summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Enabled recreation of test directory in apply_common_fixes functionOleg Fayans2016-01-292-2/+1
| | | | | | | | | | | Without it any test comprized of more than one cycle of installing-uninstalling of ipa would fail due to the fact that test folder on the remote machine gets deleted during ipa uninstallation. Also removed duplicate call of apply_common fixes and added unapply_fixes to uninstall_replica Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC CI: fix zone delegationsMartin Basti2016-01-291-1/+8
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* fix standalone installation of externally signed CA on IPA masterMartin Babinsky2016-01-281-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5636 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-getkeytab: Handle the possibility of not obtaining a resultTomas Babej2016-01-271-0/+4
| | | | | | | | | The ldap_result operation can time out, returning a NULL result, which in turn causes the parsing operation to crash. https://fedorahosted.org/freeipa/ticket/5642 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: remove moot error from webui buildPetr Vobornik2016-01-271-1/+2
| | | | | | | | | | add module 'libs/d3' to a list of modules provided by third party libraries it is provided by d3 library in libs directory https://fedorahosted.org/freeipa/ticket/5641 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* ipa-kdb: get_authz_data_types() make sure entry can be NULLSumit Bose2016-01-272-1/+9
| | | | | | | | | | | | This function determines which type of authorization data should be added to the Kerberos ticket. There are global default and it is possible to configure this per service as well. The second argument is the data base entry of a service. If no service is given it makes sense to return the global defaults and most parts of get_authz_data_types() handle this case well and this patch fixes the remain issue and adds a test for this as well. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use HTTPD_USER in dogtaginstance.pyTimo Aaltonen2016-01-271-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5587 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert renewal: import all external CA certs on IPA CA cert renewalJan Cholasta2016-01-271-19/+9
| | | | | | | | | | Import all external CA certs to the Dogtag NSS database on IPA CA cert renewal. This fixes Dogtag not being able to connect to DS which uses 3rd party server cert after ipa-certupdate. https://fedorahosted.org/freeipa/ticket/5595 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: crash nicely if sessionStorage is not availablePetr Vobornik2016-01-272-6/+19
| | | | | | https://fedorahosted.org/freeipa/ticket/5643 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add support for the 'user' url parameter for the reset_password.htmlPavel Vomacka2016-01-271-0/+4
| | | | | | | | The /ipa/ui/reset_password.html page is now able to use url paramater 'user'. The value of this parameter is used for pre-filling the username field. https://fedorahosted.org/freeipa/ticket/5001 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add tool tips for Revert, Refresh, Undo, and Undo AllPavel Vomacka2016-01-274-2/+12
| | | | | | | | | | | | Add tool tips for buttons in detail view. New tooltips: Reload - Reload current settings from the server. Revert - Undo all unsaved changes. Undo - Undo this change. Undo all - Undo all changes in this field. https://fedorahosted.org/freeipa/ticket/5428 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipatests: fix the install of external caMilan Kubík2016-01-271-1/+3
| | | | | | | | | Fixes the install invocation in the test to use domain and realm correctly. Also makes the test aware of domain levels. https://fedorahosted.org/freeipa/ticket/5605 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Warn user when ipa *-find reach limitMartin Basti2016-01-272-1/+17
| | | | | | | | | Truncated entries were silently ignored, now a user receives warning. https://fedorahosted.org/freeipa/ticket/4022 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Split ipa-client/ into ipaclient/ (Python library) and client/ (C, scripts)Petr Viktorin2016-01-2738-235/+111
| | | | | | | | | | | | | | | | Make ipaclient a Python library like ipapython, ipalib, etc. Use setup.py instead of autotools for installing it. Move C client tools, Python scripts, and man pages, to client/. Remove old, empty or outdated, boilerplate files (NEWS, README, AUTHORS). Remove /setup-client.py (ipalib/setup.py should be used instead). Update Makefiles and the spec file accordingly. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* disable RA plugins when promoting a replica from CA-less masterMartin Babinsky2016-01-271-7/+17
| | | | | | | | | | There is no point in setting 'enable_ra' to True in IPA config when the replica is promoted from CA-less master. The installer should set 'enable_ra' to False and unset 'ra_plugin' directive in this case. https://fedorahosted.org/freeipa/ticket/5626 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor test_attrFilip Skola2016-01-261-388/+281
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Refactor test_replaceFilip Skola2016-01-261-126/+48
