summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Make sure to have storage space for tagfix_ber_scanfSimo Sorce2019-09-161-1/+1
| | | | | | | | | | | | | | | | ber_scanf expects a pointer to a ber_tag_t to return the tag pointed at by "t", if that is not provided the pointer will be store in whatever memory location is pointed by the stack at that time causeing a crash. Note that this is effectively unused code because in ipa-kdb the only party that can write a key_data structure to be stored is te kdb_driver itself and we never encode these s2kparam data. But we need to handle this for future proofing. Fixes #8071 Signed-off-by: Simo Sorce <simo@redhat.com>
* Add container environment check to replicainstallTibor Dudlák2019-09-161-1/+5
| | | | | | | | Inside the container environment master's IP address does not resolve to its name. Resolves: https://pagure.io/freeipa/issue/6210 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Hidden Replica: Add a test for Automatic CRL configurationndehadra2019-09-131-0/+25
| | | | | | | | | | | Added test to check whether hidden replica can be configurred as CRL generation master. Related Tickets: https://pagure.io/freeipa/issue/7307 Signed-off-by: ndehadra <ndehadra@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* adtrust: add default read_keys permission for TDO objectsAlexander Bokovoy2019-09-122-0/+57
| | | | | | | | | | | | | | | | | If trusted domain object (TDO) is lacking ipaAllowedToPerform;read_keys attribute values, it cannot be used by SSSD to retrieve TDO keys and the whole communication with Active Directory domain controllers will not be possible. This seems to affect trusts which were created before ipaAllowedToPerform;read_keys permission granting was introduced (FreeIPA 4.2). Add back the default setting for the permissions which grants access to trust agents and trust admins. Resolves: https://pagure.io/freeipa/issue/8067 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* add default access control when migrating trust objectsAlexander Bokovoy2019-09-121-2/+12
| | | | | | | | | | | | It looks like for some cases we do not have proper set up keytab retrieval configuration in the old trusted domain object. This mostly affects two-way trust cases. In such cases, create default configuration as ipasam would have created when trust was established. Resolves: https://pagure.io/freeipa/issue/8067 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* prci: increase gating tasks priorityFrancisco Trivino2019-09-121-20/+20
| | | | | | | | | | | | Sometimes the gating tasks (build and jobs) are blocked because of nightly regression remaining tasks are in progress. The reason is because nightly regressions are not finished or they are re-triggered during day-time. Gating tasks are blocked because they have same priority than nightly tasks. This commit increases gating tasks priority so the testing of pull requests will not be blocked anymore. Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* extdom: add extdom protocol documentationTomas Halman2019-09-121-0/+242
| | | | | | Add the description of extdom protocol and its versions Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: use sss_nss_*_timeout callsTomas Halman2019-09-121-16/+24
| | | | | | Use nss calls with timeout in extdom plugin Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: plugin doesn't use timeout in blocking callTomas Halman2019-09-126-6/+32
| | | | | | | Expose nss timeout parameter. Use sss_nss_getorigbyname_timeout instead of sss_nss_getorigbyname Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: plugin doesn't allow @ in group nameTomas Halman2019-09-123-85/+197
| | | | | | | | | | | | | | | | | Old implementation handles username and group names with one common call. Character @ is used in the call to detect UPN. Group name can legaly contain this character and therefore the common approach doesn't work in such case. Also the original call is less efficient because it tries to resolv username allways then it fallback to group resolution. Here we implement two new separate calls for resolving users and groups. Fixes: https://bugzilla.redhat.com/1746951 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* WebUI: Make 'Unlock' option is available only on locked user pageSerhii Tsymbaliuk2019-09-112-10/+25
| | | | | | | | | | The implementation includes checking password policy for selected user. 'Unlock' option is available only in case user reached a limit of login failures. Ticket: https://pagure.io/freeipa/issue/5062 Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Armando Neto <abiagion@redhat.com>
* prci: fix typo on nightly test definitionsArmando Neto2019-09-112-2/+2
| | | | | | | PR-CI breaks if the class to execute the tests doesn't exist. Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Add design documentChangmin Teng2019-09-101-0/+116
