summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix removal of ipa-kdc-proxy.conf symlinkChristian Heimes2015-06-292-2/+2
| | | | | | | installutils.remove_file() ignored broken symlinks. Now it uses os.path.lexists() to detect and also remove dangling symlinks. Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* fix coverity issuesLudwig Krispenz2015-06-291-1/+13
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-kdb: common function to get key encodings/salt typesMartin Babinsky2015-06-292-70/+62
| | | | | | | | | | | This patch moves duplicate code in `ipadb_get_connection` to get default and supported key encodings/salt types from Kerberos container to a common function handling this task. It is actually a small cosmetic enhancement of the fix of https://fedorahosted.org/freeipa/ticket/4914 Reviewed-By: Martin Basti <mbasti@redhat.com>
* certprofile: fix doc errorFraser Tweedale2015-06-291-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Verify replication topology for a suffixPetr Vobornik2015-06-294-2/+94
| | | | | | | | | | | | Checks done: 1. check if the topology is not disconnected. In other words if there are replication paths between all servers. 2. check if servers don't have more than a recommended number of replication agreements(4) https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: David Kupka <dkupka@redhat.com>
* topology: check topology in ipa-replica-manage delPetr Vobornik2015-06-293-6/+166
| | | | | | | | | | | | ipa-replica-manage del now: - checks the whole current topology(before deletion), reports issues - simulates deletion of server and checks the topology again, reports issues Asks admin if he wants to continue with the deletion if any errors are found. https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: David Kupka <dkupka@redhat.com>
* fix force-sync, re-initialize of replica and a check for replication ↵Petr Vobornik2015-06-292-16/+4
| | | | | | | | | | | | | agreement existence in other words limit usage of `agreement_dn` method only for manipulation and search of agreements which are not managed by topology plugin. For other cases is safer to search for the agreement. https://fedorahosted.org/freeipa/ticket/5066 Reviewed-By: David Kupka <dkupka@redhat.com>
* DNSSEC: Improve ipa-ods-exporter log messages with key metadata.Petr Spacek2015-06-291-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Add ability to trigger full data synchronization to ipa-ods-exporter.Petr Spacek2015-06-291-45/+57
| | | | | | | | | | | | | New exporter's command 'ipa-full-update' will resynchronize all zone keys from ODS database to LDAP. This command holds database lock for the whole time to avoid race conditions so it should be used only in special cases, e.g. during master server migration. https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: log ipa-ods-exporter file lock operations into debug logPetr Spacek2015-06-291-0/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: ipa-ods-exporter: move zone synchronization into separate functionPetr Spacek2015-06-291-60/+64
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Accept ipa-ods-exporter commands from command line.Petr Spacek2015-06-291-36/+60
| | | | | | | | | | Previously only systemd socket activation was supported. Ability to call the command directly is handy in special cases, e.g. for debugging or moving key master role from one server to another. https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Detect invalid master keys in LDAP.Petr Spacek2015-06-291-0/+1
| | | | | | | | This should never happen ... https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* add python-setuptools to requiresPetr Vobornik2015-06-291-0/+1
| | | | | | | | | | | Commit 9f049ca14403f3696d54d186e6b1b15181f055df introduced dependency on python-setuptools on line: from pkg_resources import parse_version This dependency is missing on minimal installation and then ipa-server-upgrade fails on rpm install/upgrade. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add hint how to re-run IPA upgrade.Petr Spacek2015-06-291-1/+1
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* correct management of one directional segmentsLudwig Krispenz2015-06-295-39/+160
| | | | | | | | | | this patch contains the following improvements: check for existing segments works for all combinations of one directional and bidirectional segments rdns of replication agreements generated from one directional segments are preserves after merging of segments, so that deletion of the segment deletes the corresponding replication agreements Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* User life cycle: permission to delete a preserved userroot2015-06-292-0/+12
| | | | | | | | Add permission to delete an entry from Delete container https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Martin Basti <mbasti@redhat.com>
* upgrade: Raise error when certmonger is not running.David Kupka2015-06-291-0/+3
| | | | | | | | | | Certmonger should be running (should be started on system boot). Either user decided to stop it or it crashed. We should just error out and let user check & fix it. https://fedorahosted.org/freeipa/ticket/5080 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add ACI to allow hosts to add their own servicesRob Crittenden2015-06-292-3/+7
| | | | | | | | | | | Use wildcards and DN matching in an ACI to allow a host that binds using GSSAPI to add a service for itself. Set required version of 389-ds-base to 1.3.4.0 GA. https://fedorahosted.org/freeipa/ticket/4567 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix indicies ntUserDomainId, ntUniqueIdMartin Basti2015-06-292-2/+18
| | | | | | | ntUserDomainId and ntUniqueId contained "eq,pres" index value, which is not valid. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Rate-limit while loop in SystemdService.is_active().Petr Spacek2015-06-291-0/+5
| | | | | | | Previously is_active() was frenetically calling systemctl is_active in tight loop which in fact made the process slower. Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix handling of ldap.LDAPError in installerPetr Vobornik2015-06-291-3/+7
