summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Use /etc/ipa/nssdb to get nicknames of IPA certs installed in /etc/pki/nssdbJan Cholasta2014-09-303-96/+42
| | | | | | | | | Previously a list of nicknames was kept in /etc/pki/nssdb/ipa.txt. The file is removed now. https://fedorahosted.org/freeipa/ticket/3259 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use NSSDatabase instead of direct certutil calls in client codeJan Cholasta2014-09-303-58/+26
| | | | | | https://fedorahosted.org/freeipa/ticket/4416 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Add NSSDatabase.has_nickname for checking nickname presence in a NSS DBJan Cholasta2014-09-301-0/+9
| | | | | | https://fedorahosted.org/freeipa/ticket/4416 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move NSSDatabase from ipaserver.certs to ipapython.certdbJan Cholasta2014-09-302-447/+452
| | | | | | https://fedorahosted.org/freeipa/ticket/4416 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Introduce NSS database /etc/ipa/nssdbJan Cholasta2014-09-306-64/+153
| | | | | | | | | | This is the new default NSS database for IPA. /etc/pki/nssdb is still maintained for backward compatibility. https://fedorahosted.org/freeipa/ticket/3259 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix ImportError in ipa-ca-installMartin Kosek2014-09-301-1/+1
| | | | | | | Patch 3aa0731f was not merged correctly and import for a function that no longer exists. This patch fixes the import. https://fedorahosted.org/freeipa/ticket/4480
* Do stricter validation of CA certificatesJan Cholasta2014-09-302-4/+15
| | | | | | | | | Every CA certificate must have non-empty subject and basic constraints extension with the CA flag set. https://fedorahosted.org/freeipa/ticket/4477 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Allow choosing CA-less server certificates by nameJan Cholasta2014-09-306-7/+53
| | | | | | | | | | | Added new --*-cert-name options to ipa-server-install and ipa-replica-prepare and --cert-name option to ipa-server-certinstall. The options allows choosing a particular certificate and private key from PKCS#12 files by its friendly name. https://fedorahosted.org/freeipa/ticket/4489 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* CA-less installer options usability fixesJan Cholasta2014-09-308-232/+326
| | | | | | | | | | | | | | | | | | | The --*_pkcs12 options of ipa-server-install and ipa-replica-prepare have been replaced by --*-cert-file options which accept multiple files. ipa-server-certinstall now accepts multiple files as well. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. The --root-ca-file option of ipa-server-install has been replaced by --ca-cert-file option which accepts multiple files. The files are accepted in PEM and DER certificate and PKCS#7 certificate chain formats. The --*_pin options of ipa-server-install and ipa-replica-prepare have been renamed to --*-pin. https://fedorahosted.org/freeipa/ticket/4489 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* External CA installer options usability fixesJan Cholasta2014-09-309-141/+136
| | | | | | | | | | | The --external_cert_file and --external_ca_file options of ipa-server-install and ipa-ca-install have been replaced by --external-cert-file option which accepts multiple files. The files are accepted in PEM and DER certificate and PKCS#7 certificate chain formats. https://fedorahosted.org/freeipa/ticket/4480 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add NSSDatabase.import_files method for importing files in various formatsJan Cholasta2014-09-301-0/+191
| | | | | | | | | | The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. https://fedorahosted.org/freeipa/ticket/4480 https://fedorahosted.org/freeipa/ticket/4489 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* extdom: add support for new versionSumit Bose2014-09-303-252/+603
| | | | | | | | | | | | | | | Currently the extdom plugin is basically used to translate SIDs of AD users and groups to names and POSIX IDs. With this patch a new version is added which will return the full member list for groups and the full list of group memberships for a user. Additionally the gecos field, the home directory and the login shell of a user are returned and an optional list of key-value pairs which currently will contain the SID of the requested object if available. https://fedorahosted.org/freeipa/ticket/4031 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* Use stack allocation when writing values during otp authNathaniel McCallum2014-09-301-17/+11
| | | | Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* webui: do not offer ipa-ad-winsync and ipa-ipa-trust range typesPetr Vobornik2014-09-291-8/+0
| | | | | | They are not supported by API. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* baseldap: Properly handle the case of renaming object to the same nameTomas Babej2014-09-292-11/+35
