summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* DNS: URI records: bump python-dns requirementsMartin Basti2016-11-292-6/+6
| | | | | | | | Support for DNS URI records has been added in python-dns 1.13 https://fedorahosted.org/freeipa/ticket/6344 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: workaround bug while calling parallel make from rpmbuildPetr Spacek2016-11-291-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Improve the robustness FreeIPA's i18n module and its testsMartin Babinsky2016-11-282-7/+32
| | | | | | | | | | | | | Prevent false positive errors reported by `ipatests/i18n.py` and `ipatests/test_ipalib/test_text.py` when LANGUAGE env variable is set in the environment. Additionally, also set LC_ALL and LC_MESSAGES during checks to further improve the robustness. https://fedorahosted.org/freeipa/ticket/6512 Reviewed-By: Martin Basti <mbasti@redhat.com>
* wrap long lineChristian Heimes2016-11-251-1/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Silence import warnings for Samba bindingsChristian Heimes2016-11-251-1/+6
| | | | | | | | | | Python 3 Samba bindings are not available yet. Let's silence the warnings to make pylint pass under Python 3. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix Python 3 bugs discovered by pylintChristian Heimes2016-11-2510-13/+25
| | | | | | | | | | | | In Python 3 exception instances no longer have a message attribute. For most exceptions, str(e) or string formatting give the same result. Fix some renamed modules, module members and functions. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-2524-21/+40
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix ipa-replica-install when upgrade from ca-less to ca-fullFlorence Blanc-Renaud2016-11-252-5/+12
| | | | | | | | | | | | | | | | | When ipa-replica-prepare is run on a master upgraded from CA-less to CA-full, it creates the replica file with a copy of the local /etc/ipa/ca.crt. This causes issues if this file hasn't been updated with ipa-certupdate, as it contains the external CA that signed http/ldap certs, but not the newly installed IPA CA. As a consequence, ipa-replica-install fails with "Could not find a CA cert". The fix consists in retrieving the CA certificates from LDAP instead of the local /etc/ipa/ca.crt. https://fedorahosted.org/freeipa/ticket/6375 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Do not log DM password in ca/kra installation logsStanislav Laznicka2016-11-253-11/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* IPA Allows Password Reuse with History value defined when admin resets the ↵Thierry Bordaz2016-11-241-9/+14
| | | | | | | | | | | password. When admin reset a user password, history of user passwords is preserved according to its policy. https://fedorahosted.org/freeipa/ticket/6402 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add main guards to a couple of Python scriptsChristian Heimes2016-11-244-47/+48
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Break ipaplatform / ipalib import cycle of hellChristian Heimes2016-11-2420-63/+72
| | | | | | | | | | | Here is an attempt to break the import cycle of hell between ipaplatform and ipalib. All services now pass an ipalib.api object to services.service(). RedHatServices.__init__() still needs to do a local import because it initializes its wellknown service dict with service instances. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Replace LooseVersionChristian Heimes2016-11-247-35/+68
| | | | | | | | | | | | | | | | | | | | pylint is having a hard time with distutils.version in tox's virtual envs. virtualenv uses some tricks to provide a virtual distutils package, pylint can't cope with. https://github.com/PyCQA/pylint/issues/73 suggests to use pkg_resources instead. pkg_resources' version parser has some more benefits, e.g. PEP 440 conformity. But pkg_resources.parse_version() is a heavy weight solution with reduced functionality, e.g. no access to major version. For API_VERSION and plugin version we can use a much simpler and faster approach. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Don't ship install subpackages with wheelsChristian Heimes2016-11-241-0/+36
| | | | | | | | | | | | | | | | | The install subpackages of ipaclient, ipalib and ipapython contain helper code for installers such as ipa-client-install. They also depend on external modules that are not available on PyPI, e.g. SSSDConfig. Since PyPI wheel packages do not support client installation, the install subpackages contain dead and unsupported code. The custom build_py plugin removes the subpackages from bdist_wheel builds. It's not enough to just remove 'ipaclient.install' from the 'packages' list. Surplus files have to be removed from build/lib, too. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Minor fixes for IPAVersion classChristian Heimes2016-11-221-5/+11
| | | | | | | | | | | | | Py3: classes with __eq__ must provide __hash__ function or set __hash__ to None. Comparison function like __eq__ must signal unsupported types by returning NotImplemented. Python turns this in a proper TypeError. Make the version member read-only and cache _bytes represention. https://fedorahosted.org/freeipa/ticket/6473 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* remove Knob functionMartin Basti2016-11-221-89/+2
| | | | | | | | | `Knob` function is an old implementation which was replcaed by `knob` function and currently is unused, so it can be removed https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Pylint: whitelist packages with extension modulesChristian Heimes2016-11-221-0/+9
| | | | | | | | | | | | Pylint refuses to load extension modules from unsafe places. This triggers import-error failures for pylint runs inside a tox virtualenv. Any module or package in extension-pkg-whitelist is whitelisted and pylint imports extension modules. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* upgrade: ldap conn managementTomas Krizek2016-11-223-22/+3
