summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
* Move httpd restart to DNS installationStanislav Laznicka2016-11-111-10/+1
| | | | | | | | | | | | Web service needs restarting after bindinstance is created to pick up changes done to /etc/resolv.conf. This change should be included anytime DNS is installed therefore it makes sense to move it to the common code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: merge all CA install code paths into oneJan Cholasta2016-11-111-23/+3
| | | | | | | | | Merge CA install code paths use in ipa-server-install, ipa-replica-install in either domain level and ipa-ca-install into one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: use one remote CA host name everywhereJan Cholasta2016-11-111-5/+3
| | | | | | | | | Remote master and CA host names may differ. Always use the remote CA host name and never the remote master host name in CA replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Moved update of DNA plugin among update pluginsStanislav Laznicka2016-11-113-9/+9
| | | | | | | | | | | | | | | | | To make the code more general, moved the update_dna_shared_config among other update plugins. Bugfix: DNA shared config connection protocol was compared to a method string which would result in a try to always update it even if there was no need to. https://fedorahosted.org/389/ticket/48373 causes that two shared DNA config entries are created instead of one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move ds.replica_populate to an update pluginStanislav Laznicka2016-11-111-0/+1
| | | | | | | | | Replica populate can be applied with other update plugins. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Coverity - null pointer dereferencePavel Vomacka2016-11-101-1/+1
| | | | | | Add check which protect from calling method of null. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - accessing attribute of variable which can point to nullPavel Vomacka2016-11-101-2/+2
| | | | | | Added check whether variable is pointing to null or not. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - opens dialog which might not be createdPavel Vomacka2016-11-101-1/+5
| | | | | | Check whether dialog object is created before opening it. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - iterating over variable which could be nullPavel Vomacka2016-11-101-4/+4
| | | | | | Change condition to check also variable which could be null. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - null pointer dereferencePavel Vomacka2016-11-101-3/+3
| | | | | | | The 'obj' variable could be null, so there could be error when it is used. A new check that 'obj' is not false is added. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - true branch can't be executedPavel Vomacka2016-11-101-1/+2
| | | | | | | The 'result' variable is always false because of previous condition. Therefore there is direct assignment. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - true branch can't be executedPavel Vomacka2016-11-101-1/+2
| | | | | | | The 'data' variable is always false because of previous condition. Therefore there is direct assignment. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - removed dead codePavel Vomacka2016-11-101-12/+8
| | | | | | There cannot be string value because of previous checks. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - Accesing attribute of nullPavel Vomacka2016-11-101-1/+1
| | | | | | | There is a possibility that widget is null and then there could be an error. Therefore there is new check of widget variable. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - identical code for different branchesPavel Vomacka2016-11-101-2/+2
| | | | | | | In both cases when the condition is true or false ut is set the same value. Changed to assign the value directly. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - not initialized variablePavel Vomacka2016-11-101-1/+1
| | | | | | The variable hasn't been initialized, now it is set to null by default. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - null pointer exceptionPavel Vomacka2016-11-101-0/+2
| | | | | | | Variable 'row' could be null in some cases. And set css to variable which is pointing to null causes error. Therefore there is new check. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - null pointer exceptionPavel Vomacka2016-11-101-1/+1
| | | | | | Variable 'option' can be null and there will be error of reading property of null. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipaldap: remove do_bind from LDAPClientTomas Krizek2016-11-101-1/+1
| | | | | | | | | Remove do_bind() method that was a relict used in IPAdmin. Replace its uses with simple / external binds. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Refactor installer code requesting certificatesFlorence Blanc-Renaud2016-11-101-1/+1