| | | | | | | | | | When renaming a object to the same name, errors.EmptyModList is raised. This is not properly handled, and can cause other modifications in the LDAPUpdate command to be ignored. https://fedorahosted.org/freeipa/ticket/4548 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow specifying signing algorithm of the IPA CA cert in ipa-server-install.Jan Cholasta2014-09-293-5/+23
| | | | | | | | | This is especially useful for external CA install, as the algorithm is also used for the CSR signature. https://fedorahosted.org/freeipa/ticket/4447 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Do not require description in UI.David Kupka2014-09-2910-17/+17
| | | | | | | | | Description attribute is not required in LDAP schema so there is no reason to require it in UI. Modified tests to reflect this change. https://fedorahosted.org/freeipa/ticket/4387 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Detect and configure all usable IP addresses.David Kupka2014-09-266-247/+255
| | | | | | | | | | | Find, verify and configure all IP addresses that can be used to reach the server FreeIPA is being installed on. Ignore some IP address only if user specifies subset of detected addresses using --ip-address option. This change simplyfies FreeIPA installation on multihomed and dual-stacked servers. https://fedorahosted.org/freeipa/ticket/3575 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver.install.service: Don't show error message on SystemExit(0)Petr Viktorin2014-09-261-8/+9
| | | | | | Additional fix for: https://fedorahosted.org/freeipa/ticket/4499 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add 'host' setting into default.conf configuration file on client. Fix ↵David Kupka2014-09-262-4/+5
| | | | | | | | | | description in man page. 'host' setting specifies local hostname not the hostname of IPA server. https://fedorahosted.org/freeipa/ticket/4481 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* LDAP disable serviceMartin Basti2014-09-261-1/+66
| | | | | | This patch allows to disable service in LDAP (ipactl will not start it) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactoring of autobind, object_existsMartin Basti2014-09-266-50/+50
| | | | | | | | | Required to prevent code duplications ipaldap.IPAdmin now has method do_bind, which tries several bind methods ipaldap.IPAClient now has method object_exists(dn) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-restore: Set SELinux booleans when restoringPetr Viktorin2014-09-262-0/+43
| | | | | | https://fedorahosted.org/freeipa/ticket/4157 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Move setting SELinux booleans to platform codePetr Viktorin2014-09-265-119/+152
| | | | | | | | | | | | | | | | | | | Create a platform task for setting SELinux booleans. Use an exception for the case when the booleans could not be set (since this is an error if not handled). Since ipaplatform should not depend on ipalib, create a new errors module in ipapython for SetseboolError. Handle uninstallation with the same task, which means the booleans are now restored with a single call to setsebool. Preparation for: https://fedorahosted.org/freeipa/ticket/4157 Fixes: https://fedorahosted.org/freeipa/ticket/2934 Fixes: https://fedorahosted.org/freeipa/ticket/2519 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* ipa-kdb: fix unit testsSumit Bose2014-09-262-1/+4
| | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
* Remove --ip-address, --name-server otpions from DNS helpMartin Basti2014-09-261-5/+2
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* DNS tests: tests update to due to change in optionsMartin Basti2014-09-254-354/+231
| | | | | | | | Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* WebUI: DNS: Remove ip-address, admin-email optionsMartin Basti2014-09-251-89/+4
| | | | | | Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS: autofill admin emailMartin Basti2014-09-254-21/+11
| | | | | | | | | Admins email (SOA RNAME) is autofilled with value 'hostmaster'. Bind will automaticaly append zone part. Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add correct NS records during installationMartin Basti2014-09-252-46/+57
| | | | | | | | | | | All ipa-dns capable server is added to root zones as nameserver During uninstall all NS records pointing to particular replica are removed. Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Deprecation of --name-server and --ip-address option in DNSMartin Basti2014-09-254-86/+100
| | | | | | | | | | | | | Option --name-server is changing only SOA MNAME, this option has no more effect to NS records Option --ip-addres is just ignored A warning message is sent after use these options Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS test: allow '.' as zone nameMartin Basti2014-09-251-0/+104
| | | | | | https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix DNS plugin to allow to add root zoneMartin Basti2014-09-251-24/+32
