summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Restrict the old setkeytab operationsetkeytabSimo Sorce2016-07-252-1/+17
| | | | | | | | | | Allow it only to set computers keys by default. This is to allow older hosts to join a newer IPA Server only. All other principals are denied access to the setkeytab operation by default. Ticket: https://fedorahosted.org/freeipa/ticket/232 Signed-off-by: Simo Sorce <simo@redhat.com>
* Simplify date manipulation in pwd pluginSimo Sorce2016-07-253-50/+51
| | | | | | | | | Use a helper function to perform operations on dates in LDAP attributes. Related to #2795 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: David Kupka <dkupka@redhat.com>
* Use copy when replacing files to keep SELinux contextMartin Basti2016-07-221-1/+5
| | | | | | | | | When installer replaces any file with newer, it must use 'copy' instead of 'mv' to keep SELinux context valid. https://fedorahosted.org/freeipa/ticket/6111 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix session cookiesFlorence Blanc-Renaud2016-07-222-7/+23
| | | | | | | | | | | | | | The CLI was not using session cookies for communication with IPA API. The kernel_keyring code was expecting the keyname to be a string, but in python 2 a unicode was supplied (the key is built using ipa_session_cookie:%principal and principal is a unicode). The patch fixes the assertions, allowing to store and retrieve the cookie. It also adds a test with unicode key name. https://fedorahosted.org/freeipa/ticket/5984 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: fix update-system-records unpacking errorMartin Basti2016-07-221-2/+2
| | | | | | | | | Method IPASystemRecords.records_list_from_node returns only list consists only from record names not tuple, which caused unpacking error https://fedorahosted.org/freeipa/ticket/6117 Reviewed-By: Nikhil Dehadrai <ndehadra@redhat.com>
* help: Add dnsserver commands to help topic 'dns'David Kupka2016-07-221-0/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/6069 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Host-del: fix behavior of --updatedns and PTR recordsMartin Basti2016-07-221-11/+15
| | | | | | | | | | * target for ptr record must be absolute domain name * zone is detected using DNS system instead of random splitting of hostname https://fedorahosted.org/freeipa/ticket/6060 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix conflict between "got" and "expected" valuesGanna Kaihorodova2016-07-211-1/+2
| | | | | | | Fix conflict between "got" and "expected" values when testing "dnsconfig_mod: Update global DNS settings" Reviewed-By: Martin Basti <mbasti@redhat.com>
* unite log file name of ipa-ca-installPetr Vobornik2016-07-212-2/+1
| | | | | | | | | | | | | | | | | | | ipa-ca-install said that it used /var/log/ipareplica-ca-install.log but in fact it used /var/log/ipaserver-ca-install.log This patch unites it to ipareplica-ca-install.log It was chosen because of backwards compatibility - ipareplica-ca-install was more commonly used. ipaserver-ca-install.log was used only in rare CA less -> CA installation. https://fedorahosted.org/freeipa/ticket/6086 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* trust-add: handle `--all/--raw` options properlyMartin Babinsky2016-07-211-14/+27
| | | | | | | | | | `trust-add` command did not handle these options correctly often resulting in internal errors or mangled output. This patch implements a behavior which is more in-line with the rest of the API commands. https://fedorahosted.org/freeipa/ticket/6059 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* prevent search for RADIUS proxy servers by secretMartin Babinsky2016-07-211-0/+8
| | | | | | | | | radiusproxy-find should not allow search by proxy secret even for privileged users so we should hide it from CLI. https://fedorahosted.org/freeipa/ticket/6078 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* expose `--secret` option in radiusproxy-* commandsMartin Babinsky2016-07-211-1/+0
| | | | | | | | | | | Option `--secret` was hidden from radiusproxy CLI preventing setting a secret on existing server or searching by secret. Since thin client implementation it was also not recognized by the interactive prompt code in CLI frontend since it never got there. https://fedorahosted.org/freeipa/ticket/6078 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Tests: Improve handling of rename operation by user trackerLenka Doudova2016-07-202-25/+15
