summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
* Update server/replica installer man pagesMartin Babinsky2017-03-012-0/+108
| | | | | | | | | | | Since AD trust installer is now a part of composite installers, their man pages were updated with separate section documenting relevant AD trust-related option descriptions. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix erroneous short name options in ipa-adtrust-install man pageMartin Babinsky2017-03-011-2/+2
| | | | | | | | | | | `--rid-base` and `--secondary-rid-base` had `-U` option assigned by error in the man page. Remove it as these options have not short alias. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* print the installation info only in standalone modeMartin Babinsky2017-03-011-1/+1
| | | | | | | | | | There is no point in emitting this message during server/replica install. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Limit sessions to 30 minutes by defaultSimo Sorce2017-03-011-0/+1
| | | | | | | | | | When we changed the session handling code we unintentinally extended sessions expiraion time to the whole ticket lifetime of 24h. Related to https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Define template version in certmap.confFlorence Blanc-Renaud2017-03-011-0/+4
| | | | | | | | | | | | | | | | | | | | A previous commit (ffb9a09a0d63f7edae2b647b5c1d503d1d4d7a6e) removed the definition of VERSION 2 in certmap.conf.template. ipa-server-upgrade tool compares the template version with the version in certmap.conf. As VERSION is not defined in either file, it concludes that version = 0 for both and does not make a backup of certmap.conf even though it prints that it will. The fix re-defines VERSION in the template and adapts the code because the template has changed (it is using $ISSUER_DN instead of CN=Certificate Authority,$SUBJECT_BASE). The fix also logs an error when a template file is not versioned. https://fedorahosted.org/freeipa/ticket/6354 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-012-15/+25
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Workaround for certmonger's "Subject" representationsStanislav Laznicka2017-03-011-1/+11
| | | | | | | | | | | | | | | | If an OpenSSL certificate is requested in Certmonger (CERT_STORAGE == "FILE") the "Subject" field of such Certificate is ordered as received. However, when an NSS certificate is requested, the "Subject" field takes the LDAP order (components get reversed). This is a workaround so that the behavior stays the same. The workaround should be removed when https://pagure.io/certmonger/issue/62 gets fixed. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move RA agent certificate file export to a different locationStanislav Laznicka2017-03-011-2/+2
| | | | | | | | | | | | HTTPS connection to certificate server requires client authentication so we need a file with client certificate and private key prior to its first occurence which happens during migration of certificate profiles to LDAP. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Support encrypted private keysBen Lipton2017-02-281-4/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove md5_fingerprints from IPAStanislav Laznicka2017-02-235-12/+0
| | | | | | | | | | MD5 is a grandpa and FIPS does not like it at all. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* added help about default value for --external-ca-type optionThorsten Scherf2017-02-231-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove non-sensical kdestroy on https stopSimo Sorce2017-02-221-1/+1
| | | | | | | | | | | | | | This kdestroy runs as root and wipes root's own ccachs ... this is totally inappropriate. Use a file ccache that ends up in the private tmp, so that if the service is restarted the file is automatically removed. https://fedorahosted.org/freeipa/ticket/6673 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* scripts, tests: explicitly set confdir in the rest of server codeJan Cholasta2017-02-223-3/+11
| | | | | | | | | | | Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir setting to api.bootstrap() calls of a randomly selected portion of server-side scripts and tests. This commit adds it to the rest of server-side code for consistency. https://fedorahosted.org/freeipa/ticket/6389 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server upgrade: fix upgrade from pre-4.0Jan Cholasta2017-02-202-1/+2
| | | | | | | | | | | | | | update_ca_renewal_master uses ipaCert certmonger tracking information to decide whether the local server is the CA renewal master or not. The information is lost when migrating from /etc/httpd/alias to /var/lib/ipa/radb in update_ra_cert_store. Make sure update_ra_cert_store is executed after update_ca_renewal_master so that correct information is used. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: fix incorrect behavior of ESC button on comboboxPavel Vomacka2017-02-171-3/+8
| | | | | | | | | | | | | | When combobox is opened then ESC key should close it. There was a bug that ESC key closed also the dialog. It was caused by bad keyboard event handling. The CB was closed by keydown event and the dialog by keyup. Therefore the propagating of keyup and keydown event is stopped when CB is opened (when the event is fired on CB element). https://fedorahosted.org/freeipa/ticket/6388 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* WebUI: add default on_cancel function in adder_dialogPavel Vomacka2017-02-171-0/+2