| | | | | | | | | | | This document details authentication indicaters and kerberos ticket policies implemented in IPA. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Modify webUI to adhere to new IPA server APIChangmin Teng2019-09-107-14/+36
| | | | | | | | | | | | Given the changes in IPA server API changes, whebUI is modified to utilize new authentication indicators, and disabled custom indicators for services' white list. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Implement user pre-authentication control with kdcpolicy pluginChangmin Teng2019-09-103-17/+73
| | | | | | | | | | | | | | | | We created a Kerberos kdcpolicy plugin to enforce user pre-authentication policy for newly added pkinit and hardened policy. In the past version of freeIPA, password enforcement exists but was done by removing key data for a principal while parsing LDAP entry for it. This hack is also removed and is now also enforced by kdcpolicy plugin instead. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Add a skeleton kdcpolicy pluginRobbie Harwood2019-09-106-0/+85
| | | | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Move certauth configuration into a server krb5.conf templateRobbie Harwood2019-09-105-30/+19
| | | | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Enable krb5 snippet updates on client updateRobbie Harwood2019-09-102-7/+15
| | | | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Extend the list of supported pre-auth mechanisms in IPA server APIChangmin Teng2019-09-1010-31/+55
| | | | | | | | | | | | | As new authentication indicators implemented, we also modified server API to support those new values. Also, "krbprincipalauthind" attribute is modified to use a pre-defined set of values instead of arbitrary strings. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Add new authentication indicators in kdc.conf.templateChangmin Teng2019-09-101-0/+3
| | | | | | | | | | | | | | | | | | | | | | As of release 1.17, KDC can be configured to apply authentication indicator for SPAKE, PKINIT, and encrypted challenge preauth via FAST channel, which are not configured in current version of freeIPA. Note that even though the value of encrypted_challenge_indicator is attached only when encrypted challenge preauth is performed along a FAST channel, it's possible to perform FAST without encrypted challenge by using SPAKE. Since there is no reason to force clients not to use SPAKE while using FAST, we made a design choice to merge SPAKE and FAST in a new option called "Hardened Password", which requires user to use at least one of SPAKE or FAST channel. Hence same value attaching to both spake_preauth_indicator and encrypted_challenge_indicator. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* adtrust: avoid using timestamp in klist outputAlexander Bokovoy2019-09-101-4/+4
| | | | | | | | | | | When parsing a keytab to copy keys to a different keytab, we don't need the timestamp, so don't ask klist to output it. In some locales (en_IN, for example), the timestamp is output in a single field without a space between date and time. In other locales it can be represented with date and time separated by a space. Fixes: https://pagure.io/freeipa/issue/8066 Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* ipatests: add tests for ipa host-add with non-default maxhostnamelengthMichal Polovka2019-09-091-24/+118
| | | | | | | | | | | | | Implement test for ticket 2018: Change hostname length limit to 64. The fix provides a new configuration parameter (maxhostname) that can be modified through ipa config-mod, and governs the max hostname len allowed through ipa host-add. Add new tests: - check that maxhostname cannot be changed to a value < 64 - check that ipa host-add is refused if the hostname length is > maxhostname - check that ipa host-add is OK if the hostname length is <= maxhostname Related: https://pagure.io/freeipa/issue/2018 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Skip lock and fork in ipa-server-guard on unsupported opsRob Crittenden2019-09-061-0/+13
| | | | | | | | | | | | | On startup certmonger performs a number of options on the configured CA (IPA, not to be confused with the real dogtag CA) and the tracking requests. Break early for operations that are not supported by ipa-submit. This will save both a fork and a lock call. https://bugzilla.redhat.com/show_bug.cgi?id=1656519 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Defer initializing the API in dogtag-ipa-ca-renew-agent-submitRob Crittenden2019-09-061-3/+3
| | | | | | | | | | Wait until we know a supported operation is being called (SUBMIT and POLL) before initializing the API, which can be an expensive operation. https://bugzilla.redhat.com/show_bug.cgi?id=1656519 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipatests: refactor and extend tests for IPA-Samba integrationSergey Orlov2019-09-066-131/+325
