summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
...
* Unsaved changes dialog internally inconsistentGabe2015-05-075-21/+23
| | | | | | https://fedorahosted.org/freeipa/ticket/4926 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* move realm_to_serverid to installutils moduleMartin Basti2015-05-055-10/+13
| | | | | | | | | To avoid cyclic imports realm_to_serverid function had to be moved to installutils from dsinstance. Required for: https://fedorahosted.org/freeipa/ticket/4925 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Remove unneeded ip-address option in ipa-adtrust-installGabe2015-05-052-38/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4575 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Server Upgrade: Verify version and platformMartin Basti2015-05-043-11/+60
| | | | | | | | | | | | | | | | | | | | | | | | Verify version and platform before upgrade or ipactl start|restart Upgrade: * do not allow upgrade on different platforms * do not allow upgrade data with higher version than build has Start: * do not start services if platform mismatch * do not start services if upgrade is needed * do not start services if data with higher version than build has New ipactl options: --skip-version-check: do not validate IPA version --ignore-service-failures (was --force): ignore if a service start fail and continue with starting other services --force: combine --skip-version-check and --ignore-service-failures https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: ipa-server-upgrade commandMartin Basti2015-05-044-0/+54
| | | | | | | https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* speed up indirect member processingPetr Vobornik2015-04-271-1/+1
| | | | | | | | | | | | | | | the old implementation tried to get all entries which are member of group. That means also user. User can't have any members therefore this costly processing was unnecessary. New implementation reduces the search only to entries which have members. Also page size was removed to avoid paging by small pages(default size: 100) which is very slow for many members. https://fedorahosted.org/freeipa/ticket/4947 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Removed recommendation from ipa-adtrust-installThorsten Scherf2015-04-211-9/+0
| | | | | | | | | | In the wiki we say it's not longer necessary to make the IPA LDAP server not reachable by any AD domain controller. To be consistence, the setup tool should reflext this statement. https://fedorahosted.org/freeipa/ticket/4977 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Adopted kinit_keytab and kinit_password for kerberos authMartin Babinsky2015-04-203-6/+13
| | | | | | | | | Calls to ipautil.run using kinit were replaced with calls kinit_keytab/kinit_password functions implemented in the PATCH 0015. Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Server Upgrade: specify order of plugins in update filesMartin Basti2015-04-144-5/+38
| | | | | | | | | | | | * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: use only LDAPI connectionMartin Basti2015-04-141-9/+0
| | | | | | | | Use only ldapi connection to execute upgrade https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* webui: use no_members option in entity select searchPetr Vobornik2015-04-141-3/+10
| | | | | | | | | | | Obtaining member information for entity selects is not needed and it causes unwanted performance hit, especially with larger groups. This patch removes it. https://fedorahosted.org/freeipa/ticket/4948 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: unable to select single value in CB by enter keyPetr Vobornik2015-04-141-0/+1
| | | | | Fix: If editable combobox has one value, the value is selected and changed by hand, it can't be re-selected by enter key. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* User life cycle: stageuser-add verbThierry bordaz (tbordaz)2015-04-081-12/+17
| | | | | | | | | | | | | | | Add a accounts plugin (accounts class) that defines variables and methods common to 'users' and 'stageuser'. accounts is a superclass of users/stageuser Add the stageuser plugin, with support of stageuser-add verb. Reviewed By: David Kupka, Martin Basti, Jan Cholasta https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Bump ipa.conf version to 17.David Kupka2015-03-301-1/+1
| | | | | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Use mod_auth_gssapi instead of mod_auth_kerb.David Kupka2015-03-301-11/+5
| | | | | | | | | https://fedorahosted.org/freeipa/ticket/4190 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Remove unused part of ipa.conf.David Kupka2015-03-301-15/+0
| | | | | | | | | | Separate configuration of '/var/www/cgi-bin' is no longer needed legacy from IPA 1.0. Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Server Upgrade: remove --test optionMartin Basti2015-03-191-5/+0
| | | | | | | | | As --test option is not used for developing, and it is not recommended to test if upgrade will pass, this path removes it copmletely. https://fedorahosted.org/freeipa/ticket/3448 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa-dns-install: use LDAPI to connect to DSMartin Babinsky2015-03-182-39/+24
