summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* certdb: Don't restore_context() of new NSSDBChristian Heimes2017-03-011-5/+1
| | | | | | | | | | | It's not necesary to restore the context of newly created files. SELinux ensures that new files have the correct permission. An explicit restore_context() is only required when either policies have changed or the context was changed manually. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* test_config: fix fips_mode key in EnvTomas Krizek2017-03-011-2/+2
| | | | | | | | | Setting fips_mode to object would fail if ipaplatform.tasks module wasn't present. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Env __setitem__: replace assert with exceptionTomas Krizek2017-03-011-1/+2
| | | | | | Use exception to make debugging issues easier. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Finish port to PyCA cryptographyChristian Heimes2017-03-013-36/+60
| | | | | | | | | | * add missing default_backend * unpad encrypted data * use cryptography's hashes and HMAC construct * remove hard dependency on python-nss from setup.py Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Migrate OTP import script to python-cryptographyNathaniel McCallum2017-03-012-124/+80
| | | | | | https://fedorahosted.org/freeipa/ticket/5192 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Drop in-memory copy of schema zip fileChristian Heimes2017-03-011-31/+18
| | | | | | | | | | | The schema cache used a BytesIO buffer to read/write schema cache before it got flushed to disk. Since the schema cache is now loaded in one go, the temporary buffer is no longer needed. File locking has been replaced with a temporary file and atomic rename. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Speed up client schema cacheChristian Heimes2017-03-011-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | It's inefficient to open a zip file over and over again. By loading all members of the schema cache file at once, the ipa CLI script starts about 25 to 30% faster for simple cases like help and ping. Before: $ time for i in {1..20}; do ./ipa ping >/dev/null; done real 0m13.608s user 0m10.316s sys 0m1.121s After: $ time for i in {1..20}; do ./ipa ping >/dev/null; done real 0m9.330s user 0m7.635s sys 0m1.146s https://fedorahosted.org/freeipa/ticket/6690 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Define template version in certmap.confFlorence Blanc-Renaud2017-03-012-1/+8
| | | | | | | | | | | | | | | | | | | | A previous commit (ffb9a09a0d63f7edae2b647b5c1d503d1d4d7a6e) removed the definition of VERSION 2 in certmap.conf.template. ipa-server-upgrade tool compares the template version with the version in certmap.conf. As VERSION is not defined in either file, it concludes that version = 0 for both and does not make a backup of certmap.conf even though it prints that it will. The fix re-defines VERSION in the template and adapts the code because the template has changed (it is using $ISSUER_DN instead of CN=Certificate Authority,$SUBJECT_BASE). The fix also logs an error when a template file is not versioned. https://fedorahosted.org/freeipa/ticket/6354 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Tests: Basic coverage with tree root domainGanna Kaihorodova2017-03-011-1/+90
| | | | | | | | Extend existing legacy client tests to cover test cases with tree root domain. https://fedorahosted.org/freeipa/ticket/6489 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* C compilation fixes and hardeningChristian Heimes2017-03-012-0/+4
| | | | | | | | | | | | | | | | Fix "implicit declaration of function ‘strlen’" in ipa_pwd_ntlm.c, credits to Lukas. Add -Werror=implicit-function-declaration to CFLAGS to point developers to missing includes. It causes compilation to fail when a developer forgets to add a required include. The problem is no longer hidden in a massive wall of text from make. Silence a harmless error from 389-DS slapi.h until the bug is fixed in downstream, https://pagure.io/389-ds-base/issue/48979 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-0124-431/+347
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added a PEMFileHandler for Custodia storeStanislav Laznicka2017-03-011-0/+61
| | | | | | | | | This is a preparation step to be able to handle sending RA agent certificate over Custodia during domain level 1 replica installation. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor certmonger for OpenSSL certificatesStanislav Laznicka2017-03-016-97/+93
| | | | | | | | | | Currently, it was only possible to request an NSS certificate via certmonger. Merged start_tracking methods and refactored them to allow for OpenSSL certificates tracking. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Workaround for certmonger's "Subject" representationsStanislav Laznicka2017-03-012-1/+16
| | | | | | | | | | | | | | | | If an OpenSSL certificate is requested in Certmonger (CERT_STORAGE == "FILE") the "Subject" field of such Certificate is ordered as received. However, when an NSS certificate is requested, the "Subject" field takes the LDAP order (components get reversed). This is a workaround so that the behavior stays the same. The workaround should be removed when https://pagure.io/certmonger/issue/62 gets fixed. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove ipapython.nsslib as it is not used anymoreStanislav Laznicka2017-03-011-344/+0
| | | | | | | | | | Previous changes allowed the removal of nsslib. So long, and thanks for all the fish. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from otptoken pluginStanislav Laznicka2017-03-011-7/+6
