summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add options to allow ticket cachingSimo Sorce2017-03-161-0/+2
| | | | | | | | | | | | This new option (planned to land in gssproxy 0.7) we cache the ldap ticket properly and avoid a ticket lookup to the KDC on each and every ldap connection. (Also requires krb5 libs 1.15.1 to benefit from caching). Ticket: https://pagure.io/freeipa/issue/6771 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Set development version to 4.5.90Martin Basti2017-03-161-1/+1
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Python 3: Fix session storageChristian Heimes2017-03-151-1/+18
| | | | | | | | ctypes can only handle bytes, not text. Encode and decode all incoming and outgoing text from UTF-8 to bytes. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Fix Python 3 pylint errorsChristian Heimes2017-03-154-6/+6
| | | | | | | | | | | | | | | | ************* Module ipaserver.install.ipa_kra_install ipaserver/install/ipa_kra_install.py:25: [W0402(deprecated-module), ] Uses of a deprecated module 'optparse') ************* Module ipapython.install.core ipapython/install/core.py:163: [E1101(no-member), _knob] Module 'types' has no 'TypeType' member) ************* Module ipatests.test_ipapython.test_dn ipatests/test_ipapython/test_dn.py:1205: [W1505(deprecated-method), TestDN.test_x500_text] Using deprecated method assertEquals()) ************* Module ipa-ca-install install/tools/ipa-ca-install:228: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member) install/tools/ipa-ca-install:232: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member) Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Update 4.5 translationsMartin Basti2017-03-1521-44488/+58554
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Try out anonymous PKINIT after it is configuredMartin Babinsky2017-03-151-0/+6
| | | | | | | | | | | After PKINIT certificate is requested and everything is set up, we should attempt to perform anonymous PKINIT and fail hard if it does not work for some reason. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* check for replica's KDC entry on master before requesting PKINIT certMartin Babinsky2017-03-152-3/+18
| | | | | | | | | | This prevents replication-based race conditions to break PKINIT certificate requests on replica installation. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* check that the master requesting PKINIT cert has KDC enabledMartin Babinsky2017-03-151-5/+17
| | | | | | | https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make wait_for_entry raise exceptionsMartin Babinsky2017-03-151-6/+3
| | | | | | | | | | | | Instead of only logging errors when timeout is reached or query for the entry fails for other reasons, `wait_for_entry` should raise exceptions so that we can handle them in caller or let them propagate and fail early. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move PKINIT configuration to a later stage of server/replica installMartin Babinsky2017-03-153-7/+23
| | | | | | | | | | | | | | This is to ensure that we can request PKINIT certs once all the following requirements are in place: * CA is configured or PKCS#12 file is provided * LDAP, KDC and Apache are configured and the master role is thus completed and enabled https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Request PKINIT cert directly from Dogtag API on first masterMartin Babinsky2017-03-151-0/+16
| | | | | | | | | | | On the first master the framework may not be fully functional to server certificate requests. It is safer to configure helper that contacts Dogtag REST API directly. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make PKINIT certificate request logic consistent with other installersMartin Babinsky2017-03-151-8/+8
| | | | | | | | | | | | | | | | | The certmonger request handling code during pkinit setup actually never correctly handled situations when certificate request was rejected by the CA or CA was unreachable. This led to subtle errors caused by broken anonymous pkinit (e.g. failing WebUI logins) which are hard to debug. The code should behave as other service installers, e. g. use `request_and_wait_for_cert` method which raises hard error when request times out or is not granted by CA. On master contact Dogtag CA endpoint directly as is done in DS installation. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove pkinit from ipa-replica-prepareStanislav Laznicka2017-03-151-76/+7
| | | | | | | | | | | The PKINIT feature is not available on domain level 0 so any options about pkinit are false. https://pagure.io/freeipa/issue/6759 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* CONFIGURE: Improve detection of xmlrpc_c flagsLukas Slebodnik2017-03-151-1/+14
| | | | | | | | | | | | The pkg-config files for xmlrpc_c libraries are shipped just in fedora/rhel due to downstream patch. Debian does not have pkg-config files for xmlrpc_c. Therefore we need to fallback to older method of detection XMLRPC_*FLAGS which was reverted by the commit 1e0143c159134337a00a91d4ae64e614f72da62e https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* spec file: always provide python package aliasesJan Cholasta2017-03-151-0/+6
| | | | | | | Provide python-ipa* aliases for python2-ipa* subpackages when the python_provide RPM macro is not available. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* spec file: support client-only buildJan Cholasta2017-03-151-8/+12
