summaryrefslogtreecommitdiffstats
path: root/ipaclient/plugins
Commit message (Collapse)AuthorAgeFilesLines
* Handle missing LWCA certificate or chainFraser Tweedale2019-06-181-4/+15
| | | | | | | | | | | | | | | | | | | | | If lightweight CA key replication has not completed, requests for the certificate or chain will return 404**. This can occur in normal operation, and should be a temporary condition. Detect this case and handle it by simply omitting the 'certificate' and/or 'certificate_out' fields in the response, and add a warning message to the response. Also update the client-side plugin that handles the --certificate-out option. Because the CLI will automatically print the warning message, if the expected field is missing from the response, just ignore it and continue processing. ** after the Dogtag NullPointerException gets fixed! Part of: https://pagure.io/freeipa/issue/7964 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Import urllib submodulesChristian Heimes2019-04-301-1/+2
| | | | | | | | | otpclient only imported the urllib parent package, not urllib.request and urllib.parse subpackages. This may or may not work depending on the import order of other plugins. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pylint 2.2: Fix unnecessary pass statementChristian Heimes2018-11-261-2/+2
| | | | | | | | | | pylint 2.2.0 has a new checker for unnecessary pass statements. There is no need to have a pass statement in functions or classes with a doc string. Fixes: https://pagure.io/freeipa/issue/7772 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Py3: Replace six.moves importsChristian Heimes2018-10-051-2/+2
| | | | | | | | | | | | Replace six.moves and six.StringIO/BytesIO imports with cannonical Python 3 packages. Note: six.moves.input behaves differently than builtin input function. Therefore I left six.moves.input for now. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Fix writing certificate chain to fileFraser Tweedale2018-10-022-6/+4
| | | | | | | | | | | | | | | | | | | | | An client-side error occurs when cert commands are instructed to write the certificate chain (--chain option) to a file (--certificate-out option). This regression was introduced in the 'cert' plugin in commit 5a44ca638310913ab6b0c239374f4b0ddeeedeb3, and reflected in the 'ca' plugin in commit c7064494e5801d5fd4670e6aab1e07c65d7a0731. The server behaviour did not change; rather the client did not correctly handle the DER-encoded certificates in the 'certificate_chain' response field. Fix the issue by treating the 'certificate' field as base-64 encoded DER, and the 'certificate_chain' field as an array of raw DER certificates. Add tests for checking that the relevant commands succeed and write PEM data to the file (both with and without --chain). Fixes: https://pagure.io/freeipa/issue/7700 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Py3: Remove subclassing from objectChristian Heimes2018-09-271-1/+1
| | | | | | | | | Python 2 had old style and new style classes. Python 3 has only new style classes. There is no point to subclass from object any more. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Fix certificate type error when exporting to fileArmando Neto2018-09-061-6/+5
| | | | | | | | | | | | Commands `ipa ca-show` and `ipa cert-show` share the same code, this commit updates the former, closing the gap between them. Reflecting the changes done in 5a44ca638310913ab6b0c239374f4b0ddeeedeb3. https://pagure.io/freeipa/issue/7628 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix Pylint 2.0 violationsArmando Neto2018-07-142-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following violations aiming to support Pylint 2.0 - `unneeded-not` (C0113): Consider changing "not item in items" to "item not in items" used when a boolean expression contains an unneeded negation. - `useless-import-alias` (C0414): Import alias does not rename original package Used when an import alias is same as original package.e.g using import numpy as numpy instead of import numpy as np - `raising-format-tuple` (W0715): Exception arguments suggest string formatting might be intended Used when passing multiple arguments to an exception constructor, the first of them a string literal containing what appears to be placeholders intended for formatting - `bad-continuation` (C0330): This was already included on the disable list, although with current version of pylint (2.0.0.dev2) violations at the end of the files are not being ignored. See: https://github.com/PyCQA/pylint/issues/2278 - `try-except-raise` (E0705): The except handler raises immediately Used when an except handler uses raise as its first or only operator. This is useless because it raises back the exception immediately. Remove the raise operator or the entire try-except-raise block! - `consider-using-set-comprehension` (R1718): Consider using a set comprehension Although there is nothing syntactically wrong with this code, it is hard to read and can be simplified to a set comprehension.Also it is faster since you don't need to create another transient list - `dict-keys-not-iterating` (W1655): dict.keys referenced when not iterating Used when dict.keys is referenced in a non-iterating context (returns an iterator in Python 3) - `comprehension-escape` (W1662): Using a variable that was bound inside a comprehension Emitted when using a variable, that was bound in a comprehension handler, outside of the comprehension itself. On Python 3 these variables will be deleted outside of the comprehension. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Replace file.flush() calls with flush_sync() helperArmando Neto2018-07-071-2/+2
