summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* man: Decribe ipa-client-install workaround for broken D-Bus enviroment.David Kupka2016-06-091-0/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/5694 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* spec file: require correct packages to get API pluginsJan Cholasta2016-06-091-7/+7
| | | | | | | | | | Since ipalib.plugins was split into ipaserver.plugins and ipaclient.plugins, require python-ipaserver and/or python-ipaclient instead of python-ipalib where appropriate. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: fix typoJan Cholasta2016-06-091-1/+1
| | | | | | | | This fixes summary lines for commands in the help command. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: fix topic command outputJan Cholasta2016-06-092-5/+13
| | | | | | | | | | Return topic names as text instead of binary blob. This fixes ipa help topic display. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* replica install: use remote server API to create service entriesJan Cholasta2016-06-094-73/+48
| | | | | | | | | | | Use the existing remote server API to create service entries instead of a client API. This fixes a crash during replica promotion due to unavailable schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: do not validate unrequested params in command_defaultsJan Cholasta2016-06-092-5/+6
| | | | | | | | | | | | Request specific params when getting the defaults instead of getting defaults for all params and filtering the result. This fixes command_defaults failing with validation errors on unrequested params. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add custodia store for lightweight CA key replicationFraser Tweedale2016-06-092-0/+57
| | | | | | | | | | | | | | | Due to limitations in Dogtag's use of NSSDB, importing private keys must be done by the Dogtag Java process itself. This requires a PKIArchiveOptions format (signing key wrapped with host CA key) - PKCS #12 cannot be used because that would require decrypting the key in Dogtag's memory, albeit temporarily. Add a new custodia store that executes a 'pki' command to acquire the wrapped key. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Authorise CA Agent to manage lightweight CAsFraser Tweedale2016-06-092-5/+52
| | | | | | | | | Add Dogtag ACLs that authorise the CA Agent certificate to manage lightweight CAs. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Setup lightweight CA key retrieval on install/upgradeFraser Tweedale2016-06-0910-8/+119
| | | | | | | | | | | | | | | | | | Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Optionally add service name to Custodia key DNsFraser Tweedale2016-06-091-5/+22
| | | | | | | | | | | | | | | | | | | Lightweight CAs support introduces new service principals for Dogtag, with Custodia keys. The current Custodia key creation uses a DN that contains only they key type and the hostname, so keys for multiple services on the same host cannot be created. Add the 'generate_keys' method to generate keys for a host or an arbitrary service. When a service name is given, add the key entries in a nested container with RDN 'cn=<service name>'. (The container is assumed to exist). This change does not affect searching because subtree search is used, filtering on the ipaKeyUsage and memberPrincipal attributes. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add ACIs for Dogtag custodia clientFraser Tweedale2016-06-091-0/+8
| | | | | | | | | | | | | The "dogtag/$HOSTNAME@$REALM" service principal uses Custodia to retrieve lightweight CA signing keys, and therefore needs search and read access to Custodia keys. Add an ACI to permit this. Also add ACIs to allow host principals to manage Dogtag custodia keys for the same host. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* otptoken: support Python 3 for the qr codeAlexander Bokovoy2016-06-091-1/+1
| | | | | | | | | | | | | | | | | | | | | When IPA client is using Python 3, there is no str.decode() method anymore. ipa: ERROR: AttributeError: 'str' object has no attribute 'decode' Traceback (most recent call last): File "/usr/lib/python3.5/site-packages/ipalib/cli.py", line 1345, in run sys.exit(api.Backend.cli.run(argv)) File "/usr/lib/python3.5/site-packages/ipalib/cli.py", line 1110, in run rv = cmd.output_for_cli(self.api.Backend.textui, result, *args, **options) File "/usr/lib/python3.5/site-packages/ipaclient/plugins/otptoken.py", line 103, in output_for_cli qr = self._get_qrcode(output, uri, options['version']) File "/usr/lib/python3.5/site-packages/ipaclient/plugins/otptoken.py", line 61, in _get_qrcode qr_code = qr_output.getvalue().decode(encoding) AttributeError: 'str' object has no attribute 'decode' ipa: ERROR: an internal error has occurred Fixes https://fedorahosted.org/freeipa/ticket/5938 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Load server plugins in certmonger renewal helperFraser Tweedale2016-06-081-1/+1
| | | | | | | | The certmonger renewal helper needs to load server plugins to operate. Initialise the API with in_server=True. Fixes: https://fedorahosted.org/freeipa/ticket/5943 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow CustodiaClient to be used by arbitrary principalsFraser Tweedale2016-06-082-10/+24