| | | | | | | | | | | | | | | | | | | nspr-devel, nss-devel and openssl-devel are required for client-only build, move their respective BuildRequires from the server-specific BuildRequires section to the main BuildRequires section. Pass --enable-server or --disable-server to ./configure based on the value of %{ONLY_CLIENT}. Remove the `make client-check` call from %check, as the client-check target does not exist anymore. Always call `make check` instead. Do not package the /usr/share/ipa directory in freeipa-client-common, as it is not created in client-only build. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* spec file: support build without ipatestsJan Cholasta2017-03-151-5/+24
| | | | | | | | | | Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Add PYTHON_INSTALL_EXTRA_OPTIONS and --install-layout=debChristian Heimes2017-03-152-1/+10
| | | | | | | | | | | | | Debian packages should be installed under dist-packages, not site-packages. Debian has patched distutils and setuptools to add a new flag '--install-layout'. For --with-ipaplatform=debian, PYTHON_INSTALL_EXTRA_OPTIONS is set to '--install-layout=deb'. https://pagure.io/freeipa/issue/6764 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Timo Aaltonen <tjaalton@debian.org> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Make pylint and jsl optionalChristian Heimes2017-03-153-21/+51
| | | | | | | | | | | | | | | | | | | | ./configure no longer fails when pylint or jsl are not available. The make targets for pylint and jsl are no longer defined without the tools. Rational: pylint and jsl are not required to build FreeIPA. Both are useful developer tools. It's more user friendly to make both components optionally with default config arguments. There is no reason to fail building on a build system without development tools. It's still possible to enforce dependency checks with --with-jslint and --enable-pylint. https://fedorahosted.org/freeipa/ticket/6604 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* rpcserver: x509_login: Handle unsuccessful certificate login gracefullyDavid Kupka2017-03-151-0/+10
| | | | | | | | | | | | When mod_lookup_identity is unable to match user by certificate (and username) it unsets http request's user. mod_auth_gssapi is then unable to get Kerberos ticket and doesn't set KRB5CCNAME environment variable. x509_login.__call__ now returns 401 in such case to indicate that request was not authenticated. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* ipaplatform/debian/paths: Add some missing values.Timo Aaltonen2017-03-151-1/+2
| | | | | | Rename KRA_AGENT_PEM -> OLD_KRA_AGENT_PEM, add CERTMONGER_DOGTAG_SUBMIT. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* CONFIGURE: Properly detect libpopt on el7Lukas Slebodnik2017-03-151-1/+7
| | | | | | | | | | | libpopt added pkg-config file in 1.16 but there are still distributions which has older version of library (el6, el7). And new features from libpopt are not used anywhere. Configure should try to detect as much as possible and users should not use workarounds with explicitely enabled variables as parameters e.g. ./configure POPT_LIBS="-lpopt " Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* slapi plugins: fix CFLAGSJan Cholasta2017-03-1517-12/+26
| | | | | | | | | | | | Add explicit NSPR_CFLAGS and NSS_CFLAGS where NSPR_LIBS and NSS_LIBS is used. Use DIRSRV_CFLAGS rather than hardcode -I/usr/include/dirsrv. Append NSPR_CFLAGS to DIRSRV_CFLAGS in ./configure as slapi-plugin.h includes nspr.h. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* idviews: correctly handle modification of non-existent viewMartin Babinsky2017-03-151-3/+6
| | | | | | | | | | the pre-callback in `idview-mod` did not correctly handle non-existent object during objectclass check. It will now correctly report that the object was not found instead on generic 'no such entry'. https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com>
* spec file: add unconditional python-setuptools BuildRequiresJan Cholasta2017-03-151-2/+2
| | | | | | | | | | python-setuptools is required not only for lint, but to make the build possible at all. Move the python-setuptools BuildRequires from the lint section to the main section. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Ignore ipapython/.DEFAULT_PLUGINSChristian Heimes2017-03-151-0/+1
| | | | | | | https://pagure.io/freeipa/issue/6597 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove allow_constrained_delegation from gssproxy.confPavel Vomacka2017-03-141-1/+0
| | | | | | | | | | | The Apache process must not allowed to use constrained delegation to contact services because it is already allowed to impersonate users to itself. Allowing it to perform constrained delegation would let it impersonate any user against the LDAP service without authentication. https://pagure.io/freeipa/issue/6225 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* WebUI: Add support for management of user short name resolutionPavel Vomacka2017-03-142-0/+8
| | | | | | | | | | | Added field into idview details page and into server config where the order of domains used while searching for user. Domains can be separated by ':' character. https://pagure.io/freeipa/issue/6372 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Re-use trust domain retrieval code in certmap validatorsMartin Babinsky2017-03-141-8/+3
| | | | | | | | https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* idview: add domain_resolution_order attributeMartin Babinsky2017-03-144-7/+38
| | | | | | | | | | | `idview-add` and `idview-mod` can now set and validate the attribute. The required objectclass is added on-demand after modification https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaconfig: add the ability to manipulate domain resolution orderMartin Babinsky2017-03-144-6/+118
| | | | | | | | | | | | | | | optional attribute was added to config object along with validator that check for valid domain names and also checks whether the specified domains exist in FreeIPA or in trusted forests and, in case of trusted domains, are not disabled. Part of http://www.freeipa.org/page/V4/AD_User_Short_Names https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Short name resolution: introduce the required schemaMartin Babinsky2017-03-142-0/+3
