summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix minor typosYuri Chornoivan2016-06-204-6/+6
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix listing of enabled roles in `server-find`Martin Babinsky2016-06-171-1/+4
| | | | | | | | | | | | The roles can be thought of as membership attributes so we should only list them if `--all` is specified and `--no-members` is not. Also do not show them if `--raw` is passed in. https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Martin Basti <mbasti@redhat.com>
* remove the master from managed topology during uninstallationMartin Babinsky2016-06-171-155/+27
| | | | | | | | | | In managed topology, calling `ipa-server-install --uninstall` will cause the master to remove itself from the topology by calling `server_del` behind the scenes. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-manage: use `server_del` when removing domain level 1 replicaMartin Babinsky2016-06-172-241/+22
| | | | | | | | | | | `ipa-replica-manage del` will now call `server_del` behind the scenes when a removal of replica from managed topology is requested. The existing removal options were mapped on the server_del options to maintain backwards compatibility with earlier versions. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* CI test suite for `server-del`Martin Babinsky2016-06-173-16/+339
| | | | | | | | | | | | | these tests cover various scenarios such as: * trying to remove master that would disconnect topology in one of the suffixes * forcing master removal regardless of topology state before/after removal * trying to remove last CA/DNS server/DNSSec key master * forcing removal of the last DNSSec key master https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* server-del: perform full master removal in managed topologyMartin Babinsky2016-06-176-6/+434
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements most of the del_master_managed() functionality as a part of `server-del` command. `server-del` nows performs these actions: * check topology connectivity * check that at least one CA/DNS server and DNSSec masters are left after removal * cleanup all LDAP entries/attributes exposing information about the master * cleanup master DNS records * remove master and service principals * remove master entry from LDAP * check that all segments pointing to the master were removed `server-del` now accepts the following options: * `--force`: force master removal even if it doesn't exist * `--ignore-topology-disconnect`: ignore errors arising from disconnected topology before and after master removal * `--ignore-last-of-role`: remove master even if it is last DNS server, and DNSSec key master. The last CA will *not* be removed regardless of this option. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* delegate removal of master DNS record and replica keys to separate functionsMartin Babinsky2016-06-173-6/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver module for working with managed topologyMartin Babinsky2016-06-174-52/+199
| | | | | | | | | This module should aggregate common functionality utilized in the commands managing domain-level 1 topology. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused locking "context manager"David Kupka2016-06-171-13/+0
| | | | | | Class ods_db_lock is unused since August 2015. Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: dnsserver: print specific error when DNS is not installedMartin Basti2016-06-171-0/+7
| | | | | | | | Print 'DNS is not configured' if there is no IPA DNS in domain https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Location: add list of roles and DNS servers to location-showMartin Basti2016-06-171-14/+25
| | | | | | | | | Add to output list of DNS servers which advertise location and list fo roles per server https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* upgrade: don't fail if zone does not exists in in findMartin Basti2016-06-171-1/+5
| | | | | | | In case that zone is not managed by IPA, upgrade fails with not found error. Prevent failure in this case. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: generate NTP recordsMartin Basti2016-06-172-23/+26
| | | | | | | | Move NTP records to centralized record generator https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: Rename ipalocationweight to ipaserviceweightMartin Basti2016-06-1711-36/+36
| | | | | | | | | Service weight explains better meaning of attribute than location weight, because location itself have no weight only services have. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: location-del: remove location recordMartin Basti2016-06-172-3/+43
| | | | | | | | Remove unused location records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: do not generate location records for unused locationsMartin Basti2016-06-171-4/+7
| | | | | | | | | Location records for locations without assigned servers are useless and we should not generate them. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: prevent to remove used locationsMartin Basti2016-06-171-5/+11
| | | | | | | | | User should be notified that location is used by IPA server(s) and deletion should be aborted. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: show warning if there is no DNS servers in locationMartin Basti2016-06-173-0/+37
| | | | | | | | | DNS servers must be in each location, otherwise DNS location without DNS server assigned will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: require to restart named-pkcs11 affter location changeMartin Basti2016-06-172-1/+15
| | | | | | | | | Send a warning message that named-pkcs11 service must be restarted after changes related to locations or server weight https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: set proper substitution variableMartin Basti2016-06-171-0/+20
| | | | | | | | | DNS Server (bind-dyndb-ldap) needs to have set 'idnsSubstitutionVariable;ipalocation' in ldap to the proper location https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Always qualify requests for admin in ipa-replica-conncheckFlorence Blanc-Renaud2016-06-171-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | ipa-replica-conncheck connects to the master using an SSH command: ssh -o StrictHostKeychecking=no -o UserKnownHostsFile=<tmpfile> \ -o GSSAPIAuthentication=yes <principal>@<master hostname> \ echo OK The issue is that the principal name is not fully qualified (for instance 'admin' is used, even if ipa-replica-conncheck was called with --principal admin@EXAMPLE.COM). When the FreeIPA server is running with a /etc/sssd/sssd.conf containing [sssd] default_domain_suffix = ad.domain.com this leads to the SSH connection failure because admin is not defined in the default domain. The fix uses the fully qualified principal name, and calls ssh with ssh -o StrictHostKeychecking=no -o UserKnownHostsFile=<tmpfile> \ -o GSSAPIAuthentication=yes -o User=<principal> \ <master hostname> echo OK to avoid syntax issues with admin@DOMAIN@master https://fedorahosted.org/freeipa/ticket/5812 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: dnsserver: remove config when replica is removedMartin Basti2016-06-171-0/+15
