summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Coverity: removed useless semicolon which ends statement earlierPavel Vomacka2017-01-181-2/+2
| | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Coverity: Fix possibility of access to attribute of undefinedPavel Vomacka2017-01-181-1/+1
| | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* SPEC: Fix build in mockLukas Slebodnik2017-01-181-2/+13
| | | | | | | | | | | | | | | | | | | Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* CONFIGURE: Update help message for jslintLukas Slebodnik2017-01-181-4/+5
| | | | | | | | Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* CONFIGURE: Fix detection of pylintLukas Slebodnik2017-01-181-9/+11
| | | | | | | | | | | | If configure script was executed with --enable-pylint then it behaved the same as --disable-pylint. It does not make any sense. Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix for handling CalledProcessError in authconfigAbhijeet Kasurde2017-01-182-3/+16
| | | | | | | | | | | NIS configuration error should be hidden from user while running ipa-client-install Fixes https://fedorahosted.org/freeipa/ticket/5244 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix coverity issueTomas Krizek2017-01-161-1/+2
| | | | | | | A code path exists, where principal_obj is None. Add check principal_obj is not None to avoid dereferencing it. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipapython: Add dependencies on version.pyChristian Heimes2017-01-161-0/+2
| | | | | | | | | | | | install-exec and bdist_wheel also depend on version.py. Let's ensure that version.py is correctly generated when installing or building packages. Yes, make is clever and correctly merges dependencies with rules from included make files. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* cainstance: do not configure renewal guardJan Cholasta2017-01-162-39/+15
| | | | | | | | | | Do not configure renewal guard for dogtag-ipa-renew-agent, as it is not used in IPA anymore. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dogtaginstance: track server certificate with our renew agentJan Cholasta2017-01-162-3/+3
| | | | | | | | | | Track Dogtag's server certificate with dogtag-ipa-ca-renew-agent instead of dogtag-ipa-renew-agent. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* renew agent: handle non-replicated certificatesJan Cholasta2017-01-161-9/+16
| | | | | | | | | | | In addition to replicated certificates (Dogtag certificates, RA certificate), handle non-replicated certificates in dogtag-ipa-ca-renew-agent as well. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pytest: set rules to find test files and functionsChristian Heimes2017-01-121-6/+10
| | | | | | | | | 1e06a5195bafe0224d77371987f2509f5508ca2f removed pytest.ini. Without the ini file, pytest 3.x has suboptimal settings and no longer picks up all test functions and test files. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Remove duplicated step from DS installMartin Basti2017-01-121-2/+0
| | | | | | | "Adding SASL mappings.." is duplicated step in __common_setup in DS instance and should be removed. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Generate sha256 ssh pubkey fingerprints for hostsStanislav Laznicka2017-01-127-12/+13
| | | | | | | | Replace md5 with sha256 for host ssh pubkey fingerprints https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* disable hostname canonicalization by Kerberos libraryMartin Babinsky2017-01-111-0/+1
| | | | | | | | | | | | | | | | By default, Kerberos client library attempts to canonicalize service hostname in TGS requests. This can fail e.g. if hosts file on the client machine references short names before FQDNs. In this case the short name is used in TGS_REQ which KDC fails to resolve. Since we do not (yet) support referencing hosts by their short names it is safe to just disable this behavior in krb5.conf and use supplied FQDNs. https://fedorahosted.org/freeipa/ticket/6584 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Add sanity checks for use of --ca-subject and --subject-baseFraser Tweedale2017-01-112-0/+12
| | | | | | | | | | Print an error and terminate if --ca-subject or --subject-base are used when installing a CA-less master or when performing standalone installation of a CA replica. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Indicate that ca subject / subject base uses LDAP RDN orderFraser Tweedale2017-01-114-8/+14
| | | | | | | | Update man pages and help output to indicate that --subject-base and --ca-subject options interpret their arguments in LDAP order. Fixes: https://fedorahosted.org/freeipa/ticket/6455 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-1113-98/+198
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Reuse self.api when executing ca_enabled_checkFraser Tweedale2017-01-113-21/+21
| | | | | | | | | | | | | | The ca_enabled_check function is a wrapper around api.Command.ca_is_enabled. When using remote_api (e.g. during installer), ca_enabled_check invokes the *global* api instead of the remote_api. Update ca_enabled_check to explicitly receive an api object from the caller and invoke Command.ca_is_enabled through it. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dsinstance: extract function for writing certmap.confFraser Tweedale2017-01-112-6/+14
