summaryrefslogtreecommitdiffstats
path: root/ipaclient
Commit message (Collapse)AuthorAgeFilesLines
* Enable krb5 snippet updates on client updateRobbie Harwood2019-09-101-7/+13
| | | | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Use tasks to configure automount nsswitch settingsRob Critenden2019-08-282-145/+7
| | | | | | | | | | | | | | | | | | | | | authselect doesn't allow one to directly write to /etc/nsswitch.conf. It will complain bitterly if it detects it and will refuse to work until reset. Instead it wants the user to write to /etc/authselect/user-nsswitch.conf and then it will handle merging in any differences. To complicate matters some databases are not user configurable like passwd, group and of course, automount. There are some undocumented options to allow one to override these though so we utilize that. tasks are used so that authselect-based installations can still write directly to /etc/nsswitch.conf and operate as it used to. Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move ipachangeconf from ipaclient.install to ipapythonRob Critenden2019-08-281-559/+11
| | | | | | | | | This will let us call it from ipaplatform. Mark the original location as deprecated. Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-client-automount: always restore nsswitch.conf at uninstall timeFrançois Cami2019-08-281-15/+54
| | | | | | | | | | | | | | | ipa-client-automount used to only restore nsswitch.conf when sssd was not used. However authselect's default profile is now sssd so always restore nsswitch.conf's automount configuration to 'files sssd'. Note that the behavior seen before commit: a0e846f56c8de3b549d1d284087131da13135e34 would always restore nsswitch.conf to the previous state which in some cases was wrong. Fixes: https://pagure.io/freeipa/issue/8038 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-client-samba: remove state on uninstallFrançois Cami2019-07-261-5/+19
| | | | | | | | | | | | | The "domain_member" state was not removed at uninstall time. Remove it so that future invocations of ipa-client-samba work. Fixes: https://pagure.io/freeipa/issue/8021 Signed-off-by: François Cami <fcami@redhat.com> https://pagure.io/freeipa/issue/8021 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
* ipa-client-samba: remove and restore smb.conf only on first uninstallFrançois Cami2019-07-261-3/+4
| | | | | | | Fixes: https://pagure.io/freeipa/issue/8019 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
* ipa-client-samba: a tool to configure Samba domain member on IPA clientAlexander Bokovoy2019-06-291-0/+745
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduces new utility to configure Samba on an IPA domain member. The tool sets up Samba configuration and internal databases, creates cifs/... Kerberos service and makes sure that a keytab for this service contains the key with the same randomly generated password that is set in the internal Samba databases. Samba configuration is created by querying an IPA master about details of trust to Active Directory configuration. All known identity ranges added to the configuration to allow Samba to properly handle them (read-only) via idmap_sss. Resulting configuration allows connection with both NTLMSSP and Kerberos authentication for IPA users. Access controls for the shared content should be set by utilizing POSIX ACLs on the file system under a specific share. The utility is packaged as freeipa-client-samba package to allow pulling in all required dependencies for Samba and cifs.ko (smb3.ko) kernel module. This allows an IPA client to become both an SMB server and an SMB client. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa_client_automount.py and ipactl.py: fix codestyleFrançois Cami2019-06-281-75/+153
| | | | | | | | | | Updating ipa_client_automount.py and ipactl.py's codestyle is mandatory to make pylint pass as these are considered new files. Fixes: https://pagure.io/freeipa/issue/7984 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move ipa-client-automount.in and ipactl into modulesFrançois Cami2019-06-281-0/+542
| | | | | | | Fixes: https://pagure.io/freeipa/issue/7984 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Handle missing LWCA certificate or chainFraser Tweedale2019-06-181-4/+15
| | | | | | | | | | | | | | | | | | | | | If lightweight CA key replication has not completed, requests for the certificate or chain will return 404**. This can occur in normal operation, and should be a temporary condition. Detect this case and handle it by simply omitting the 'certificate' and/or 'certificate_out' fields in the response, and add a warning message to the response. Also update the client-side plugin that handles the --certificate-out option. Because the CLI will automatically print the warning message, if the expected field is missing from the response, just ignore it and continue processing. ** after the Dogtag NullPointerException gets fixed! Part of: https://pagure.io/freeipa/issue/7964 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Return 0 on uninstall when on_master for case of not installedRob Crittenden2019-06-071-1/+5