| | | | | | | | | | | | Add ipaDomainResolutionOrder and ipaNameResolutionData to IPAv3 schema. Extend ipaConfig object with ipaNameResolutionData objectclass during update. https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Run test_ipaclient test suiteChristian Heimes2017-03-141-0/+1
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* httpinstance: disable system trust module in /etc/httpd/aliasJan Cholasta2017-03-143-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the NSS database in /etc/httpd/alias is installed with the system trust module enabled. This is problematic for a number of reasons: * IPA has its own trust store, which is effectively bypassed when the system trust module is enabled in the database. This may cause IPA unrelated CAs to be trusted by httpd, or even IPA related CAs not to be trusted by httpd. * On client install, the IPA trust configuration is copied to the system trust store for third parties. When this configuration is removed, it may cause loss of trust information in /etc/httpd/alias (https://bugzilla.redhat.com/show_bug.cgi?id=1427897). * When a CA certificate provided by the user in CA-less install conflicts with a CA certificate in the system trust store, the latter may be used by httpd, leading to broken https (https://www.redhat.com/archives/freeipa-users/2016-July/msg00360.html). Disable the system trust module on install and upgrade to prevent the system trust store to be used in /etc/httpd/alias and fix all of the above issues. https://pagure.io/freeipa/issue/6132 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Backup KDC certificate pairStanislav Laznicka2017-03-141-0/+2
| | | | | | | | | KDC certificate pair was added but is not included in backup which might cause issues when restoring the IPA service. https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaplatform/debian/paths: Rename IPA_KEYTAB to OLD_IPA_KEYTAB.Timo Aaltonen2017-03-141-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaplatform/debian/paths: Add IPA_HTTPD_KDCPROXY.Timo Aaltonen2017-03-141-0/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaplatform/debian/services: Fix is_running arguments.Timo Aaltonen2017-03-141-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add copy-schema-to-ca for RHEL6 to contrib/Martin Basti2017-03-141-0/+118
| | | | | | | | Fixed version that works on RHEL6. Adding it to contrib to avoid loosing it. https://pagure.io/freeipa/issue/6540 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove copy-schema-to-ca.py from master branchMartin Basti2017-03-144-132/+2
| | | | | | | | | This script is used only for IPA <3.1, so it must be compatible with ipa-3-0 branch, so it should be placed there https://pagure.io/freeipa/issue/6540 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: add link to login page which for login using certificatePavel Vomacka2017-03-143-4/+78
| | | | | | | | | | Also add error message when login failed. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Support certificate login after installation and upgradePavel Vomacka2017-03-146-2/+59
| | | | | | | | | | | | Add necessary steps which set SSSD and set SELinux boolean during installation or upgrade. Also create new endpoint in apache for login using certificates. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Don't fail more if cert req/cert creation failedStanislav Laznicka2017-03-141-2/+5
| | | | | | | | | This should help debugging issues that could happen during server certificate creation. https://pagure.io/freeipa/issue/6755 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix ipa-replica-prepare server-cert creationStanislav Laznicka2017-03-141-1/+2
| | | | | | | | | | Fixes an issue introduced in 0a54fac0, we need to specify the current master's hostname so that we know to which CA we need to connect to create the other's server Server-Cert. https://pagure.io/freeipa/issue/6755 Reviewed-By: Martin Basti <mbasti@redhat.com>
* csrgen: hide cert-get-requestdata in CLIJan Cholasta2017-03-141-0/+2
| | | | | | | | | The CSR generation feature is supposed to be used from cert-request, hide the internal cert-get-requestdata command in the CLI. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* cert: include certificate chain in cert command outputJan Cholasta2017-03-144-12/+56
| | | | | | | | | | | | Include the full certificate chain in the output of cert-request, cert-show and cert-find if --chain or --all is specified. If output file is specified in the CLI together with --chain, the full certificate chain is written to the file. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert: add output file option to cert-requestJan Cholasta2017-03-141-14/+52
| | | | | | | | | | | The certificate returned by cert-request can now be saved to a file in the CLI using a new --certificate-out option. Deprecate --out in cert-show in favor of --certificate-out. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* TESTS WebUI: Vaults managementPavel Vomacka2017-03-143-1/+273
| | | | | | | | | | | | | | Bunch of tests for WebUI Vault Management. Covers: Adding vaults Modifying vaults Adding members and owners to all types of vaults https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* TESTS: Add support for sidebar with facetsPavel Vomacka2017-03-141-2/+12
| | | | | | | Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* TESTS: Add support for KRA in ui_driverPavel Vomacka2017-03-141-0/+7
| | | | | | | https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-22 07:51:25 +0000