| | | | | | | | | | | | | | | | | Calls to `os.fsync(f.fileno())` need to be accompained by `f.flush()`. Commit 8bbeedc93fd442cbbb9bb70e5f446011e95211db introduces the helper `ipapython.ipautil.flush_sync()`, which handles all calls in the right order. However, `flush_sync()` takes as parameter a file object with fileno and name, where name must be a path to the file, this isn't possible in some cases where file descriptors are used. Issue: https://pagure.io/freeipa/issue/7251 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix translation of commands description in API BrowserStanislav Levin2018-06-121-0/+1
| | | | | | | | The command description is taken from python docstring. Thus commands should have them and should include the callings of gettext to be translated. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Load certificate files as binary dataChristian Heimes2018-04-302-4/+4
| | | | | | | | | | | | | In Python 3, cryptography requires certificate data to be binary. Even PEM encoded files are treated as binary content. certmap-match and cert-find were loading certificates as text files. A new BinaryFile type loads files as binary content. Fixes: https://pagure.io/freeipa/issue/7520 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* csrgen: support initialising OpenSSL adaptor with key objectFraser Tweedale2018-04-251-1/+2
| | | | | | | | | | | As a convenience for using it with the test suite, update the csrgen OpenSSLAdaptor class to support initialisation with a python-cryptography key object, rather than reading the key from a file. Part of: https://pagure.io/freeipa/issue/7496 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Defer import of ipaclient.csrgenChristian Heimes2018-04-102-8/+9
| | | | | | | | | The modules ipaclient.csrgen and ipaclient.csrgen_ffi are expensive to load, but rarely used. On demand loading speeds up ipa CLI by about 200ms. Fixes: https://pagure.io/freeipa/issue/7484 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* vault: fix vault-retrieve to a fileStanislav Laznicka2018-03-061-1/+1
| | | | | | | | | `data` is bytes but we were opening the "--out" file as a text. https://pagure.io/freeipa/issue/7430 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Vault: Add argument checks to encrypt/decryptChristian Heimes2017-12-191-6/+14
| | | | | | | | | | | Vault's encrypt and decrypt helper function take either symmetric or public/private key. Raise an exception if either both or none of them are passed down. See https://pagure.io/freeipa/issue/7326 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Fix pylint warnings inconsistent-return-statementsChristian Heimes2017-12-182-0/+5
| | | | | | | | | | Add consistent return to all functions and methods that are covered by tox -e pylint[23]. I haven't checked if return None is always a good idea or if we should rather raise an error. See: https://pagure.io/freeipa/issue/7326 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* x509: remove the strip_header() functionStanislav Laznicka2017-11-012-2/+3
| | | | | | | | We don't need the strip_header() function, to load an unknown x509 certificate, load_unknown_x509_certificate() should be used. Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* parameters: introduce CertificateSigningRequestStanislav Laznicka2017-10-251-3/+0
| | | | | | | | | | Previously, CSRs were handled as a Str parameter which brought trouble to Python 3 because of its more strict type requirements. We introduce a CertificateSigningRequest parameter which allows to use python-cryptography x509.CertificateSigningRequest to represent CSRs in the framework. https://pagure.io/freeipa/issue/7131
* csrgen: accept public key info as BytesStanislav Laznicka2017-10-252-3/+3
| | | | | | | | cert_get_requestdata() method is meant for internal use only and is never passed a file. Make its parameter public_key_info Bytes to better represent what's actually being passed to it. https://pagure.io/freeipa/issue/7131
* ipaclient.plugins.dns: Cast DNS name to unicodeAleksei Slaikovskii2017-10-201-1/+1
| | | | | | | | | | | | | | cmd.api.Command.dnsrecord_split_parts expects name to be unicode string and instead gets ascii. It leads to an error: ipa: ERROR: invalid 'name': must be Unicode text This commit's change is casting name's type to unicode so 'ipa dnsrecord-mod' will not fail with error above. https://pagure.io/freeipa/issue/7185 Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3: fix vault public key decodingFraser Tweedale2017-08-291-1/+1