| | | | | | | | | | | | | | | | This is to suppress the spurious error message: The ipa-client-install command failed. when the client is not configured. This is managed by allowing a ScriptError to return SUCCESS (0) and have this ignored in log_failure(). https://pagure.io/freeipa/issue/7836 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Drop list of return values to be ignored in AdminToolRob Crittenden2019-06-071-1/+0
| | | | | | | | | | | | | | This was an attempt to suppress client uninstallation failure messages in the server uninstallation script. This method inadvertently also suppressed client uninstallation messages and was generally confusing. This reverts part of b96906156be37a7b29ee74423b82f04070c84e22 https://pagure.io/freeipa/issue/7836 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* When reading SSH pub key don't assume last character is newlineRob Crittenden2019-06-051-2/+3
| | | | | | | | | | | | | | | | | The code was attempting to strip off any trailing newline and then calling lstrip() on the rest. This assumes that the key has a trailing newline. At best this can cause the last character of the comment to be lost. If there is no comment it will fail to load the key because it is invalid. Patch by Félix-Antoine Fortin <felix-antoine.fortin@calculquebec.ca> https://pagure.io/freeipa/issue/7959 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Moving prompt for NTP options to install_checkTibor Dudlák2019-05-222-17/+36
| | | | | | | | | | | In a interactive installation of freeipa server a promt asks for NTP related options after install_check has been called. As it may cause confusion to users moving to install_check methods where the prompt for other options is being done. Refactored sync_time() method to use passed parameters ntp_servers and ntp_pool. Resolves: https://pagure.io/freeipa/issue/7930 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Oleg Kozlov <okozlov@redhat.com>
* Add knob to limit hostname lengthRob Crittenden2019-05-161-1/+9
| | | | | | | | | | | | | | | | | | | | | | On Linux systems the length limit for hostnames is hardcoded at 64 in MAXHOSTNAMELEN Solaris, for example, allows 255 characters, and DNS allows the total length to be up to 255 (with each label < 64). Add a knob to allow configuring the maximum hostname length (FQDN) The same validators are used between hosts and DNS to apply the knob only when dealing with a FQDN as a hostname. The maxlen option is included so installers can limit the length of allowed hostnames when the --hostname option is used. https://pagure.io/freeipa/issue/2018 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix `build_requestinfo` in LibreSSL environmentsStanislav Levin2019-05-141-3/+22
| | | | | | | | | | `build_requestinfo` was broken in @ac6568dcf. In this case LibreSSL behavior is the same as OpenSSL < 1.1.x. Thus, an additional check for SSL implementation was added. Fixes: https://pagure.io/freeipa/issue/7937 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix `build_requestinfo` in OpenSSL1.1.0+ environmentsStanislav Levin2019-05-121-13/+50
| | | | | | | | | | | | | Since OpenSSL 1.1.0 the `req_info` field of X509_REQ structure is no longer a pointer to X509_REQ_INFO. This results in a crash of `build_requestinfo` in environments having OpenSSL1.1.0+ (libcrypto). With this patch, the X509_REQ definition becomes the version dependent. Both OpenSSL1.0.x and OpenSSL1.1.x are supported. Fixes: https://pagure.io/freeipa/issue/7937 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Import urllib submodulesChristian Heimes2019-04-301-1/+2
| | | | | | | | | otpclient only imported the urllib parent package, not urllib.request and urllib.parse subpackages. This may or may not work depending on the import order of other plugins. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make ipaclient.discovery usable from command lineChristian Heimes2019-04-261-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | | For debugging and testing make it possible to run a simple domain discovery from the command line ``` $ python3 -m ipaclient.discovery demo1.freeipa.org realm DEMO1.FREEIPA.ORG (Discovered from LDAP DNS records in ipa.demo1.freeipa.org) domain demo1.freeipa.org (Discovered LDAP SRV records from demo1.freeipa.org) basedn dc=demo1,dc=freeipa,dc=org (From IPA server ldap://ipa.demo1.freeipa.org:389) server ipa.demo1.freeipa.org (Discovered from LDAP DNS records in ipa.demo1.freeipa.org) servers ['ipa.demo1.freeipa.org'] Success $ python3 -m ipaclient.discovery freeipa.org realm None domain None basedn None server None servers [] NO_LDAP_SERVER ``` Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make IPADiscovery work without ldapChristian Heimes2019-04-261-10/+21
