summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Move httpd restart to DNS installationStanislav Laznicka2016-11-114-18/+3
| | | | | | | | | | | | Web service needs restarting after bindinstance is created to pick up changes done to /etc/resolv.conf. This change should be included anytime DNS is installed therefore it makes sense to move it to the common code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: use ldaps for pkispawn in ipa-ca-installJan Cholasta2016-11-112-2/+7
| | | | | | | | | | | | | Commit 822e1bc82af3a6c1556546c4fbe96eeafad45762 undone the fix from commit 276d16775a4ce8af5d39ca8a7bf5bcd638df343f, breaking ipa-ca-install on servers with hardened DS configuration. Put the fix back to make ipa-ca-install work on hardened DS configuration again. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica install: fix DS restart failure during replica promotionJan Cholasta2016-11-111-2/+6
| | | | | | | | | | | | | | Since commit 0914a3aeb778986dea4020ddf8ca550ebef02bad, ipa config file is created before DS certificate is requested, which makes certmonger request the certificate from the local system rather than the remote master. This causes the request to fail, as local httpd is not yet configured at the time of the request. Move ipa config file creation to its original place to fix the issue. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Import just IPAChangeConf instead of the whole moduleStanislav Laznicka2016-11-111-4/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added file permissions option to IPAChangeConf.newConf()Stanislav Laznicka2016-11-113-3/+8
| | | | | | | | | Also added information about why os.chmod is called sometimes after newConf() calls. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix to ipachangeconf docstringsStanislav Laznicka2016-11-111-18/+22
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replicainstall: Unify default.conf file creationStanislav Laznicka2016-11-111-72/+53
| | | | | | | | | | | | In domain level 0, the default.conf file was created using just file operations. Unified this with domain level 1 where IPAChangeConf is used. Also moved the creation of the file to promote_check in DL1. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* client: use correct code for failed uninstallMartin Basti2016-11-111-2/+2
| | | | | | | | | Hardcoded value 1 means CLIENT_INSTALL_ERROR, but this part belongs to uninstallation so it should be CLIENT_UNINSTALL_ERROR https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: use exceptions instead of return statesMartin Basti2016-11-112-91/+109
| | | | | | | | | | | Python has builtin exceptions which can be used very well to handling errors in python instead of returning error states (C style) Exception will allow better client-server integration in future https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move install part to else branchMartin Basti2016-11-111-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move install cleanup from ipa-client-install to moduleMartin Basti2016-11-112-18/+16
| | | | | | | | Cleanup should be part of installation function https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move clean CCACHE to moduleMartin Basti2016-11-112-5/+10
| | | | | | | | | | According 04b8575c52410bb6d31e0e55f1cf431d7cc9c7c3 cleaning CCACHE is needed after installation. This commit moves this cleanup from ipa-client-install to client.install() function https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: fix script executionMartin Basti2016-11-111-11/+12
| | | | | | | | | if __name__ == "__main__" should be first instead of try block. We want execute it only when file was executed as script https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: Remove useless except in ipa-client-installMartin Basti2016-11-111-2/+0
| | | | | | | | | SystemExit is raised by sys.exit() so catching and reraising it again is wasting of resources https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move custom env variable into client moduleMartin Basti2016-11-112-7/+13
| | | | | | | | | | | | | There is no need to have env as parameter because this is used only once, so it can eb safely moved to client.py module NOTE: PATH should be overwritten to safe values before we execute any command https://www.securecoding.cert.org/confluence/display/c/ENV03-C.+Sanitize+the+environment+when+invoking+external+programs https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: extract checks from uninstall to uninstall_checkMartin Basti2016-11-112-2/+12
| | | | | | | | Checks if uninstallation is possible should be moved to uninstall_check https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: extract checks from install to install_checkMartin Basti2016-11-111-20/+46
| | | | | | | | | client install contained installation check that have been moved to install_check function https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move checks to client.install_checkMartin Basti2016-11-112-17/+24
