summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add support for searching policies in cn=accountspwdpolicySimo Sorce2017-01-253-6/+17
| | | | | | | | | | Use the new multibase search to collect policies from multiple subtrees. The 'any' parameter is set to 'true' so the search stop when the first result is found in any of the bases. https://fedorahosted.org/freeipa/ticket/6568 Signed-off-by: Simo Sorce <simo@redhat.com>
* Add code to retrieve results from multiple basesSimo Sorce2017-01-252-0/+113
| | | | | | | | Internally performs multiple seraches as needed based on the basedn strings passed in and whether the caller indicated that any result is ok or all results are needed. Signed-off-by: Simo Sorce <simo@redhat.com>
* cert: fix search limit handling in cert-findJan Cholasta2017-01-241-4/+17
| | | | | | | | | | | | | | If search limits are not specified in cert-find, use the configured limits. This applies to the certificate search in the CA as well. Detect and report if size limit was exceeded in the certificate search in the CA. Do not apply limits to the internal ca-find call. https://fedorahosted.org/freeipa/ticket/6564 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* dogtag: search past the first 100 certificatesJan Cholasta2017-01-241-1/+1
| | | | | | | | | | | | | Dogtag requires a size limit to be specified when searching for certificates. When no limit is specified in the dogtag plugin, a limit of 100 entries is assumed. As a result, an unlimited certificate search returns data only for a maximum of 100 certificates. Raise the "unlimited" limit to the maximum value Dogtag accepts. https://fedorahosted.org/freeipa/ticket/6564 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* py3: decode bytes for json.loads()Martin Basti2017-01-245-6/+59
| | | | | | | | | | | | In py 3.5 json.loads requires to have string as input, all bytes must be decoded. Note: python 3.6 supports bytes for json.loads() https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dogtag.py: fix exception logging of JSON dataMartin Basti2017-01-241-4/+8
| | | | | | | | 'read_ca' and 'create_ca' have no logging when exception happened and it masks real reason why it failed. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: convert_attribute_members: don't use bytes as parameter for DNMartin Basti2017-01-241-1/+1
| | | | | | | | | | due perfomance improvement in e4930b3235e5d61d227a7e43d30a8feb7f35664d we have to decode value before it can be used in DN() constructor. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: make_filter_from_attr: use string instead of bytesMartin Basti2017-01-241-1/+2
| | | | | | | | | | Method escape_filter_chars() requires string as parameter instead of bytes. 'value_to_utf8' returns bytes thus this code has to be removed. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: __add_acl: use standard ipaldap methodsMartin Basti2017-01-241-8/+5
| | | | | | | | | | Using raw pyldap interface we have to keep vaules as bytes. Is easier to migrate to ipaldap and use strings without decoding and encoding. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: add_entry_to_group: attribute name must be string not bytesMartin Basti2017-01-241-1/+1
| | | | | | | | | With bytes as attribute name pyldap raises type error https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: HTTPResponse has no 'dict' attribute in 'msg'Martin Basti2017-01-241-1/+1
| | | | | | | | | | There is no 'dict' attribute in 'msg', but 'msg' attribute is dict-like object in both py2/3, so it can be used instead. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: _httplib_request: don't convert string to bytesMartin Basti2017-01-241-3/+1
| | | | | | | | | | | There is no need to encode hostname to bytes. UTF-8 characters must be encoded in different format in URL anyway and it causes only error in Py3. String must be unicode to support Py2. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: cainstance: replace mkstemp with NamedTemporaryFileMartin Basti2017-01-241-24/+25
| | | | | | | | | | | With Python3 files must be opened in textual mode to write text, and best practise is to use fileobject instead fo os.write() and manual encodig https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: write CA/KRA config into file opened in text modeMartin Basti2017-01-242-2/+2
| | | | | | | | | | config parser writes data as text so CA/KRA should be opened in textual mode otherwise type errors are raised from installer https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: CA/KRA: config parser requires stringMartin Basti2017-01-242-2/+4
| | | | | | | | | | basedn is DN object it has to be converted to string before it can be used with config parser https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: ipautil: open tempfiles in text modeMartin Basti2017-01-241-2/+2
| | | | | | | | | | Code in ipautlis works with text, so tempfiles should be open in textmode otherwise TypeErrors are raised https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: ldap modlist must have keys as string, not bytesMartin Basti2017-01-241-1/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: open temporary ldif file in text modeMartin Basti2017-01-241-2/+3
