summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* replication: ensure bind DN group check interval is set on replica configMartin Babinsky2016-11-291-0/+6
| | | | | | | | | | This is a safeguard ensuring valid replica configuration against incorrectly upgraded masters lacking 'nsds5replicabinddngroupcheckinterval' attribute on their domain/ca topology config. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* upgrade: add replica bind DN group check interval to CA topology configMartin Babinsky2016-11-291-0/+1
| | | | | | | | | | Without this attribute explicitly set the replication plugin won't recognize updates from members of 'replication managers' sysaccount group, leading to stuck replica CA installation. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Build: properly integrate ipa.pot into build system testsPetr Spacek2016-11-291-2/+2
| | | | | | | | i18n.py tests indirectly depend on existence on ipa.pot file. https://fedorahosted.org/freeipa/ticket/6498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: properly integrate ipasetup.py into build systemPetr Spacek2016-11-293-7/+17
| | | | | | | | | | | | | | | | AC_CONFIG_FILES in configure.ac works well only with Makefiles. Other files have to be handled by Makefile.am so depedencies are tracked properly. There is a problem that Python sub-directories depend on ipasetup.py which is one level above the sub-directory. This means that depedencies are the other way around that expected. This is being worked around using hack from http://lists.gnu.org/archive/html/automake/2009-03/msg00011.html https://fedorahosted.org/freeipa/ticket/6498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: properly integrate version.py into build systemPetr Spacek2016-11-293-5/+20
| | | | | | | | | | AC_CONFIG_FILES in configure.ac works well only with Makefiles. Other files have to be handled by Makefile.am so depedencies are tracked properly. https://fedorahosted.org/freeipa/ticket/6498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: properly integrate loader.js into build systemPetr Spacek2016-11-293-3/+15
| | | | | | | | | | AC_CONFIG_FILES in configure.ac works well only with Makefiles. Other files have to be handled by Makefile.am so depedencies are tracked properly. https://fedorahosted.org/freeipa/ticket/6498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: properly integrate freeipa.spec.in into build systemPetr Spacek2016-11-292-2/+9
| | | | | | | | | | AC_CONFIG_FILES in configure.ac works well only with Makefiles. Other files have to be handled by Makefile.am so depedencies are tracked properly. https://fedorahosted.org/freeipa/ticket/6498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: properly integrate ipa-version.h.in into build systemPetr Spacek2016-11-292-1/+13
| | | | | | | | | | AC_CONFIG_FILES in configure.ac works well only with Makefiles. Other files have to be handled by Makefile.am so depedencies are tracked properly. https://fedorahosted.org/freeipa/ticket/6498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaclient: remove hard dependency on ipaplatformJan Cholasta2016-11-293-19/+13
| | | | | | | | Hard-code the user cache directory path in ipaclient.remote_plugins.schema. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipaclient: move install modules to the install subpackageJan Cholasta2016-11-2912-26/+23
| | | | | | | | | | | | The ipa_certupdate, ipachangeconf, ipadiscovery and ntpconf modules depend on ipaplatform. Move them to ipaclient.install as they are used only from the client installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib: remove hard dependency on ipapythonJan Cholasta2016-11-293-3/+5
| | | | | | | | | | | Hard-code the path to /bin/false in SubprocessError doc string. Remove ipaplatform dependency from ipalib's setup.py and add it as optional installer dependency to ipalib's and ipaclient's setup.py. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* constants: remove CACERTJan Cholasta2016-11-2912-73/+70
| | | | | | | | | | CACERT depends on ipaplatform. Replace all uses of CACERT with paths.IPA_CA_CRT and remove CACERT. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib: move certstore to the install subpackageJan Cholasta2016-11-2910-20/+17
| | | | | | | | | | The certstore module depends on ipaplatform. Move it to ipalib.install, as it is used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: remove hard dependency on ipaplatformJan Cholasta2016-11-295-9/+17
| | | | | | | | | | | | | | Use hard-coded paths to certutil, pk12util and openssl in certdb if ipaplatform is not available. Hard-coded the path to setpasswd in ipautil.run() doc string. Remove ipaplatform dependency from ipapython's setup.py and add ipapython dependency to ipaplatform's setup.py. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move file encryption functions to installutilsJan Cholasta2016-11-294-63/+89
| | | | | | | | | | | The encrypt_file() and decrypt_file() functions depend on ipaplatform. Move them to ipaserver.install.installutils, as they are only used for the server installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-2916-127/+146
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move is_fips_enabled() to ipaplatform.tasksJan Cholasta2016-11-297-28/+28