| | | | | | | | | | | | | | Add tests for following scenarios: * running `ipa-client-samba --uninstall` without prior installation * mount and access Samba share by IPA user * mount and access Samba share by AD user * mount samba share by one IPA user and access it by another one * try mount samba share without kerberos authentication * uninstall and reinstall ipa-client-samba Relates: https://pagure.io/freeipa/issue/3999 Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
* ipatests: modify run_command to allow specify successful return codesSergey Orlov2019-09-061-3/+11
| | | | | Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
* ipatests: add utility functions related to using and managing user accountsSergey Orlov2019-09-061-2/+42
| | | | | Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
* ipatests: allow to pass additional options for clients installationSergey Orlov2019-09-061-4/+4
| | | | | Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
* ipatests: add nightly definition for DS integration testsFlorence Blanc-Renaud2019-09-061-291/+99
| | | | | | | | | | | | | | | | | This commit is a first step in order to run nightly integration tests with the 389-ds Directory Server. It is updating the tests that should be run against a nightly build of 389-ds. The vagrant box freeipa/389ds-master-f30 version 0.0.1 has already been created, available in vagrant cloud. freeipa-pr-ci workspace also already contains the nightly scheduler definition for this job (saturdays 00:10, using nightly_master_389ds.yaml) but the cron job is not scheduled yet. Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix NULL pointer dereference in maybe_require_preauth()Robbie Harwood2019-09-051-1/+1
| | | | | | | ipadb_get_global_config() is permitted to return NULL. Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Log INFO message when LDAP connection fails on startupRobbie Harwood2019-09-055-5/+5
| | | | | | | | Since krb5_klog_syslog() always needs parameters from syslog.h, move the include into ipa_krb5.h. Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add missing timeout option to logging statementRob Crittenden2019-09-051-1/+1
| | | | Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Log dogtag auth timeout in install, provide hint to increase itRob Crittenden2019-09-041-1/+5
| | | | | | | | | | | | There is a loop which keeps trying to bind as the admin user which will fail until it is replicated. In the case where there is a lot to replicate the default 5 minute timeout may be insufficient. Provide a hint for tuning. Fixes: https://pagure.io/freeipa/issue/7971 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Log the replication wait timeout for debugging purposesRob Crittenden2019-09-041-1/+2
| | | | | Related: https://pagure.io/freeipa/issue/7971 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Replace replication_wait_timeout with certmonger_wait_timeoutRob Crittenden2019-09-049-8/+27
| | | | | | | | | | | | The variable is intended to control the timeout for replication events. If someone had significantly reduced it via configuration then it could have caused certmogner requests to fail due to timeouts. Add replication_wait_timeout, certmonger_wait_timeout and http_timeout to the default.conf man page. Related: https://pagure.io/freeipa/issue/7971 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Add new env vars to pylint pluginChristian Heimes2019-09-041-0/+2
| | | | | | | | | | The vars api.env.host_princ and smb_princ where introduced a while ago. Sometimes parallel linting complain about the attributes. Add both to the list of known members in pylint_plugins.py. Related: https://pagure.io/freeipa/issue/3999 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Fix wrong use of identity operationChristian Heimes2019-09-045-7/+7
| | | | | | | | | Strings should not be compared with the identity operation 'is' or 'is not'. Fixes: https://pagure.io/freeipa/issue/8057 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Enable literal-comparison linter againChristian Heimes2019-09-041-1/+0
| | | | | | | | The literal comparison linter checks for "value is 0" or "value is ''". Related: https://pagure.io/freeipa/issue/8057 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* config plugin: replace 'is 0' with '== 0'Florence Blanc-Renaud2019-09-041-2/+2
| | | | | | | | | Since python3.8, identity checks with literal produce syntax warnings. Replace the check 'if .. is 0' with 'if .. == 0' Related: https://pagure.io/freeipa/issue/8057 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipapython/ipachangeconf.py: change "is not 0" for "!= 0"François Cami2019-09-021-1/+1
| | | | | | | | | | | Python 3.8 introduced a warning to check for usage of "is not" when comparing literals. Any such usage will output: SyntaxWarning: "is not" with a literal. Did you mean "!="? See: https://bugs.python.org/issue34850 Fixes: https://pagure.io/freeipa/issue/8057 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Replace %{_libdir} macro in BuildRequiresChristian Heimes2019-08-311-1/+1
