summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Test for installing rules with service principalsOleg Fayans2016-11-141-0/+82
| | | | | | https://fedorahosted.org/freeipa/ticket/6481 Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* Test: integration tests for certs in idoverrides featureOleg Fayans2016-11-141-0/+156
| | | | | | https://fedorahosted.org/freeipa/ticket/6005 Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* Added interface to certutilOleg Fayans2016-11-141-0/+7
| | | | | | Added generic method to run certutil with arbitrary set of paramenters Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* ipatests: Fix assert_deepequal outside of pytest processMilan Kubík2016-11-141-1/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/6420 Reviewed-By: Martin Basti <mbasti@redhat.com>
* git: Add commit templateMichal Židek2016-11-141-0/+5
| | | | | | | | | | In order to use the commit template, run the following command: git config commit.template .git-commit-template Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* TESTS: Update group type namePavel Vomacka2016-11-141-1/+1
| | | | | | | | | As the group type has been changed from 'normal' to 'nonposix' we need to update this information also in tests. https://fedorahosted.org/freeipa/ticket/6334 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cainstance: use correct certificate for replica install checkTomas Krizek2016-11-141-1/+1
| | | | | | | | Incorrect certificate file extension caused DL0 replica install to fail. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Update man page for ipa-adtrust-install by removing --no-msdcs optionPetr Spacek2016-11-141-27/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/6480 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Tests: Verify that validity info is present in cert-show and cert-find commandLenka Doudova2016-11-141-0/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/6419 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add file_exists method as a member of transport objectLenka Doudova2016-11-141-1/+1
| | | | | | | | | | Method file_exists is reported by pylint as not being a member of transport object, however it is used as such. Adding the method to object to avoid pylint errors or unnecessary pylint disable. https://fedorahosted.org/freeipa/ticket/6400 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Tests: Provide AD cleanup for legacy client testsLenka Doudova2016-11-141-0/+4
| | | | | | | | Providing cleanup of trust information from AD machines for legacy client tests. https://fedorahosted.org/freeipa/ticket/6396 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Tests: Provide AD cleanup for trust testsLenka Doudova2016-11-142-0/+14
| | | | | | | | Providing cleanup of trust information from AD machines for trusts tests. https://fedorahosted.org/freeipa/ticket/6396 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use api.env.nss_dir instead of paths.IPA_NSSDB_DIRChristian Heimes2016-11-143-8/+4
| | | | | | | | | | ipaclient plugins are now using nss_dir from api.env instead of hard-coded paths.IPA_NSSDB_DIR. Closes: https://fedorahosted.org/freeipa/ticket/6386 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert-request: accept CSRs with extraneous dataFraser Tweedale2016-11-112-3/+6
| | | | | | | | | | | | | | | The cert-request command used to accept CSRs that had extra data surrounding the PEM data, e.g. commentary about the contents of the CSR. Recent commits that switch to using python-cryptography for cert and CSR handling broke this. Our acceptance tests use such CSRs, hence the tests are now failing. To avoid the issue, freshly encode the python-cryptography CertificateSigningRequest object as PEM. This avoids re-using the user-supplied data, in case it has extraneous data. Fixes: https://fedorahosted.org/freeipa/ticket/6472 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dns: check if container exists using ldapiTomas Krizek2016-11-117-58/+15
| | | | | | | | | | | Previously an adhoc connection was established for checking if dns(sec) container exists. A simple or external bind was used. Instead, always connect with ldapi through api.Backend.ldap2. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Provide user hint about IP address in IPA installAbhijeet Kasurde2016-11-111-2/+4
| | | | | | | | | | | With this fix, user will be notified about pressing enter to proceed with IPA installation procedure, if user has provided valid IP address previously. Fixes https://fedorahosted.org/freeipa/ticket/5949 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: migrate client install to the new class hierarchyJan Cholasta2016-11-113-229/+194
| | | | | | | | | Migrate ipa-client-install from the custom script to the new installer class hierarchy classes. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: allow specifying verbosity and console log format in CLIJan Cholasta2016-11-112-6/+20
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: migrate server installers to the new class hierarchyJan Cholasta2016-11-118-910/+258
| | | | | | | | | Migrate ipa-server-install and ipa-replica-install from the old installer classes to the new installer class hierarchy classes. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: introduce installer class hierarchyJan Cholasta2016-11-1113-4/+1332
