summaryrefslogtreecommitdiffstats
path: root/install/tools
Commit message (Collapse)AuthorAgeFilesLines
* replica promotion: use host credentials when setting up replicationJan Cholasta2015-12-071-1/+0
| | | | | | | | | | | Use the local host credentials rather than the user credentials when setting up replication. The host must be a member of the ipaservers host group. The user credentials are still required for connection check. https://fedorahosted.org/freeipa/ticket/5401 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* check whether replica exists before executing the domain level 1 deletion codeMartin Babinsky2015-12-041-7/+11
| | | | | | | | | | | Move this check before the parts that check topology suffix connectivity, wait for removed segments etc. If the hostname does not exist, it should really be one of the first errors user encounters during ipa-replica-manage del. https://fedorahosted.org/freeipa/ticket/5424 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* add '--auto-forwarders' description to server/replica/DNS installer man pagesMartin Babinsky2015-12-043-0/+9
| | | | | | https://fedorahosted.org/freeipa/ticket/5438 Reviewed-By: Martin Basti <mbasti@redhat.com>
* add auto-forwarders option to standalone DNS installerMartin Babinsky2015-12-041-0/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5438 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Update ipa-(cs)replica-manage man pagesPetr Vobornik2015-12-042-9/+21
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* man: Update the ipa-replica-install manpage with promotion related infoTomas Babej2015-12-041-12/+57
| | | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* implement domain level 1 specific topology checks into IPA server uninstallerMartin Babinsky2015-12-021-0/+3
| | | | | | | | | | | | | When uninstalling domain level 1 master its removal from topology is checked on remote masters. The uninstaller also checks whether the uninstallation disconnects the topology and if yes aborts the procedure. The '--ignore-disconnected-topology' options skips this check. https://fedorahosted.org/freeipa/ticket/5377 https://fedorahosted.org/freeipa/ticket/5409 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* extract domain level 1 topology-checking code from ipa-replica-manageMartin Babinsky2015-12-021-97/+11
| | | | | | | | | | This facilitates reusability of this code in other components, e.g. IPA server uninstallers. https://fedorahosted.org/freeipa/ticket/5409 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix 'iparepltopomanagedsuffix' attribute consumersMartin Babinsky2015-12-011-6/+2
| | | | | | | | | Commit 46ae52569a179f73b1445922f7bac993d598c953 reimplemented reporting of managed topology suffixes in server-find/show commands using membership attributes. This patch fixes consumers of this attribute in ipa-replica-manage command and webui to reflect this change. Reviewed-By: Martin Basti <mbasti@redhat.com>
* change suffices to suffixesPetr Vobornik2015-12-011-12/+12
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-ca-install: error when replica file is passed with domain level > 0Martin Basti2015-11-271-0/+3
| | | | | | | | | | | with replica promotion (domain level > 0) there are no replica files, thus adding replica file as parameter when domain level > 0 should be disallowed. https://fedorahosted.org/freeipa/ticket/5455 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-252-6/+3
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* check for disconnected topology and deleted agreements for all sufficesMartin Babinsky2015-11-131-80/+165
| | | | | | | | | | The code in ipa-replica-manage which checks for disconnected topology and deleted agreements during node removal was generalized so that it now performs these checks for all suffixes to which the node belongs. https://fedorahosted.org/freeipa/ticket/5309 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-replica-manage del continues when host does not exist in domain level 1Gabe2015-11-121-1/+7
| | | | | | | | - Raises error and stops operation unless --cleanup is specified. https://fedorahosted.org/freeipa/ticket/5424 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Incomplete ports for IPA AD TrustGabe2015-11-052-0/+29
| | | | | | | | | - Add subsection to ipa-adtrust-install man page - Update port information in ipa-adtrust-install https://fedorahosted.org/freeipa/ticket/5414 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-csreplica-manage: disable connect/disconnect/del with domain level > 0Martin Basti2015-11-022-8/+31
| | | | | | | | | | * ipa-csreplica-manage {connect|disconnect} - a user should use 'ipa topologysegment-*' commands * ipa-csreplica-manage del - a user should use ipa-replica-manage del https://fedorahosted.org/freeipa/ticket/5405 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Check early if a CA is already installed locallySimo Sorce2015-10-271-0/+3
| | | | | | | | | | There is no reason to proceed if a CA is already installed, and the check does not involve a lot of setup, so do it early on. Ticket: https://fedorahosted.org/freeipa/ticket/5397 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Domain levels: use constants rather than hardcoded valuesMartin Basti2015-10-272-5/+7