| | | | | | | | ipaclient.discover.IPADiscovery skips LDAP discovery when python-ldap is not present. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make python-ldap optional for PyPI packagesChristian Heimes2019-04-261-0/+1
| | | | | | | | | | | | | | | python-ldap is a Python package with heavy C extensions. In order to build python-ldap, not only OpenLDAP development headers are necessary, but also OpenSSL, Cyrus SASL, and MIT KRB5 development headers. A fully functional ipaclient doesn't need an LDAP driver. It talks JSON RPC over HTTPS to a server. python-ldap is only used by ipapython.dn.DN to convert a string to a DN with ldap_str2dn(). The function is simple and can be wrapped with ctypes in a bunch of lines. Related: https://pagure.io/freeipa/issue/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Deprecate ipa-client-install --request-certChristian Heimes2019-04-241-1/+11
| | | | | | | | | | | Mark the --request-cert option for ipa-client-install as deprecated. Users are encouraged to request a PEM certificate with certmonger instead. The option and /etc/ipa/nssdb will be removed in a future version. Related: https://pagure.io/freeipa/issue/7492 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Support interactive prompt for ntp optionsTibor Dudlák2019-04-112-7/+41
| | | | | | | | | | | | | | | | | | | | As the FreeIPA server is no longer a NTP service providing instance its clients and replicas configuration of time service can not be handled as it was before change to chrony. Configuration using master FQDN or autodiscovery for DNS record would make no difference because every FreeIPA instance is only chrony client now and does not update DNS _ntp._udp record. FreeIPA now asks user for NTP source server or pool address in interactive mode if there is no server nor pool specified and autodiscovery has not found any NTP source in DNS records. Resolves: https://pagure.io/freeipa/issue/7747 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-client-install: autodiscovery must refuse single-label domainsFlorence Blanc-Renaud2019-04-101-11/+34
| | | | | | | | | | | | | | Since commit 905ab93, ipa-server-install refuses single-label domains, but older IPA server versions could be installed with a single-label domain/realm. ipa-client-install is already refusing single-label domain/realm when provided to the CLI with --domain / --realm but does not perform the same check when the domain is discovered. This commit adds a check to domain names automatically discovered and skips single-label domains. Same check for realm names. Fixes: https://pagure.io/freeipa/issue/7598 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Reformat and PEP8 ipaclient.discoveryChristian Heimes2019-03-011-47/+48
| | | | | | | | Since the moved code is detected as new/modified code, make fastlint is complaining about PEP 8 violations. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make IPADiscovery available in PyPI packagesChristian Heimes2019-03-013-578/+602
| | | | | | | | | | | | | | The ipaclient PyPI package does not ship the ipaclient.install subpackage. The ipaclient.install.ipadiscovery module with IPADiscovery is now available as ipaclient.discovery, so it can be used by consumers of PyPI packages. The module ipaclient.install.ipadiscovery provides a backwards compatibility shim with deprecation warning. Fixes: https://pagure.io/freeipa/issue/7861 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Use new LDAPClient constructorsChristian Heimes2019-02-052-4/+2
| | | | | | | | | | | | | | | | | | Replace get_ldap_uri() + LDAPClient() with new LDAPClient constructors like LDAPClient.from_realm(). Some places now use LDAPI with external bind instead of LDAP with simple bind. Although the FQDN *should* resolve to 127.0.0.1 / [::1], there is no hard guarantee. The draft https://tools.ietf.org/html/draft-west-let-localhost-be-localhost-04#section-5.1 specifies that applications must verify that the resulting IP is a loopback API. LDAPI is always local and a bit more efficient, too. The simple_bind() method also prevents the caller from sending a password over an insecure line. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Allow HTTPd user to access SSSD IFPChristian Heimes2018-12-111-1/+9