| | | | | | Part of: https://pagure.io/freeipa/issue/7033 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* otptoken_yubikey.py: Removed traceback when package missing.Tibor Dudlák2017-08-111-0/+3
| | | | | | | | | IPA should suggest user to install dependent packages instead of throwing traceback. To work with IPA and Yubikey, packages libyubikey(not in official RHEL repo) and libusb are required. Resolves: https://pagure.io/freeipa/issue/6979 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Create a Certificate parameterStanislav Laznicka2017-07-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Up until now, Bytes parameter was used for certificate parameters throughout the framework. However, the Bytes parameter does nothing special for certificates, like validation, so this had to be done for each of the parameters which were supposed to represent a certificate. This commit introduces a special Certificate parameter which takes care of certificate validation so this does not have to be done separately. It also makes sure that the certificates represented by this parameter are always converted to DER format so that we can work with them in a unified manner throughout the framework. This commit also makes it possible to pass bytes directly during instantiation of the Certificate parameter and they are still represented correctly after their conversion in the _convert_scalar() method. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* x509: Make certificates represented as objectsStanislav Laznicka2017-07-276-27/+22
| | | | | | | | https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Split x509.load_certificate() into PEM/DER functionsStanislav Laznicka2017-07-272-3/+3
| | | | | | | | | | | | | Splitting the load_certificate() function into two separate helps us word the requirements for the input explicitly. It also makes our backend similar to the one of python-cryptography so eventually we can swap python-cryptography for IPA x509 module. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: do not use `ipa_log_manager` to create module-level loggersJan Cholasta2017-07-141-2/+2
| | | | | | | | Replace all `ipa_log_manager.log_mgr.get_logger` calls to create module-level loggers with `logging.getLogger` calls and deprecate `ipa_log_manager.log_mgr.get_logger`. Reviewed-By: Martin Basti <mbasti@redhat.com>
* topology.py: Removes error message from dictionary.Tibor Dudlák2017-07-141-6/+5
| | | | | | | | IPA will not print error message header when maximum number of agreements per replica exceeded in topology. Resolves: https://pagure.io/freeipa/issue/6533 Reviewed-By: David Kupka <dkupka@redhat.com>
* py3: vault: data must be bytesMartin Basti2017-06-231-1/+1
| | | | | | | | Use bytes for vault data https://pagure.io/freeipa/issue/4985 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ca/cert-show: check certificate_out in optionsStanislav Laznicka2017-05-242-5/+15
| | | | | | | | | | | | | | If --certificate-out was specified on the command line, it will appear among the options. If it was empty, it will be None. This check was done properly in the ca plugin. Lets' just unify how this is handled and improve user experience by announcing which option causes the failure. https://pagure.io/freeipa/issue/6885 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use os.fsync instead of os.fdatasync because macOS doesn't support fdatasyncDavid Kreitschmann2017-05-171-1/+1
| | | | | | Signed-off-by: David Kreitschmann <david@kreitschmann.de> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* otptoken-add-yubikey: When --digits not provided use default valueDavid Kupka2017-05-161-1/+4
| | | | | | | | | | Since Thin client was introduced default values for options are not populated in client side plugins. When option has default value and is needed in client plugin it must be handled by explicitly. https://pagure.io/freeipa/issue/6900 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Slim down dependenciesChristian Heimes2017-05-092-5/+16
| | | | | | | | * Make jinja2 an optional dependency and csrgen an optional plugin * Make otptoken_yubikey an optional plugin Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* vault: piped input for ipa vault-add failsFlorence Blanc-Renaud2017-04-281-29/+8
| | | | | | | | | | | | | | | An exception is raised when using echo "Secret123\n" | ipa vault-add myvault This happens because the code is using (string).decode(sys.stdin.encoding) and sys.stdin.encoding is None when the input is read from a pipe. The fix is using the prompt_password method defined by Backend.textui, which gracefully handles this issue. https://pagure.io/freeipa/issue/6907 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* csrgen: Modify cert_get_requestdata to return a CertificationRequestInfoBen Lipton2017-04-032-60/+50
| | | | | | | | | Also modify cert_request to use this new format. Note, only PEM private keys are supported for now. NSS databases are not. https://pagure.io/freeipa/issue/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Change to pure openssl config format (no script)Ben Lipton2017-04-031-2/+1
