summaryrefslogtreecommitdiffstats
path: root/daemons
Commit message (Collapse)AuthorAgeFilesLines
* ipa-otpd.socket.in: Use a platform specific value for KDC service fileTimo Aaltonen2017-04-122-1/+2
| | | | | | | https://pagure.io/freeipa/issue/6845 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix PKCS11 helperMartin Basti2017-04-122-3/+4
| | | | | | | | | | | | | | | | | | | | | | | Slots in HSM are not assigned statically, we have to chose proper slot from token label. Softhsm i2.2.0 changed this behavior and now slots can change over time (it is allowed by pkcs11 standard). Changelog: * created method get_slot() that returns slot number from used label * replaces usage of slot in __init__ method of P11_Helper with label * slot is dynamically detected from token label before session is opened * pkcs11-util --init-token now uses '--free' instead '--slot' which uses first free slot (we don't care about slot numbers anymore) https://pagure.io/freeipa/issue/6692 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix s4u2self with adtrustSimo Sorce2017-04-121-4/+10
| | | | | | | | | | | | When ADtrust is installed we add a PAC to all tickets, during protocol transition we need to generate a new PAC for the requested user ticket, not check the existing PAC on the requestor ticket. https://pagure.io/freeipa/issue/6862 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-sam: create the gidNumber attribute in the trusted domain entryFlorence Blanc-Renaud2017-04-071-3/+37
| | | | | | | | | | | | | | | | | | | When a trusted domain entry is created, the uidNumber attribute is created but not the gidNumber attribute. This causes samba to log Failed to find a Unix account for DOM-AD$ because the samu structure does not contain a group_sid and is not put in the cache. The fix creates the gidNumber attribute in the trusted domain entry, and initialises the group_sid field in the samu structure returned by ldapsam_getsampwnam. This ensures that the entry is put in the cache. Note that this is only a partial fix for 6660 as it does not prevent _netr_ServerAuthenticate3 from failing with the log _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client VM-AD machine account dom-ad.example.com. https://pagure.io/freeipa/issue/6827 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* IPA-KDB: use relative path in ipa-certmap config snippetSumit Bose2017-04-052-9/+5
| | | | | | | | | | | Architecture specific paths should be avoided in the global Kerberos configuration because it is read e.g. by 32bit and 64bit libraries they are installed in parallel. Resolves https://pagure.io/freeipa/issue/6833 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* extdom: improve cert requestSumit Bose2017-03-282-18/+142
| | | | | | | | | | | | | | | Certificates can be assigned to multiple user so the extdom plugin must use sss_nss_getlistbycert() instead of sss_nss_getnamebycert() and return a list of fully-qualified user names. Due to issues on the SSSD side the current version of lookups by certificates didn't work at all and the changes here won't break existing clients. Related to https://pagure.io/freeipa/issue/6826 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* extdom: do reverse search for domain separatorSumit Bose2017-03-281-3/+3
| | | | | | | | | To avoid issues which @-signs in the short user or group names it is better to search for the domain separator starting at the end of the fully-qualified name. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa-kdb: do not depend on certauth_plugin.hSumit Bose2017-03-272-0/+10
| | | | | | Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* IPA certauth pluginSumit Bose2017-03-276-1/+434
| | | | | | | | | | | | This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa-kdb: add ipadb_fetch_principals_with_extra_filter()Sumit Bose2017-03-272-13/+56
| | | | | | | | | Additionally make ipadb_find_principal public. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* configure: Use ODS_USER and NAMED_GROUP in daemons/dnssec/*.service.inTimo Aaltonen2017-03-223-4/+6
| | | | | | | | | These are platform specific, add values for Debian and default values for Fedora/RHEL. Also, use prettier output when checking the extra python install options. Reviewed-By: Martin Basti <mbasti@redhat.com>
* slapi plugins: fix CFLAGSJan Cholasta2017-03-1516-12/+24
| | | | | | | | | | | | Add explicit NSPR_CFLAGS and NSS_CFLAGS where NSPR_LIBS and NSS_LIBS is used. Use DIRSRV_CFLAGS rather than hardcode -I/usr/include/dirsrv. Append NSPR_CFLAGS to DIRSRV_CFLAGS in ./configure as slapi-plugin.h includes nspr.h. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Add support for searching policies in cn=accountsSimo Sorce2017-03-103-6/+17
| | | | | | | | | | | Use the new multibase search to collect policies from multiple subtrees. The 'any' parameter is set to 'true' so the search stop when the first result is found in any of the bases. https://fedorahosted.org/freeipa/ticket/6568 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add code to retrieve results from multiple basesSimo Sorce2017-03-102-0/+113
| | | | | | | | | Internally performs multiple seraches as needed based on the basedn strings passed in and whether the caller indicated that any result is ok or all results are needed. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use RemoveOnStop to cleanup systemd socketsNathaniel McCallum2017-02-171-1/+1
| | | | Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa-kdb: support KDB DAL version 6.1Alexander Bokovoy2017-02-153-20/+66
| | | | | | | | | | | | | | | | | | | | | | | | | DAL version 6.0 removed support for a callback to free principal. This broke KDB drivers which had complex e_data structure within the principal structure. As result, FreeIPA KDB driver was leaking memory with DAL version 6.0 (krb5 1.15). DAL version 6.1 added a special callback for freeing e_data structure. See details at krb5/krb5#596 Restructure KDB driver code to provide this callback in case we are built against DAL version that supports it. For DAL version prior to 6.0 use this callback in the free_principal callback to tidy the code. Use explicit KDB version dependency in Fedora 26+ via BuildRequires. With new DAL version, freeipa package will fail to build and we'll have to add a support for new DAL version explicitly. https://fedorahosted.org/freeipa/ticket/6619 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Clean / ignore make check artefactChristian Heimes2017-01-181-0/+3
| | | | | | | | | In tree runs of make check leave some artifacts around. The patch adds them to make clean and .gitignore. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-kdb: search for password policies globallyAlexander Bokovoy2016-12-151-1/+1
| | | | | | | | | | | | | | | | With the CoS templates now used to create additional password policies per object type that are placed under the object subtrees, DAL driver needs to search for the policies in the whole tree. Individual policies referenced by the krbPwdPolicyReference attribute are always searched by their full DN and with the base scope. However, when KDC asks a DAL driver to return a password policy by name, we don't have any specific base to search. The original code did search by the realm subtree. Fixes https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Set explicit confdir option for global contextsChristian Heimes2016-12-023-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | Some API contexts are used to modify global state (e.g. files in /etc and /var). These contexts do not support confdir overrides. Initialize the API with an explicit confdir argument to paths.ETC_IPA. The special contexts are: * backup * cli_installer * installer * ipctl * renew * restore * server * updates The patch also corrects the context of the ipa-httpd-kdcproxy script to 'server'. https://fedorahosted.org/freeipa/ticket/6389 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Build: properly integrate ipa-version.h.in into build systemPetr Spacek2016-11-291-0/+11
| | | | | | | | | | AC_CONFIG_FILES in configure.ac works well only with Makefiles. Other files have to be handled by Makefile.am so depedencies are tracked properly. https://fedorahosted.org/freeipa/ticket/6498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-293-8/+8
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move dnssec, p11helper and secrets to ipaserverJan Cholasta2016-11-293-10/+9
| | | | | | | | | | | The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* IPA Allows Password Reuse with History value defined when admin resets the ↵Thierry Bordaz2016-11-241-9/+14
| | | | | | | | | | | password. When admin reset a user password, history of user passwords is preserved according to its policy. https://fedorahosted.org/freeipa/ticket/6402 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add main guards to a couple of Python scriptsChristian Heimes2016-11-241-15/+21
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: fix path in ipa-ods-exporter.socket unit filePetr Spacek2016-11-211-1/+1
| | | | | | | | | | This fixes regression caused by incorrect daemons/dnssec/ipa-ods-exporter.socket.in path template introduced in commit 312e780041fc9025ca3c189e6c9fcb54c7340714. https://fedorahosted.org/freeipa/ticket/6495 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: remove incorrect use of MAINTAINERCLEANFILESPetr Spacek2016-11-1620-89/+0
| | | | | | | | | | | | | Automake manual section 13 What Gets Cleaned says that make maintainer-clean should not remove files necessary for subsequent runs of ./configure. It practically means that all usage of MAINTAINERCLEANFILES were incorrect so I've removed them. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Support DAL version 5 and version 6Simo Sorce2016-11-101-39/+63
| | | | | | | | https://fedorahosted.org/freeipa/ticket/6466 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Build: integrate daemons/dnssec into build systemPetr Spacek2016-11-096-9/+42
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/topology filesPetr Spacek2016-11-091-0/+1
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-winsync filesPetr Spacek2016-11-091-0/+1
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-sidgen filesPetr Spacek2016-11-091-0/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-pwd-extop filesPetr Spacek2016-11-091-0/+2
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-otp-lasttoken filesPetr Spacek2016-11-091-1/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-otp-counter filesPetr Spacek2016-11-091-1/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-exdom-extop filesPetr Spacek2016-11-091-0/+2