| | | | | | | | | | | | | For smart card and certificate authentication, Apache's mod_lookup_identity module must be able to acess SSSD IFP. The module accesses IFP as Apache user, not as ipaapi user. Apache is not allowed to use IFP by default. The update code uses the service's ok-to-auth-as-delegate flag to detect smart card / cert auth. See: https://pagure.io/freeipa/issue/7751 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* certupdate: add commentary about certmonger behaviourFraser Tweedale2018-12-031-0/+11
| | | | | | | | | | It is not obvious why we "renew" (reuse only) the IPA CA certificate in ipa-certupdate. Add some commentary to explain this behaviour. Related: https://pagure.io/freeipa/issue/7751 See also: https://github.com/freeipa/freeipa/pull/2576#issuecomment-442220840 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pylint 2.2: Fix unnecessary pass statementChristian Heimes2018-11-261-2/+2
| | | | | | | | | | pylint 2.2.0 has a new checker for unnecessary pass statements. There is no need to have a pass statement in functions or classes with a doc string. Fixes: https://pagure.io/freeipa/issue/7772 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Allow ipaapi user to access SSSD's info pipeChristian Heimes2018-11-071-7/+34
| | | | | | | | | | | | | | | | | For smart card authentication, ipaapi must be able to access to sss-ifp. During installation and upgrade, the ipaapi user is now added to [ifp]allowed_uids. The commit also fixes two related issues: * The server upgrade code now enables ifp service in sssd.conf. The existing code modified sssd.conf but never wrote the changes to disk. * sssd_enable_service() no longer fails after it has detected an unrecognized service. Fixes: https://pagure.io/freeipa/issue/7751 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix misleading errors during client install rollbackRob Crittenden2018-10-261-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some incorrect errors are possible if a client installation fails and a configuration rollback is required. These include: 1. Unconfigured automount client failed: CalledProcessError(Command ['/usr/sbin/ipa-client-automount', '--uninstall', '--debug'] returned non-zero exit status 1: '') Caused by check_client_configuration() not returning the correct return value (2). 2. WARNING: Unable to revert to the pre-installation state ('authconfig' tool has been deprecated in favor of 'authselect'). The default sssd profile will be used instead. The authconfig arguments would have been: authconfig --disableldap --disablekrb5 --disablesssdauth --disablemkhomedir If installation fails before SSSD is configured there is no state to roll back to. Detect this condition. 3. An error occurred while removing SSSD's cache.Please remove the cache manually by executing sssctl cache-remove -o. Again, if SSSD is not configured yet then there is no cache to remove. Also correct the missing space after the period. https://pagure.io/freeipa/issue/7729 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Py3: Replace six.moves importsChristian Heimes2018-10-053-9/+5
| | | | | | | | | | | | Replace six.moves and six.StringIO/BytesIO imports with cannonical Python 3 packages. Note: six.moves.input behaves differently than builtin input function. Therefore I left six.moves.input for now. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Fix writing certificate chain to fileFraser Tweedale2018-10-022-6/+4
| | | | | | | | | | | | | | | | | | | | | An client-side error occurs when cert commands are instructed to write the certificate chain (--chain option) to a file (--certificate-out option). This regression was introduced in the 'cert' plugin in commit 5a44ca638310913ab6b0c239374f4b0ddeeedeb3, and reflected in the 'ca' plugin in commit c7064494e5801d5fd4670e6aab1e07c65d7a0731. The server behaviour did not change; rather the client did not correctly handle the DER-encoded certificates in the 'certificate_chain' response field. Fix the issue by treating the 'certificate' field as base-64 encoded DER, and the 'certificate_chain' field as an array of raw DER certificates. Add tests for checking that the relevant commands succeed and write PEM data to the file (both with and without --chain). Fixes: https://pagure.io/freeipa/issue/7700 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Py3: Remove subclassing from objectChristian Heimes2018-09-275-13/+13
| | | | | | | | | Python 2 had old style and new style classes. Python 3 has only new style classes. There is no point to subclass from object any more. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Remove replica_file from ClientInstall class in ipaclient/install/client.pyThomas Woerner2018-09-121-1/+0