| | | | | | | | | | Clean up unnecessary starts/stops of DS and unnescessary attributes. If the DS is running, establish an LDAP connection and properly close it. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* services: replace admin_conn with api.Backend.ldap2Tomas Krizek2016-11-2213-120/+120
| | | | | | | | | Since service.admin_conn is only an alias to api.Backend.ldap2, replace it everywhere with the explicit api.Backend.ldap2 instead. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: remove ipa.pot from Git as it can be re-generated at any timePetr Spacek2016-11-222-46922/+1
| | | | | | | | | | | All the source files are in the very same repo so there is no point in keeping the file in Git. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: integrate translation system tests againPetr Spacek2016-11-223-2/+20
| | | | | | | | | | | | | | | | | The Makefile test targets were lost when gettextize infrastructure was introduced. Now it is re-added in its modernized form which counts with generated .pot files. ipatests/i18n.py is now explicitly setting character encoding in files it generates. According to gettext manual chapter "Filling in the Header Entry" the Content-Type header is language-specific so it does not make sense to fill it in in .pot file. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: automatically generate list of files to be translated in configurePetr Spacek2016-11-224-632/+23
| | | | | | | | | | | | | | | | configure is easiest option how to automatically generate POTFILES.in. Attempts to add it to po/Makefile* have big potential to create cyclic depedencies and cause other trouble. Given how rare operation adding a source file is, I think it is sufficient to document that configure needs to be run again after adding a source file with translatable strings. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: clean in po/ removes *~ files as wellPetr Spacek2016-11-221-0/+2
| | | | | | | | | | | Editing work is done in Zanata UI so there is no point in keeping all versions around in SCM. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: support strip-po target for translationsPetr Spacek2016-11-224-0/+32
| | | | | | | | | | | | The target was added to top-level Makefile.am as well so the maintainer does not need to jump between directories when doing Zanata pull/push and strip-po. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Build: use standard infrastructure for translationsPetr Spacek2016-11-2215-334/+937
| | | | | | | | | | | | | | | | | | | | | | | | | | We now use standard framework generatedby "gettextize" utility. It has two limitations which I do not consider sufficiently important to invest into hand-made solution: 1. It can automatically gather strings only from files which have some file extension like .c or .py. Right now we do not have any translatable strings in Python files without extensions. Given that these files will be removed from source tree and replaced with entry points from setuptools I do not see a reason to invest into supporting this. 2. It does not automatically strip untranslated strings from po files. This is a manual step in mainteiner's in workflow anyway so I will add separate Makefile target for it later on. This commit contains gettextize instrastructure + filled-in files Makevars and POTFILES.in. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* tests: Mark 389-ds acceptance testsDavid Kupka2016-11-222-0/+4
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: Mark Dogtag acceptance testsDavid Kupka2016-11-222-0/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove references to ds_newinst.plFraser Tweedale2016-11-212-7/+6
| | | | | | | | ds_newinst.pl was removed from 389 DS over 9 years ago. Remove references to it. Fixes: https://fedorahosted.org/freeipa/ticket/6496 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* KRA: don't add KRA container when KRA replicaMartin Basti2016-11-211-10/+4
| | | | | | | | | | | | | | | | | | | This fixes regression caused by c56256e2a29f076e6afa559225a66f58b0773eb5 """ [9/11]: add vault container ipa : CRITICAL Failed to load vault.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpxxO9IC -H ldapi://%2fvar%2frun%2fslapd-IPA-TEST.socket -x -D cn=Directory Manager -y /tmp/tmpVKinCZ' returned non-zero exit status 68 [10/11]: apply LDAP updates """ and removes unneded steps during installation of KRA replica, because KRA container must be there since installation of first KRA instance. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Build: fix path in ipa-ods-exporter.socket unit filePetr Spacek2016-11-211-1/+1
| | | | | | | | | | This fixes regression caused by incorrect daemons/dnssec/ipa-ods-exporter.socket.in path template introduced in commit 312e780041fc9025ca3c189e6c9fcb54c7340714. https://fedorahosted.org/freeipa/ticket/6495 Reviewed-By: Martin Basti <mbasti@redhat.com>
* upgrade: do not explicitly set principal for servicesTomas Krizek2016-11-211-2/+0
| | | | | | | | After installer refactoring, principal is a property of service. https://fedorahosted.org/freeipa/ticket/6500 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Zanata: exlude testing ipa.pot fileMartin Basti2016-11-211-1/+1
| | | | | | | | | Exlude testing file "ipatests/test_ipalib/data/ipa.pot" which should not be uploaded to zanata. https://fedorahosted.org/freeipa/ticket/6435 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add 'ipa localenv' subcommandChristian Heimes2016-11-182-1/+29
| | | | | | | | | | | | ipa local-env simply dumps all values from api.env as sorted key="value" pairs. It's a convenient helper for debugging and to write tests for e.g. PR #182. https://fedorahosted.org/freeipa/ticket/6490 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipapython and ipatest no longer require lxmlChristian Heimes2016-11-172-2/+0