| | | | | | | | | | | | | | | | | | | | | | | | | Currently CustodiaClient assumes that the client is the host principal, and it is hard-coded to read the host keytab and server keys. For the Lightweight CAs feature, Dogtag on CA replicas will use CustodiaClient to retrieve signing keys from the originating replica. Because this process runs as 'pkiuser', the host keys cannot be used; instead, each Dogtag replica will have a service principal to use for Custodia authentication. Update CustodiaClient to require specifying the client keytab and Custodia keyfile to use, and change the client argument to be a full GSS service name (instead of hard-coding host service) to load from the keytab. Update call sites accordingly. Also pass the given 'ldap_uri' argument through to IPAKEMKeys because without it, the client tries to use LDAPI, but may not have access. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Auth Indicators WebUI partPavel Vomacka2016-06-075-169/+233
| | | | | | | | | | Add custom_checkbox_widget on service page. The old aci.attribute_widget now inherits from the new base class custom_checkboxes_widget and overrides the populate method. https://fedorahosted.org/freeipa/ticket/5872 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Exclude unneeded dirs and files from pylint checkMartin Basti2016-06-071-1/+6
| | | | | | | | | | Generated files or paths that does not contain src files should be skipped: * yacctab.py - autogenerated * lextab.py - autogenerated * dist/* - doesn't contain usefule src files Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* test: test_cli: Do not expect defaults in kwargs.David Kupka2016-06-061-80/+46
| | | | | | | | Client is no longer forwarding in arguments with default values to the server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add the culprit line when a configuration file has an incorrect formatFlorence Blanc-Renaud2016-06-061-1/+5
| | | | | | | | | | | | | | For instance if /etc/nsswitch.conf contains an incorrect line sudoers file sss (Note the missing : after sudoers) ipa-client-install exits with a SyntaxError traceback but does not state which line caused the issue. With the fix, the filename and the line are displayed in the SyntaxError message. https://fedorahosted.org/freeipa/ticket/5811 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Extend the certificate request dialogPavel Vomacka2016-06-063-2/+13
| | | | | | | | | The command for requesting certificate for hosts and services is extended. There is added how to add DNS name as subjectAltName. https://fedorahosted.org/freeipa/ticket/5645 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Removed dead code from LDAP{Remove,Add}ReverseMemberStanislav Laznicka2016-06-061-16/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5892 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Upgrade mod_wsgi socket-timeout on existing installationMartin Basti2016-06-061-1/+1
| | | | | | | | The original fix was efective only on new installations. https://fedorahosted.org/freeipa/ticket/5833 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove service and host cert issuer validationFraser Tweedale2016-06-064-36/+1
| | | | | | | | | | | When adding certifiates to a host or service entry, we currently check that the issuer matches the issuer DN of the IPA CA. Now that sub-CAs have been implemented, this check is no longer valid and will cause false negatives. Remove it and update call sites. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added krb5.conf.d/ to included dirs in krb5.confStanislav Laznicka2016-06-053-1/+4
| | | | | | | | | The include of /etc/krb5.conf.d/ is required for crypto-policies to work properly https://fedorahosted.org/freeipa/ticket/5912 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Change 'Restore' to 'Remove Hold'Pavel Vomacka2016-06-033-19/+25
| | | | | | | | | To be consistent with CLI the restoring certificate is renamed to removing certificate hold in all WebUI components. https://fedorahosted.org/freeipa/ticket/5878 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Change lang.hitch to javascript bind methodPavel Vomacka2016-06-0320-145/+134
| | | | | | | | Also remove the dojo/_base/lang module in cases it is not needed any more. https://fedorahosted.org/freeipa/ticket/5702 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add option to stage user from details pagePavel Vomacka2016-06-034-3/+39
| | | | | | | | Add 'stage' option to the activity dropdown menu on preserved user details page. https://fedorahosted.org/freeipa/ticket/5371 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add ability to stage multiple usersPavel Vomacka2016-06-034-0/+39
| | | | | | | | Add 'Stage' button on search page where preserved users are listed. https://fedorahosted.org/freeipa/ticket/5371 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNS Locations: extend tests with server-* commandsMartin Basti2016-06-034-7/+240
| | | | | | | https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: when removing location remove it from servers firstMartin Basti2016-06-032-0/+9
| | | | | | | | | | | | Locations should be removed from server by using server-mod during location-del (future patches will handle DNS records in server-mod) Referint plugin is configured to remove references of deleted locations. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Location: location-show: return list of servers in locationMartin Basti2016-06-036-5/+110
