summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* dns: fix dns_update_system_records to work with thin clientJan Cholasta2016-06-214-14/+20
| | | | | | | https://fedorahosted.org/freeipa/ticket/2008 https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Updated IPA translationsMartin Basti2016-06-2123-7486/+16062
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* DNS: Warn about restart when default TTL setting DNS is changedPetr Spacek2016-06-211-0/+13
| | | | | | | | | bind-dyndb-ldap 10.0 has to be restarted after each change to default TTL. https://fedorahosted.org/freeipa/ticket/2956 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: Support default TTL setting for master DNS zonesPetr Spacek2016-06-215-12/+23
| | | | | | https://fedorahosted.org/freeipa/ticket/2956 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert: allow search by certificateJan Cholasta2016-06-214-11/+67
| | | | | | | | | Allow search by certificate data or file in cert-find. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* cert: add owner informationJan Cholasta2016-06-213-35/+254
| | | | | | | | | | Get owner information from LDAP in cert-show and cert-find. Allow search by owner in cert-find. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* cert: add object pluginJan Cholasta2016-06-214-265/+327
| | | | | | | | | | Implement cert as an object with methods rather than a bunch of loosely related commands. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* ldap: fix handling of binary data in search filtersJan Cholasta2016-06-211-1/+6
| | | | | | | | | | This fixes a UnicodeDecodeError when passing non-UTF-8 binary data to LDAPClient.make_filter() and friends. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* restart scripts: bootstrap api with in_server=TrueFraser Tweedale2016-06-214-4/+4
| | | | | | | | renew_ca_cert fails because it cannot access the 'config' plugin. Bootstrap all the restart scripts to avoid such issues. Fixes: https://fedorahosted.org/freeipa/ticket/5968 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix possibly undefined variable in ipa_smb_conf_exists()Martin Basti2016-06-201-0/+2
| | | | | | | There was missing else statement what may result in undefined conf_fd variable. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DNS Locations: make ipa-ca record generation more robustPetr Spacek2016-06-201-1/+20
| | | | | | | | | | | | | | __add_ca_records_from_hostname() now skips over DNS exceptions and retries resolution until timeout of 120 seconds is reached. Luckily current logic fails safe: In cases where resolution failed for all the CA servers, the resulting zone object will not contain ipa-ca record at all and the update logic will skip update for this name. I.e. the original values in ipa-ca record set will be left in place. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Increased certmonger timeoutOleg Fayans2016-06-201-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5758 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Make sure ipapwd_extop takes precedence over passwd_modify_extopThierry Bordaz2016-06-203-2/+11
| | | | | | | | | | | | DS core server provides a default plugin (passwd_modify_extop) to handle 1.3.6.1.4.1.4203.1.11.1 extended op (https://www.ietf.org/rfc/rfc3062.txt) IPA delivers ipa_pwd_extop plugin that should take precedence over the default DS plugin (passwd_modify_extop) In addition make sure that slapi-nis has a low precedence Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* replica install: fix thin client regressionJan Cholasta2016-06-201-22/+28
| | | | | | | | | | | Fix a regression introduced by commit 3157eec28ff35e3c407a9552d6b59bef9891b555. https://fedorahosted.org/freeipa/ticket/4739 https://fedorahosted.org/freeipa/ticket/5985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: remove `no_cli` from command schemaJan Cholasta2016-06-203-20/+15
| | | | | | | | | Instead, support excluding commands from specified contexts and exclude commands with NO_CLI set from the 'cli' context. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: remove redundant informationJan Cholasta2016-06-203-90/+23
| | | | | | | | | | | | | | | | | | | | Remove the `autofill` kwarg from param schema. On the server, include default value only if autofill is set. On the client, set autofill if param has a default value. Remove the `deprecated_cli_aliases`, `hint` and `sortorder` kwargs, and the `dnsrecord_extra`, `dnsrecord_part` and `suppress_empty` flags from param schema, as they are now handled exclusively on the client. Replace the `no_option` and `no_output` flags in param schema with exclusion of the param in 'cli' and 'webui' contexts. Remove the `no_display` flag from output schema, as it is now handled exclusively on the client. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: merge command args and optionsJan Cholasta2016-06-203-25/+17
| | | | | | | | | | Rather than having args and options separately in command schema, merge them together and use new `positional` param flag to differentiate between them. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: remove output_paramsJan Cholasta2016-06-204-16/+146
