summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Make host/service cert revocation aware of lightweight CAsFraser Tweedale2016-09-072-39/+37
| | | | | | | | | | Revocation of host/service certs on host/service deletion or other operations is broken when cert is issued by a lightweight (sub)CA, causing the delete operation to be aborted. Look up the issuing CA and pass it to 'cert_revoke' to fix the issue. Fixes: https://fedorahosted.org/freeipa/ticket/6221 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert-request: raise CertificateOperationError if CA disabledFraser Tweedale2016-09-071-2/+10
| | | | | | | | | | Detect when cert-request returns HTTP 409, which indicates that the target CA is disabled - a valid scenario - and raise CertificateOperationError with a friendly message instead of HTTPRequestError. Fixes: https://fedorahosted.org/freeipa/ticket/6260 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use Dogtag REST API for certificate requestsFraser Tweedale2016-09-072-287/+193
| | | | | | | | | | | | The Dogtag REST API gives better responses statuses than the RPC API and properly reports failure due to disabled CA (status 409). Make 'ra' extend 'RestClient' and refactor the 'request_certificate' method to use Dogtag's REST API. Part of: https://fedorahosted.org/freeipa/ticket/6260 Part of: https://fedorahosted.org/freeipa/ticket/3473 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add HTTPRequestError classFraser Tweedale2016-09-072-1/+12
| | | | | | | | | | | | | | | Currently, HTTP requests that respond with status not in the 2xx range raise RemoteRetrieveError. The exception includes no information about the response status. Add the 'HTTPRequestError' class which extends 'RemoteRequestError' with an attribute for the response status, and update the Dogtag RestClient to raise the new error. Part of: https://fedorahosted.org/freeipa/ticket/6260 Part of: https://fedorahosted.org/freeipa/ticket/3473 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow Dogtag RestClient to perform requests without logging inFraser Tweedale2016-09-071-12/+24
| | | | | | | | | | | | | | | | | Currently the Dogtag RestClient '_ssldo' method requires a session cookie unconditionally, however, not all REST methods require a session: some do not require authentication at all, and some will authenticate the agent on the fly. To avoid unnecessary login/logout requests via the context manager, add the 'use_session' keyword argument to '_ssldo'. It defaults to 'True' to preserve existing behaviour (session required) but a caller can set to 'False' to avoid the requirement. Part of: https://fedorahosted.org/freeipa/ticket/6260 Part of: https://fedorahosted.org/freeipa/ticket/3473 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* cert: fix cert-find --certificate when the cert is not in LDAPJan Cholasta2016-09-071-7/+5
| | | | | | | | | Always return the cert specified in --certificate in cert-find result, even when the cert is not found in LDAP. https://fedorahosted.org/freeipa/ticket/6304 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add ca-disable and ca-enable commandsFraser Tweedale2016-09-074-4/+88
| | | | | | | | | | | | | We soon plan to revoke certificates upon lightweight CA deletion. This makes it important to provide a way to prevent a CA from issuing certificates whilst not deleting and revoking it, and continuing to allow management of issued certs. This commit adds the ca-disable and ca-enable commands. Fixes: https://fedorahosted.org/freeipa/ticket/6257 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* WebUI add support for sub-CAs while revoking certificatesPavel Vomacka2016-09-072-30/+100
| | | | | | | | | Also the same for removing certificate hold. https://fedorahosted.org/freeipa/ticket/6216 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: Fix showing certificates issued by sub-CAPavel Vomacka2016-09-071-0/+7
| | | | | | | | | The cert-show command needs to be called with cacn option. Cacn option is passed using URL attribute. https://fedorahosted.org/freeipa/ticket/6238 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add support for additional options taken from table facetPavel Vomacka2016-09-071-1/+48
| | | | | | | | | | | | | | Sometimes the entity_show command must be called with options which are gathered from result of entity_find command. These options needs to be passed as arguments in URL which points to details page. This functionality is implemented to table facet. There is new property 'additional_navigation_arguments' which is prepared for array of attributes which will be passed to URL. Part of: https://fedorahosted.org/freeipa/ticket/6238 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Use Travis-CI for basic sanity checksMartin Babinsky2016-09-061-0/+16
| | | | | | | | | | | | | | | This patch adds the config file for Travis CI. The config file instructs the CI to: * check pep8 errors in PR * build RPMs in pulled in Fedora builder container (docker.io/martbab/freeipa-fedora-builder) These basic checks should eliminate basic errors that can break the build itself (formatting errors, Syntax errors/undeclared variables, missing BuildRequires, broken API.txt, etc.). It does not run any of our integration/unit tests. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix parse errors with link-local addressesMartin Basti2016-09-061-1/+6