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemons/ipa-slapi-plugins/ipa-cldap filesPetr Spacek2016-11-091-0/+1
| | | | | | | | | | | | | | | | | | | All the headers are now listed in _SOURCES variable. It seems weird but this is what GNU Automake manual suggests in section 9.2 Header files: Headers used by programs or convenience libraries are not installed. The noinst_HEADERS variable can be used for such headers. However when the header actually belongs to a single convenience library or program, we recommend listing it in the program’s or library’s _SOURCES variable (see Program Sources) instead of in noinst_HEADERS. This is clearer for the Makefile.am reader. noinst_HEADERS would be the right variable to use in a directory containing only headers and no associated library or program. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of ipa-slapi-plugins/common filesPetr Spacek2016-11-091-0/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of daemon/ipa-kdb filesPetr Spacek2016-11-091-0/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: remove non-existing README files from Makefile.amPetr Spacek2016-11-091-1/+0
| | | | | | | | | | | Some Makefile.am files were apparently created by copy-pasting other files. As a result, some Makefiles require non-existing README files. Remove this to fix dist target. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix Makefile.am files to separate source and build directoriesPetr Spacek2016-11-0918-55/+30
| | | | | | | | | | | | | This is step forward working VPATH builds which cleanly separate sources and build artifacts. It makes the system cleaner and easier to understand. Python and web UI likely require more work to make VPATH builds working. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: move version handling from Makefile to configurePetr Spacek2016-11-091-3/+3
| | | | | | | | | | | | | | | Version information is now in VERSION.m4 instead of VERSION. Makefile target version-update was minimized and configure can be run before make. Makefile temporarily contains hardcoded version which has to match the one specified in VERSION.m4. This is preparatory step which will allow us to replace hand-made Makefile with one generated by Automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: transform util directory to libutil convenience libraryPetr Spacek2016-10-244-11/+8
| | | | | | | | | | | | This is autoconf way of doing things. It should allow us to enable subdir-objects automake option and stay compatible with future versions of automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: promote daemons/configure.ac to top-level configure.acPetr Spacek2016-10-241-333/+0
| | | | | | | | | | | | | Top-level Makefile is still not managed by Automake (e.g. hand-made). This is preparatory work. Other configure.ac files will be gradually merged into the top-level one. After that we will be able to throw-away the hand-made top-level Makefile and use Automake for everything. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: adjust include paths in daemons/ipa-kdb/tests/ipa_kdb_tests.cPetr Spacek2016-10-241-2/+2
| | | | | | | | | | | Fix include paths to prevent breakage when we move configure.ac from daemons to the top-level. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: remove deprecated AC_STDC_HEADERS macroPetr Spacek2016-10-181-1/+0
| | | | | | | Interestingly, the new macro AC_HEADER_STDC is alredy present. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Build: require Python >= 2.7Petr Spacek2016-10-181-1/+1
| | | | | | | | | The Python detection logic will be improved later when we start to use top-level configure.ac to manage build completely. For now simple bump is enough. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Build: remove traces of mozldap libraryPetr Spacek2016-10-182-54/+7
| | | | | | | | | | | | | | Mozldap is not used for some time now. We can remove all traces of it. AFAIK the complex logic for OpenLDAP detection should not be necessary and -lldap_r -llber options should suffice. Unfortunatelly OpenLDAP package does not ship package config files so we have to hardcode flags. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Build: modernize crypto library detectionPetr Spacek2016-10-183-10/+6
| | | | | | | | | | Use package config instead of checking headers. Package config is faster because it does not invoke compiler and guarantees proper linking flags because these are provided by package maintainer instead of hardcoded into build system. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Build: modernize UUID library detectionPetr Spacek2016-10-181-4/+1
| | | | | | | | | | Use package config instead of checking headers. Package config is faster because it does not invoke compiler and guarantees proper linking flags because these are provided by package maintainer instead of hardcoded into build system. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Build: modernize Kerberos library detectionPetr Spacek2016-10-181-5/+1
| | | | | | | | | | | | Use package config instead of checking headers. Package config is faster because it does not invoke compiler and guarantees proper linking flags because these are provided by package maintainer instead of hardcoded into build system. libkrad does not have package config file so we keep the old way here. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 11:18:40 +0000