| | | | | | | | | Replace NSSConnection with httplib.HTTPSConenction to be able to remove NSSConnection for good. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove pkcs12 handling functions from CertDBStanislav Laznicka2017-03-013-25/+24
| | | | | | | | | | These functions don't require anything from the CertDB instance, move them out so no needless instantiation of CertDB is performed in order to use them. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from DogtagStanislav Laznicka2017-03-015-63/+42
| | | | | | | | | | | | | Replaced NSSConnection with Python's httplib.HTTPSConnection. This class is OpenSSL-based. A client certificate with a private key is required to authenticate against the certificate server. We facilitate the RA_AGENT_PEM which already exists. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move publishing of CA cert to cainstance creation on masterStanislav Laznicka2017-03-012-6/+9
| | | | | | | | | IPAHTTPSConnection which is set up first time in certificate profiles migration to LDAP requires CA cert to be stored in a file. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Don't run kra.configure_instance if not necessaryStanislav Laznicka2017-03-012-41/+39
| | | | | | | | | | | | | | | | | | If kra should not be set up, don't run the code as it would only prolong the installations. Previously, krainstance configuration would be performed just to export the client certificate and private key to authenticate to certificate server. This is now performed somewhere else therefore there's no need to run KRAInstance.configure_instance. The kra.install() method still performs actions on replicas and we're keeping it in server installer to conform to the installers design. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move RA agent certificate file export to a different locationStanislav Laznicka2017-03-018-19/+17
| | | | | | | | | | | | HTTPS connection to certificate server requires client authentication so we need a file with client certificate and private key prior to its first occurence which happens during migration of certificate profiles to LDAP. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from the Python RPC moduleStanislav Laznicka2017-03-014-57/+169
| | | | | | | | | | | | | | | | | | | | NSSConnection was causing a lot of trouble in the past and there is a lot of logic around it just to make it not fail. What's more, when using NSS to create an SSL connection in FIPS mode, NSS always requires database password which makes the `ipa` command totally unusable. NSSConnection is therefore replaced with Python's httplib.HTTPSConnection which is OpenSSL based. The HTTPSConnection is set up to handle authentication with client certificate for connections to Dogtag server as RA agent. It allows to handle client cert/private key in separate files and also encrypted private key files. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix ipa.service unit re. gssproxyFlorence Blanc-Renaud2017-03-011-1/+1
| | | | | | | | | | | | | ipa.service unit defines Requires=gssproxy. Because of this, during ipa-server-upgrade, the restart of gssproxy triggers a restart of ipa unit (hence stopping LDAP server and breaking the connection api.Backend.ldap2). Calls using this connection after gssproxy restart fail and ipa-server-upgrade exits on failure. The fix defines Wants=gssproxy to avoid the restart of ipa.service https://fedorahosted.org/freeipa/ticket/6705 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ca: correctly authorise ca-del, ca-enable and ca-disableFraser Tweedale2017-02-281-2/+14
| | | | | | | | | | | | | | | | | | | | CAs consist of a FreeIPA and a corresponding Dogtag object. When executing ca-del, ca-enable and ca-disable, changes are made to the Dogtag object. In the case of ca-del, the corresponding FreeIPA object is deleted after the Dogtag CA is deleted. These operations were not correctly authorised; the FreeIPA permissions are not checked before the Dogtag operations are executed. This allows any user to delete, enable or disable a lightweight CA (except the main IPA CA, for which there are additional check to prevent deletion or disablement). Add the proper authorisation checks to the ca-del, ca-enable and ca-disable commands. https://pagure.io/freeipa/issue/6713 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Support encrypted private keysBen Lipton2017-02-282-4/+15
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Allow overriding the CSR generation profileBen Lipton2017-02-281-1/+12
| | | | | | | | | | In case users want multiple CSR generation profiles that work with the same dogtag profile, or in case the profiles are not named the same, this flag allows specifying an alternative CSR generation profile. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Automate full cert request flowBen Lipton2017-02-282-2/+79
| | | | | | | | | | | | | | | | | Allows the `ipa cert-request` command to generate its own CSR. It no longer requires a CSR passed on the command line, instead it creates a config (bash script) with `cert-get-requestdata`, then runs it to build a CSR, and submits that CSR. Example usage (NSS database): $ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --database /tmp/certs Example usage (PEM private key file): $ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --private-key /tmp/key.pem https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* added ssl verification using IPA trust anchorThorsten Scherf2017-02-271-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6686 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Remove md5_fingerprints from IPAStanislav Laznicka2017-02-2313-40/+2
| | | | | | | | | | MD5 is a grandpa and FIPS does not like it at all. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* lite-server: validate LDAP connection and cache schemaChristian Heimes2017-02-231-2/+32
