summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix more bytes/unicode issuesPetr Viktorin2015-10-2212-69/+101
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.messages: Add "message" property to PublicMessagePetr Viktorin2015-10-221-0/+5
| | | | | | | In Python 3, the "message" property was removed in favor of calling str(). Add it to PublicMessage, since IPA code depends on it. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipatest.util: Port to Python 3Petr Viktorin2015-10-222-5/+5
| | | | | | | - Allow bytes or str in Fuzzy - test_util: Fix indices in lists whose elements are unorderable in py3 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Handle binascii.Error from base64.b64decode()Petr Viktorin2015-10-227-11/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In Python 3, the base64.b64decode function raises binascii.Error (a ValueError subclass) when it finds incorrect padding. In Python 2 it raises TypeError. Callers should usually handle ValueError; unless they are specifically concerned with handling base64 padding issues). In some cases, callers should handle ValueError: - ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should handle ValueError - ipalib.x509 (load_certificate*, get_*): callers should handle ValueError In other cases ValueError is handled: - ipalib.parameters - ipapython.ssh - ipalib.rpc (json_decode_binary - callers already expect ValueError) - ipaserver.install.ldapupdate Elsewhere no error handling is done, because values come from trusted sources, or are pre-validated: - vault plugin - ipaserver.install.cainstance - ipaserver.install.certs - ipaserver.install.ipa_otptoken_import Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNSSEC: warn user if DNSSEC key master is not installedMartin Basti2015-10-223-0/+56
| | | | | | | | | Warning user that DNSSEC key master is not installed when commands dnszone-add, dnszone-mod, dnszone-show when option dnssec=true https://fedorahosted.org/freeipa/ticket/5290 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: Remove service containers from LDAP after uninstallingMartin Basti2015-10-222-0/+16
| | | | | | | | | | The service containers are no needed there after uninstall anymore. Removing these service also allows to detect if DNSSEC master is installed on any replica for any user. https://fedorahosted.org/freeipa/ticket/5290 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: store status of services only before first installMartin Basti2015-10-222-5/+8
| | | | | | | DNS installer allows to reinstall DNS and DNSSEC, so the status of services should be stored only for first time. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC CI: wait until DS records is replicatedMartin Basti2015-10-221-0/+6
| | | | | | | In some cases replication may take much more time than we expected. This patch adds explicit cech if DS records has been replicated. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* default.conf.5: Fix a typoBenjamin Drung2015-10-221-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix manpage-has-errors-from-man warning (found by Lintian)Benjamin Drung2015-10-222-20/+33
| | | | | | | | | See https://lintian.debian.org/tags/manpage-has-errors-from-man.html for an explanation. Issues found were ipa-client-install.1.gz 208: warning [p 5, 4.0i]: cannot adjust line default.conf.5.gz 50: warning: macro `np' not defined Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix hyphen-used-as-minus-sign warning (found by lintian)Benjamin Drung2015-10-225-8/+8
| | | | | | | See https://lintian.debian.org/tags/hyphen-used-as-minus-sign.html for an explanation. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow to install the KRA on a promoted serverSimo Sorce2015-10-229-152/+301
| | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Warn if no installation found when running ipa-server-install --uninstallGabe2015-10-221-0/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/5341 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow ipa-ca-install to use the new promotion codeSimo Sorce2015-10-222-41/+93
| | | | | | | | | | | This makes it possible to install a CA after-the-fact on a server that has been promoted (and has no replica file available). https://fedorahosted.org/freeipa/ticket/2888 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* fix class teardown in user plugin testsMartin Babinsky2015-10-222-1/+15
| | | | | | https://fedorahosted.org/freeipa/ticket/5368 Reviewed-By: Martin Basti <mbasti@redhat.com>
* execute user-del pre-callback also during user preservationMartin Babinsky2015-10-211-21/+28
| | | | | | | | | | | user preservation code was not using the pre-callback function which did check whether a protected member is being deleted and facilitated the orphaning/deletion of OTP tokens owner/managed by the user. https://fedorahosted.org/freeipa/ticket/5362 https://fedorahosted.org/freeipa/ticket/5372 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* disable ipa-replica-prepare in non-zero IPA domain levelMartin Babinsky2015-10-201-1/+27
| | | | | | | | | | | | the original replica installation path (ipa-replica-prepare + ipa-replica-install) remains valid only when IPA domain level is zero. When this is not the case, ipa-replica-prepare will print out an error message which instructs the user to use the new replica promotion machinery to setup replicas. https://fedorahosted.org/freeipa/ticket/5175 Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix dsinstance.py:get_domain_level functionMartin Babinsky2015-10-201-2/+2
| | | | | | | This patch cleans up an unused parameter and fixes the return value when 'ipaDomainLevel' is found: instead of a dict we should return an integer. Reviewed-By: Martin Basti <mbasti@redhat.com>
* do not ask for segment direction when running topology commandsMartin Babinsky2015-10-203-3/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5222 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Rename option --dirsrv-config-mods to --dirsrv-config-fileMartin Basti2015-10-196-10/+10
| | | | | | | | | | | Option is renamed to be consistent with other options. Affected tickets: https://fedorahosted.org/freeipa/ticket/4949 https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* CI: installation with customized DS configMartin Basti2015-10-152-5/+105
| | | | | | | | | | Test covers: https://fedorahosted.org/freeipa/ticket/4949 https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add option to specify LDIF file that contains DS configuration changesMartin Basti2015-10-156-15/+64
| | | | | | | | | | | | | This allows to user modify configuration changes of the directory server instance during installation of DS https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add method to read changes from LDIFMartin Basti2015-10-151-0/+40