| | | | | | | | | | Configuration of DNS server should be removed together with any other information about replica https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: dnsserver: use the newer config way in installerMartin Basti2016-06-172-4/+23
| | | | | | | | | Store some parts of DNS configuration in LDAP tree instead of named.conf https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: dnsserver: put server_id option into named.confMartin Basti2016-06-176-7/+78
| | | | | | | | | | The option server_id is required for DNS location feature, otherwise it will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: dnsserver-* commandsMartin Basti2016-06-1711-58/+336
| | | | | | | | | | | | | New commands for manipulation with DNS server configuration were added: * dnsserver-show * dnsserver-mod * dnsserver-find https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/PerServerConfigInLDAP https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: dnsservers: add required objectclassesMartin Basti2016-06-171-0/+3
| | | | | | | | | | | | Objectclass: idnsServerConfigObject - stores configuration values for DNS servers Attributetype: idnsServerId - identifier of dns server (server hostname) https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: server-mod: add automatic records updateMartin Basti2016-06-172-1/+16
| | | | | | | | | For any location or server weight change is required to update records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: use automatic records update in ipa-adtrust-installMartin Basti2016-06-171-34/+11
| | | | | | | | | DNS records for adtrust is added by call dns_update_system_records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: adtrustinstance simplify dns managementMartin Basti2016-06-172-9/+7
| | | | | | | | | | The path how to get IPA domain in code was somehow obfuscated, this patch simplifies and make clear what happened there with domain name. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: use dns_update_service_records in installersMartin Basti2016-06-177-120/+45
| | | | | | | | | use the dns_update_system_records command to set proper DNS records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: command dns-update-system-recordsMartin Basti2016-06-176-4/+187
| | | | | | | | | | | | | | command dns-update-system-records updates/fixes DNS records for IPA services: * updating A, AAAA records for CA * updating SRV records for LDAP, kerberos and AD trust * updating TXT record in _kerberos with proper realm * updating dns locations if used https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: add ACI for template attributeMartin Basti2016-06-172-4/+7
| | | | | | | | | | | | | DNS Servers and DNS Administrators must have access to 'idnsTemplateAttribute' to be able set/read template for generating CNAME records pointing to proper location records. Also user must be able to add objectclass for idnsTemplateAttribute https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: permission: allow to read status of servicesMartin Basti2016-06-172-2/+9
| | | | | | | | | | | New permission was added: "System: Read Status of Services on IPA Servers" This permission is needed for detection which records should be created on which servers. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: DNS data managementMartin Basti2016-06-173-0/+383
| | | | | | | | | | | | Adding module that allows to work with IPA DNS system records: * getting system records * updating system records * work with DNS locations https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: add idnsTemplateObject objectclassMartin Basti2016-06-171-0/+2
| | | | | | | | | | | The objectclass and its related is used for generating cname records inside bind-dyndb-ldap, see design for more details https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/RecordGenerator https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: fix location-delMartin Basti2016-06-171-1/+2
| | | | | | | | | The wrong option was used https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: add index for ipalocation attributeMartin Basti2016-06-172-0/+17
| | | | | | | | | | For performace ipalocation should be indexed because it is used by referint plugin https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Require 389-ds-base >= 1.3.5.6Petr Spacek2016-06-161-3/+3
| | | | | | | | | Old DS handles LDAP filters incorrectly and breaks bind-dyndb-ldap. See https://www.redhat.com/archives/freeipa-devel/2016-June/msg00477.html https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added missing translation to automount.py methodAbhijeet Kasurde2016-06-161-12/+12
| | | | | | | Fixes: https://fedorahosted.org/freeipa/ticket/5920 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix minor typosYuri Chornoivan2016-06-164-5/+5
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Increase nsslapd-db-locks to 50000Stanislav Laznicka2016-06-151-5/+10
| | | | | | | | | | Sometimes the lock table would run out of available locks. This should improve the lock table default configuration. https://fedorahosted.org/freeipa/ticket/5914 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Fixes CA always being presented as runningStanislav Laznicka2016-06-153-4/+21
| | | | | | | | | | Even after manually stopping the pki-tomcatd service instance the service's is_running() method would still return True. https://fedorahosted.org/freeipa/ticket/5898 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: do not try to start CA if not configuredFraser Tweedale2016-06-151-6/+8
| | | | | | | | The upgrade script always attempts to start the CA, even on instances where the CA is not configured. Add guards. Fixes: https://fedorahosted.org/freeipa/ticket/5958 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* schema: fix client-side dynamic defaultsJan Cholasta2016-06-151-3/+3
| | | | | | | | Call command_defaults with properly typed arguments. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: exclude local commandsJan Cholasta2016-06-151-8/+14
| | | | | | | | | Commands inherited from Local can't be executed remotely, so exclude them from API schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: call `execute` rather than `forward` in LocalJan Cholasta2016-06-151-0/+3
| | | | | | | | This allows properly subclassing from both Local and other Command classes. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns, passwd: fix outputs of `dns_resolve` and `passwd` commandsJan Cholasta2016-06-154-4/+10
| | | | | | | | Use proper output type for the `value` output of the commands. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* misc: fix empty CLI output of `env` and `plugins` commandsJan Cholasta2016-06-151-0/+24
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* batch, schema: use Dict instead of AnyJan Cholasta2016-06-155-17/+16
| | | | | | | | | Add new Dict parameter class and use it in the batch and command_defaults plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: generate client-side commands on demandJan Cholasta2016-06-151-7/+28
| | | | | | | | | | Instead of pre-generating all command classes from API schema on API initialization and using them as plugins, use placeholder objects which generate the classes on demand. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 18:42:56 +0000