| | | | | | | | Move checks from ipa-client-install to clien.install_check https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: make statestore and fstore consistent with serverMartin Basti2016-11-112-21/+21
| | | | | | | | | | | | There should not be mixed statestore as global variable and as local function parameter. This commit fixes usage of sysrestore and statestore as local variables only. In future we may need to change default statestore and fstore depending on where the functions are called and this change makes it easier and less error prone. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* fix incorrect invocation of ipa-getkeytab during DL0 host enrollmentMartin Babinsky2016-11-111-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6434 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* do partial host enrollment in domain level 0 replica installMartin Babinsky2016-11-112-3/+57
| | | | | | | | | | | | | | | | | In order to unify domain-level specific replica installers to a single workflow some kind of host enrollment must be done also in domain level 0 replica installation. Here the enrollment is done by directory manager using one-time password and only krb5.conf is configured to point to master KDC. Since host keytab is fetched during enrollment KDC installer no longer needs to request it during replica install. https://fedorahosted.org/freeipa/ticket/6434 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Separate function to purge IPA host principals from keytabMartin Babinsky2016-11-111-24/+31
| | | | | | | | | This functionality will be reused in the DL0 host enrollment https://fedorahosted.org/freeipa/ticket/6434 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* certs: do not re-create NSS database when requesting service certMartin Babinsky2016-11-112-1/+1
| | | | | | | | | | | `CertDB.request_service_cert` could re-create NSSDB files if the supplied CA certificate was not found in database. This could cause subtle bugs since the files were recreated with wrong permissions. This behavior was removed so that there are no destructive operations performed by the method. https://fedorahosted.org/freeipa/ticket/6429 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: merge KRA agent cert export into KRA installJan Cholasta2016-11-115-56/+67
| | | | | | | | | Merge all KRA agent cert export code paths into a single code path in KRA install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: merge RA cert import into CA installJan Cholasta2016-11-115-96/+103
| | | | | | | | Merge all RA cert import code paths into a single code path in CA install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Replaced EMPTY_LINE constant with a function callStanislav Laznicka2016-11-112-28/+26
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* client: Making the configure functions more readableStanislav Laznicka2016-11-111-301/+84
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* server install: do not restart httpd during CA installJan Cholasta2016-11-111-2/+3
| | | | | | | | At this point, httpd is not configured and the restart fails. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* IPAChangeConf: use constant for empty lineMartin Basti2016-11-112-84/+26
| | | | | | | | | Instead of copy&paste is better to use constant. It makes code shorter and improves readability, saves resources. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: import IPAChangeConf directly instead the moduleMartin Basti2016-11-111-8/+8
| | | | | | | | | We should use as specific import as possible, better for python memory consumption and speed, and looks better in code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: remove extra return from hardcode_ldap_serverMartin Basti2016-11-111-2/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: install function: return constant not hardcoded numberMartin Basti2016-11-111-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: remove unneded return from configure_ipa_confMartin Basti2016-11-111-2/+0
| | | | | | | | | Function always returns return code 0, and this code is even not used elsewehere. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: remove unneded return configure_krb5_confMartin Basti2016-11-111-25/+20
| | | | | | | | | Function configure_krb5_conf always returns 0 as return state. Remove the 'return' statement and let exceptions work https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-client-install: move client install to moduleMartin Basti2016-11-115-2885/+3503
| | | | | | | | | This commit only moves the code from ipa-client-install to module ipaclient/install/client.py and fixes PEP8. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: merge all KRA install code paths into oneJan Cholasta2016-11-113-130/+50