| | | | | | | | | | | | | | | | | | | | - Temporary modify certmonger dogtag-ipa-ca-renew helper to request the IPA RA agent cert, using the temp cert created during pkispawn. The cert request is now processed through certmonger, and the helper arguments are restored once the agent cert is obtained. - Modify the installer code creating HTTP and LDAP certificates to use certmonger's IPA helper with temporary parameters (calling dogtag-submit instead of ipa-submit) - Clean-up for the integration tests: sometimes ipa renewal.lock is not released during ipa-server-uninstall. Make sure that the file is removed to allow future installations. https://fedorahosted.org/freeipa/ticket/6433 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Use autobind instead of host keytab authentication in dogtag-ipa-ca-renew-agentFlorence Blanc-Renaud2016-11-101-6/+1
| | | | | | | | This commit makes sure that dogtag-ipa-ca-renew-agent CA helper can be used before Kerberos is configured. Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-101-9/+6
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pkcs10: remove pyasn1 PKCS #10 specFraser Tweedale2016-11-101-16/+36
| | | | | | | | | | | | | | | In the dogtag-ipa-ca-renew-agent-submit certmonger renewal helper, we currently use our hand-rolled PKCS #10 pyasn1 specification to parse the friendlyName out of CSRs generated by certmonger (it contains the NSSDB nickname of the cert). Use other information from the renewal helper process environment to determine the nickname and remove our PKCS #10 pyasn1 spec. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* libexec scripts: ldap conn managementTomas Krizek2016-11-093-0/+7
| | | | | | | | | Certificate renewal scripts require connection to LDAP. Properly handle connects and disconnects from LDAP. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Build: fix make clean for web UIPetr Spacek2016-11-092-0/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix KDC proxy installation and remove unused kdcproxy.confPetr Spacek2016-11-091-1/+4
| | | | | | | | | | The only useful file is /etc/ipa/kdcproxy/kdcproxy.conf so I've removed the other copy of the file in /usr. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: do not compress manual pages at install timePetr Spacek2016-11-091-4/+0
| | | | | | | | | | | | | | | | | | | At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of install/REDME.schema filePetr Spacek2016-11-091-0/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of oddjob filesPetr Spacek2016-11-091-10/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: Remove spurious EXTRA_DIST from install/share/Makefile.amPetr Spacek2016-11-091-7/+2
| | | | | | | | | dist_ prefix can be used instead of EXTRA_DIST magic. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: cleanup unused LDIFs from install/sharePetr Spacek2016-11-094-34/+0
| | | | | | | | | | Unused LDIF files were packaged in old tarballs but unused for a long time. Remove them - git log can be used for archaeology if needed. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of libexec scriptsPetr Spacek2016-11-091-6/+2
| | | | | | | | | | Scripts ipa-httpd-kdcproxy and ipa-pki-retrieve-key were missing from tarball. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution and installation of update LDIFsPetr Spacek2016-11-091-0/+1
| | | | | | | | | | 10-ipapwd.update file was missing in Makefile.am and thus missing in tarball and installed system. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Web UI: Remove offline version of Web UIPetr Spacek2016-11-094-4/+0
| | | | | | | | | | | The offline version does not work for some time already. I'm removing it right now to get rid of garbage which clutters build system. https://fedorahosted.org/freeipa/ticket/6447 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of static files for web UIPetr Spacek2016-11-097-4/+17
| | | | | | | | | | | | | | | | Static files from Git which are not touched by the build system have to be explicitly listed in Makefile.am so they get into tarball. EXTRA_DIST lists whole sub-directories with static files. This is not ideal but we do not have enough time to fix it properly. Dojo builder patch files were renames to shorten their name. The original names were exceeding autotools length limit. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: stop build when a step in web UI build failsPetr Spacek2016-11-0911-6/+17
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix man page distributionPetr Spacek2016-11-091-2/+2
| | | | | | | | | | By default automake does not distribute man pages. This marks then with dist_ prefix to force their distribution in tarball. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: remove non-existing README files from Makefile.amPetr Spacek2016-11-091-1/+0
| | | | | | | | | | | Some Makefile.am files were apparently created by copy-pasting other files. As a result, some Makefiles require non-existing README files. Remove this to fix dist target. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix Makefile.am files to separate source and build directoriesPetr Spacek2016-11-092-2/+2