| | | | | | | | | | | | ldif parser uses file in text mode, so we have to open it in text mode in py3 Also values passed to parser should be bytes https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: service.py: replace mkstemp by NamedTemporaryFileMartin Basti2017-01-242-4/+5
| | | | | | | | | | NamedTemporaryfile can be used in more pythonic way and file can be opened in textual mode that is required with PY3 https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: create_cert_db: write to file in a compatible wayMartin Basti2017-01-241-3/+3
| | | | | | | | | | Py3 expect bytes to be writed using os.write. Instead of that using io module is more pythonic. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: properly escape raw binary values in LDAP filtersJan Cholasta2017-01-241-3/+6
| | | | | | | | | | | Manually escape each byte in the value, do not use ldap.filter.escape_filter_chars() as it does not work with bytes in Python 3. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* _resolve_records: fix assert, nameserver_ip can be noneMartin Basti2017-01-241-1/+1
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Remove deprecated ipa-upgradeconfig commandAbhijeet Kasurde2017-01-245-72/+0
| | | | | | | Fixes https://fedorahosted.org/freeipa/ticket/6620 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-restore must stop tracking PKINIT cert in the preparation phaseFlorence Blanc-Renaud2017-01-201-1/+3
| | | | | | | | | | | | | ipa-restore calls certmonger to stop tracking the PKI certs, HTTP and DS certs. It must also stop tracking the newly introduced PKINIT cert (stored in /var/kerberos/krb5kdc/kdc.crt). Otherwise the restore operation ends up with PKINIT cert tracked twice and uninstallation fails. https://fedorahosted.org/freeipa/ticket/6570 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* client install: correctly report all failuresJan Cholasta2017-01-201-12/+13
| | | | | | | | | | | | | In commit 5249eb817efbb5708d097173a8d5f1e322fb201e, the client install code was converted to use exception handling instead of return codes. However, some return statements were not converted to raise statements and as a result, ipa-client-install will report success in some error conditions. Convert the return statements to raise statements to fix the issue. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* User Tracker: Test to create user with minimal valuesGanna Kaihorodova2017-01-191-0/+13
| | | | | | | | | | Test to create user with minimal values, where uid is not specified https://fedorahosted.org/freeipa/ticket/6126 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com> Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* User Tracker: creation of user with minimal valuesGanna Kaihorodova2017-01-191-11/+31
| | | | | | | | | | | | Fix provide possibility to create user-add test with minimal values, where uid is not specified, to provide better coverage. Also provide check for non-empty unicode string for attributes required in init method https://fedorahosted.org/freeipa/ticket/6126 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com> Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* Stage User: Test to create stage user with minimal valuesGanna Kaihorodova2017-01-191-0/+11
| | | | | | | | | Test to create stage user with minimal values, where uid is not specified https://fedorahosted.org/freeipa/ticket/6448 Reviewed-By: Lenka Doudova <ldoudova@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Tests: Stage User Tracker implementationGanna Kaihorodova2017-01-191-8/+30
| | | | | | | | | | | Fix provide possibility of creation stage user with minimal values, with uid not specified and check for non-empty unicode string for attributes requested in init method https://fedorahosted.org/freeipa/ticket/6448 Reviewed-By: Lenka Doudova <ldoudova@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipaplatform: Add Debian platform module.Timo Aaltonen2017-01-197-1/+365
| | | | | | | | | | | | | | | | | | | | | | | v2: - use redhat_services.redhat_system_units.copy - don't use wildcard imports - add some empty lines to make pep8 happy v3: - make parse_ipa_version static v4: - make more methods static v5: - fix pylint issues - use syntax that doesn't break with python3 v6: - remove IPA_GETKEYTAB from paths, it's the same across distros Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Tests: Add tree root domain role in legacy client testsGanna Kaihorodova2017-01-181-3/+3
| | | | | | | | | Legacy client tests inherits test cases from trust tests, that have role for tree root domain. That role was missing in legacy client tests. https://fedorahosted.org/freeipa/ticket/6600 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update warning message for ipa server uninstallAbhijeet Kasurde2017-01-181-1/+3