| | | | | | | | The FIPS setting is platform-specific. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove the timeout argument of run()Jan Cholasta2016-11-292-17/+10
| | | | | | | | | | | | The argument depends on the platform-specific timeout binary and is used only in ipaclient.ntpconf. Call the timeout binary explicitly in ipaclient.ntpconf and remove the argument. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove get_domain_name()Jan Cholasta2016-11-297-170/+2
| | | | | | | | | | | get_domain_name() and related code depends on ipaplatform. Replace all uses of get_domain_name() with api.env.domain and remove get_domain_name() and all of the related code. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-2917-35/+53
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: use a temporary file to pass password to pk12utilJan Cholasta2016-11-292-4/+7
| | | | | | | | | | | Currently the PKCS#12 file password is passed via stdin and pk12util reads it from /dev/stdin, which is platform-specific. Use a temporary file instead. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: move IPA NSS DB install functions to ipaclient.installJan Cholasta2016-11-294-52/+53
| | | | | | | | | | | The create_ipa_nssdb() and update_ipa_nssdb() depend on ipaplatform. Move them to ipaclient.install.client as they are used only from the client installer and ipa-restore. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-2921-33/+29
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move dnssec, p11helper and secrets to ipaserverJan Cholasta2016-11-2930-49/+47
| | | | | | | | | | | The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* custodiainstance: automatic restart on config file updateJan Cholasta2016-11-292-1/+9
| | | | | | | | | | | Automatically restart Custodia during IPA server upgrade if custodia.conf was updated. Use the new store class name in custodia.conf.template. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* paths: remove DEV_NULLJan Cholasta2016-11-293-3/+2
| | | | | | | | | | | The platform-specific path to /dev/null is provided by the Python standard library in os.devnull. Replace all uses of paths.DEV_NULL with os.devnull and remove DEV_NULL. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* DNS: URI records: bump python-dns requirementsMartin Basti2016-11-292-6/+6
| | | | | | | | Support for DNS URI records has been added in python-dns 1.13 https://fedorahosted.org/freeipa/ticket/6344 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: workaround bug while calling parallel make from rpmbuildPetr Spacek2016-11-291-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Improve the robustness FreeIPA's i18n module and its testsMartin Babinsky2016-11-282-7/+32
| | | | | | | | | | | | | Prevent false positive errors reported by `ipatests/i18n.py` and `ipatests/test_ipalib/test_text.py` when LANGUAGE env variable is set in the environment. Additionally, also set LC_ALL and LC_MESSAGES during checks to further improve the robustness. https://fedorahosted.org/freeipa/ticket/6512 Reviewed-By: Martin Basti <mbasti@redhat.com>
* wrap long lineChristian Heimes2016-11-251-1/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Silence import warnings for Samba bindingsChristian Heimes2016-11-251-1/+6
| | | | | | | | | | Python 3 Samba bindings are not available yet. Let's silence the warnings to make pylint pass under Python 3. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix Python 3 bugs discovered by pylintChristian Heimes2016-11-2510-13/+25
| | | | | | | | | | | | In Python 3 exception instances no longer have a message attribute. For most exceptions, str(e) or string formatting give the same result. Fix some renamed modules, module members and functions. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-2524-21/+40
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix ipa-replica-install when upgrade from ca-less to ca-fullFlorence Blanc-Renaud2016-11-252-5/+12
| | | | | | | | | | | | | | | | | When ipa-replica-prepare is run on a master upgraded from CA-less to CA-full, it creates the replica file with a copy of the local /etc/ipa/ca.crt. This causes issues if this file hasn't been updated with ipa-certupdate, as it contains the external CA that signed http/ldap certs, but not the newly installed IPA CA. As a consequence, ipa-replica-install fails with "Could not find a CA cert". The fix consists in retrieving the CA certificates from LDAP instead of the local /etc/ipa/ca.crt. https://fedorahosted.org/freeipa/ticket/6375 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Do not log DM password in ca/kra installation logsStanislav Laznicka2016-11-253-11/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* IPA Allows Password Reuse with History value defined when admin resets the ↵Thierry Bordaz2016-11-241-9/+14
| | | | | | | | | | | password. When admin reset a user password, history of user passwords is preserved according to its policy. https://fedorahosted.org/freeipa/ticket/6402 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add main guards to a couple of Python scriptsChristian Heimes2016-11-244-47/+48
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Break ipaplatform / ipalib import cycle of hellChristian Heimes2016-11-2420-63/+72