| | | | | | | | | Add class hierarchy which allows inherting knob definitions between the various client and server install scripts. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: fix subclassing of knob groupsJan Cholasta2016-11-113-17/+12
| | | | | | | | | | Add new @group decorator to declare an installer class as a knob group instead of subclassing Group, so that subclassing the installer does not create duplicates of the original group. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: make knob base declaration explicitJan Cholasta2016-11-111-37/+43
| | | | | | | | | Declare knob bases explicitly using a keyword argument instead of guessing if the type argument is a base or a type of the knob. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: declare knob CLI names using the argparse conventionJan Cholasta2016-11-112-53/+109
| | | | | | | | | | | | | | Replace cli_name, cli_short_name and cli_positional knob arguments with a single cli_names argument, which allows defining one or more CLI names using the argparse convention ("--option" for long option name, "-o" for short option name and "argument" for positional argument name). Also replace cli_aliases with cli_deprecated_names which uses the same convention. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: use standard Python classes to declare knob typesJan Cholasta2016-11-115-13/+96
| | | | | | | | | | | | | | | | | | | Use type(None) rather than bool to define knobs which are represented as command line flags. This allows declaring both "--option" and "--option={0,1}"-style command line options. Use enum.Enum subclasses instead of set literals to declare enumerations. Use typing.List[T] instead of (list, T) to declare lists. (Note that a minimal reimplementation of typing.List is used instead of the Python 2 backport of the typing module due to non-technical reasons.) Use CheckedIPAddress instead of 'ip' and 'ip-local' to declare IP addresses. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: introduce updated knob constructorJan Cholasta2016-11-111-1/+17
| | | | | | | | | Add new knob() knob constructor. Keep the old Knob() constructor for backward compatibility with old code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: simplify CLI option parsingJan Cholasta2016-11-111-96/+69
| | | | | | | | | | | | Let IPAOptionParser handle parsing of its supported types and use an option callback only for unsupported types. Instead of parsing positional arguments manually, parse them using a custom IPAOptionParser instance, reusing the option parsing code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: improve CLI positional argument handlingJan Cholasta2016-11-114-45/+67
| | | | | | | | | | | | | Instead of specifying which knobs should be positional arguments in cli.install_tool(), do it using a flag in knob definition, where the rest of CLI configuration is. As a side effect, the usage string for CLI tools can now be generated automatically. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix CA replica install on DL1Stanislav Laznicka2016-11-111-1/+1
| | | | | | | | | | | | Dogtag requires Directory Manager password for its installation. On Domain Level 1 a special password for Directory Manager is created and used during the installation. However, by importing the real DM password from remote LDAP, we can no longer use the temporary password from the replica installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installutils: remove 'install_service_keytab' functionMartin Babinsky2016-11-111-11/+0
| | | | | | | | | This functionality was merged to Service class and is not longer used anywhere. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* domain-level agnostic keytab retrieval in httpinstanceMartin Babinsky2016-11-112-30/+4
| | | | | | | | | | | | | apache keytab is now retrieved using the same method in both domain levels. The difference lies in the authentication scheme used to retrieve service keytab: * in DL0 passed in DM credentials are used * in DL1 GSSAPI is used https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* installers: restart DS after KDC is configuredMartin Babinsky2016-11-112-0/+8
| | | | | | | | | This is required to enable password extension plugin right away so that services configured later can use it to request keytabs via ipa-getkeytab. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* dsinstance: use keytab retrieval method from parent classMartin Babinsky2016-11-112-21/+3
| | | | | | | | | | DS replica can now use remote API and ipa-getkeytab to create service principal and fetch the keytab in both domain levels. There is no need to use KDC installer to do it. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* use DM credentials to retrieve service keytab only in DLOMartin Babinsky2016-11-111-1/+2
| | | | | | | | | | | | | | | In DL0 directory manager password is bundled in the supplied replica file and the replica installer can use it to authenticate against master when retrieving service keytabs. In DL1, however, DM credentials are generated randomly and used during local DS instance creation. The proper DM password is imported by custodia much later to the process. We must not allow the installer to contact the remote master using this random password since it would fail. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Service: common method for service keytab requestsMartin Babinsky2016-11-111-0/+54