| | | | | | | | | | | | | Since output params are copied from object plugins, remove them from command schema and include object name instead. One exception to this are the output params used for failed members in member add/remove commands. Move these to the client side, as they will be replaced by warnings. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: add object class schemaJan Cholasta2016-06-204-97/+267
| | | | | | | | | | | | Support object classes defined by object plugins in API schema. Added new commands `class-show` and `class-find` to retrieve information about object classes. `param-show` and `param-find` now support both commands and classes. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* permission: handle ipapermright deprecated CLI alias on the clientJan Cholasta2016-06-203-4/+34
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* passwd: handle sort order of passwd argument on the clientJan Cholasta2016-06-202-1/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* misc: skip `count` and `total` output in env.output_for_cliJan Cholasta2016-06-201-0/+3
| | | | | | | | | Do not include the `count` and `total` output values in CLI output in env.output_for_cli by default. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: do not rely on custom param fields in record attributesJan Cholasta2016-06-203-29/+46
| | | | | | | | | Obtain the information provided by the `hint` kwarg and `dnsrecord_part` and `dnsrecord_extra` flags by other means. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* automember: add object plugin for automember_rebuildJan Cholasta2016-06-201-9/+17
| | | | | | | | Change automember_rebuild into a method of a new automember_task object. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: do not crash on missing output in output_for_cliJan Cholasta2016-06-201-1/+1
| | | | | | | | Do not crash in Command.output_for_cli when an output value is missing. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: skip `value` output in output_for_cliJan Cholasta2016-06-201-1/+3
| | | | | | | | | Do not include the `value` output value in CLI output in Command.output_for_cli by default. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: don't copy command arguments to output paramsJan Cholasta2016-06-209-34/+42
| | | | | | | | | | | | | | Use only object params and params defined in has_output_params as output params. This removes unnecessary duplication of params defined both in object plugins and as command arguments. This requires all command output params to be properly defined in either the object plugins or the command's has_output_params. Fix the plugins where this wasn't true. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* makeaci, makeapi: use in-server APIJan Cholasta2016-06-203-129/+10
| | | | | | | | | | Capture the server API rather than client API in API.txt. Client API may be affected by client-side plugins and thus may not correspond to what is transmitted over the wire. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix minor typosYuri Chornoivan2016-06-204-6/+6
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix listing of enabled roles in `server-find`Martin Babinsky2016-06-171-1/+4
| | | | | | | | | | | | The roles can be thought of as membership attributes so we should only list them if `--all` is specified and `--no-members` is not. Also do not show them if `--raw` is passed in. https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Martin Basti <mbasti@redhat.com>
* remove the master from managed topology during uninstallationMartin Babinsky2016-06-171-155/+27
| | | | | | | | | | In managed topology, calling `ipa-server-install --uninstall` will cause the master to remove itself from the topology by calling `server_del` behind the scenes. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-manage: use `server_del` when removing domain level 1 replicaMartin Babinsky2016-06-172-241/+22
| | | | | | | | | | | `ipa-replica-manage del` will now call `server_del` behind the scenes when a removal of replica from managed topology is requested. The existing removal options were mapped on the server_del options to maintain backwards compatibility with earlier versions. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* CI test suite for `server-del`Martin Babinsky2016-06-173-16/+339
| | | | | | | | | | | | | these tests cover various scenarios such as: * trying to remove master that would disconnect topology in one of the suffixes * forcing master removal regardless of topology state before/after removal * trying to remove last CA/DNS server/DNSSec key master * forcing removal of the last DNSSec key master https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* server-del: perform full master removal in managed topologyMartin Babinsky2016-06-176-6/+434