| | | | | | | | | | Link-local addresses received from netifaces contains '%suffix' that causes parse error in IPNetwork class. We must remove %suffix before it us used in IPNetwork objects. https://fedorahosted.org/freeipa/ticket/6296 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* schema cache: Store and check info for pre-schema serversDavid Kupka2016-09-063-91/+128
| | | | | | | | | | | | | Cache CommandError answer to schema command to avoid sending the command to pre-schema servers every time. This information expires after some time (1 hour) in order to start using schema as soon as the server is upgraded. https://fedorahosted.org/freeipa/ticket/6095 Signed-off-by: Jan Cholasta <jcholast@redhat.com> Signed-off-by: David Kupka <dkupka@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ldapupdate: Use proper inheritance in BadSyntax exceptionMartin Babinsky2016-09-061-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/6294 Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns: fix crash in interactive mode against old serversJan Cholasta2016-09-061-1/+61
| | | | | | | | | | Add a client-side fallback of the dnsrecord_split_parts command for old servers to avoid CommandError in dnsrecord_add and dnsrecord_mod CLI interactive mode. https://fedorahosted.org/freeipa/ticket/6203 Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns: prompt for missing record parts in CLIJan Cholasta2016-09-064-16/+62
| | | | | | | | | Fix the code which determines if a record part is required and thus should be prompted not to wrongfully consider all record parts to be optional. https://fedorahosted.org/freeipa/ticket/6203 Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns: normalize record type read interactively in dnsrecord_addJan Cholasta2016-09-061-0/+2
| | | | | | | | | | | | | When dnsrecord_add is called without options in interactive mode, it prompts the user to enter a record type. The record type is expected to be upper case further in the code, which causes non-upper case values not to work correctly. Fix this issue by upper casing the value after it is read. https://fedorahosted.org/freeipa/ticket/6203 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Track lightweight CAs on replica installationFraser Tweedale2016-09-063-44/+77
| | | | | | | | | | Add Certmonger tracking requests for lightweight CAs on replica installation. As part of this change, extract most of the lightweight CA tracking code out of ipa-certupdate and into cainstance. Fixes: https://fedorahosted.org/freeipa/ticket/6019 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix ipa-certupdate for CA-less installationFlorence Blanc-Renaud2016-09-061-3/+4
| | | | | | | | | | | | | | | | | In a CA-less installation, ipa-certupdate fails with the error message: $ ipa-certupdate trying https://vm-180.abc.idm.lab.eng.brq.redhat.com/ipa/session/json Forwarding 'ca_is_enabled' to json server 'https://vm-180.abc.idm.lab.eng.brq.redhat.com/ipa/session/json' Forwarding 'ca_find/1' to json server 'https://vm-180.abc.idm.lab.eng.brq.redhat.com/ipa/session/json' CA is not configured The ipa-certupdate command failed. The issue happens because ipa-certupdate tries to call ca_find even on a CA_less deployment. The fix skips the call to ca_find in this case. https://fedorahosted.org/freeipa/ticket/6288 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix ScriptError to always return string from __str__Martin Basti2016-09-051-3/+4
| | | | | | | | | Use super for proper handling of exceptions. msg property was added due compatibility with the current code. https://fedorahosted.org/freeipa/ticket/6294 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Use RSA-OAEP instead of RSA PKCS#1 v1.5Christian Heimes2016-09-051-1/+1
| | | | | | | | | | | jwcrypto's RSA1-5 (PKCS#1 v1.5) is vulnerable to padding oracle side-channel attacks. OAEP (PKCS#1 v2.0) is a safe, more modern alternative. https://fedorahosted.org/freeipa/ticket/6278 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* cli: use full name when executing a commandJan Cholasta2016-09-051-1/+1
| | | | | | | | | Fixes the CLI not to always call the default version of a command even when the version was explicitly specified. https://fedorahosted.org/freeipa/ticket/6279 Reviewed-By: Martin Basti <mbasti@redhat.com>
* raise ValidationError when deprecated param is passed to commandMartin Babinsky2016-09-051-4/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/6190 Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* Always fetch forest info from root DCs when establishing one-way trustMartin Babinsky2016-09-051-1/+24