| | | | | | | | | | | | | | | | modifications_from_ldif will read LDIF file and changes in LDIF will be cached until parse() is called. After calling parse() method changes will be applied into destination LDIF. Only changetype modify is supported, the default operation is add. https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Make offline LDIF modify more robustMartin Basti2015-10-152-101/+109
| | | | | | | | | | | | | | * move code to installutils * add replace_value method * use lists instead of single values for add_value, remove_value methods https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Remove unused kra optionSimo Sorce2015-10-151-3/+0
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add low level helper to get domain levelSimo Sorce2015-10-151-0/+14
| | | | | | | | | This can be used only locally on an existing master (uses ldapi). Useful to check the domain_level in scripts before the api is initialized and/or credentials are available. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make checks for existing credentials reusableSimo Sorce2015-10-152-73/+75
| | | | | | | move the in installutils so they can be reused by multiple scripts Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow to setup the CA when promoting a replicaSimo Sorce2015-10-156-62/+332
| | | | | | | | | This patch makes --setup-ca work to set upa clone CA while creating a new replica. The standalone ipa-ca-install script is not converted yet though. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* prevent operation on tombstonesLudwig Krispenz2015-10-154-1/+22
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* handle multiple managed suffixesLudwig Krispenz2015-10-1510-51/+221
| | | | | | | | trigger topology updaet if suffix entry is added trigger topology update if managedSuffix is modified in host entry Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* topology plugin configuration workaroundPetr Vobornik2015-10-152-0/+2
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* enable topology plugin on upgradePetr Vobornik2015-10-153-0/+52
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* topology: manage ca replication agreementsPetr Vobornik2015-10-157-2/+64
| | | | | | | | | | | | | Configure IPA so that topology plugin will manage also CA replication agreements. upgrades if CA is congigured: - ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX - ipaReplTopoManagedSuffix: o=ipaca is added to master entry - binddngroup is added to o=ipaca replica entry Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add function to extract CA certs for installSimo Sorce2015-10-152-2/+61
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow ipa-replica-conncheck to use default credsSimo Sorce2015-10-153-43/+83
| | | | | | | | If the user has already run kinit try to use those credentials. The user can always override by explicitly passing the -p flag. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change DNS installer code to use passed in apiSimo Sorce2015-10-153-57/+69
| | | | | | | | | Fixes a number of places where api was not passed around internally. Also allows to install dns in replica promotion which requires an alternative api to be created with the right configuration. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Implement replica promotion functionalitySimo Sorce2015-10-1514-58/+860
| | | | | | | | | | | | | | | | | | This patch implements a new flag --promote for the ipa-replica-install command that allows an administrative user to 'promote' an already joined client to become a full ipa server. The only credentials used are that of an administrator. This code relies on ipa-custodia being available on the peer master as well as a number of other patches to allow a computer account to request certificates for its services. Therefore this feature is marked to work only with domain level 1 and above servers. Ticket: https://fedorahosted.org/freeipa/ticket/2888 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Require a DS version that has working DNA pluginSimo Sorce2015-10-151-3/+3
| | | | | | | | The DNA plugin needed to be fixed to deal with replica binddn groups. Version 1.3.4.4 is needed for that. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add ipa-custodia serviceSimo Sorce2015-10-1521-4/+763
| | | | | | | | | | Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* topology: add realm suffix to master entry on updatePetr Vobornik2015-10-151-0/+5
| | | | | | Realm suffix was set only during installation but not on update. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* admintool: Add error message with path to log on failure.David Kupka2015-10-151-0/+4
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* tests: Add tests for idoverride object integrityTomas Babej2015-10-141-2/+173
| | | | | | | | | | | As far as IPA objects are concerned, ID overrides are supposed to be removed when the respective user/group is removed. Adds a couple of tests to ensure this behaviour is covered. https://fedorahosted.org/freeipa/ticket/5322 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* idoverride: Ignore ValidationErrors when converting the anchorTomas Babej2015-10-141-24/+33
| | | | | | | | | | | When converting the anchor to a human readable form, SID validation may fail, i.e. if the domain is no longer trusted. Ignore such cases and pass along the anchor in the raw format. https://fedorahosted.org/freeipa/ticket/5322 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* remove ID overrides when deleting a userMartin Babinsky2015-10-141-0/+6
| | | | | | | | patch fixes a regression introduced during user-del refactoring https://fedorahosted.org/freeipa/ticket/5365 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-adtrust-install: Print complete SRV recordsPetr Spacek2015-10-141-3/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5358 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fixes disappearing automember expressionsStanislav Laznicka2015-10-141-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5353 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Replace tab with space in test_user_plugin.pyMartin Basti2015-10-141-2/+2
| | | | | | Mixing tabs and spaces is not allowed in python3 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Remove bind configuration detected questionGabe2015-10-132-11/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5351 Reviewed-By: Martin Basti <mbasti@redhat.com>
* vault: fix private service vault creationJan Cholasta2015-10-132-3/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5361 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipaldap: Remove extraneous `long` (included in six.int_types)Petr Viktorin2015-10-131-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 01:38:02 +0000