summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* cacert install: fix trust chain validationJan Cholasta2016-02-241-0/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5612 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fixes minor issuesStanislav Laznicka2016-02-243-7/+13
| | | | | | | | | | | | | Fixes issues discovered by Coverity plugins/baseldap.py: possible undefined value in return certmonger.py: possible dereference of None value i18n.py: fixed always True bug (+ cosmetic change) https://fedorahosted.org/freeipa/ticket/5661 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Cosmetic changes to the codeStanislav Laznicka2016-02-245-6/+5
| | | | | | | | | | | | | | | Fixes some Coverity issues ipadiscovery.py: added assert should universe break plugins/dns.py: removed dead code dnssec/ldapkeydb.py: attribute assert in the proper object test_automount_plugin.py: fixed possible close() on None xmlrpc_test.py: Coverity does not like accessing None.__class__ https://fedorahosted.org/freeipa/ticket/5661 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix upgrade: wait for proper DS socket after DS restartMartin Basti2016-02-231-3/+1
| | | | | | | | | | | DS restart executed by upgrade plugin causes that upgrade framework is waiting for the improper socket. It leads to TimeoutError because DS is not listening on 389 port during upgrade. This commit fixes the issue. Required for: https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Warn user if trust is brokenMartin Basti2016-02-232-0/+52
| | | | | | | | | | Detect missing ipaNTSecurityIdentifier and print message for a user, that the trust is broken as result of trust-show and trust-find commands. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* trusts: use ipaNTTrustPartner attribute to detect trust entriesMartin Basti2016-02-232-3/+6
| | | | | | | | | | | | | | Trust entries were found by presence of ipaNTSecurityIdentifier attribute. Unfortunately this attribute might not be there due the bug. As replacement for this, attribute ipaNTTrustPartner can be used. Note: other non trust entries located in cn=trusts subtree can be cross-realm principals. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* upgrade: fix config of sidgen and extdom pluginsMartin Basti2016-02-234-8/+163
| | | | | | | | | | | | | | | During upgrade to IPA 4.2, literally "$SUFFIX" value was added to configuration of sidgen and extdom plugins. This cause that SID are not properly configured. Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task against IPA domain (if exists). All trusts added when plugins configuration was broken must be re-added. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* CI: Add test for double-circle topology generator.David Kupka2016-02-231-0/+63
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: Add replication test utilizing double-circle topology.David Kupka2016-02-231-0/+18
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: Add double circle topology.David Kupka2016-02-231-0/+52
| | | | | | | Every site consist of at least two replicas and is connected to two other sites. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: add empty topology test for 2-connected topology generatorDavid Kupka2016-02-231-0/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* CI: Fix pep8 errors in 2-connected topology generatorDavid Kupka2016-02-231-5/+6
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Py3: do not use dict.iteritems()Martin Basti2016-02-231-2/+2
| | | | | | | | | | Py3 does not support iter* methods, this commit replaces 2 occurencies of iteritems() to items(). The dictionaries there are not big, this is sufficient we do not need to use six. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Disable new pylint checksMartin Basti2016-02-231-1/+14
| | | | | | | | | | | | | | New checks have been introduced in pylint 1.5 and many of them are not compatible with IPA code or produce false positives. Disable them all. Note: due older versions of pylint, new checks cannot be disabled locally, must be disabled globally. https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com>
* upgrade: unconditional import of certificate profiles into LDAPMartin Babinsky2016-02-232-3/+9
| | | | | | | | | | | | | | During IPA server upgrade, the migration of Dogtag profiles into LDAP backend was bound to the update of CS.cfg which enabled the LDAP profile subsystem. If the subsequent profile migration failed, the subsequent upgrades were not executing the migration code leaving CA subsystem in broken state. Therefore the migration code path should be executed regardless of the status of the main Dogtag config file. https://fedorahosted.org/freeipa/ticket/5682 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* webui: fixed showing of success message after password change on loginPetr Vobornik2016-02-231-1/+1
| | | | | | | | | | similar issue and cause as in https://fedorahosted.org/freeipa/ticket/5567 root cause is that binding triggers validation which clears messages in validation summary. Maybe it could be refactored in a future to not use the same validation summary field for API calls and fields. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: use API call ca_is_enabled instead of enable_ra env variable.Petr Vobornik2016-02-233-1/+15