| | | | | | | Commits 64af88fe and 9fbd29cc have removed dependency on lxml. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix ipa migrate-ds when it finds a search referenceFlorence Blanc-Renaud2016-11-172-10/+5
| | | | | | | | | | | | | | | | | | | | When ipa migrate-ds finds user entries and a search reference, it complains that the LDAP search did not return any result and does not migrate the entries or the groups. The issue comes from LDAPClient._convert_result which returns an empty result list when the input is a search reference. In turn LDAPClient.find_entries assumes that the empty result list corresponds to a Search Result Done and returns without any entry. The fix examines first the objtype returned by self.conn.result3. If it is a search result done, then the loop can be exited. Otherwise (referral or entry), _convert_result is called and the result (if not empty) is appended to the list of returned entries. https://fedorahosted.org/freeipa/ticket/6358 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use common procedure to setup initial replication in both domain levelsMartin Babinsky2016-11-172-8/+20
| | | | | | | | | | | | | | Set up initial replication using GSSAPI also in domin level 0. For this to work, the supplied DM password is used to connect to remote master and set up agreements. The workflow is unchanged in DL1 where GSSAPI bind as host or admin is used. This obsoletes the conversion of replication agreements to GSSAPI made in DL0 during KDC installation. https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ensure that the initial sync using GSSAPI works agains old mastersMartin Babinsky2016-11-171-15/+31
| | | | | | | | | | | | | | IPA 3.x masters neither have 'cn=replication managers' sysaccount groups set, nor do they support adding nsds5ReplicaBinddnGroup attribute to the replica config objects. In order for common replication mechanism to work against them, the replica must be ready to supply the required information to the old master. https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replication: refactor the code setting principals as replica bind DNsMartin Babinsky2016-11-171-26/+21
| | | | | | | | | | In addition to improving the readability of `setup_krb_princs_as_replica_binddns` method, the re-usable bits were factored out to separate methods https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replication: augment setup_promote_replication methodMartin Babinsky2016-11-171-3/+7
| | | | | | | | | | | | | the method that sets up initial GSSAPI replication in DL1 was augmented so that the specified bind DN/bind password allows simple bind to remote master using STARTTLS. The CA certificate for the connection is also configurable. This facilitates the use of this method in DL0 where GSSAPI bind can not be used during DS bootstrap while DM credentials are available. https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Turn replication manager group into ReplicationManager class memberMartin Babinsky2016-11-172-6/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Register entry points of Custodia pluginsChristian Heimes2016-11-162-1/+13
| | | | | | | | | | | With setuptools in place FreeIPA is able to register its Custodia plugins. Custodia 0.1 ignores the plugins directives. Custodia 0.2 uses the entry points to discover plugins. https://fedorahosted.org/freeipa/ticket/6492 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use xml.etree in ipa-client-automount scriptChristian Heimes2016-11-161-24/+23
| | | | | | | | The ipa-client-automount script used lxml.etree to modify /etc/autofs_ldap_auth.conf. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Port ipapython.dnssec.odsmgr to xml.etreeChristian Heimes2016-11-163-17/+65
| | | | | | | | | | The module ipapython.dnssec.odsmgr is the only module in ipalib, ipaclient, ipapython and ipaplatform that uses lxml.etree. https://fedorahosted.org/freeipa/ticket/6469 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add install requirements to Python packagesChristian Heimes2016-11-1610-3/+157
| | | | | | | https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix the naming of ipa-dnskeysyncd service principalMartin Babinsky2016-11-161-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: ignore rpmbuild for lint targetTomas Krizek2016-11-161-6/+10
| | | | | | | | | Exclude rpmbuild from pylint checks when make lint is executed. Clean up the current find expression. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Make api.env.nss_dir relative to api.env.confdirChristian Heimes2016-11-162-2/+4
| | | | | | | | | | | | | api.env.nss_dir is no longer hard-coded to paths.IPA_NSSDB_DIR. Instead the path is calculated relatively to api.env.confdir. The default value is still /etc/ipa/nssdb. The change makes it a bit easier to run FreeIPA's API with a custom configuration directory. See https://fedorahosted.org/freeipa/ticket/6386 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Don't modify redhat_system_unitsChristian Heimes2016-11-161-1/+1
| | | | | | | | ipaplatform.fedora.services used to modify the redhat_system_units dict. It now creates a proper shallow copy. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Build: fix file dependencies for make-css.shPetr Spacek2016-11-161-1/+5
| | | | | | | | | | Some of .less files included by ipa.less were not listed in the Makefile.am so some changes might not trigger rebuild. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: update makerpms.sh to use same paths as rpmbuildPetr Spacek2016-11-161-1/+20
| | | | | | | | | | | | | This allows us to simply use makerpms.sh to configure the build tree, install RPMs to configure system for the first time and then use make install for rapid devel/test cycles. Configuration parameteres were taken from rpm-4.13.0-0.rc1.27.fc24.x86_64. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 12:29:19 +0000