| | | | | | | | | | | | | | | | | | The %{_libdir} macro is architecture dependend and therefore does not correctly work across different platforms. In the past the SRPM was created on a platform with /usr/lib64. Recent SRPMs have /usr/lib, which breaks dnf builddep. Depend on krb5-server directly rather than a file in krb5-server package: $ rpm -qf /usr/lib64/krb5/plugins/kdb/db2.so krb5-server-1.16.1-25.fc29.x86_64 Fixes: https://pagure.io/freeipa/issue/8056 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: François Cami <fcami@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* ipatests: fix topology for TestIpaNotConfigured in PR-CI nightly definitionsMichal Polovka2019-08-303-3/+3
| | | | | | | | | Topology for TestIpaNotConfigured is changed from ipaserver to master_1repl in order to prevent aforementioned test suite runner from configuring ipa-server, which is required by the test itself. Resolves: https://pagure.io/freeipa/issue/8055 Related: https://pagure.io/freeipa/issue/6843
* ipatests: fix wrong xfail in test_domain_resolution_orderFlorence Blanc-Renaud2019-08-301-4/+0
| | | | | | | | | | | | | | | | The test is written for a SSSD fix delivered in 2.2.0, but has a xfail based on fedora version < 30. SSSD 2.2.0 was originally available only on fedora 30 but is now also available on fedora 29, and recent runs on f29 started to succeed (because the fix is now present) but with a strict xfail. The fix completely removes the xfail as the current branch is supported on fedora 29 and 30. Fixes: https://pagure.io/freeipa/issue/8052 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
* WebUI tests: Fix login screen loading issueSerhii Tsymbaliuk2019-08-291-0/+1
| | | | | | | | | | test_webui/test_loginscreen fails because login screen is rendered with delays. To solve the issue small pause added after login. Ticket: https://pagure.io/freeipa/issue/8053 Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
* authconfig.py: restore user-nsswitch.conf at uninstall timeFrançois Cami2019-08-291-0/+4
| | | | | | | | | | | Calling authselect at uninstall time before restoring user-nsswitch.conf would result in a sudoers entry in nsswitch.conf which is not activated in the default sssd authselect profile. Make sure user-nsswitch.conf is restored before calling authselect. Fixes: https://pagure.io/freeipa/issue/8054 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* ipatests: remove xfail in TestIpaClientAutomountFileRestoreFrançois Cami2019-08-291-2/+0
| | | | | | | | | Remove xfail in TestIpaClientAutomountFileRestore to check the associated bugfix. Related-to: https://pagure.io/freeipa/issue/8054 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Added testcase to check capitalization fix while running ipa user-modsumenon2019-08-291-0/+36
| | | | | | | | | | | | | | | 1. This testcase checks that when ipa user-mod command is run with capital letters there is no error shown in the console, instead the modifications for first and last name of the user is applied. 2. Adding tasks.kinit_admin since the test was being executed as different user leading to permission issue. ipa: ERROR: Insufficient access: Could not read UPG Definition originfilter. Check your permissions Issue: https://pagure.io/freeipa/issue/5879 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
* Use tasks to configure automount nsswitch settingsRob Critenden2019-08-285-145/+180
| | | | | | | | | | | | | | | | | | | | | authselect doesn't allow one to directly write to /etc/nsswitch.conf. It will complain bitterly if it detects it and will refuse to work until reset. Instead it wants the user to write to /etc/authselect/user-nsswitch.conf and then it will handle merging in any differences. To complicate matters some databases are not user configurable like passwd, group and of course, automount. There are some undocumented options to allow one to override these though so we utilize that. tasks are used so that authselect-based installations can still write directly to /etc/nsswitch.conf and operate as it used to. Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move ipachangeconf from ipaclient.install to ipapythonRob Critenden2019-08-287-566/+608
| | | | | | | | | This will let us call it from ipaplatform. Mark the original location as deprecated. Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-client-automount: always restore nsswitch.conf at uninstall timeFrançois Cami2019-08-281-15/+54
| | | | | | | | | | | | | | | ipa-client-automount used to only restore nsswitch.conf when sssd was not used. However authselect's default profile is now sssd so always restore nsswitch.conf's automount configuration to 'files sssd'. Note that the behavior seen before commit: a0e846f56c8de3b549d1d284087131da13135e34 would always restore nsswitch.conf to the previous state which in some cases was wrong. Fixes: https://pagure.io/freeipa/issue/8038 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-29 05:48:55 +0000