| | | | | | | | | | | | | | Prior To Windows Server 2012R2, the `netr_DsRGetForestTrustInformation` calls performed against non-root forest domain DCs were automatically routed to the root domain DCs to resolve trust topology information. This is no longer the case, so the `com.redhat.idm.trust-fetch-domains` oddjob helper used to establish one-way needs to explicitly contact root domain DCs even in the case when an external trust to non-root domain is requested. https://fedorahosted.org/freeipa/ticket/6057 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* factor out `populate_remote_domain` method into module-level functionMartin Babinsky2016-09-051-41/+53
| | | | | | | | | | This allows for re-use of this method in cases where the caller can not or wishes not to instantiate local Samba domain to retrieve information about remote ones. https://fedorahosted.org/freeipa/ticket/6057 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Always fetch forest info from root DCs when establishing two-way trustMartin Babinsky2016-09-051-8/+21
| | | | | | | | | | | | | | Prior To Windows Server 2012R2, the `netr_DsRGetForestTrustInformation` calls performed against non-root forest domain DCs were automatically routed to the root domain DCs to resolve trust topology information. This is no longer the case, so the `dcerpc.fetch_domains` function must explicitly contact root domain DCs even in the case when an external two-way trust to non-root domain is requested. https://fedorahosted.org/freeipa/ticket/6057 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Don't show error messages in bash completionTomas Krizek2016-09-021-1/+1
| | | | | | | | | Redirect bash error output to prevent displaying error messages in bash completion for ipa command. https://fedorahosted.org/freeipa/ticket/6273 Reviewed-By: David Kupka <dkupka@redhat.com>
* Bump master IPA devel version to 4.4.90Martin Basti2016-09-011-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Become IPA 4.4.1Martin Basti2016-09-011-1/+1
|
* Tests: Avoid skipping tests due to missing filesLenka Doudova2016-09-012-22/+30
| | | | | | | | | | | When running test_install/test_updates and test_pkcs10/test_pkcs10 as outoftree, these are skipped with reason 'Unable to find test update files'. For outoftree tests wrong paths are checked for these files. Changing file localization to provide proper test setup. https://fedorahosted.org/freeipa/ticket/6284 Reviewed-By: Martin Basti <mbasti@redhat.com>
* rpcserver: fix crash in XML-RPC system commandsJan Cholasta2016-09-011-4/+4
| | | | | | | | | | Fix an AttributeError in XML-RPC methodSignature and methodHelp commands caused by incorrect mangled name usage. https://fedorahosted.org/freeipa/ticket/6217 Reviewed-By: Lenka Doudova <ldoudova@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* custodia: force reconnect before retrieving CA certs from LDAPJan Cholasta2016-09-011-0/+2
| | | | | | | | | | | Force reconnect to LDAP as DS might have been restarted after the connection was opened, rendering the connection invalid. This fixes a crash in ipa-replica-install with --setup-ca. https://fedorahosted.org/freeipa/ticket/6207 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Revert "Enable LDAPS in replica promotion"Martin Basti2016-08-311-1/+0
| | | | | | | | | | This reverts commit 89de60c5d8ba64d619101a7498b8c4469b6e50ae. This commit breaks replica installation https://fedorahosted.org/freeipa/ticket/6226 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* do not use trusted forest name to construct domain admin principalMartin Babinsky2016-08-311-1/+1
| | | | | | | | | | | | | | When `trust-add` is supplied AD domain admin name without realm component, the code appends the uppercased AD forest root domain name to construct the full principal. This can cause authentication error, however, when external trust with non-root domain is requested. We should instead use the supplied DNS domain name (if valid) as a realm component. https://fedorahosted.org/freeipa/ticket/6277 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Tests: Add missing attributes to test_xmlrpc/test_trust testsLenka Doudova2016-08-311-3/+9
| | | | | | | | | Several tests in test_xmlrpc/test_trust_plugin.py fail because some attributes are not expected. Fixing the tests so that the extra attributes are recognized. https://fedorahosted.org/freeipa/ticket/6276 Reviewed-By: Ganna Kaihorodova <gkaihoro@redhat.com>
* rpcserver: assume version 1 for unversioned command callsJan Cholasta2016-08-311-16/+27
| | | | | | | | | | | | | When a command is called on the server over RPC without its version specified, assume version 1 instead of the highest known version. This ensures backward compatibility with old clients, which do not support versioned commands and understand only the first version of any given command. https://fedorahosted.org/freeipa/ticket/6217 Reviewed-By: David Kupka <dkupka@redhat.com>
* Tests: Random issuer certificate can be added to a serviceLenka Doudova2016-08-311-7/+33
| | | | | | | | | | | Changing negative test case that verified that a certificate with different than expected issuer cannot be added to a service to a positive one that verifies that this operation now proceeds successfully. Corresponds to changes made in scope of https://fedorahosted.org/freeipa/ticket/4559 implementation. https://fedorahosted.org/freeipa/ticket/6258 Reviewed-By: Ganna Kaihorodova <gkaihoro@redhat.com>