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Refactor test_user_plugin, use UserTracker for testsFilip Skola2016-01-252-1520/+1026
| | | | | Reviewed-By: Ales 'alich' Marecek <amarecek@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* stop installer when setup-ds.pl failPetr Vobornik2016-01-251-1/+1
| | | | | | | | | | DS instance install should fail immediately after setup-ds.pl fail. tickets: #2539, #3720, #5607 https://fedorahosted.org/freeipa/ticket/2539 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix DNSSEC test: add glue recordMartin Basti2016-01-251-1/+8
| | | | | | | Missing glue record causes test failure in cases when DNS zone was not managed by IPA DNS Reviewed-By: Petr Spacek <pspacek@redhat.com>
* spec file: package python-ipalib as noarchJan Cholasta2016-01-251-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* correctly set LDAP bind related attributes when setting up replicationMartin Babinsky2016-01-211-7/+15
| | | | | | | | | | | | | | when CA replica configures 'cn=replica,cn=o\=ipaca,cn=mapping tree,cn=config' entry on remote master during replica installation, the 'nsds5replicabinddn' and 'nsds5replicabinddngroup' attributes are not correctly updated when this entry already existed on the master (e.g. when existing domain-level 0 topology was promoted to domain level 1). This patch ensures that these attributes are always set correctly regardless of existence of the replica entry. https://fedorahosted.org/freeipa/ticket/5412 Reviewed-By: Martin Basti <mbasti@redhat.com>
* uninstallation: more robust check for master removal from topologyMartin Babinsky2016-01-212-4/+37
| | | | | | | | | | | | When uninstalling IPA master in domain level 1 topology, the code that checks for correct removal from topology will now consider failures to lookup host entry in local LDAP and to obtain host TGT as a sign that the master entry was already removed. https://fedorahosted.org/freeipa/ticket/5584 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove workaround for CA running checkFraser Tweedale2016-01-213-48/+4
| | | | | | | | | | | | | A workaround was introduced for ticket #4676 that used wget to perform an (unauthenticated) https request to check the CA status. Later, wget was changed to curl (the request remained unauthenticated). Remove the workaround and use an http request (no TLS) to check the CA status. Also remove the now-unused unauthenticated_http_request method, and update specfile to remove ipalib dependency on curl. Reviewed-By: Martin Basti <mbasti@redhat.com>
* prevent moving of topology entries out of managed scope by modrdn operationsLudwig Krispenz2016-01-213-0/+56
| | | | | | Ticket: https://fedorahosted.org/freeipa/ticket/5536 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Exclude o=ipaca subtree from Retro Changelog (syncrepl)Martin Basti2016-01-211-0/+1
| | | | | | | | | | CA and DS have issues with Retro Changelog plugin. CA subtree should be excluded from syncrepl. This should improve speed of CA related operations too. https://fedorahosted.org/freeipa/ticket/5538 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipapython: use python-cryptography instead of libcrypto in p11helperJan Cholasta2016-01-211-232/+108
| | | | | | | | Replace CFFI calls to libcrypto with equivalent python-cryptography code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipapython: port p11helper C code to PythonJan Cholasta2016-01-2116-2492/+1873
| | | | | | | | This replaces the binary _ipap11helper module with cffi-based Python code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Set close button type attribute to 'button'.James Groffen2016-01-201-0/+1
| | | | | | Stops IE10 from closing the dialog on an enter keypress. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fixed login error message box in LoginScreen pageAbhijeet Kasurde2016-01-201-4/+4
| | | | | | | | | | | Fix added for showing error message returned from server to client browser. User is now notified with proper error messages returned by server. https://bugzilla.redhat.com/show_bug.cgi?id=1293870 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: dislay server suffixes in server search pagePetr Vobornik2016-01-202-1/+12
| | | | | | | | | | | | | | There was a change where suffixes in server are not longer returned as DNs but rather a cn of related topology suffix. I.e. they share "memberof" logic. This caused that search page doesn't get the data because it uses "no_member: true" option by default. This patch overrides the behavior because it is OK for server search page to fetch also member data - it is not so costly as e.g. in users. https://fedorahosted.org/freeipa/ticket/5609 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Added kpasswd_server directive in client krb5.confAbhijeet Kasurde2016-01-201-0/+4
| | | | | | | | | | While configuring ipa client using ipa-client-install can configure kpasswd_server explicitly using directive in client's krb5.conf https://fedorahosted.org/freeipa/ticket/5547 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* spec: do not require arch specific ipalib package from noarch packagesPetr Vobornik2016-01-201-7/+7
| | | | | | | | | | | noarch packages should not contain: Requires: some-package-{?_isa} because then they are not the same for each arch - are not noarch https://fedorahosted.org/freeipa/ticket/5568 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* make-lint: Allow running pylint --py3k to detect Python3 issuesPetr Viktorin2016-01-201-13/+26