| | | | | | | | | | | | | | | Adder dialog is mixed with confirmation_mixin. That mixin calls on_cancel method when closing dialog using ESC key. Previously the on_cancel method was not defined, therefore dialog was not correctly closed. This was the root cause of the bug, that adder dialog cannot be opened after closing it using ESC. Now the default function for on_cancel is dialog.close. So dialog is correctly closed. https://fedorahosted.org/freeipa/ticket/6388 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move AD trust installation code to a separate moduleMartin Babinsky2017-02-171-342/+7
| | | | | | | | | | | | This facilitates calling the necessary checks and configuration code as a module from e.g. a composite installer. The code that checks for the admin credentials stays in the standalone installer as the code inside the adtrust module is expected to operate also without admin credentials. https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add password to certutil calls in NSSDatabaseStanislav Laznicka2017-02-171-8/+1
| | | | | | | | | | NSSDatabases should call certutil with a password. Also, removed `password_filename` argument from `.create_db()`. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Deduplicate session cookies in headersSimo Sorce2017-02-171-0/+5
| | | | | | | | | This removes one of the 2 identical copies of the ipa_session cookie Fixes https://fedorahosted.org/freeipa/ticket/6676 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Update man page of ipa-server-installAbhijeet Kasurde2017-02-171-2/+5
| | | | | | | | | | This fix adds information about --ignore-last-of-role in ipa-server-install man page Fixes https://fedorahosted.org/freeipa/ticket/6634 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add a new user to run the framework codeSimo Sorce2017-02-157-8/+17
| | | | | | | | | | | | | | | | | Add the apache user the ipawebui group. Make the ccaches directory owned by the ipawebui group and make mod_auth_gssapi write the ccache files as r/w by the apache user and the ipawebui group. Fix tmpfiles creation ownership and permissions to allow the user to access ccaches files. The webui framework now works as a separate user than apache, so the certs used to access the dogtag instance need to be usable by this new user as well. Both apache and the webui user are in the ipawebui group, so use that. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Separate RA cert store from the HTTP cert storeSimo Sorce2017-02-154-6/+9
| | | | | | | | | | | | | | | This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Configure HTTPD to work via Gss-ProxySimo Sorce2017-02-155-3/+11
| | | | | | | | https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use Anonymous user to obtain FAST armor ccacheSimo Sorce2017-02-153-0/+17
| | | | | | | | | | | | The anonymous user allows the framework to obtain an armor ccache without relying on usable credentials, either via a keytab or a pkinit and public certificates. This will be needed once the HTTP keytab is moved away for privilege separation. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Generate tmpfiles config at install timeSimo Sorce2017-02-153-1/+4
| | | | | | | | | | | | | | We do not want to generate runtime directories just because the packages are installed, but only if the server is actually setup and run. Also this will be needed later because we will create a user at install time and some tmpfiles will need to be owned by this user. As we are changing this code also rationalize the directory structure and move it from the http rundir to the ipa specific rundir. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change session handlingSimo Sorce2017-02-154-14/+13
| | | | | | | | | | | | | | | | Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove is_fips_enabled checks in installers and ipactlStanislav Laznicka2017-02-131-3/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* named.conf template: update API for bind 9.11Tomas Krizek2017-02-091-9/+7
| | | | | | | | | | | | | Use the new API for bind 9.11. Removed deprecated "serial_autoincrement" and updated the rest of configuration to conform to the new format. This only fixes new IPA installations. For existing installations, named.conf will be transformed when the new version of bind-dyndb-ldap is installed. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Replace exit() calls with exceptionsMartin Babinsky2017-02-091-13/+17
| | | | | | | | | | | In order to enable correct handling of hard errors from within the composite installer code, all calls to `sys.exit` have to be replaced with raising ScriptError. https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused variables in exception handlingMartin Babinsky2017-02-091-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-adtrust-install: format the code for PEP-8 complianceMartin Babinsky2017-02-091-81/+144
| | | | | | | https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* csrgen: Use data_sources option to define which fields are renderedBen Lipton2017-01-3112-64/+48
| | | | | | | | | | | | | | | This removes the ipa.syntaxrule and ipa.datarule macros in favor of simple 'if' statements based on the data referenced in the rules. The 'if' statement for a syntax rule is generated based on the data rules it contains. The Subject DN should not be generated unless all data rules are in place, so the ability to override the logical operator that combines data_sources (from 'or' to 'and') is added. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Add a CSR generation profile for user certificatesBen Lipton2017-01-314-0/+41
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Add CSR generation profile for caIPAserviceCertBen Lipton2017-01-316-0/+73