| | | | | | | | | | | Added constants for domain levels DOMAIN_LEVEL_0 = 0 DOMAIN_LEVEL_1 = 1 This allows to search for domain level easier in code. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* handle cleaning of RUV in the topology pluginLudwig Krispenz2015-10-261-6/+1
| | | | | | | | | | After removing a server the replicaid needs to be cleared in the ruv entry and in the changelog. This was triggere by initiating a cleanallruv task in "ipa-replica-manage del", but the removal of a master already triggers a cleanup of segments and replication agreement by the topology plugin, so this could be handled by the plugin as well. Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* ipa-replica-manage: fix undefined variableMartin Basti2015-10-231-1/+1
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix hyphen-used-as-minus-sign warning (found by lintian)Benjamin Drung2015-10-223-5/+5
| | | | | | | See https://lintian.debian.org/tags/hyphen-used-as-minus-sign.html for an explanation. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow to install the KRA on a promoted serverSimo Sorce2015-10-221-2/+3
| | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow ipa-ca-install to use the new promotion codeSimo Sorce2015-10-221-39/+93
| | | | | | | | | | | This makes it possible to install a CA after-the-fact on a server that has been promoted (and has no replica file available). https://fedorahosted.org/freeipa/ticket/2888 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Rename option --dirsrv-config-mods to --dirsrv-config-fileMartin Basti2015-10-192-2/+2
| | | | | | | | | | | Option is renamed to be consistent with other options. Affected tickets: https://fedorahosted.org/freeipa/ticket/4949 https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add option to specify LDIF file that contains DS configuration changesMartin Basti2015-10-152-1/+6
| | | | | | | | | | | | | This allows to user modify configuration changes of the directory server instance during installation of DS https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow ipa-replica-conncheck to use default credsSimo Sorce2015-10-151-38/+67
| | | | | | | | If the user has already run kinit try to use those credentials. The user can always override by explicitly passing the -p flag. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Implement replica promotion functionalitySimo Sorce2015-10-151-0/+1
| | | | | | | | | | | | | | | | | | This patch implements a new flag --promote for the ipa-replica-install command that allows an administrative user to 'promote' an already joined client to become a full ipa server. The only credentials used are that of an administrator. This code relies on ipa-custodia being available on the peer master as well as a number of other patches to allow a computer account to request certificates for its services. Therefore this feature is marked to work only with domain level 1 and above servers. Ticket: https://fedorahosted.org/freeipa/ticket/2888 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* comment: Add Documentation string to deduplicate functionDavid Kupka2015-10-131-0/+3
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use six.moves.xmlrpc.client instead of xmlrpclibPetr Viktorin2015-10-071-1/+1
| | | | | | | | The module is renamed to xmlrpc.client in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.urllib instead of urllib/urllib2/urlparsePetr Viktorin2015-10-071-2/+3
| | | | | | | | In Python 3, these modules are reorganized. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* dnssec option missing in ipa-dns-install man pageGabe2015-09-253-0/+18
| | | | | | | | - Add DNSSEC option ipa-replica-install and ipa-server-install man page as well https://fedorahosted.org/freeipa/ticket/5300 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Rewrap errors in get_principal to CCacheErrorMichael Simacek2015-09-221-1/+1
| | | | | | | | | Causes nicer error message when kerberos credentials are not available. https://fedorahosted.org/freeipa/ticket/5272 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Alias "unicode" to "str" under Python 3Jan Cholasta2015-09-171-0/+4
| | | | | | | | | The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Handle timeout error in ipa-httpd-kdcproxyChristian Heimes2015-09-101-1/+2
| | | | | | | | | The ipa-httpd-kdcproxy script now handles LDAP timeout errors correctly. A timeout does no longer result into an Apache startup error. https://fedorahosted.org/freeipa/ticket/5292 Reviewed-By: Martin Basti <mbasti@redhat.com>
* load RA backend plugins during standalone CA install on CA-less IPA masterMartin Babinsky2015-09-091-1/+3
| | | | | | | | | | CA-less IPA master has 'ra_plugin' set to 'none' in IPA config. When setting up Dogtag CA on the master we must override this setting in order to load dogtag backend plugins and succesfully complete CA installation. https://fedorahosted.org/freeipa/ticket/5288 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Decode script arguments using file system encodingJan Cholasta2015-09-071-1/+1