| | | | | | | | | | | | | | | | For full customisability of the IPA CA subject DN, we will need the ability to update DS `certmap.conf' when upgrading a deployment from CA-less to CA-ful. Extract the existing behaviour, which is private to DsInstance, to the `write_certmap_conf' top-level function. Also update `certmap.conf.template' for substition of the whole CA subject DN (not just the subject base). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-ca-install: add missing --subject-base optionFraser Tweedale2017-01-112-4/+16
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Extract function for computing default subject baseFraser Tweedale2017-01-116-11/+16
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installer: rename --subject to --subject-baseFraser Tweedale2017-01-115-22/+23
| | | | | | | | | | | | The --subject option is actually used to provide the "subject base". We are also going to add an option for fully specifying the IPA CA subject DN in a subsequent commit. So to avoid confusion, rename --subject to --subject-base, retaining --subject as a deprecated alias. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installutils: remove hardcoded subject DN assumptionFraser Tweedale2017-01-113-6/+12
| | | | | | | | | | | | `installutils.load_external_cert` assumes that the IPA CA subject DN is `CN=Certificate Authority, {subject_base}`. In preparation for full customisability of IPA CA subject DN, push this assumption out of this function to call sites (which will be updated in a subsequent commit). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor and relocate set_subject_base_in_configFraser Tweedale2017-01-112-23/+10
| | | | | | | | | | | | | Refactor set_subject_base_in_config to use api.Backend.ldap2 instead of a manually created LDAP connection. Also rename the function to have a more accurate name, and move it to 'ipaserver.install.ca' to avoid cyclic import (we will eventually need to use it from within that module). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: enable py3 pylintMartin Basti2017-01-111-1/+2
| | | | | | We should run pylint in both python2 and python3 versions Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Travis CI: actually return non-zero exit status when the test job failsMartin Babinsky2017-01-091-1/+5
| | | | | | | The original code did not actually propagate the test runner exit status to parent process so Travis CI job was always green. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipaclient: schema cache: Handle malformed server info data gracefullyDavid Kupka2017-01-091-2/+8
| | | | | | | | | | | As a part of CLI schema cache some data about each previously contacted server are stored in simple JSON file. The file may get corrupted and became undecodable for various reasons (parallel access, file system error, tampering). Since the data are not necessary we should just warn an continue. https://fedorahosted.org/freeipa/ticket/6578 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Py3: Fix ToASCII methodMartin Basti2017-01-063-14/+19
| | | | | | | | | | | in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix used before assignment bug in host_port_open()Christian Heimes2017-01-061-2/+2
| | | | | | | Detected by most recent pylint under Python 3.5. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_generate_password algorithm changePetr Spacek2017-01-0611-59/+106
| | | | | | | | | | | | | | | | A change to the algorithm that generates random passwords for multiple purposes throught IPA. This spells out the need to assess password strength by the entropy it contains rather than its length. This new password generation should also be compatible with the NSS implementation of password requirements in FIPS environment so that newly created databases won't fail with wrong authentication. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Unify password generation across FreeIPAStanislav Laznicka2017-01-066-18/+8
| | | | | | | | | | | | Also had to recalculate entropy of the passwords as originally, probability of generating each character was 1/256, however the default probability of each character in the ipa_generate_password is 1/95 (1/94 for first and last character). https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Change activity text while loading metadataPavel Vomacka2017-01-054-0/+10
| | | | | | | | | | | | After log in into webui there was 'Authenticating' sign even during loading metadata. Now while data are loading there is 'Loading data' text. This change requires new global topic 'set-activity' of activity widget. So for now there is possibility to change every activity string during running phase just by publishing 'set-activity' topic and setting new text as first parameter. Part of: https://fedorahosted.org/freeipa/ticket/6144 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Refactoring of rpc modulePavel Vomacka2017-01-056-73/+152