| | | | | | | | 'info' is optional component in LDAPError http://www.python-ldap.org/doc/html/ldap.html#exceptions Reviewed-By: Martin Basti <mbasti@redhat.com>
* Bump minimal BIND version for CentOS.Petr Spacek2015-06-291-2/+2
| | | | | | | | DNSSEC support added dependency on bind-pkcs11 sub-package. https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Hide traceback in ipa-dnskeysyncd if kinit failed.Petr Spacek2015-06-241-1/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Provide Kerberos over HTTP (MS-KKDCP)Christian Heimes2015-06-2415-5/+335
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Replicas cannot define their own master password.Simo Sorce2015-06-241-8/+0
| | | | | | | | | Seem like this slipped in during the refactoring of the install tools. https://fedorahosted.org/freeipa/ticket/4468 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix for a typo in certprofile mod command.Milan Kubík2015-06-231-1/+1
| | | | Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* generalize certificate creation during testingMartin Babinsky2015-06-233-26/+26
| | | | | | | | | | | With added support for multiple certificates for hosts, services, and even users, IPA testing framework will need a more flexible way to generate temporary testing certificates for these entities. This patch modifies the currently used `testcert` module to support these requirements. Related to work on http://www.freeipa.org/page/V4/User_Certificates Reviewed-By: Milan Kubík <mkubik@redhat.com>
* Become IPA 4.2.0 Alpha 1Petr Vobornik2015-06-181-3/+3
|
* Server Upgrade: create default config for NIS Server pluginMartin Basti2015-06-181-0/+18
| | | | | | | | Plugin is disabled by default. This commit prevents false positive upgrade errors. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-ca-install fix: reconnect ldap2 after DS restartMartin Basti2015-06-181-0/+9
| | | | | | https://fedorahosted.org/freeipa/ticket/5064 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: adjust user deleter dialog to new apiPetr Vobornik2015-06-184-14/+18
| | | | | | | | | In user_del, flags 'permanently' and 'preserve' were replaced with single bool option 'preserve' part of: https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: change user-del flags to be CLI-specificJan Cholasta2015-06-183-12/+28
| | | | | | | | Rename --permanently to --no-preserve. https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* add DS index for userCertificate attributeMartin Babinsky2015-06-182-0/+17
| | | | | | | | | | 'eq' and 'pres' indices for userCertificate attribute allow for more efficient lookup and matching of binary certificates assigned to users, hosts, and services. Part of http://www.freeipa.org/page/V4/User_Certificates Reviewed-By: Martin Basti <mbasti@redhat.com>
* Clarify error messages in ipa-replica-prepare: add_dns_records()Petr Spacek2015-06-181-3/+3
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Clarify recommendation about --ip-address option in ipa-replica-prepaprePetr Spacek2015-06-181-2/+3
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Improve error messages about reverse address resolution in ipa-replica-preparePetr Spacek2015-06-181-2/+8
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: Fix ipa-replica-install not installing RA certJan Cholasta2015-06-182-9/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: David Kupka <dkupka@redhat.com>
* DNS: add UnknownRecord to schemaMartin Basti2015-06-185-8/+13
| | | | | | | | defintion of UnknownRecord attributetype https://fedorahosted.org/freeipa/ticket/4939 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Bump run-time requires to SoftHSM 2.0.0rc1.Petr Spacek2015-06-181-1/+1
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix OTP token URI generationNathaniel McCallum2015-06-171-1/+1
| | | | | | | | Google Authenticator fails if the algorithm is not uppercase. https://fedorahosted.org/freeipa/ticket/5047 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* User life cycle: provide preserved user virtual attributeJan Cholasta2015-06-153-33/+51
| | | | | | | https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-replica-manage: adjust del to work with managed topologyPetr Vobornik2015-06-151-63/+166
| | | | | | | | | Introduces new method for deletion of replica. This method is used if managed topology is enabled. part of https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* server: add "del" commandPetr Vobornik2015-06-153-2/+17
| | | | | | | this command is internal and is supposed to be used by ipa-replica-managed to delete replica. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-replica-manage: Do not allow topology altering commands from DL 1Petr Vobornik2015-06-151-16/+37
| | | | | | | | | | | | | | | | | | With Domain Level 1 and above, the usage of ipa-replica-manage commands that alter the replica topology is deprecated. Following commands are prohibited: * connect * disconnect Upon executing any of these commands, users are pointed out to the ipa topologysegment-* replacements. Exception is creation/deletion of winsync agreement. Part of: https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* regenerate ACI.txt after stage user permission renamePetr Vobornik2015-06-151-2/+2
| | | | ./makeaci was not run
* Server Upgrade: disconnect ldap2 connection before DS restartMartin Basti2015-06-151-0/+5
| | | | | | | | Without this patch, the invalid api.Backend.ldap2 connection was used to communicate with DS and it raises network error after DS restart. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Stage User: Fix permissions naming and split them where apropriate.Thierry Bordaz2015-06-153-56/+56
| | | | | Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* DNSSEC: fix traceback during shutdown phaseMartin Basti2015-06-151-11/+11
| | | | | | | ipa-dnskeysyncd causes traceback when receive SIGTERM, SIGINT Ticket: https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* topology: fix swapped topologysegment-reinitialize behaviorPetr Vobornik2015-06-151-2/+4
| | | | | | | | | | setting "nsds5BeginReplicaRefresh;left" to "start" reinintializes the right node and not the left node. This patch fixes API to match the behavior. part of: https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 20:58:38 +0000