| | | | | | | | | | | Fix adds an additional recommendation message for taking backup of existing data and configuration before proceeding to ipa server uninstallation procedures. Fixes https://fedorahosted.org/freeipa/ticket/6548 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Clean / ignore make check artefactChristian Heimes2017-01-182-0/+8
| | | | | | | | | In tree runs of make check leave some artifacts around. The patch adds them to make clean and .gitignore. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Coverity: removed useless semicolon which ends statement earlierPavel Vomacka2017-01-181-2/+2
| | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Coverity: Fix possibility of access to attribute of undefinedPavel Vomacka2017-01-181-1/+1
| | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* SPEC: Fix build in mockLukas Slebodnik2017-01-181-2/+13
| | | | | | | | | | | | | | | | | | | Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* CONFIGURE: Update help message for jslintLukas Slebodnik2017-01-181-4/+5
| | | | | | | | Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* CONFIGURE: Fix detection of pylintLukas Slebodnik2017-01-181-9/+11
| | | | | | | | | | | | If configure script was executed with --enable-pylint then it behaved the same as --disable-pylint. It does not make any sense. Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix for handling CalledProcessError in authconfigAbhijeet Kasurde2017-01-182-3/+16
| | | | | | | | | | | NIS configuration error should be hidden from user while running ipa-client-install Fixes https://fedorahosted.org/freeipa/ticket/5244 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix coverity issueTomas Krizek2017-01-161-1/+2
| | | | | | | A code path exists, where principal_obj is None. Add check principal_obj is not None to avoid dereferencing it. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipapython: Add dependencies on version.pyChristian Heimes2017-01-161-0/+2
| | | | | | | | | | | | install-exec and bdist_wheel also depend on version.py. Let's ensure that version.py is correctly generated when installing or building packages. Yes, make is clever and correctly merges dependencies with rules from included make files. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* cainstance: do not configure renewal guardJan Cholasta2017-01-162-39/+15
| | | | | | | | | | Do not configure renewal guard for dogtag-ipa-renew-agent, as it is not used in IPA anymore. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dogtaginstance: track server certificate with our renew agentJan Cholasta2017-01-162-3/+3
| | | | | | | | | | Track Dogtag's server certificate with dogtag-ipa-ca-renew-agent instead of dogtag-ipa-renew-agent. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* renew agent: handle non-replicated certificatesJan Cholasta2017-01-161-9/+16
| | | | | | | | | | | In addition to replicated certificates (Dogtag certificates, RA certificate), handle non-replicated certificates in dogtag-ipa-ca-renew-agent as well. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pytest: set rules to find test files and functionsChristian Heimes2017-01-121-6/+10
| | | | | | | | | 1e06a5195bafe0224d77371987f2509f5508ca2f removed pytest.ini. Without the ini file, pytest 3.x has suboptimal settings and no longer picks up all test functions and test files. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Remove duplicated step from DS installMartin Basti2017-01-121-2/+0
| | | | | | | "Adding SASL mappings.." is duplicated step in __common_setup in DS instance and should be removed. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Generate sha256 ssh pubkey fingerprints for hostsStanislav Laznicka2017-01-127-12/+13
| | | | | | | | Replace md5 with sha256 for host ssh pubkey fingerprints https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* disable hostname canonicalization by Kerberos libraryMartin Babinsky2017-01-111-0/+1
| | | | | | | | | | | | | | | | By default, Kerberos client library attempts to canonicalize service hostname in TGS requests. This can fail e.g. if hosts file on the client machine references short names before FQDNs. In this case the short name is used in TGS_REQ which KDC fails to resolve. Since we do not (yet) support referencing hosts by their short names it is safe to just disable this behavior in krb5.conf and use supplied FQDNs. https://fedorahosted.org/freeipa/ticket/6584 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Add sanity checks for use of --ca-subject and --subject-baseFraser Tweedale2017-01-112-0/+12
| | | | | | | | | | Print an error and terminate if --ca-subject or --subject-base are used when installing a CA-less master or when performing standalone installation of a CA replica. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Indicate that ca subject / subject base uses LDAP RDN orderFraser Tweedale2017-01-114-8/+14
| | | | | | | | Update man pages and help output to indicate that --subject-base and --ca-subject options interpret their arguments in LDAP order. Fixes: https://fedorahosted.org/freeipa/ticket/6455 Reviewed-By: Christian Heimes <cheimes@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 00:01:16 +0000