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipa-replica-prepare: Wait for the DNS entry to be resolvablePetr Viktorin2014-09-251-0/+53
| | | | | | | | | | | | | | | | | | | It takes some time after the DNS record is added until it propagates to Bind. In automated installations, it might happen that replica-install is attempted before the hostname is resolvable; in that case the connection check would fail. Wait for the name to be resolvable at the end of replica-prepare. Mention that this can be interrupted (Ctrl+C). Provide an option to skip the wait. In case DNS is not managed by IPA, this reminds the admin of the necessary configuration and checks their work, but it's possible to skip (either by interrupting it interactively, or by the option). https://fedorahosted.org/freeipa/ticket/4551 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* upgradeinstance: Restore listeners on failurePetr Viktorin2014-09-252-12/+37
| | | | | | | | | Allow running some installation after failure, and use this for the upgradeinstance cleanup steps. https://fedorahosted.org/freeipa/ticket/4499 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_permission_plugin: Check legacy permissionsPetr Viktorin2014-09-251-4/+12
| | | | | | | | | Currently a number of v2 permissions are in $SUFFIX, which the original test did not anticipate. Properly check that legacy permissions are found. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* FIX: ldap schmema updater needs correct ordering of the updatesMartin Basti2014-09-252-44/+91
| | | | | | | | | Required bugfix in python-ldap 2.4.15 Updates must respect SUP objectclasses/attributes and update dependencies first Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* WebUI: DNS: remove --class optionMartin Basti2014-09-251-7/+0
| | | | | | Ticket: https://fedorahosted.org/freeipa/ticket/3414 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS: remove --class optionMartin Basti2014-09-251-4/+5
| | | | | | | | This option haven't been working, it is time to remove it. Ticket: https://fedorahosted.org/freeipa/ticket/3414 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* webui-ci: case-insensitive record checkPetr Vobornik2014-09-251-3/+2
| | | | | | Indirect association are no longer lower cased, which caused a issue in CI. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: fix regression in association facet preopPetr Vobornik2014-09-251-1/+1
| | | | | | | Association facet specs use 'add_method' instead of 'add command' origin: https://fedorahosted.org/freeipa/ticket/4507 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* dnszone-remove-permission should raise errorMartin Basti2014-09-251-4/+1
| | | | | | | dnszone-remove-permission should raise NotFound error if permission was not found (regression of 21c829ff). Reviewed-By: Martin Kosek <mkosek@redhat.com>
* JSON client: Log pretty-printed request and response with -vv or abovePetr Viktorin2014-09-243-4/+12
| | | | | | | | | | | | | The whole HTTP request is now printed with -vvv or above. Changes `verbose` in the connection to be the level from api.env, rather than a boolean value. For XML-RPC, the whole request will be shown already with -v. https://fedorahosted.org/freeipa/ticket/4233 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add test for backup/delete system users/restorePetr Viktorin2014-09-241-10/+48
| | | | | | Regression test for: https://fedorahosted.org/freeipa/ticket/3866 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add basic test for backup & restorePetr Viktorin2014-09-241-0/+110
| | | | | | https://fedorahosted.org/freeipa/ticket/3893 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Set the default attributes for RootDSETomas Babej2014-09-242-0/+10
| | | | | | | | | | | With 389 DS 1.3.3 upwards we can leverage the nsslapd-return-default-opattr attribute to enumerate the list of attributes that should be returned even if not specified explicitly. Use the behaviour to get the same attributes returned from searches on rootDSE as in 1.3.1. https://fedorahosted.org/freeipa/ticket/4288 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Include the ipa command in client-only buildJan Cholasta2014-09-232-6/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4536 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Include ipaplatform in client-only buildJan Cholasta2014-09-233-3/+9
| | | | | | https://fedorahosted.org/freeipa/ticket/4533 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Allow RPM upgrade from ipa-* packagesJan Cholasta2014-09-231-5/+16
| | | | | | https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix certmonger code causing the ca_renewal_master update plugin to failJan Cholasta2014-09-232-2/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/4547 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2026-03-13 07:19:02 +0000