summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* server: use topologysuffix name in iparepltopomanagedsuffixJan Cholasta2015-12-013-7/+103
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Upgrade: increase time limit for upgradesMartin Basti2015-12-014-34/+57
| | | | | | | | | | | | | | | | Default ldap search limit is now 30 sec by default during upgrade. Limits must be changed for the whole ldap2 connection, because this connection is used inside update plugins and commands called from upgrade. Together with increasing the time limit, also size limit should be unlimited during upgrade. With sizelimit=None we may get the TimeExceeded exception from getting default value of the sizelimit from LDAP. https://fedorahosted.org/freeipa/ticket/5267 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* FIX: ipa_kdb_principals: add missing break statementMartin Basti2015-11-301-0/+1
| | | | | | | Needs a 'break' otherwise prevents correct reporting of data and it always overrides it with the placeholder data. Reviewed-By: Simo Sorce <ssorce@redhat.com>
* use starttls in CSReplicationManager connection againPetr Vobornik2015-11-301-1/+1
| | | | | | | | | | | | | | | | | commit 2606f5aecd6ac0db31abb515b691529bb7eaf14e has: - realm, hostname, dirman_passwd, port, starttls=True) + realm, hostname, dirman_passwd, port) In CSReplicationManager which causes, e.g.: ipa-csreplica-manage -p Secret123 list ipa.example.com cannot connect to 'ldaps://ipa.example.com:389': TLS error -5938:Encountered end of file Reviewed-By: Tomas Babej <tbabej@redhat.com>
* custodia: Make sure container is created with first custodia replicaTomas Babej2015-11-301-0/+15
| | | | | | | | | | If a first 4.3+ replica is installed in the domain, the custodia container does not exist. Make sure it is created to avoid failures during key generation. https://fedorahosted.org/freeipa/ticket/5474 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-kra-install: error when replica file is passed with domain level > 0Martin Basti2015-11-271-4/+4
| | | | | | | | | | installing kra on promoted replica (domain level > 0) does not require replica file. https://fedorahosted.org/freeipa/ticket/5455 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* KRA install: show installation message only if install really startedMartin Basti2015-11-271-6/+3
| | | | | | | | | | | Message that installation started/failed was shown even when install_check fail (installation itself did not start). This commit show messages only if installation started. Enhacement for https://fedorahosted.org/freeipa/ticket/5455 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-ca-install: error when replica file is passed with domain level > 0Martin Basti2015-11-271-0/+3
| | | | | | | | | | | with replica promotion (domain level > 0) there are no replica files, thus adding replica file as parameter when domain level > 0 should be disallowed. https://fedorahosted.org/freeipa/ticket/5455 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Support sourcing the IPA server name from configSimo Sorce2015-11-275-6/+132
| | | | | | | | | | Use ding-libs to parse /etc/ipa/default.conf to find the IPA server to contact by default. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2203 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* topology: treat server suffix as multivalued attribute in APIPetr Vobornik2015-11-274-5/+5
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: update topology graph after raising domain levelPetr Vobornik2015-11-272-8/+32
| | | | | | | | | | | | When topology graph was shown with domain level == 0, a view describing that domain level needs to be at least 1 was shown. If domain level is raised, this view is then properly replaced by the graph when shown again. https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: remove segments on topology graph pagePetr Vobornik2015-11-271-2/+81
| | | | | | https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add segments on topology graph pagePetr Vobornik2015-11-272-4/+151
| | | | | | https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: topology graph facetPetr Vobornik2015-11-276-3/+367
| | | | | | https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: topology graph componentPetr Vobornik2015-11-274-3/+428
| | | | | | https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add d3 library - version 3.5.6Petr Vobornik2015-11-274-0/+41
| | | | | | prerequisite for: https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: allow to update action_state directlyPetr Vobornik2015-11-271-2/+9
| | | | | | prerequisite for: https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: extract header and action logic from facet to separate mixinsPetr Vobornik2015-11-274-0/+321
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Into: * ActionMixin * HeaderMixin It is supposed to be used as a mixin classes to facet.Facets. In long term it should replace/serve as a base class for facet.facet. e.g: var SomeFacet = declare([Facet, ActionMixin, HeaderMixin], { foo: function() {} }); Then following spec can be used: some_facet_spec = { name: 'some', label: 'Some Facet', tab_label: 'Some Facet', facet_groups: [foo.bar_facet_group], facet_group: 'search', actions: ['refresh'], control_buttons: [ { name: 'refresh', label: '@i18n:buttons.refresh', icon: 'fa-refresh' } ], header_actions: [refresh] }; reg.facet.register({ type: 'some', ctor: SomeFacet, spec: some_facet_spec }); prerequisite for: https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: split facet header into two classesPetr Vobornik2015-11-272-79/+144
