform to the installers design. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move RA agent certificate file export to a different locationStanislav Laznicka2017-03-018-19/+17
| | | | | | | | | | | | HTTPS connection to certificate server requires client authentication so we need a file with client certificate and private key prior to its first occurence which happens during migration of certificate profiles to LDAP. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from the Python RPC moduleStanislav Laznicka2017-03-014-57/+169
| | | | | | | | | | | | | | | | | | | | NSSConnection was causing a lot of trouble in the past and there is a lot of logic around it just to make it not fail. What's more, when using NSS to create an SSL connection in FIPS mode, NSS always requires database password which makes the `ipa` command totally unusable. NSSConnection is therefore replaced with Python's httplib.HTTPSConnection which is OpenSSL based. The HTTPSConnection is set up to handle authentication with client certificate for connections to Dogtag server as RA agent. It allows to handle client cert/private key in separate files and also encrypted private key files. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix ipa.service unit re. gssproxyFlorence Blanc-Renaud2017-03-011-1/+1
| | | | | | | | | | | | | ipa.service unit defines Requires=gssproxy. Because of this, during ipa-server-upgrade, the restart of gssproxy triggers a restart of ipa unit (hence stopping LDAP server and breaking the connection api.Backend.ldap2). Calls using this connection after gssproxy restart fail and ipa-server-upgrade exits on failure. The fix defines Wants=gssproxy to avoid the restart of ipa.service https://fedorahosted.org/freeipa/ticket/6705 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ca: correctly authorise ca-del, ca-enable and ca-disableFraser Tweedale2017-02-281-2/+14
| | | | | | | | | | | | | | | | | | | | CAs consist of a FreeIPA and a corresponding Dogtag object. When executing ca-del, ca-enable and ca-disable, changes are made to the Dogtag object. In the case of ca-del, the corresponding FreeIPA object is deleted after the Dogtag CA is deleted. These operations were not correctly authorised; the FreeIPA permissions are not checked before the Dogtag operations are executed. This allows any user to delete, enable or disable a lightweight CA (except the main IPA CA, for which there are additional check to prevent deletion or disablement). Add the proper authorisation checks to the ca-del, ca-enable and ca-disable commands. https://pagure.io/freeipa/issue/6713 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Support encrypted private keysBen Lipton2017-02-282-4/+15
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Allow overriding the CSR generation profileBen Lipton2017-02-281-1/+12
| | | | | | | | | | In case users want multiple CSR generation profiles that work with the same dogtag profile, or in case the profiles are not named the same, this flag allows specifying an alternative CSR generation profile. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Automate full cert request flowBen Lipton2017-02-282-2/+79
| | | | | | | | | | | | | | | | | Allows the `ipa cert-request` command to generate its own CSR. It no longer requires a CSR passed on the command line, instead it creates a config (bash script) with `cert-get-requestdata`, then runs it to build a CSR, and submits that CSR. Example usage (NSS database): $ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --database /tmp/certs Example usage (PEM private key file): $ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --private-key /tmp/key.pem https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* added ssl verification using IPA trust anchorThorsten Scherf2017-02-271-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6686 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Remove md5_fingerprints from IPAStanislav Laznicka2017-02-2313-40/+2
| | | | | | | | | | MD5 is a grandpa and FIPS does not like it at all. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 22:16:44 +0000