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Add code to generate scripts that generate CSRsBen Lipton2017-01-316-0/+148
| | | | | | | | | | | | Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-ca-install: do not fail without --subject-base and --ca-subjectJan Cholasta2017-01-311-3/+4
| | | | | | | | | | | | | | When --subject-base and --ca-subject are not specified in ipa-ca-install, default values are used. DN objects are used as the default values in ipa-ca-install, but the CA installer expects the values to be strings. This causes ipa-ca-install to fail unless both --subject-base and --ca-subject are specified. Convert the DN objects to strings to fix the issue. https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Remove deprecated ipa-upgradeconfig commandAbhijeet Kasurde2017-01-244-70/+0
| | | | | | | Fixes https://fedorahosted.org/freeipa/ticket/6620 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Coverity: removed useless semicolon which ends statement earlierPavel Vomacka2017-01-181-2/+2
| | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Coverity: Fix possibility of access to attribute of undefinedPavel Vomacka2017-01-181-1/+1
| | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* renew agent: handle non-replicated certificatesJan Cholasta2017-01-161-9/+16
| | | | | | | | | | | In addition to replicated certificates (Dogtag certificates, RA certificate), handle non-replicated certificates in dogtag-ipa-ca-renew-agent as well. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add sanity checks for use of --ca-subject and --subject-baseFraser Tweedale2017-01-111-0/+5
| | | | | | | | | | Print an error and terminate if --ca-subject or --subject-base are used when installing a CA-less master or when performing standalone installation of a CA replica. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Indicate that ca subject / subject base uses LDAP RDN orderFraser Tweedale2017-01-113-6/+8
| | | | | | | | Update man pages and help output to indicate that --subject-base and --ca-subject options interpret their arguments in LDAP order. Fixes: https://fedorahosted.org/freeipa/ticket/6455 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-113-1/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dsinstance: extract function for writing certmap.confFraser Tweedale2017-01-111-1/+1
| | | | | | | | | | | | | | | | For full customisability of the IPA CA subject DN, we will need the ability to update DS `certmap.conf' when upgrading a deployment from CA-less to CA-ful. Extract the existing behaviour, which is private to DsInstance, to the `write_certmap_conf' top-level function. Also update `certmap.conf.template' for substition of the whole CA subject DN (not just the subject base). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-ca-install: add missing --subject-base optionFraser Tweedale2017-01-111-4/+8
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installer: rename --subject to --subject-baseFraser Tweedale2017-01-112-4/+4
| | | | | | | | | | | | The --subject option is actually used to provide the "subject base". We are also going to add an option for fully specifying the IPA CA subject DN in a subsequent commit. So to avoid confusion, rename --subject to --subject-base, retaining --subject as a deprecated alias. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change activity text while loading metadataPavel Vomacka2017-01-053-0/+9
| | | | | | | | | | | | After log in into webui there was 'Authenticating' sign even during loading metadata. Now while data are loading there is 'Loading data' text. This change requires new global topic 'set-activity' of activity widget. So for now there is possibility to change every activity string during running phase just by publishing 'set-activity' topic and setting new text as first parameter. Part of: https://fedorahosted.org/freeipa/ticket/6144 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Refactoring of rpc modulePavel Vomacka2017-01-056-73/+152
| | | | | | | | | | | | | | | | | | | | | | The rpc module is now separated from display layer. There are two new global topics: - 'rpc-start' for showing the widget which indicates execution of rpc calls - 'rpc-end' for hiding the widget which indicates execution of rpc calls. These two global topics replace the original methods IPA.display_activity_icon() and IPA.hide_activity_icon(). There is also new property of a command (notify_globally), which allows to turn off the widget which indicates network activity. Instead of classic activity indicator there can be called custom function at the beginning and at the end of network activity. There are also changes in internal communication in rpc.js module. There are four new events, two for calling on_success and on_error methods and two for calling custom functions at the beginning and at the end of network activity. https://fedorahosted.org/freeipa/ticket/6144 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: update Patternfly and BootstrapPavel Vomacka2017-01-054-8/+11
| | | | | | | | | | | | Current versions: PatternFly: 3.9.0 Boostrap: 3.3.7 Bootstrap-select: 1.4.3 Font-Awesome: 4.0.3 https://fedorahosted.org/freeipa/ticket/6394 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Clarify meaning of --domain and --realm in installersStanislav Laznicka2017-01-053-58/+48
| | | | | | | | Man pages need bigger overhaul. Take this as hot-fix for FAQ. https://fedorahosted.org/freeipa/ticket/6574 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
generated by cgit (git 2.34.1) at 2024-11-11 20:57:03 +0000