| | | | | | | | | | | | | ipa-dns-install now uses LDAPI/autobind to connect to DS during the setup of DNS/DNSSEC-related service and thus makes -p option obsolete. Futhermore, now it makes more sense to use LDAPI also for API Backend connections to DS and thus all forms of Kerberos auth were removed. This fixes https://fedorahosted.org/freeipa/ticket/4933 and brings us closer to fixing https://fedorahosted.org/freeipa/ticket/2957 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-dns-install: use STARTTLS to connect to DSMartin Babinsky2015-03-181-4/+8
| | | | | | | BindInstance et al. now use STARTTLS to set up secure connection to DS during ipa-dns-install. This fixes https://fedorahosted.org/freeipa/ticket/4933 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-prepare can only be created on the first masterGabe2015-03-131-2/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4944 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Remove unused disable-betxn.ldif fileMartin Basti2015-03-092-62/+0
| | | | Reviewed-By: David Kupka <dkupka@redhat.com>
* Limit deadlocks between DS plugin DNA and slapi-nisroot2015-03-051-0/+5
| | | | | | | | | | Deadlock can occur if DNA plugin (shared) config and Schema-compat plugin config are updated at the same time. Schema-compat should ignore update on DNA config. https://fedorahosted.org/freeipa/ticket/4927 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix uniqueness pluginsMartin Basti2015-03-052-36/+48
| | | | | | | | | | | | * add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users will not be forced to have unique uid * remove unneded update plugins -> update was moved to .update file * add uniqueness-across-all-subtrees required by user lifecycle management Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Migrate uniquess plugins configuration to new styleMartin Basti2015-03-052-30/+30
| | | | | | | New configuration style contains options required for user lifecycle management. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* replica-install: Use different API instance for the remote serverJan Cholasta2015-03-051-131/+106
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-replica-prepare should document ipv6 optionsGabe2015-02-261-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4877 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* webui: service: add ipakrbrequirespreauth checkboxPetr Vobornik2015-02-261-0/+5
| | | | | | Allow to configure missing krb ticket flag - ipakrbrequirespreauth from Web UI. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Remove references to GPL v2.0 licenseMartin Kosek2015-02-202-82/+0
| | | | | | | | | | | | All FreeIPA original code should be licensed to GPL v3+ license, update the respective files: - daemons/ipa-slapi-plugins/ipa-dns/ipa_dns.c Remove GPL v2.0 license files from LDIFs or template to keep consistency. Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Uninstall configured services onlyMartin Basti2015-02-181-2/+8
| | | | | | | | | | Fixes: dnskeysyncisntance - requires a stored state to be uninstalled bindinstance - uninstal service only if bind was configured by IPA Ticket:https://fedorahosted.org/freeipa/ticket/4869 Reviewed-By: David Kupka <dkupka@redhat.com>
* Expose the disabled User Auth TypeNathaniel McCallum2015-02-122-0/+2
| | | | | | | | | Additionally, fix a small bug in ipa-kdb so that the disabled User Auth Type is properly handled. https://fedorahosted.org/freeipa/ticket/4720 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Use 'remove-ds.pl' to remove DS instanceMartin Babinsky2015-01-271-1/+5
| | | | | | | | | | | The patch adds a function which calls 'remove-ds.pl' during DS instance removal. This should allow for a more thorough removal of DS related data during server uninstallation (such as closing custom ports, cleaning up slapd-* entries etc.) This patch is related to https://fedorahosted.org/freeipa/ticket/4487. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Revert "Make all ipatokenTOTP attributes mandatory"Jan Cholasta2015-01-211-1/+1
| | | | | | | | | | | | This prevents schema replication conflicts which cause replication failures with older versions of IPA. Details in https://bugzilla.redhat.com/show_bug.cgi?id=1176995#c7 This reverts commit adcd373931c50d91550f6b74b191d08ecce5b137. https://fedorahosted.org/freeipa/ticket/4833 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Replication Administrators cannot remove replication agreementsMartin Kosek2015-01-201-0/+11
| | | | | | | | | | | | Replication agreement deletion requires read access to DNA range setting. The read access was accidently removed during PermissionV2 refactoring. Add the read ACI back as a special SYSTEM permission. https://fedorahosted.org/freeipa/ticket/4848 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow Replication Administrators manipulate Winsync AgreementsMartin Kosek2015-01-192-1/+24
| | | | | | | | | | | | | Replication Administrators members were not able to set up changelog5 entry in cn=config or list winsync agreements. To allow reading winsync replicas, the original deny ACI cn=replica had to be removed as it prevented admins from reading the entries, but just anonymous/authenticated users. https://fedorahosted.org/freeipa/ticket/4836 Reviewed-By: David Kupka <dkupka@redhat.com>
* Allow PassSync user to locate and update NT usersMartin Kosek2015-01-191-0/+30