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements most of the del_master_managed() functionality as a part of `server-del` command. `server-del` nows performs these actions: * check topology connectivity * check that at least one CA/DNS server and DNSSec masters are left after removal * cleanup all LDAP entries/attributes exposing information about the master * cleanup master DNS records * remove master and service principals * remove master entry from LDAP * check that all segments pointing to the master were removed `server-del` now accepts the following options: * `--force`: force master removal even if it doesn't exist * `--ignore-topology-disconnect`: ignore errors arising from disconnected topology before and after master removal * `--ignore-last-of-role`: remove master even if it is last DNS server, and DNSSec key master. The last CA will *not* be removed regardless of this option. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* delegate removal of master DNS record and replica keys to separate functionsMartin Babinsky2016-06-173-6/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver module for working with managed topologyMartin Babinsky2016-06-174-52/+199
| | | | | | | | | This module should aggregate common functionality utilized in the commands managing domain-level 1 topology. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused locking "context manager"David Kupka2016-06-171-13/+0
| | | | | | Class ods_db_lock is unused since August 2015. Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: dnsserver: print specific error when DNS is not installedMartin Basti2016-06-171-0/+7
| | | | | | | | Print 'DNS is not configured' if there is no IPA DNS in domain https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Location: add list of roles and DNS servers to location-showMartin Basti2016-06-171-14/+25
| | | | | | | | | Add to output list of DNS servers which advertise location and list fo roles per server https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* upgrade: don't fail if zone does not exists in in findMartin Basti2016-06-171-1/+5
| | | | | | | In case that zone is not managed by IPA, upgrade fails with not found error. Prevent failure in this case. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: generate NTP recordsMartin Basti2016-06-172-23/+26
| | | | | | | | Move NTP records to centralized record generator https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: Rename ipalocationweight to ipaserviceweightMartin Basti2016-06-1711-36/+36
| | | | | | | | | Service weight explains better meaning of attribute than location weight, because location itself have no weight only services have. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: location-del: remove location recordMartin Basti2016-06-172-3/+43
| | | | | | | | Remove unused location records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: do not generate location records for unused locationsMartin Basti2016-06-171-4/+7
| | | | | | | | | Location records for locations without assigned servers are useless and we should not generate them. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: prevent to remove used locationsMartin Basti2016-06-171-5/+11
| | | | | | | | | User should be notified that location is used by IPA server(s) and deletion should be aborted. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: show warning if there is no DNS servers in locationMartin Basti2016-06-173-0/+37
| | | | | | | | | DNS servers must be in each location, otherwise DNS location without DNS server assigned will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: require to restart named-pkcs11 affter location changeMartin Basti2016-06-172-1/+15
| | | | | | | | | Send a warning message that named-pkcs11 service must be restarted after changes related to locations or server weight https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: set proper substitution variableMartin Basti2016-06-171-0/+20
| | | | | | | | | DNS Server (bind-dyndb-ldap) needs to have set 'idnsSubstitutionVariable;ipalocation' in ldap to the proper location https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Always qualify requests for admin in ipa-replica-conncheckFlorence Blanc-Renaud2016-06-171-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | ipa-replica-conncheck connects to the master using an SSH command: ssh -o StrictHostKeychecking=no -o UserKnownHostsFile=<tmpfile> \ -o GSSAPIAuthentication=yes <principal>@<master hostname> \ echo OK The issue is that the principal name is not fully qualified (for instance 'admin' is used, even if ipa-replica-conncheck was called with --principal admin@EXAMPLE.COM). When the FreeIPA server is running with a /etc/sssd/sssd.conf containing [sssd] default_domain_suffix = ad.domain.com this leads to the SSH connection failure because admin is not defined in the default domain. The fix uses the fully qualified principal name, and calls ssh with ssh -o StrictHostKeychecking=no -o UserKnownHostsFile=<tmpfile> \ -o GSSAPIAuthentication=yes -o User=<principal> \ <master hostname> echo OK to avoid syntax issues with admin@DOMAIN@master https://fedorahosted.org/freeipa/ticket/5812 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: dnsserver: remove config when replica is removedMartin Basti2016-06-171-0/+15
| | | | | | | | | | Configuration of DNS server should be removed together with any other information about replica https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 13:57:26 +0000