| | | | | | | | | | | Since creation of service principals and keytab retrieval are common operations, Service class should provide means to add service entry to LDAP, retrieve its keytab to designated destination and change the owner to service user. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Turn Kerberos-related properties to Service class membersMartin Babinsky2016-11-119-74/+95
| | | | | | | | | | | | | The Service class now accepts keytab path and service name part of Kerberos principal as members. Kerberos principal is turned into a property computed from service prefix, FQDN and realm. the handling of Kerberos principals and keytabs in service installers was changed to use class members instead of copy-pasted constants. This shall aid in the future refactoring of principal/keytab handling code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Make service user name a class member of ServiceMartin Babinsky2016-11-117-22/+27
| | | | | | | | | This will aid further refactoring of service installers, since the user will be defined only once during parent class initialization. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* service installers: clean up the inheritanceMartin Babinsky2016-11-1111-72/+51
| | | | | | | | | | | | Instead of delegating handling of some parameters like fstore to the parent class, the *Instance installers had the logic copy-pasted in their constructors. Some other members were also moved to the Service class and the parent class constructors in children were fixed to modern standards of initializing parent class in Python. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Offer more general way to check domain level in replicainstallStanislav Laznicka2016-11-111-59/+49
| | | | | | | | | | | | Domain levels 0 and 1 use the same mechanism of checking domain level correctness. Group them together and make it more general should there be more domain levels in the future (although lets hope there won't be). https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use same means of checking replication agreements on both DLsStanislav Laznicka2016-11-111-14/+7
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replicainstall: move common checks to common_check()Stanislav Laznicka2016-11-111-53/+34
| | | | | | | | | | install_check() and promote_check() have some common checks that can be safely moved to common grounds. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Take advantage of the ca/kra code cleanup in replica installationStanislav Laznicka2016-11-111-27/+11
| | | | | | | | | | | | | | The recent cleanup of ca/kra installation code can be used to greatly reduce the number of differences between DL0 and DL1 in replica installation. This change also allows to move Custodia instance creation after Kerberos and httpd instances installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use updated CA certs in replica installationStanislav Laznicka2016-11-111-25/+21
| | | | | | | | | | | | DL0 updated its CA certificate file prior to installing a DS but would not use it for the installation. Update the file on both domain levels and use it to setup DS and HTTP replica instances. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use os.path.join instead of concatenationStanislav Laznicka2016-11-111-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove redundant CA cert file existance checkStanislav Laznicka2016-11-111-3/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use host keytab to connect to remote server on DL0Stanislav Laznicka2016-11-111-11/+15
| | | | | | | | | | | | Since host enrollment was implemented in DL0, use the host keytab to connect to remote api and perform certain actions to merge DL1 and DL0 replica install workflows. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Split install_http_certs() into two functionsStanislav Laznicka2016-11-111-5/+12
| | | | | | | | | | | | install_http_certs() was actually installing http service keytab and actually installing certificates after that. Split it into two so that the names of the new functions better reflect what's actually happening. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* First step of merging replica installation of both DLsStanislav Laznicka2016-11-111-177/+120
| | | | | | | | | | | | The installation steps of replica installation on DL0 and DL1 don't differ too much and should be merged. When host enrollment on DL0 is finished, most of the code will be the same. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Properly bootstrap replica promotion apiStanislav Laznicka2016-11-111-10/+6
| | | | | | | | | | Properly bootstrap api in replica promote_check() so that it can be used later in the installation for setting up dns. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move the pki-tomcat restart to cainstance creationStanislav Laznicka2016-11-113-6/+13
| | | | | | | | | | | pki-tomcat would have been restarted in install and replicainstall for backward compatibility reasons. As Dogtag 9 is not supported anymore, we can move this restart only for DL0 replica installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move httpd restart to DNS installationStanislav Laznicka2016-11-114-18/+3
| | | | | | | | | | | | Web service needs restarting after bindinstance is created to pick up changes done to /etc/resolv.conf. This change should be included anytime DNS is installed therefore it makes sense to move it to the common code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 22:00:25 +0000