| | | | | | | | There is no need to set replica_file to None for client installations. See: https://pagure.io/freeipa/issue/7689 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix certificate type error when exporting to fileArmando Neto2018-09-061-6/+5
| | | | | | | | | | | | Commands `ipa ca-show` and `ipa cert-show` share the same code, this commit updates the former, closing the gap between them. Reflecting the changes done in 5a44ca638310913ab6b0c239374f4b0ddeeedeb3. https://pagure.io/freeipa/issue/7628 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Delete empty keytab during client installationArmando Neto2018-09-051-0/+10
| | | | | | | | | | | Client installation fails if '/etc/krb5.keytab' exists as a zero-length file. Deleting empty keytab before proceeding with the installation fixes the problem. https://pagure.io/freeipa/issue/7625 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Retrieve certificate subject base directly instead of ipa-joinRob Crittenden2018-08-291-7/+14
| | | | | | | | | | | | | | | | | | | | | The subject base is used as a fallback to find the available CA certificates during client enrollment if the LDAP connection fails (e.g. due to new client connecting to very old server) and for constructing the subject if a certificate is requested. raw=True is passed to config-show in order to avoid parsing the server roles which will fail because the services aren't marked as enabled until after the client installation is successful on a master. ipa-join providing the subject base via stderr was fragile and would cause client enrollment to fail if any other output was included in stderr. https://pagure.io/freeipa/issue/7674 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaclient: Remove --no-sssd and --no-ac optionsThomas Woerner2018-08-132-13/+2
| | | | | | | | | | | | Client installation with --no-sssd option has already beeen deprecated with https://pagure.io/freeipa/issue/5860. Authconfig support has been removed, therefore --no-ac option can be removed also. ipatests/test_integration/test_authselect.py: Skip no_sssd and no_ac tests. See: https://pagure.io/freeipa/issue/7671 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaclient-install: chmod needs octal permissionsOrion Poplawski2018-07-251-1/+1
| | | | | | | | | Fixes incorrect usage introduced in 792adebfabb456d154164387fb7e60acb30f4325 https://pagure.io/freeipa/issue/7650 Signed-off-by: Orion Poplawski <orion@nwra.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix regression: Handle unicode where str is expectedArmando Neto2018-07-181-1/+1
| | | | | | | | | | | Regression caused by 947ac4bc1f6f4016cf5baf2ecb4577e893bc3948 when trying to fix a similar issue for clients running Python 3. However, that fix broke Python 2 clients. Issue: https://pagure.io/freeipa/issue/7626 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix Pylint 2.0 violationsArmando Neto2018-07-142-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following violations aiming to support Pylint 2.0 - `unneeded-not` (C0113): Consider changing "not item in items" to "item not in items" used when a boolean expression contains an unneeded negation. - `useless-import-alias` (C0414): Import alias does not rename original package Used when an import alias is same as original package.e.g using import numpy as numpy instead of import numpy as np - `raising-format-tuple` (W0715): Exception arguments suggest string formatting might be intended Used when passing multiple arguments to an exception constructor, the first of them a string literal containing what appears to be placeholders intended for formatting - `bad-continuation` (C0330): This was already included on the disable list, although with current version of pylint (2.0.0.dev2) violations at the end of the files are not being ignored. See: https://github.com/PyCQA/pylint/issues/2278 - `try-except-raise` (E0705): The except handler raises immediately Used when an except handler uses raise as its first or only operator. This is useless because it raises back the exception immediately. Remove the raise operator or the entire try-except-raise block! - `consider-using-set-comprehension` (R1718): Consider using a set comprehension Although there is nothing syntactically wrong with this code, it is hard to read and can be simplified to a set comprehension.Also it is faster since you don't need to create another transient list - `dict-keys-not-iterating` (W1655): dict.keys referenced when not iterating Used when dict.keys is referenced in a non-iterating context (returns an iterator in Python 3) - `comprehension-escape` (W1662): Using a variable that was bound inside a comprehension Emitted when using a variable, that was bound in a comprehension handler, outside of the comprehension itself. On Python 3 these variables will be deleted outside of the comprehension. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix pylint 2.0 conditional-related violationsArmando Neto2018-07-121-1/+1