| | | | | | | | | | | | | | Improving handling of rename operation by user tracker, together with fixes for user tests, that failed as consequence. Failures were caused by RFE Kerberos principal alias. Some tests were rewritten, since they used "--setattr" option instead of "--rename", and hence didn't reflect proper behaviour of the principal aliases feature. https://fedorahosted.org/freeipa/ticket/6024 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* server uninstall fails to remove krb principalsFlorence Blanc-Renaud2016-07-201-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the 3rd issue of ticket 6012: ipa-server-install --uninstall -U complains while removing Kerberos service principals from /etc/krb5.keytab ---- Failed to remove Kerberos service principals: Command '/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r DOM-221.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM' returned non-zero exit status 5 ---- This happens because the uninstaller performs the following sequence: 1/ restore pre-install files, including /etc/krb5.keytab At this point /etc/krb5.keytab does not contain any principal for IPA domain 2/ call ipa-client-install --uninstall, which in turns runs ipa-rmkeytab -k /etc/krb5.keytab -r <domain> to remove the principals. The fix ignores ipa-rmkeytab's exit code 5 (Principal name or realm not found in keytab) https://fedorahosted.org/freeipa/ticket/6012 Reviewed-By: Martin Basti <mbasti@redhat.com>
* allow multiple dashes in the components of server hostnameMartin Babinsky2016-07-201-3/+10
| | | | | | | | | | | Relax the check for valid hostname component by allowing multiple consecutive '-' or '/' characters int he middle of the label (the first/last character must still be alphanumeric or underscore). Also use verbose regex format to document its structure. https://fedorahosted.org/freeipa/ticket/4710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* allow 'value' output param in commands without primary keyMartin Babinsky2016-07-205-7/+22
| | | | | | | | | | | | | | | | | `PrimaryKey` output param works only for API objects that have primary keys, otherwise it expects None (nothing is associated with this param). Since the validation of command output was tightened durng thin client effort, some commands not honoring this contract began to fail output validation. A custom output was implemented for them to restore their functionality. It should however be considered as a fix for broken commands and not used further. https://fedorahosted.org/freeipa/ticket/6037 https://fedorahosted.org/freeipa/ticket/6061 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Show full error message for selinuxusermap-add-hostgroupFlorence Blanc-Renaud2016-07-201-38/+15
| | | | | | | | | | | | | | | | While investigating the issue for selinuxusermap-add-hostgroup, we discovered that other commands were missing output. A first patch fixes most of the issues: freeipa-jcholast-677-frontend-copy-command-arguments-to-output-params-on-.patch This patch fixes servicedelegation CLI, where servicedelegation.takes_params was missing ipaallowedtarget_servicedelegationtarget, ipaallowedtoimpersonate and memberprincipal https://fedorahosted.org/freeipa/ticket/6026 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* frontend: copy command arguments to output params on clientJan Cholasta2016-07-201-0/+4
| | | | | | | | | | | | | | | In commit f554078291d682d59956998af97f7d3066fbe7e7 we stopped copying command arguments to output params in order to remove redundancies and reduce API schema in size. Since then, output params were removed from API schema completely and are reconstructed on the client. Not including arguments in output params hides failed members from member commands' CLI output. To fix this, copy arguments to output params again, but only on the client side. https://fedorahosted.org/freeipa/ticket/6026 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Create server and host certs with DNS altnameFraser Tweedale2016-07-193-4/+15
| | | | | | | | | | | | | | Currently server (HTTP / LDAP) certs are created without a Subject Alternative Name extension during server install, replica prepare and host enrolment, a potentially problematic violation of RFC 2818. Add the hostname as a SAN dNSName when these certs are created. (Certmonger adds an appropriate request extension when renewing the certificate, so nothing needs to be done for renewal). Fixes: https://fedorahosted.org/freeipa/ticket/4970 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Use server API in com.redhat.idm.trust-fetch-domains oddjob helperMartin Babinsky2016-07-191-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6082 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Tests: Support of UPN for trusted domainsLenka Doudova2016-07-191-0/+42