| | | | | | | | | location-show returns list of servers curently assigned to the location https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: extend server-* command with locationsMartin Basti2016-06-034-9/+121
| | | | | | | | | Server find, server show, server mod should work with IPA locations. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow to use non-Str attributes as keys for membersMartin Basti2016-06-031-6/+8
| | | | | | | | | | | Locations use DNSNameParam as pkey_value, but implementation of searches for members was able to use only Str param. This commit allows to use other param classes for search. Required for: https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: API testsMartin Basti2016-06-032-0/+232
| | | | | | | | | Tests for location-* commands https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: location-* commandsMartin Basti2016-06-038-2/+230
| | | | | | | | | http://www.freeipa.org/page/V4/DNS_Location_Mechanism https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: add new attributes and objectclassesMartin Basti2016-06-031-0/+4
| | | | | | | | | http://www.freeipa.org/page/V4/DNS_Location_Mechanism https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: Always create DNS related privilegesMartin Basti2016-06-034-16/+32
| | | | | | | | | | | DNS privileges are important for handling DNS locations which can be created without DNS servers in IPA topology. We will also need this privileges presented for future feature 'External DNS support' https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix minor typoYuri Chornoivan2016-06-031-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove dangling RUVs even if replicas are offlineStanislav Laznicka2016-06-033-7/+4
| | | | | | | | | | | Previously, an offline replica would mean the RUVs cannot be removed otherwise the task would be hanging in the DS. This is fixed in 389-ds 1.3.5. https://fedorahosted.org/freeipa/ticket/5396 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Ludwig Krispenz <lkrispen@redhat.com>
* fixes premature sys.exit in ipa-replica-manage delStanislav Laznicka2016-06-031-6/+5
| | | | | | | | | | | | Deletion of a replica would fail should there be no RUVs on the server. Also removed some dead code in del_master_managed which might cause premature exit if RuntimeError occurs. https://fedorahosted.org/freeipa/ticket/5307 Reviewed-By: Martin Basti <mbasti@redhat.com>
* frontend: do not check API minor version of the clientJan Cholasta2016-06-031-2/+0
| | | | | | | | | | Thin client always respects API schema of the server, even when it is newer that the server. Remove the API minor version check done on the server, as it is no longer necessary. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: move server-side plugins to ipaserverJan Cholasta2016-06-03103-80/+65
| | | | | | | | | | Move the remaining plugin code from ipalib.plugins to ipaserver.plugins. Remove the now unused ipalib.plugins package. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipaclient: implement thin clientJan Cholasta2016-06-039-9/+352
| | | | | | | | | | Dynamically create plugin package for the remote server with modules and commands based on the API schema when client API is finalizes. For in-tree API instances, use ipalib.plugins directly. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* misc: hide the unused --all option of `env` and `plugins` in CLIJan Cholasta2016-06-031-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: move File command arguments to ipaclientJan Cholasta2016-06-036-8/+51
| | | | | | | | | | File arguments are relevant only on the client, on the server they are the same as Str. Specify the arguments as Str in ipalib.plugins and override them with File in ipaclient.plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipactl: use server APIJan Cholasta2016-06-031-1/+1
| | | | | | | | | Initialize API in ipactl with in_server=True, as this is a server-side script. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* client install: finalize API after CA certs are availableJan Cholasta2016-06-031-1/+2
| | | | | | | | | This is required for the finalize call to be able connect to the server to retrieve API schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: do not validate command name in RPCClient.forwardJan Cholasta2016-06-031-4/+0
| | | | | | | | | | | The validation is already done on the server. This allows manually forwarding commands unknown to the client but known to the server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: optimize JSON-RPC response handlingJan Cholasta2016-06-031-3/+3
| | | | | | | | | | Speed up JSON-RPC response handling by putting received response data fragments in a list and joining them at once instead of concatenating each fragment one by one. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: specify connection options in API configJan Cholasta2016-06-0311-70/+73
| | | | | | | | | Specify RPC connection options once in API.bootstrap rather than in each invocation of rpcclient.connect. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: allow overriding NSS DB directory in API configJan Cholasta2016-06-032-5/+6
| | | | | | | | | Add new `nss_dir` API config option to allow rpcclient to use a non-default NSS DB for the connection. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 15:01:36 +0000