| | | | | | | | | | | | | | | Pylint can be run with the --py3k switch to detect porting issues. This is not compatible with regular checking (i.e. to do all checks, pylint must be run twice, with and without --py3k). So, do an additional run of pylint in a subprocess for the py3k checks. Add a --no-py3k switch to skip the additional py3k run. Also add a --no-lint switch to allow only running the py3 checks. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove deprecated contrib/RHEL4Petr Viktorin2016-01-207-1010/+0
| | | | | | | | | This code is no longer maintained. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* dnsutil: Rename __nonzero__ to __bool__Petr Viktorin2016-01-201-1/+3
| | | | | | | | | | In Python 3, this special method got renamed. Set both to the same function to keep compatibility. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Avoid builtins that were removed in Python 3Petr Viktorin2016-01-203-3/+3
| | | | | | | | | | | | - `file` was removed in favor of `open`. Switch to the new spelling. - `buffer` was removed in favor of a buffer protocol (and memoryview), and `reload` was moved to importlib. Both are used in py2-only blocks, so just placate PyLint. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Alias "unicode" to "str" under Python 3Petr Viktorin2016-01-206-0/+27
| | | | | | | | | | | | | | Follow-up to commit 23507e6124041ed17f39db211e802495e37520e7 The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use print_function future definition wherever print() is usedPetr Viktorin2016-01-203-0/+5
| | | | | | | | | | | | Pylint considers `print` a statement if the __future__ import is not present, even if it's used like a function with one argument. Add the __future__ import to files `pylint --py3k` complains about. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Don't index exceptions directlyPetr Viktorin2016-01-202-4/+4
| | | | | | | | | | In Python 3, exceptions don't behave as tuples of their arguments; instead of e[1] it's necessary to use e.args[1]. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use explicit truncating divisionPetr Viktorin2016-01-205-9/+9
| | | | | | | | | | In Python 3, the truncating division operator, //, is needed to get C-style "int division". https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* fixed an issue with master installation not creating reverse zoneOleg Fayans2016-01-191-3/+4
| | | | | | | | | When resolv.conf is set to point to the master's ip before installation, the ipa-server-install does not create a reverse zone for it's ip even despite --auto-reverse option provided. The fix is not to mess around with resolv.conf before master installation. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Loggger: Use warning instead of warn - dns pluginTomas Babej2016-01-191-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* logger: Use warning instead of warnTomas Babej2016-01-1811-25/+25
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* IPA upgrade: move replication ACIs to the mapping tree entryMartin Babinsky2016-01-181-1/+9
| | | | | | | | | | | | | | | During IPA server upgrade from pre-4.3 versions, the ACIs permitting manipulation of replication agreements are removed from the 'cn="$SUFFIX",cn=mapping tree,cn=config' and 'cn=o\3Dipaca,cn=mapping tree,cn=config'. However they are never re-added breaking management and installation of replicas. This patch modifies the update process so that the ACIs are first added to the 'cn=mapping tree,cn=config' and then removed from the child entries. https://fedorahosted.org/freeipa/ticket/5575 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix: uninstall does not stop named-pkcs11 and ipa-ods-exporterMartin Basti2016-01-182-0/+7
| | | | | | | | | | | ipactl is not aware of new services installed later, if ipactl restart or start has not been executed. This commit is workaround, proper fix may need to improve ipactl. https://fedorahosted.org/freeipa/ticket/5262 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipapython: remove default_encoding_utf8Jan Cholasta2016-01-158-142/+4
| | | | | | | | | Replace the "import default_encoding_utf8" in ipalib/cli.py with equivalent Python code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Warn about potential loss of CA, KRA, DNSSEC during uninstallMartin Basti2016-01-141-1/+11
| | | | | | | | | | If connection do LDAP failed (or LDAP server is down) we cannot verify if there is any additonal instance of CA, KRA, DNSSEC master. In this case a user is warned and promted to confirm uninstallation. https://fedorahosted.org/freeipa/ticket/5544 Reviewed-By: David Kupka <dkupka@redhat.com>
* CI test: fix regression in task.install_kraMartin Basti2016-01-141-1/+1
| | | | | | | | ipa-kra-install needs directory manager password Regression caused by c4b9b295d8184694c50c0d56051e0273445c98ec Reviewed-By: Martin Basti <mbasti@redhat.com>
* Enable pylint unbalanced-tuple-unpacking checkMartin Basti2016-01-142-3/+1
| | | | | | | | Enables check and fixes one issue. get_entries can be replaced by get_entry, filter is not needed because check of 'originfilter' attribute is done later. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2026-01-20 12:17:08 +0000