| | | | | | | | | So that facet.simple_facet_header could be used even in pages without entity structure - e.g. future topology graph. prerequisite for: https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add Deferred/Promise API to rpc.commandPetr Vobornik2015-11-271-1/+20
| | | | | | | | so that commands could be easily chained prerequisite for: https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica promotion: modify default.conf even if DS configuration failsMartin Babinsky2015-11-271-25/+30
| | | | | | | | | | | When we promote an IPA client to replica, we need to write master-like default.conf once we start configuring directory server instance. This way even if DS configuration fails for some reason the server uninstall code can work properly and clean up partially configured replica. https://fedorahosted.org/freeipa/ticket/5417 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* mod_auth_gssapi: Remove ntlmssp support and restrict mechanism to krb5Christian Heimes2015-11-262-1/+2
| | | | | | | | | | | | | | | | By default mod_auth_gssapi allows all locally available mechanisms. If the gssntlmssp package is installed, it also offers ntlmssp. This has the annoying side effect that some browser will pop up a username/password request dialog if no Krb5 credentials are available. The patch restricts the mechanism to krb5 and removes ntlmssp and iakerb support from Apache's ipa.conf. The new feature was added to mod_auth_gssapi 1.3.0. https://fedorahosted.org/freeipa/ticket/5114 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-client-automount: Leverage IPAChangeConf to configure the domain for idmapdTomas Babej2015-11-261-5/+15
| | | | | | | | | | | | | Simple regexp substitution caused that the domain directive fell under an inapprorpiate section, if the domain directive was not present. Hence the idmapd.conf file was not properly parsed. Use IPAChangeConf to put the directive in its correct place even if it the domain directive is missing. https://fedorahosted.org/freeipa/ticket/5069 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* ipachangeconf: Add ability to preserve section caseTomas Babej2015-11-261-1/+4
| | | | | | | | | | The IPAChangeConf normallizes section names to lower case. There are cases where this behaviour might not be desirable, so provide a way to opt out. https://fedorahosted.org/freeipa/ticket/5069 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* fix a typo in replica DS creation codeMartin Babinsky2015-11-261-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* KRA: do not stop certmonger during standalone uninstallMartin Basti2015-11-261-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5477 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Compare objectclasses as case insensitive in baseuser.pyMartin Basti2015-11-251-4/+7
| | | | | | | | Objectclasses must be handled as case insensitive. https://fedorahosted.org/freeipa/ticket/5456 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-getkeytab: do not return error when translations cannot be loadedMartin Basti2015-11-251-1/+1
| | | | | | | | Only warning is shown https://fedorahosted.org/freeipa/ticket/5483 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use absolute domain in detection of A/AAAA recordsMartin Basti2015-11-252-6/+5
| | | | | | | | | | | | Python dns resolver append configured domain to queries which may lead to false positive answer. Exmaple: resolving "ipa.example.com" may return records for "ipa.example.com.example.com" if domain is configured as "example.com" https://fedorahosted.org/freeipa/ticket/5421 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Return default TL_DATA is krbExtraData is missingSimo Sorce2015-11-251-1/+10
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/937 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Call directly function is_host_resolvable instead do call via frameworkMartin Basti2015-11-251-3/+1
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Make command dns-resolve deprecated.Martin Basti2015-11-252-3/+24
| | | | | | | | | | | | | | | | | To debug DNS issues other commands should be used like 'dig', 'host', 'nslookup' instead of command 'ipa dns-resolve'. This command is executed on server side, what may not be helpful with debugging clients. 'ipa dns-resolve' command is worse copy of host command, users should use 'host' command instead. dns-resolve is removed from CLI https://fedorahosted.org/freeipa/ticket/5466 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Remove invalid error messages from topology upgradeMartin Basti2015-11-252-6/+3
| | | | | | | | | Return False does not mean that update failed, it mean that nothing has been updated, respectively ldap is up to date. https://fedorahosted.org/freeipa/ticket/5482 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* private_ccache: Harden the removal of KRB5CCNAME env variableTomas Babej2015-11-251-1/+1