| | | | | | | | | | | | | This is step forward working VPATH builds which cleanly separate sources and build artifacts. It makes the system cleaner and easier to understand. Python and web UI likely require more work to make VPATH builds working. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: move version handling from Makefile to configurePetr Spacek2016-11-091-3/+3
| | | | | | | | | | | | | | | Version information is now in VERSION.m4 instead of VERSION. Makefile target version-update was minimized and configure can be run before make. Makefile temporarily contains hardcoded version which has to match the one specified in VERSION.m4. This is preparatory step which will allow us to replace hand-made Makefile with one generated by Automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* install tools: ldap conn managementTomas Krizek2016-11-077-219/+159
| | | | | | | | | | | | | | | | | | | | | | | | | | | * ipca-ca-install: Use a single ldap connection for the entire script. Connecting with ccache in promote is not needed. * ipa-cacert-manage: Always connect to ldap, since renew and install are the only options and renew seems to need ldap connection even for self signed certificates. * ipa-compat-manage: Use one ldap connection for the entire script. Replaced try-finally with proper disconnect, code block reindented. * ipa-csreplica-manage: Properly establish and close the ldap connection. * ipa-dns-install: Proper connect, disconnect to ldap. * ipa-kra-install: Proper connect/disconnect for install and uninstall. * ipa-ldap-update: Proper connect and disconnect to ldap. * ipa-nis-manage: Proper connect/disconnect for ldap. Try-finally removed and code block reindented. * ipa-replica-manage: Proper connect/disconnect to ldap. * ipa-replica-prepare: Connect added to validate_options(), where api is initialized and disconnected added at the end of run. Reconnect in ask_for_options() to validate directory manager password. * ipa-server-certinstall: Use api.Backend.ldap2 for ldap connections. * ipa-server-upgrade: Connect to and disconnect from api.Backend.ldap2. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-adtrust-install: ldap conn managementTomas Krizek2016-11-071-0/+2
| | | | | | | | | Properly close ldap connection. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cainstall: add dm_password to CA installationTomas Krizek2016-11-071-0/+1
| | | | | | | | | | | Installation of Certificate Server replica requires directory manager password. Specify it explicitly in function call and pass it in through an argument. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: remove dirman_pw from servicesTomas Krizek2016-11-075-10/+8
| | | | | | | | | Remove directory manager's password from service's constructors https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: merge IPAdmin to LDAPClientTomas Krizek2016-11-076-15/+19
| | | | | | | | | | | | | | | | * move IPAdmin methods to LDAPClient * add extra arguments (cacert, sasl_nocanon) to LDAPClient.__init__() * add host, port, _protocol to LDAPClient (parsed from ldap_uri) * create get_ldap_uri() method to create ldap_uri from former IPAdmin.__init__() arguments * replace IPAdmin with LDAPClient + get_ldap_uri() * remove ununsed function argument hostname from enable_replication_version_checking() https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: merge gssapi_bind to LDAPClientTomas Krizek2016-11-072-2/+2
| | | | | | | | | * Rename do_sasl_gssapi_bind to gssapi_bind https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: merge external_bind into LDAPClientTomas Krizek2016-11-071-1/+1
| | | | | | | | | | | * Rename do_external_bind to external_bind * Remove user_name argument in external_bind() and always set it to effective user name https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: merge simple_bind into LDAPClientTomas Krizek2016-11-074-8/+15
| | | | | | | | | | | | * Use LDAPClient.simple_bind instead of extra call to IPAdmin.do_simple_bind * Rename binddn to bind_dn * Rename bindpw to bind_password * Explicitly specify bind_dn in all calls https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: remove wait/timeout during bindsTomas Krizek2016-11-071-1/+1
| | | | | | | | | | Testing whether it is possible to connect to directory server is already done in RedHatDirectoryService.restart(). https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* WebUI: services without canonical name are shown correctlyPavel Vomacka2016-10-312-1/+92
| | | | | | | | | | | | | There is a change introduced in 4.4 that new services have canonical name. The old ones didn't have it, therefore these services were not correctly displayed in WebUI. This patch adds support for this type of services. Service name is taken from 'krbprincipalname' attribute in case that 'krbcanonicalname' attribute is not present in server response. https://fedorahosted.org/freeipa/ticket/6397 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
generated by cgit (git 2.34.1) at 2024-11-16 11:22:46 +0000