| | | | | | https://pagure.io/freeipa/issue/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Remove helper abstractionBen Lipton2017-04-031-1/+1
| | | | | | | | | All requests now use the OpenSSL formatter. However, we keep Formatter a separate class so that it can be changed out for tests. https://pagure.io/freeipa/issue/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Simplify KRA transport cert cacheChristian Heimes2017-03-281-48/+55
| | | | | | | | | | In-memory cache causes problem in forking servers. A file based cache is good enough. It's easier to understand and avoids performance regression and synchronization issues when cert becomes out-of-date. https://pagure.io/freeipa/issue/6787 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: hide cert-get-requestdata in CLIJan Cholasta2017-03-141-0/+2
| | | | | | | | | The CSR generation feature is supposed to be used from cert-request, hide the internal cert-get-requestdata command in the CLI. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* cert: include certificate chain in cert command outputJan Cholasta2017-03-141-1/+4
| | | | | | | | | | | | Include the full certificate chain in the output of cert-request, cert-show and cert-find if --chain or --all is specified. If output file is specified in the CLI together with --chain, the full certificate chain is written to the file. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert: add output file option to cert-requestJan Cholasta2017-03-141-14/+52
| | | | | | | | | | | The certificate returned by cert-request can now be saved to a file in the CLI using a new --certificate-out option. Deprecate --out in cert-show in favor of --certificate-out. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* vault: cache the transport certificate on clientJan Cholasta2017-03-131-52/+153
| | | | | | | | | | Cache the KRA transport certificate on disk (in ~/.cache/ipa) as well as in memory. https://fedorahosted.org/freeipa/ticket/6652 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certmap: load certificate from file in certmap-match CLIJan Cholasta2017-03-131-0/+49
| | | | | | | | | Load the certificate from a file specified in the first argument. Raw certificate value can be specified using --certificate. https://pagure.io/freeipa/issue/6646 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* dns: fix `dnsrecord_add` interactive modeJan Cholasta2017-03-081-0/+6
| | | | | | | | | | | | | | | `dnsrecord_add` interactive mode might prompt for value of non-existent arguments `a_part_create_reverse` and `aaaa_part_create_reverse`. This happens because `dnsrecord_add` extra flags are incorrectly defined as parts of the respective DNS records. Remove extra flags from DNS record parts to fix the interactive mode on old clients talking to new servers. Skip non-existent arguments in the interactive mode to fix new clients talking to old servers. https://fedorahosted.org/freeipa/ticket/6457 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Vault: port key wrapping to python-cryptographyChristian Heimes2017-03-021-89/+92
| | | | | | | https://fedorahosted.org/freeipa/ticket/6650 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove NSSConnection from otptoken pluginStanislav Laznicka2017-03-011-7/+6
| | | | | | | | | Replace NSSConnection with httplib.HTTPSConenction to be able to remove NSSConnection for good. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Support encrypted private keysBen Lipton2017-02-281-0/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Allow overriding the CSR generation profileBen Lipton2017-02-281-1/+12
| | | | | | | | | | In case users want multiple CSR generation profiles that work with the same dogtag profile, or in case the profiles are not named the same, this flag allows specifying an alternative CSR generation profile. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Automate full cert request flowBen Lipton2017-02-282-2/+79
| | | | | | | | | | | | | | | | | Allows the `ipa cert-request` command to generate its own CSR. It no longer requires a CSR passed on the command line, instead it creates a config (bash script) with `cert-get-requestdata`, then runs it to build a CSR, and submits that CSR. Example usage (NSS database): $ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --database /tmp/certs Example usage (PEM private key file): $ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --private-key /tmp/key.pem https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS: dns-update-system-record can create nsupdate fileMartin Basti2017-02-151-6/+66
| | | | | | | | | | Added option --out <path> creates a file with IPA DNS data in nsupdate format. https://fedorahosted.org/freeipa/ticket/6585 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* tests: Add tests for CSR autogenerationBen Lipton2017-01-311-1/+2
| | | | | | | | | This patch also contains some code changes to make the code easier to test and to make the tests pass. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2026-01-26 12:05:53 +0000