| | | | | | | | | | If the code within the private_ccache contextmanager does not set/removes the KRB5CCNAME, the pop method will raise KeyError, which will cause unnecessary termination of the code flow. Make sure the KRB5CCNAME is popped out of os.environ only if present. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix upgrade of forwardzones when zone is in realmdomainsMartin Basti2015-11-251-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5472 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-2531-820/+297
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* Install: Force service add during replica promotionMartin Basti2015-11-242-2/+4
| | | | | | | | | Replica does not need to have A/AAAA records during install, so we cannot enforce it and service must be added with --force option. https://fedorahosted.org/freeipa/ticket/5420 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* do not disconnect when using existing connection to check default CA ACLsMartin Babinsky2015-11-241-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* disconnect ldap2 backend after adding default CA ACL profilesMartin Babinsky2015-11-241-0/+3
| | | | | | | | | | ensure_default_caacl() was leaking open api.Backend.ldap2 connection which could crash server/replica installation at later stages. This patch ensures that after checking default CA ACL profiles the backend is disconnected. https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add profiles and default CA ACL on migrationFraser Tweedale2015-11-249-56/+90
| | | | | | | | | | | | | | | | | | | | Profiles and the default CA ACL were not being added during replica install from pre-4.2 servers. Update ipa-replica-install to add these if they are missing. Also update the caacl plugin to prevent deletion of the default CA ACL and instruct the administrator to disable it instead. To ensure that the cainstance installation can add profiles, supply the RA certificate as part of the instance configuration. Certmonger renewal setup is avoided at this point because the NSSDB gets reinitialised later in installation procedure. Also move the addition of the default CA ACL from dsinstance installation to cainstance installation. Fixes: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Do not erroneously reinit NSS in Dogtag interfaceFraser Tweedale2015-11-241-1/+2
| | | | | | | | | | The Dogtag interface always attempts to (re)init NSS, which can fail with SEC_ERROR_BUSY. Do not reinitialise NSS when it has already been initialised with the given dbdir. Part of: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-otptoken-import: Fix connection to ldap.David Kupka2015-11-231-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5475 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-cacert-renew: Fix connection to ldap.David Kupka2015-11-231-17/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/5468 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipasam: fix a use-after-free issueSumit Bose2015-11-231-1/+2
| | | | | | | Since endptr points to a location inside of dummy, dummy should be freed only after dereferencing endptr. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipasam: use more restrictive search filter for group lookupSumit Bose2015-11-231-1/+3
| | | | | | | | | | | Since we are interested in looking up the SID of a group it makes sense to include the objectclass which contains the SID attribute in the search filter. This makes sure the group is not accidentally found a second time in the compat tree. Related to https://fedorahosted.org/freeipa/ticket/5457 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipasam: fix wrong usage of talloc_new()Sumit Bose2015-11-231-1/+1
| | | | | | Fixes https://fedorahosted.org/freeipa/ticket/5457 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Check if IPA is configured before attempting a winsync migrationGabe2015-11-231-1/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5470 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* update idrange tests to reflect disabled modification of local ID rangesMartin Babinsky2015-11-231-24/+10
| | | | | | | | Fix for https://fedorahosted.org/freeipa/ticket/4826 temporarily disallowed modification of local ID ranges via API calls The corresponding XMLRPC tests were updated to reflect this change. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* remove forgotten print in DNS pluginMartin Basti2015-11-231-1/+0
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Avoid race condition caused by profile delete and recreateFraser Tweedale2015-11-231-2/+1
| | | | | | | | | | | | | | | When importing IPA-managed certificate profiles into Dogtag, profiles with the same name (usually caIPAserviceCert) are removed, then immediately recreated with the new profile data. This causes a race condition - Dogtag's LDAPProfileSystem profileChangeMonitor thread could observe and process the deletion after the profile was recreated, disappearing it again. Update the profile instead of deleting and recreating it to avoid this race condition. Fixes: https://fedorahosted.org/freeipa/ticket/5269 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2024-08-07 20:51:52 +0000