| | | | | | | | | | | | | | | | | | | | | In order to support pylint 2.0 the following violations must be fixed: - `chained-comparison` (R1716): Simplify chained comparison between the operands This message is emitted when pylint encounters boolean operation like "a < b and b < c", suggesting instead to refactor it to "a < b < c". - `consider-using-in` (R1714): Consider merging these comparisons with "in" to %r To check if a variable is equal to one of many values,combine the values into a tuple and check if the variable is contained "in" it instead of checking for equality against each of the values.This is faster and less verbose. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix pylint 2.0 return-related violationsArmando Neto2018-07-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Aiming to support pylint 2.0 some functions and methods must have their return statements updated in order to fix two new violations: - `useless-return` (R1711): Useless return at end of function or method Emitted when a single "return" or "return None" statement is found at the end of function or method definition. This statement can safely be removed because Python will implicitly return None - `inconsistent-return-statements` (R1710): Either all return statements in a function should return an expression, or none of them should. According to PEP8, if any return statement returns an expression, any return statements where no value is returned should explicitly state this as return None, and an explicit return statement should be present at the end of the function (if reachable) Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Wait for client certificatesChristian Heimes2018-07-091-6/+12
| | | | | | | | | | | | | ipa-client-install --request-cert now waits until certmonger has provided a host certificate. In case of an error, ipa-client-install no longer pretents to success but fails with an error code. The --request-cert option also ensures that certmonger is enabled and running. See: Fixes: https://pagure.io/freeipa/issue/7623 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Replace file.flush() calls with flush_sync() helperArmando Neto2018-07-073-8/+7
| | | | | | | | | | | | | | | | | Calls to `os.fsync(f.fileno())` need to be accompained by `f.flush()`. Commit 8bbeedc93fd442cbbb9bb70e5f446011e95211db introduces the helper `ipapython.ipautil.flush_sync()`, which handles all calls in the right order. However, `flush_sync()` takes as parameter a file object with fileno and name, where name must be a path to the file, this isn't possible in some cases where file descriptors are used. Issue: https://pagure.io/freeipa/issue/7251 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Cleanup shebang and executable bitChristian Heimes2018-07-052-3/+0
| | | | | | | | | | | | - Add missing executable bits to all scripts - Remove executable bits from all files that are not scripts, e.g. js, html, and Python libraries. - Remove Python shebang from all Python library files. It's frown upon to have executable library files in site-packages. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Armando Neto <abiagion@redhat.com>
* Import ABCs from collections.abcChristian Heimes2018-07-052-5/+19
| | | | | | | | | | | | | Python 3 has moved all collection abstract base classes to collections.abc. Python 3.7 started to deprecate the old aliases. The whole import block needs to be protected with import-error and no-name-in-module, because Python 2 doesn't have collections.abc module and collections.abc.Mapping, while Python 3 doesn't have collections.Mapping. Fixes: https://pagure.io/freeipa/issue/7609 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipa-client-install: Update how comments are added by ipachangeconfArmando Neto2018-07-052-4/+11
| | | | | | | | | | | | | | | | | Due to how 'openldap-client' parses its configuration files this patch changes how comments are added, moving them to the line above instead of appending to the same line. IPA doesn't want to break existing configuration, if a value already exists it adds a comment to the modified setting and a note about that on the line above. New settings will be added without any note. Issue: https://pagure.io/freeipa/issue/5202 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 06:53:14 +0000