| | | | | | | | This mimics Python 3's behavior, where sys.argv is automatically decoded using file system encoding, as returned by sys.getfilesystemencoding(). This includes reimplementation of os.fsdecode() from Python 3. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use the print functionPetr Viktorin2015-09-019-315/+336
| | | | | | | | | In Python 3, `print` is no longer a statement. Call it as a function everywhere, and include the future import to remove the statement in Python 2 code as well. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use Python3-compatible dict method namesPetr Viktorin2015-09-012-4/+3
| | | | | | | | | | | | | | | | | | | | | | Python 2 has keys()/values()/items(), which return lists, iterkeys()/itervalues()/iteritems(), which return iterators, and viewkeys()/viewvalues()/viewitems() which return views. Python 3 has only keys()/values()/items(), which return views. To get iterators, one can use iter() or a for loop/comprehension; for lists there's the list() constructor. When iterating through the entire dict, without modifying the dict, the difference between Python 2's items() and iteritems() is negligible, especially on small dicts (the main overhead is extra memory, not CPU time). In the interest of simpler code, this patch changes many instances of iteritems() to items(), iterkeys() to keys() etc. In other cases, helpers like six.itervalues are used. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove use of sys.exc_valuePetr Viktorin2015-09-012-4/+4
| | | | | | | sys.exc_value is deprecated since Python 1.5, and was removed in Python 3. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipactl: Do not start/stop/restart single service multiple timesDavid Kupka2015-08-261-1/+16
| | | | | | | | | In case multiple services are provided by single system daemon it is not needed to start/stop/restart it mutiple time. https://fedorahosted.org/freeipa/ticket/5248 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Port from python-krbV to python-gssapiMichael Simacek2015-08-263-16/+12
| | | | | | | | | | | | | | | | | | python-krbV library is deprecated and doesn't work with python 3. Replacing all it's usages with python-gssapi. - Removed Backend.krb and KRB5_CCache classes They were wrappers around krbV classes that cannot really work without them - Added few utility functions for querying GSSAPI credentials in krb_utils module. They provide replacements for KRB5_CCache. - Merged two kinit_keytab functions - Changed ldap plugin connection defaults to match ipaldap - Unified getting default realm Using api.env.realm instead of krbV call Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* winsync-migrate: Expand the man pageTomas Babej2015-08-171-1/+26
| | | | | | https://fedorahosted.org/freeipa/ticket/5162 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-128-94/+94
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* adtrust-install: Correctly determine 4.2 FreeIPA serversTomas Babej2015-08-111-1/+1
| | | | | | | | | | | | | We need to detect a list of FreeIPA 4.2 (and above) servers, since only there is the required version of SSSD present. Since the maximum domain level for 4.2 is 0 (and not 1), we can filter for any value of ipaMaxDomainLevel / ipaMinDomainLevel attributes to generate the list. https://fedorahosted.org/freeipa/ticket/5199 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommandMartin Basti2015-07-172-2/+2
| | | | | | | | | --force option set replica-certify-all to 'no' during abort-clean-ruv subcommand https://fedorahosted.org/freeipa/ticket/4988 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-adtrust-install: allow configuring of trust agentsAlexander Bokovoy2015-07-082-1/+95
| | | | | | | | | | | | | | | Trust agents are IPA master without Samba which can serve information about users from trusted forests. Such IPA masters cannot be used to configure trust but they can resolve AD users and groups for IPA clients enrolled to them. Since support from both FreeIPA and SSSD is needed to enable trust agent support, we currently only consider those IPA masters which have been upgraded to FreeIPA 4.2 or later. Part of https://fedorahosted.org/freeipa/ticket/4951 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix regression: ipa-dns-install will add CA records if requiredMartin Basti2015-07-081-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5101 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Improve error handling in ipa-httpd-kdcproxyChristian Heimes2015-07-071-20/+55
| | | | | | | | | | | | | The pre start script 'ipa-httpd-kdcproxy' for httpd.service now handles connection and authentication errors more gracefully. If the script is not able to conenct to LDAP, it only prints a warning and exits with status code 0. All other errors are still reported as fatal error and result in a non-zero exit code. This fixes a problem with offline RPM updates. A restart of Apache no longer fails when LDAP is not running. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DNSSEC: Detect attempt to install & disable master at the same time.Petr Spacek2015-07-071-0/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: update messageMartin Basti2015-07-071-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Petr Spacek <pspacek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 10:15:19 +0000