| | | | | | | | | | | | | | | Basic set of tests to verify support of UPN functionality. Test cases: - establish trust - verify the trust recognizes UPN - verify AD user with UPN can be resolved - verify AD user with UPN can authenticate - remove trust https://fedorahosted.org/freeipa/ticket/6094 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Tests: External trustLenka Doudova2016-07-192-32/+154
| | | | | | | | | | | | | | | | | Provides basic coverage for external trust feature. Test cases: 1. verify an external trust with AD subdomain can be established - verify only one trustdomain is listed - verify subdomain users are resolvable - verify trust can be deleted 2. verify non-external trust with AD subdomain cannot be established 3. verify an external trust with AD forest root domain can be established - verify that even if AD subdomain is specified, it is not associated with the trust - verify trust can be deleted https://fedorahosted.org/freeipa/ticket/6093 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Heap corruption in ipapwd pluginThierry Bordaz2016-07-191-1/+1
| | | | | | | | | | | | | | | | | | | ipapwd_encrypt_encode_key allocates 'kset' on the heap but with num_keys and keys not being initialized. Then ipa_krb5_generate_key_data initializes them with the generated keys. If ipa_krb5_generate_key_data fails (here EINVAL meaning no principal->realm.data), num_keys and keys are left uninitialized. Upon failure, ipapwd_keyset_free is called to free 'kset' that contains random num_keys and keys. allocates kset with calloc so that kset->num_keys==0 and kset->keys==NULL https://fedorahosted.org/freeipa/ticket/6030 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* CI: DNS locationsMartin Basti2016-07-183-17/+277
| | | | | | | | This test is testing default IPA system records in locations, if priority and weight were properly set per service, per server, per location. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS install: Ensure that DNS servers container existsMartin Babinsky2016-07-152-11/+23
| | | | | | | | | | | | | during DNS installation it is assumed that the cn=servers,cn=dns container is always present in LDAP backend when migrating DNS server info to LDAP. This may not always be the case (e.g. when a new replica is set up against older master) so the code must take additional steps to ensure this container is present. https://fedorahosted.org/freeipa/ticket/6083 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* spec: require Dogtag >= 10.3.3-3Fraser Tweedale2016-07-151-3/+3
| | | | | | | | | | Required features that were expected to be released in Dogtag 10.3.4 have instead been released for Fedora in 10.3.3-3. Retract the minimum required version. https://fedorahosted.org/freeipa/ticket/5956 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* schema: Fix subtopic -> topic mappingDavid Kupka2016-07-151-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/6069 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Tests: Authentication indicators integration testsLenka Doudova2016-07-151-0/+56
| | | | | | https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Tests: Authentication indicators xmlrpc testsLenka Doudova2016-07-151-1/+44
| | | | | | https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Tests: Tracker class for servicesLenka Doudova2016-07-151-0/+152
| | | | | | | | | Provides basic service tracker, so far for purposes of [1]. Tracker is not complete, some methods will need to be added in case of service test refactoring. [1] https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Milan Kubik <mkubik@redhat.com>
* messages: specify message type for ResultFormattingErrorMartin Babinsky2016-07-151-0/+1
| | | | | | | | | | the ResultFormattingError message class was missing a `type` member which could cause `otptoken-add` command to crash during QR image rendering using suboptimal TTY settings https://fedorahosted.org/freeipa/ticket/6081 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Preserve user principal aliases during rename operationMartin Babinsky2016-07-151-0/+46
| | | | | | | | | | | | | | | | When a MODRDN is performed on the user entry, the MODRDN plugin resets both krbPrincipalName and krbCanonicalName to the value constructed from uid. In doing so, hovewer, any principal aliases added to the krbPrincipalName are wiped clean. In this patch old aliases are fetched before the MODRDN operation takes place and inserted back after it is performed. This also preserves previous user logins which can be used further for authentication as aliases. https://fedorahosted.org/freeipa/ticket/6028 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* vault-add: set the default vault type on the client side if none was givenMartin Babinsky2016-07-131-0/+5