| | | | | | | | | The LDAP schema cache makes the lite-server behave more like mod_wsgi. See https://fedorahosted.org/freeipa/ticket/6679 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* added help about default value for --external-ca-type optionThorsten Scherf2017-02-231-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* compat: fix `Any` params in `batch` and `dnsrecord`Jan Cholasta2017-02-238-8/+8
| | | | | | | | | The `methods` argument of `batch` and `dnsrecords` attribute of `dnsrecord` were incorrectly defined as `Str` instead of `Any`. https://fedorahosted.org/freeipa/ticket/6647 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove DM password files after successfull pkispawn runStanislav Laznicka2017-02-234-13/+52
| | | | | | | https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove ra_db argument from CAInstance initStanislav Laznicka2017-02-233-28/+14
| | | | | | | | | | | | The ra_db argument to CAInstance init is a constant so it can be removed. This constant corresponds to the default CertDB directory and since CertDB now passes passwords to its inner NSSDatabase instance we do need to care about having our own run_certutil() method. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Update Contributors.txtMartin Kosek2017-02-232-2/+13
| | | | | | | | Update mailmap with the new mistyped authors and generate a new Contributors list. Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix ipa-server-upgradeStanislav Laznicka2017-02-231-1/+2
| | | | | | | | | Running ipa-server-upgrade would fail to stop ipa_memcached if it's already uninstalled. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use newer Certificate.serial_number in krainstance.pyStanislav Laznicka2017-02-231-1/+1
| | | | Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* use the methods of the parent class to retrieve CIFS kerberos keysMartin Babinsky2017-02-221-19/+11
| | | | | | | | | | | | adtrustinstance will now use parent's methods to retrieve keys for CIFS principal. Since the keys are appended to the host keytab (/etc/krb5.keytab) we need to make sure that only the stale CIFS keys are purged from the file and that we do not re-set its ownership. https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* httpinstance: re-use parent's methods to retrieve anonymous keytabMartin Babinsky2017-02-221-1/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make request_service_keytab into a public methodMartin Babinsky2017-02-223-5/+5
| | | | | | | | | | a cosmetic change: we had private method comprising of calls to public ones, which did not make much sense in our case https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* allow for more flexibility when requesting service keytabMartin Babinsky2017-02-221-15/+26
| | | | | | | | | | | | | The service installers can now override the methods for cleaning up stale keytabs and changing file ownership of the newly acquired keytabs. The default actions should be usable by most installers without specific overriding. https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove non-sensical kdestroy on https stopSimo Sorce2017-02-224-3/+3
| | | | | | | | | | | | | | This kdestroy runs as root and wipes root's own ccachs ... this is totally inappropriate. Use a file ccache that ends up in the private tmp, so that if the service is restarted the file is automatically removed. https://fedorahosted.org/freeipa/ticket/6673 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add --without-ipatests optionChristian Heimes2017-02-222-10/+28
| | | | | | | | | | --without-ipatests skips building and installation of the ipatests package. By default the ipatests package is always build and installed by make install. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add missing include of stdint.h for uint8_tChristian Heimes2017-02-221-0/+1
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa_pwd: remove unnecessary dependency on dirsrv pluginsLukas Slebodnik2017-02-222-1/+3
| | | | | | | | "dirsrv/slapi-plugin.h" is unnecessary for build of ipa_pwd. This patch allow us to move DIRSRV to daemon only dependencies Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Client-only builds with --disable-serverChristian Heimes2017-02-223-127/+172
| | | | | | | https://fedorahosted.org/freeipa/ticket/6517 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix session logoutSimo Sorce2017-02-222-5/+5
| | | | | | | | | | | There were 2 issues with session logouts, one is that the logout_cookie was checked and acted on in the wrong place, the other is that the wrong value was set in the IPASESSION header. Fixes https://fedorahosted.org/freeipa/ticket/6685 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* scripts, tests: explicitly set confdir in the rest of server codeJan Cholasta2017-02-2213-15/+37
| | | | | | | | | | | Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir setting to api.bootstrap() calls of a randomly selected portion of server-side scripts and tests. This commit adds it to the rest of server-side code for consistency. https://fedorahosted.org/freeipa/ticket/6389 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* FIPS: perform replica installation checkTomas Krizek2017-02-211-0/+22
| | | | | | | | | | | Check status of remote server's FIPS mode and proceed with installation only if it matches the current replica's FIPS mode. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replicainstall: add context manager for rpc clientTomas Krizek2017-02-211-11/+22
| | | | | | | | Abstract creating rpc client into a context manager to allow re-use. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-28 01:29:25 +0000