| | | | | | | | To be consistent with backend code. https://fedorahosted.org/freeipa/ticket/5622 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* WebUI tests: fix failing of tests due to unclicable labelLenka Doudova2016-02-231-5/+1
| | | | | | | | | | | | Checkbox label is no longer clickable, most tests fail with error like this: AssertionError: Can't click on checkbox label: table.table Message: Element is not clickable at point (37, 340.3999938964844). Other element would receive the click: <input class="standalone" id="cn18" value="itest-group" name="cn" type="checkbox"> The checkbox is clickable directly without the label, this patch provides according fix. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* cli: Don't encode/decode for stdin/stdout on Python 3Petr Viktorin2016-02-171-17/+24
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* p11helper: Port to Python 3Petr Viktorin2016-02-171-6/+5
| | | | | | | | | - Use binascii.hexlify instead of encode('hex') - Keep the library name as a text string instead of encoding to bytes https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* test_util: str/bytes check fixes for Python 3Petr Viktorin2016-02-171-6/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipautil: Use mode 'w+' in write_tmp_filePetr Viktorin2016-02-171-1/+1
| | | | | | | | | Python defaults to 'w+b', but all callers in IPA write use text (as opposed to bytes). https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* tests: Use absolute importsPetr Viktorin2016-02-172-6/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipautil.run, kernel_keyring: Encoding fixes for Python 3Petr Viktorin2016-02-173-6/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap, ldapupdate: Encoding fixes for Python 3Petr Viktorin2016-02-172-4/+18
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix bytes/string handling in rpcMichael Simacek2016-02-171-7/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* test_parameters: Ignore specific error messagePetr Viktorin2016-02-171-2/+1
| | | | | | | | | | | | | In Python 3, the error message from the decimal module is less clear than before. (It's apparently the price to pay for speed -- Python3 uses libmpdec as its Decimal implementation by default.) Don't check for the exact error message. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* CI: Add test for 2-connected topology generator.David Kupka2016-02-121-0/+19
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: Add simple replication test in 2-connected topology.David Kupka2016-02-121-0/+18
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* CI: Add '2-connected' topology generator.David Kupka2016-02-121-0/+57
| | | | | | | | | | | If number of servers (master+replicas) is equal to 4 + SUM(1, n, 2^n*5) for any n >= 0: * every server has replication agreement with 2 - 4 other servers. * at least two agreements must fail in order to disconnect the topology. Otherwise there can be server(s) with single agreement on the edge of the topology. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Upgrade: log to ipaupgrade.log when IPA server is not installedMartin Basti2016-02-111-1/+1
| | | | | | | | | | Message was printed only to stdout and leaves ipaupgrade.log without any record that ipa-server-upgrade failed because ipa server is not installed. Now error is passed to logger which prints meassage to stderr and ipaupgrade.log. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica promotion: fix AVC denials in remote connection checkJan Cholasta2016-02-112-6/+3
| | | | | | | | Also move com.redhat.idm.trust-fetch-domains to /usr/libexec/ipa/oddjob. https://fedorahosted.org/freeipa/ticket/5550 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipatests: Add missing certificate profile fixtureMilan Kubík2016-02-111-1/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/5630 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* make lint: use config file and plugin for pylintMartin Basti2016-02-116-354/+312
| | | | | | | | | | | | | | | | | | | Our custom implementation of pylint checker is often broken by incompatible change on pylint side. Using supported solutions (config file, pylint plugins) should avoid this issue. The plugin adds missing (dynamic) member to classes in abstract syntax tree generated for pylint, instead of just ignoring missing members and all sub-members. This should improve pylint detection of typos and missing members in api. env and test config. make-lint python script has been removed, to run pylint execute 'make lint' https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modernize mod_nss's cipher suitesChristian Heimes2016-02-114-0/+220
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The list of supported TLS cipher suites in /etc/httpd/conf.d/nss.conf has been modernized. Insecure or less secure algorithms such as RC4, DES and 3DES are removed. Perfect forward secrecy suites with ephemeral ECDH key exchange have been added. IE 8 on Windows XP is no longer supported. The list of enabled cipher suites has been generated with the script contrib/nssciphersuite/nssciphersuite.py. TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_256_CBC_SHA https://fedorahosted.org/freeipa/ticket/5589 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Removed --ip-address option from replica installationOleg Fayans2016-02-041-7/+30