* ipa-pwd-extop memory leak during passord updateThierry Bordaz2016-08-311-7/+17
| | | | | | | | During an extend op password update, there is a test if the user is changing the password is himself. It uses local Slapi_SDN variable that are not freed Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix CA ACL Check on SubjectAltNamesSimo Sorce2016-08-311-4/+8
| | | | | | | | | | The code is supposed to check that the SAN name is also authorized to be used with the specified profile id. The original principal has already been checked. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Raise error when running ipa-adtrust-install with empty netbios--nameLenka Doudova2016-08-302-6/+6
| | | | | | | | | | | | | | | When running ipa-adtrust-install, a netbios-name option must be specified. Currently if an invalid netbios name in form of empty string is specified, the installation proceeds, but changes the invalid value to a netbios name determined from domain name without any notification. Fixing this so that any attempt to supply empty string as netbios name fails with error in case of unattended installation, or to request input of valid netbios name from command line during normal installation. https://fedorahosted.org/freeipa/ticket/6120 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Disabled raiseonerr in kinit call during topology level checkOleg Fayans2016-08-301-5/+12
| | | | | | | | | | | domainlevel method is called upon each master uninstallation. Sometimes the master uninstallation is called from within teardown method of some tests when the master was not in fact installed, in which case the kinit_admin would always raise an error. https://fedorahosted.org/freeipa/ticket/6254 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert: include CA name in cert command outputJan Cholasta2016-08-301-9/+24
| | | | | | | | | | | | Include name of the CA that issued a certificate in cert-request, cert-show and cert-find. This allows the caller to call further commands on the cert without having to call ca-find to find the name of the CA. https://fedorahosted.org/freeipa/ticket/6151 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert: add missing param values to cert-find outputJan Cholasta2016-08-301-1/+2
| | | | | | | | | Add back `serial_number_hex` and `revoked` param values to cert-find output accidentally removed in commit c718ef058847bb39e78236e8af0ad69ac961bbcf. https://fedorahosted.org/freeipa/ticket/6269 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Print to debug output answer from CAMartin Basti2016-08-301-0/+1
| | | | | | | CA request may fail due various erros, without debug output we cannot decide what is wrong. Reviewed-By: Oleg Fayans <ofayans@redhat.com>
* Tests: fix test_forward_zones in test_xmlrpc/test_dns_pluginPetr Spacek2016-08-301-9/+1
| | | | | | | | | | | | | | | | | | Class test_forward_zones in ipatests/test_xmlrpc/test_dns_plugin was using DNS zone 'fwzone2.test.' and expected to get warning 'Forwarding policy conflicts with some automatic empty zones.' (aka 'DNSForwardPolicyConflictWithEmptyZone'). This does not make sense because 'test.' zone is not listed in IANA registry 'Locally-Served DNS Zones': http://www.iana.org/assignments/locally-served-dns-zones/locally-served-dns-zones.xhtml To fix this I simply removed the warning from set of expected results. https://fedorahosted.org/freeipa/ticket/6213 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Tests: fix test_forward_zones in test_xmlrpc/test_dns_pluginPetr Spacek2016-08-301-2/+2
| | | | | | | | | | | | Class test_forward_zones in ipatests/test_xmlrpc/test_dns_plugin had server IP and zone name interchanged in "expected" dictionart. I do not understand how this happened. https://fedorahosted.org/freeipa/ticket/6213 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Test for caacl-add-servicegkaihoro2016-08-301-0/+1
| | | | | | | | Test for caacl-add-service: incorrect error message when service does not exists https://fedorahosted.org/freeipa/ticket/6171 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Update translationsMartin Basti2016-08-3022-24952/+64980
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* freeipa.spec.in: move ipa CLI utility to freeipa-clientAlexander Bokovoy2016-08-301-31/+12
| | | | | | | | | | | | There is no notable package size cost, as all the libraries and packages are already in the freeipa-client package and freeipa-admintools only contained a short shim calling this code. Move /bin/ipa to freeipa-client, along with a man page and bash completion. Resolves: https://fedorahosted.org/freeipa/ticket/5934 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Raise DuplicatedEnrty error when user exists in delete_containerMartin Basti2016-08-301-2/+13
| | | | | | | | | | | We do not have right to write to users delete_container. In case that user already exists in that container and we tried to add entry, we receive ACIError. This must be checked and DuplicationEntry error must be raised before. https://fedorahosted.org/freeipa/ticket/6199 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-29 12:50:35 +0000