| | | | | | | | | | | | | | | | | | | | | | The rpc module is now separated from display layer. There are two new global topics: - 'rpc-start' for showing the widget which indicates execution of rpc calls - 'rpc-end' for hiding the widget which indicates execution of rpc calls. These two global topics replace the original methods IPA.display_activity_icon() and IPA.hide_activity_icon(). There is also new property of a command (notify_globally), which allows to turn off the widget which indicates network activity. Instead of classic activity indicator there can be called custom function at the beginning and at the end of network activity. There are also changes in internal communication in rpc.js module. There are four new events, two for calling on_success and on_error methods and two for calling custom functions at the beginning and at the end of network activity. https://fedorahosted.org/freeipa/ticket/6144 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: update Patternfly and BootstrapPavel Vomacka2017-01-054-8/+11
| | | | | | | | | | | | Current versions: PatternFly: 3.9.0 Boostrap: 3.3.7 Bootstrap-select: 1.4.3 Font-Awesome: 4.0.3 https://fedorahosted.org/freeipa/ticket/6394 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* schema_cache: Make handling of string compatible with python3David Kupka2017-01-051-9/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/6559 Reviewed-By: Martin Basti <mbasti@redhat.com>
* client, platform: Use paths.SSH* instead of get_config_dir().Timo Aaltonen2017-01-054-37/+17
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ca: fix ca-find with --pkey-onlyJan Cholasta2017-01-051-3/+7
| | | | | | | | | | | | | | Since commit 32b1743e5fb318b226a602ec8d9a4b6ef2a25c9d, ca-find will fail with internal error if --pkey-only is specified, because the code to look up the CA certificate and certificate chain assumes that the ipaCAId attribute is always present in the result. Fix this by not attempting to lookup the certificate / chain at all when --pkey-only is specified. https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Use pytest conftest.py and drop pytest.iniChristian Heimes2017-01-058-42/+90
| | | | | | | | | | | | | | Let's replace some ugly hacks with proper pytest conftest.py hooks. Test initialization of ipalib.api is now handled in pytest_cmdline_main(). Pytest plugins, markers and ignores are also moved into conftest.py. Additional guards make it possible to run tests without ipaserver installed. I added confcutdir to ensure that pytest does not leave our project space. Pytest used pytest.ini or setup.py before but pytest.ini is gone. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Catch ValueError raised by pytest.config.getoption()Christian Heimes2017-01-052-3/+5
| | | | | | pytest.config.getoption() can raise ValueError for unknown options, too. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Trim the test runner log to show only pytest failures/errorsMartin Babinsky2017-01-052-1/+18
| | | | | | | | | | | | If we get to the `run-tests` phase, we no longer care about messages from previous steps so we can truncate the log output to only show pytest failures/errors, reducing log size. As a fallback, the previous behaviour to print last 5000 log lines was kept in the case the CI tests fail during setup. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Add license headers to the files used by Travis CIMartin Babinsky2017-01-052-1/+9
| | | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Travis CI: use specific Python version during buildMartin Babinsky2017-01-052-1/+4
| | | | | | | | This is a preparatory work for the future requirement of running Python2/3 jobs simultaneously. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* introduce install step to .travis.yml and cache pip installsMartin Babinsky2017-01-051-1/+2
| | | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* split out lint to a separate Travis jobMartin Babinsky2017-01-051-5/+10
| | | | | | | | | | In order to speed our Travis CI gating even further, the lint step has been split to a separate job that can be run in parallel with the test runs. The test runs are in turn launched in developer mode to speed them up. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Travis: offload test execution to a separate scriptMartin Babinsky2017-01-051-16/+1
| | | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Travis CI: a separate script to run test tasksMartin Babinsky2017-01-051-0/+34
| | | | | | | | | | | | | | | | this script is intended only for use in Travis CI and contains configuration of the test run requested: * it can run linter step separately by specifying TASK_TO_RUN="lint" environment variable in .travis.yml. In this case it also runs pep8 checker on the commits in PR. * other steps are run in developer mode in order to skip pylint run and speed up the task * in all cases the CI result log is populated and can be displayed if the job fails Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Put the commands informing and displaying build logs on single lineMartin Babinsky2017-01-051-4/+2
| | | | | | | | This prevents Travis log collector to add separate expansion marks to the echo output and the actuall log output. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* travis: mark FreeIPA as python projectMartin Babinsky2017-01-051-0/+1
| | | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Bump up ipa-docker-test-runner versionMartin Babinsky2017-01-051-1/+1
| | | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 21:01:57 +0000