| | | | | | | | | | | Here is an attempt to break the import cycle of hell between ipaplatform and ipalib. All services now pass an ipalib.api object to services.service(). RedHatServices.__init__() still needs to do a local import because it initializes its wellknown service dict with service instances. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Replace LooseVersionChristian Heimes2016-11-247-35/+68
| | | | | | | | | | | | | | | | | | | | pylint is having a hard time with distutils.version in tox's virtual envs. virtualenv uses some tricks to provide a virtual distutils package, pylint can't cope with. https://github.com/PyCQA/pylint/issues/73 suggests to use pkg_resources instead. pkg_resources' version parser has some more benefits, e.g. PEP 440 conformity. But pkg_resources.parse_version() is a heavy weight solution with reduced functionality, e.g. no access to major version. For API_VERSION and plugin version we can use a much simpler and faster approach. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Don't ship install subpackages with wheelsChristian Heimes2016-11-241-0/+36
| | | | | | | | | | | | | | | | | The install subpackages of ipaclient, ipalib and ipapython contain helper code for installers such as ipa-client-install. They also depend on external modules that are not available on PyPI, e.g. SSSDConfig. Since PyPI wheel packages do not support client installation, the install subpackages contain dead and unsupported code. The custom build_py plugin removes the subpackages from bdist_wheel builds. It's not enough to just remove 'ipaclient.install' from the 'packages' list. Surplus files have to be removed from build/lib, too. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Minor fixes for IPAVersion classChristian Heimes2016-11-221-5/+11
| | | | | | | | | | | | | Py3: classes with __eq__ must provide __hash__ function or set __hash__ to None. Comparison function like __eq__ must signal unsupported types by returning NotImplemented. Python turns this in a proper TypeError. Make the version member read-only and cache _bytes represention. https://fedorahosted.org/freeipa/ticket/6473 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* remove Knob functionMartin Basti2016-11-221-89/+2
| | | | | | | | | `Knob` function is an old implementation which was replcaed by `knob` function and currently is unused, so it can be removed https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Pylint: whitelist packages with extension modulesChristian Heimes2016-11-221-0/+9
| | | | | | | | | | | | Pylint refuses to load extension modules from unsafe places. This triggers import-error failures for pylint runs inside a tox virtualenv. Any module or package in extension-pkg-whitelist is whitelisted and pylint imports extension modules. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* upgrade: ldap conn managementTomas Krizek2016-11-223-22/+3
| | | | | | | | | | Clean up unnecessary starts/stops of DS and unnescessary attributes. If the DS is running, establish an LDAP connection and properly close it. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* services: replace admin_conn with api.Backend.ldap2Tomas Krizek2016-11-2213-120/+120
| | | | | | | | | Since service.admin_conn is only an alias to api.Backend.ldap2, replace it everywhere with the explicit api.Backend.ldap2 instead. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: remove ipa.pot from Git as it can be re-generated at any timePetr Spacek2016-11-222-46922/+1
| | | | | | | | | | | All the source files are in the very same repo so there is no point in keeping the file in Git. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: integrate translation system tests againPetr Spacek2016-11-223-2/+20
| | | | | | | | | | | | | | | | | The Makefile test targets were lost when gettextize infrastructure was introduced. Now it is re-added in its modernized form which counts with generated .pot files. ipatests/i18n.py is now explicitly setting character encoding in files it generates. According to gettext manual chapter "Filling in the Header Entry" the Content-Type header is language-specific so it does not make sense to fill it in in .pot file. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: automatically generate list of files to be translated in configurePetr Spacek2016-11-224-632/+23
| | | | | | | | | | | | | | | | configure is easiest option how to automatically generate POTFILES.in. Attempts to add it to po/Makefile* have big potential to create cyclic depedencies and cause other trouble. Given how rare operation adding a source file is, I think it is sufficient to document that configure needs to be run again after adding a source file with translatable strings. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: clean in po/ removes *~ files as wellPetr Spacek2016-11-221-0/+2
| | | | | | | | | | | Editing work is done in Zanata UI so there is no point in keeping all versions around in SCM. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: support strip-po target for translationsPetr Spacek2016-11-224-0/+32
| | | | | | | | | | | | The target was added to top-level Makefile.am as well so the maintainer does not need to jump between directories when doing Zanata pull/push and strip-po. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 11:36:04 +0000