| | | | | | | | | Merge KRA install code paths use in ipa-replica-install in either domain level and ipa-kra-install into one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: merge all CA install code paths into oneJan Cholasta2016-11-114-263/+111
| | | | | | | | | Merge CA install code paths use in ipa-server-install, ipa-replica-install in either domain level and ipa-ca-install into one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: use one remote KRA host name everywhereJan Cholasta2016-11-113-8/+8
| | | | | | | | | Remote master and KRA host names may differ. Always use the remote KRA host name and never the remote master host name in KRA replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: use one remote CA host name everywhereJan Cholasta2016-11-114-11/+11
| | | | | | | | | Remote master and CA host names may differ. Always use the remote CA host name and never the remote master host name in CA replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* initialize empty /etc/http/alias during server/replica installMartin Babinsky2016-11-114-58/+42
| | | | | | | | | | In order to reduce coupling between httpinstance and other service installers, the HTTP installer is now tasked with initialization of /etc/httpd/alias (RA agent database) in the beginning of server/replica installation Part of https://fedorahosted.org/freeipa/ticket/6429 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* CertDB: add API for non-destructive initialization from PKCS#12 bundleMartin Babinsky2016-11-111-0/+8
| | | | | | | | | | | | `create_from_pkcs12` method of CertDB was re-creating NSS database files during PKCS#12 bundle import. This may cause bugs because the file permissions could be re-set to wrong values causing subtle bugs. Modify the class API so that the server cert chain can be imported while preserving existing FS attributes. https://fedorahosted.org/freeipa/ticket/6429 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Moved update of DNA plugin among update pluginsStanislav Laznicka2016-11-118-124/+134
| | | | | | | | | | | | | | | | | To make the code more general, moved the update_dna_shared_config among other update plugins. Bugfix: DNA shared config connection protocol was compared to a method string which would result in a try to always update it even if there was no need to. https://fedorahosted.org/389/ticket/48373 causes that two shared DNA config entries are created instead of one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move ds.replica_populate to an update pluginStanislav Laznicka2016-11-114-21/+39
| | | | | | | | | Replica populate can be applied with other update plugins. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove redundant dsinstance restartStanislav Laznicka2016-11-111-5/+2
| | | | | | | | | | | Removed a redundant restart in server install which was there only so other methods of dsinstance would not fail as they would use the wrong connection mentioned above. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Build: pass down %{release} from SPEC to configurePetr Spacek2016-11-111-1/+1
| | | | | | | | | This is required in order to bake-in precise vendor version to version.py. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Build: update IPA_VERSION_IS_GIT_SNAPSHOT to comply with PEP440Petr Spacek2016-11-111-6/+7
| | | | | | | | | | Python setuptools started to warn about forward incompatibility. Now we are following PEP440 so it should not cause any problems with future versions of setuptools. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Build: add make srpms targetPetr Spacek2016-11-111-1/+9
| | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Build: IPA_VERSION_IS_GIT_SNAPSHOT re-generates version number on RPM buildPetr Spacek2016-11-114-16/+62
| | | | | | | | | | | | | | | | | | | | | | | This is a huge hack. rpms target will touch VERSION.m4 file. This change is then detected by automake Makefiles which subsequently re-execute configure and make. We have to workaround fact that variables in new make targets (executed after new configure) are different than original ones. Also, we have to 'bake-in' precise snapshot version from Git to VERSION.m4 inside of RPM tarball so the RPM does not depend on git anymore. All this magic slows build down a bit. Do not enable IPA_VERSION_IS_GIT_SNAPSHOT if you want fastest possible builds. The option IPA_VERSION_IS_GIT_SNAPSHOT is now enabled by default as it was before we started the build system refactoring effort. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Build: use POSIX 1003.1-1988 (ustar) file format for tar archivesPetr Spacek2016-11-111-1/+1
| | | | | | | | | Default format used by Autotools limits length of paths to 99 characters. This is not enough for tarballs with Git snapshots. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Build: IPA_VERSION_IS_GIT_SNAPSHOT checks if source directory is Git repoPetr Spacek2016-11-111-0/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
generated by cgit (git 2.34.1) at 2024-11-16 11:11:07 +0000