| | | | | | | | | | | | | | | Add new PassSync Service privilege that have sufficient access to let AD PassSync service search for NT users and update the password. To make sure existing PassSync user keeps working, it is added as a member of the new privilege. New update plugin is added to add link to the new privilege to the potentially existing PassSync user to avoid breaking the PassSync service. https://fedorahosted.org/freeipa/ticket/4837 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix validation of ipa-restore optionsJan Cholasta2015-01-141-4/+4
| | | | | | | | | | | | | | | Fix restore mode checks. Do some of the existing checks earlier to make them effective. Check if --instance and --backend exist both in the filesystem and in the backup. Log backup type and restore mode before performing restore. Update ipa-restore man page. https://fedorahosted.org/freeipa/ticket/4797 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Make certificate renewal process synchronizedJan Cholasta2015-01-139-6/+102
| | | | | | | | Synchronization is achieved using a global renewal lock. https://fedorahosted.org/freeipa/ticket/4803 Reviewed-By: David Kupka <dkupka@redhat.com>
* Restart dogtag when its server certificate is renewedJan Cholasta2015-01-131-3/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4803 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix CA certificate renewal syslog alertJan Cholasta2015-01-131-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4820 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix: Upgrade forwardzones zones after adding newer replicaMartin Basti2015-01-092-0/+3
| | | | | | | | Patch fixes issue, when forwardzones has not been upgraded after adding replica >=4.0 into topology with IPA 3.x servers. Ticket: https://fedorahosted.org/freeipa/ticket/4818 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Remove the removal of the ccacheSimo Sorce2015-01-081-1/+0
| | | | | | | | | | | | | | It is not necessary to remove the ccache on upgrades on modern IPA servers, even if the ccache contains stale data either it is re-initialized by mod_auth_kerb or a new ccache collection is created (if completely unrelated credentials were present), at least when using DIR or keyring ccaches. This line causes wrong SELinux labels to be set in the kernel keyring on uprades, which the cause the apache server to fail to use th ccache. https://fedorahosted.org/freeipa/ticket/4815 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Using wget to get status of CAMartin Basti2014-12-101-4/+0
| | | | | | | This is just workaround Ticket: https://fedorahosted.org/freeipa/ticket/4676 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* revert removal of cn attribute from idnsRecordPetr Vobornik2014-12-091-1/+1
| | | | | | | | | The removal, which was done in IPA-3.2, causes replication issues between IPA < 3.2 and IPA 4.1. Because IPA 4.1 adds two more attributes. https://fedorahosted.org/freeipa/ticket/4794 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Do not renew the IPA CA cert by serial number in dogtag-ipa-ca-renew-agentJan Cholasta2014-12-091-1/+1
| | | | | | | | | | | Always use the full CSR when renewing the IPA CA certificate with Dogtag. The IPA CA certificate may be issued by an external CA, in which case renewal by serial number does not make sense and will fail if the IPA CA was initially installed as a subordinate of an external CA. https://fedorahosted.org/freeipa/ticket/4784 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix automatic CA cert renewal endless loop in dogtag-ipa-ca-renew-agentJan Cholasta2014-12-091-0/+2
| | | | | | | | | Reset profile name after requesting the CA cert from Dogtag to prevent the automatic renewal request from being restarted in subsequent calls. https://fedorahosted.org/freeipa/ticket/4765 Reviewed-By: David Kupka <dkupka@redhat.com>
* Upgrade fix: masking named should be executed only onceMartin Basti2014-12-091-14/+16
| | | | | | | | | There was error in code, masking was executed more times, even it was succesful https://fedorahosted.org/freeipa/ticket/4755 Reviewed-By: David Kupka <dkupka@redhat.com>
* webui: increase duration of notification messagesPetr Vobornik2014-12-091-1/+1
| | | | | | | | by 66% https://fedorahosted.org/freeipa/ticket/4792 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: fix service unprovisioningPetr Vobornik2014-12-091-1/+1
| | | | | | | | Missed part of field refactoring caused that service could not be unprovisioned. https://fedorahosted.org/freeipa/ticket/4770 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Prefer TCP connections to UDP in krb5 clientsNathaniel McCallum2014-12-082-0/+2
| | | | | | | | | | | | | | In general, TCP is a better fit for FreeIPA due to large packet sizes. However, there is also a specific need for TCP when using OTP. If a UDP packet is delivered to the server and the server takes longer to process it than the client timeout (likely), the OTP value will be resent. Unfortunately, this will cause failures or even lockouts. Switching to TCP avoids this problem altogether. https://fedorahosted.org/freeipa/ticket/4725 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* hosts: Display assigned ID view by default in host-find and show commandsTomas Babej2014-12-051-1/+0
| | | | | | | | | | Makes ipaassignedidview a default attribute and takes care about the conversion from the DN to the proper ID view name. https://fedorahosted.org/freeipa/ticket/4774 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-29 17:19:19 +0000