| | | | | | | | | | Explicitly specifying ip-address of the replica messes up with the current bind-dyndb-ldap logic, causing reverse zone not to be created. Enabled reverse-zone creation for the clients residing in different subnet from master Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add validation to Issue new certificate dialogPavel Vomacka2016-02-022-20/+45
| | | | | | | | | 'Issue new certificate' dialog now validates whether user fills 'principal' and 'csr' field. In case that one of these fields is empty then it does not allow to submit the dialog. https://fedorahosted.org/freeipa/ticket/5432 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* IPA-SAM: Fix build with samba 4.4Lukas Slebodnik2016-02-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | samba_util.h is not shipped with samba-4.4 and it was indirectly included by "ndr.h" Some functions have prototypes in different header file "util/talloc_stack.h" and other does not have declarations in other header file. But they are still part of libsamba-util.so sh$ objdump -T /usr/lib64/libsamba-util.so.0.0.1 | grep -E "trim_s|xstrdup" 0000000000022200 g DF .text 000000000000001f SAMBA_UTIL_0.0.1 smb_xstrdup 00000000000223b0 g DF .text 000000000000019d SAMBA_UTIL_0.0.1 trim_string ipa_sam.c: In function 'ldapsam_uid_to_sid': ipa_sam.c:836:24: warning: implicit declaration of function 'talloc_stackframe' [-Wimplicit-function-declaration] TALLOC_CTX *tmp_ctx = talloc_stackframe(); ^ ipa_sam.c: In function 'pdb_init_ipasam': ipa_sam.c:4493:2: warning: implicit declaration of function 'trim_string' [-Wimplicit-function-declaration] trim_string( uri, "\"", "\"" ); ^ ipa_sam.c:4580:26: warning: implicit declaration of function 'smb_xstrdup' [-Wimplicit-function-declaration] ldap_state->domain_dn = smb_xstrdup(dn); ^ Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix ipa-adtrust-install to always generate SRV records with FQDNsPetr Spacek2016-02-021-7/+2
| | | | | | | | | | | Previous code failed in following setup: * IPA domain = ipa.example.com * IPA master = vm1.example.com * IPA replica = vm2.example.com https://fedorahosted.org/freeipa/ticket/5663 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: map_groups() consider all resultsSumit Bose2016-02-021-52/+56
| | | | | | | Resolves https://fedorahosted.org/freeipa/ticket/5573 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fixed typo in service-addThorsten Scherf2016-02-021-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* always start certmonger during IPA server configuration upgradeMartin Babinsky2016-02-021-28/+5
| | | | | | | | | | | | This patch fixes a regression introduced by commit bef0f4c5c38e7ff6415e8f8c96dc306ef7f0ce56. Instead of checking whether there is CA installed in the topology, we should always start certmonger service during upgrade regardless when CA was configured. https://fedorahosted.org/freeipa/ticket/5655 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Automatically detect and remove dangling RUVsStanislav Laznicka2016-02-022-0/+163
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Listing and cleaning RUV extended for CA suffixStanislav Laznicka2016-02-022-16/+30
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Updated connect/disconnect replica to work with both domainlevelsOleg Fayans2016-02-011-6/+23
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* reset ldap.conf to point to newly installer replica after promotionMartin Babinsky2016-02-011-0/+44
| | | | | | | | | | | | When promoting a client to replica reset openldap client config so that it no longer uses remote master as default LDAP hosts but uses local connection to replica. Also make sure that the behavior regarding editing of user-customized config is consistent with the client installer. https://fedorahosted.org/freeipa/ticket/5488 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* replica install: validate DS and HTTP server certificatesJan Cholasta2016-02-011-1/+30
| | | | | | | | | Validate the DS and HTTP certificates from the replica info file early in ipa-replica-install to prevent crashes later. https://fedorahosted.org/freeipa/ticket/5598 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Convert ipa-sam to use the new getkeytab controlSimo Sorce2016-02-013-52/+33
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/5495 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Improve keytab code to select the right principal.Simo Sorce2016-02-014-9/+20
| | | | | | | | | | | | Whe requesting a keytab the salt used is the NORMAL type (for backwards and AD compatibility), however since we added alias support we need to search for the krbCanonicalName in preference, hen nothing is specified, and for the requested principal name when a getkeytab operation is performed. This is so that the correct salt can be applied. (Windows AD uses some peculiar aliases for some special accounts to generate the salt). Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: Remove unused macroLukas Slebodnik2016-01-291-2/+0
| | | | | | | Last usage of the macre SSSD_SYSDB_SID_STR was removed in the commit 0ee8fe11aea9811c724182def3f50960d5dd87b3 Reviewed-By: Sumit Bose <sbose@redhat.com>
generated by cgit (git 2.34.1) at 2026-03-05 16:33:46 +0000