| | | | | | | | | | | | `vault-add` commands does much processing depending on the vault type even before the request is forwarded to remote server. Since default values for parameters are now filled only on server side, the client-side logic would fail if the vault type was not explicitly given. In this case we have to retrieve and use the default vault type from schema. https://fedorahosted.org/freeipa/ticket/6047 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Removed unused method parameter from migrate-dsStanislav Laznicka2016-07-131-1/+1
| | | | | | | | | An extra parameter on client side command override of migrate-ds output was causing errors. https://fedorahosted.org/freeipa/ticket/6034 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* host-find: do not show SSH key by defaultMartin Basti2016-07-131-1/+0
| | | | | | | | | Only function 'remove_sshpubkey_from_output_list_post' should be used in postcallbacks of *-find, otherwise only one entry will be cleaned up https://fedorahosted.org/freeipa/ticket/6043 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* caacl: expand plugin documentationFraser Tweedale2016-07-131-6/+28
| | | | | | | | | | Expand the 'caacl' plugin documentation to explain some common confusions including the fact that CA ACLs apply to the target subject principal (not necessarily the principal requesting the cert), and the fact that CA-less CA ACL implies the 'ipa' CA. Fixes: https://fedorahosted.org/freeipa/ticket/6002 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Enable vault-* commands on clientMartin Basti2016-07-121-16/+0
| | | | | | | | | | | | | Client plugins fot vault commands were disabled by NO_CLI=True, inherited from vault_add_interal, that is always NO_CLI=True. Introduced by this commit 8278da6967dbe425b4e0c6cf37dc1c53052525b2 Removed NO_CLI=True from client side plugins for vault. https://fedorahosted.org/freeipa/ticket/6035 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* kdb: check for local realm in enterprise principalsSumit Bose2016-07-121-12/+40
| | | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* ipa-advise: correct handling of plugin namespace iterationMartin Babinsky2016-07-121-4/+4
| | | | | | | | | | The API object namespace iterators now yield plugin classes themselves instead of their names as strings. The method enumerating through available plugins needs to be made aware of this change. https://fedorahosted.org/freeipa/ticket/6044 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-compat-manage: use server API to retrieve plugin statusMartin Babinsky2016-07-121-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6033 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipatests: remove ipacertbase option from test CSR configurationMilan Kubík2016-07-122-7/+0
| | | | | | | | | The issue was found during test review. If the cert base contains spaces, openssl req fails. https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipatests: Test Sub CA with CAACL and certificate profileMilan Kubík2016-07-121-0/+110
| | | | | | | | | | | | | Test the Sub CA feature by signing a CSR with custom certificate profile. The test also covers 'cert-request' fallback behaviour for missing 'cacn' and 'profile-id' options by reusing the fixtures from the module. https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipatests: Extend CAACL suite to cover Sub CA membersMilan Kubík2016-07-122-7/+45
| | | | | | https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipatests: Tracker implementation for Sub CA featureMilan Kubík2016-07-124-0/+309
| | | | | | | | | The patch implements Tracker subclass for CA plugin and the basic CRUD tests for the plugin entries. https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipa-nis-manage: Use server API to retrieve plugin statusMartin Babinsky2016-07-121-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6027 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* uninstall: untrack lightweight CA certsFraser Tweedale2016-07-121-0/+6
| | | | | Fixes: https://fedorahosted.org/freeipa/ticket/6020 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Test for incorrect client domainOleg Fayans2016-07-011-0/+52
| | | | | | https://fedorahosted.org/freeipa/ticket/5976 Reviewed-By: Martin Basti <mbasti@redhat.com>
* client-install: log exceptions from certmonger.request_certPetr Spacek2016-07-011-3/+3
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix incorrect check for principal type when evaluating CA ACLsMartin Babinsky2016-07-011-1/+3
| | | | | | | | This error prevented hosts to request certificates for themselves. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Become IPA 4.4.0Petr Vobornik2016-07-011-1/+1
|
generated by cgit (git 2.34.1) at 2025-08-29 03:07:04 +0000