summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* Make `env` and `plugins` commands local againMartin Babinsky2016-12-021-0/+124
| | | | | | | | | | | | | | During thin client refactoring, LocalOrRemote class implementation of `run` method was overriden by default Command implementation during instantiation of client plugins from schema. This caused these commands to always forward this request to IPA master. This patch restores the original behavior: unless `--server` option was specified, the commands will always print out local config. https://fedorahosted.org/freeipa/ticket/6490 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Revert "Add 'ipa localenv' subcommand"Martin Babinsky2016-12-021-24/+0
| | | | | | | | | | This reverts commit 1166fbc4946596fcc2ed51a1ec6990fc7dae8964. The proper fix is to restore pre-thin client behavior of commands inheriting from LocalOrRemote class. https://fedorahosted.org/freeipa/ticket/6490 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Adjustments for setup requirements v2Pavel Vomacka2016-12-021-3/+0
| | | | | | | | Remove setup requirement on wheel since it triggers download. https://fedorahosted.org/freeipa/ticket/6468 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Wheel bundles fixesChristian Heimes2016-11-301-1/+1
| | | | | | | | | | | * make wheel_bundle no longer bundles ipaplatform * ipaclient and ipalib use a consistent extra tag for the install subpackage. `pip install ipalib[ipalib.install]` looks a bit silly. https://fedorahosted.org/freeipa/ticket/6474 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Check the result of cert request in replica installerFlorence Blanc-Renaud2016-11-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | When running ipa-replica-install in domain-level 1, the installer requests the LDAP and HTTP certificates using certmonger but does not check the return code. The installer goes on and fails when restarting dirsrv. Fix: when certmonger was not able to request the certificate, raise an exception and exit from the installer: [28/45]: retrieving DS Certificate [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE) Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Certificate issuance failed (CA_UNREACHABLE) ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information https://fedorahosted.org/freeipa/ticket/6514 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Adjustments for setup requirementsChristian Heimes2016-11-301-0/+1
| | | | | | | | | | | | | | * Fix some typos, missing or surplus dependencies. * Remove setup requirement on wheel since it triggers download. ipatests is now installable. Tests need further changes to be runable. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipalib: remove hard dependency on ipapythonJan Cholasta2016-11-292-3/+4
| | | | | | | | | | | Hard-code the path to /bin/false in SubprocessError doc string. Remove ipaplatform dependency from ipalib's setup.py and add it as optional installer dependency to ipalib's and ipaclient's setup.py. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* constants: remove CACERTJan Cholasta2016-11-291-4/+0
| | | | | | | | | | CACERT depends on ipaplatform. Replace all uses of CACERT with paths.IPA_CA_CRT and remove CACERT. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib: move certstore to the install subpackageJan Cholasta2016-11-291-0/+0
| | | | | | | | | | The certstore module depends on ipaplatform. Move it to ipalib.install, as it is used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-291-0/+97
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-292-0/+1052
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix Python 3 bugs discovered by pylintChristian Heimes2016-11-251-1/+1
| | | | | | | | | | | | In Python 3 exception instances no longer have a message attribute. For most exceptions, str(e) or string formatting give the same result. Fix some renamed modules, module members and functions. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-254-5/+9
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Replace LooseVersionChristian Heimes2016-11-243-20/+22
| | | | | | | | | | | | | | | | | | | | pylint is having a hard time with distutils.version in tox's virtual envs. virtualenv uses some tricks to provide a virtual distutils package, pylint can't cope with. https://github.com/PyCQA/pylint/issues/73 suggests to use pkg_resources instead. pkg_resources' version parser has some more benefits, e.g. PEP 440 conformity. But pkg_resources.parse_version() is a heavy weight solution with reduced functionality, e.g. no access to major version. For API_VERSION and plugin version we can use a much simpler and faster approach. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add 'ipa localenv' subcommandChristian Heimes2016-11-181-0/+24
| | | | | | | | | | | | ipa local-env simply dumps all values from api.env as sorted key="value" pairs. It's a convenient helper for debugging and to write tests for e.g. PR #182. https://fedorahosted.org/freeipa/ticket/6490 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Turn replication manager group into ReplicationManager class memberMartin Babinsky2016-11-171-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add install requirements to Python packagesChristian Heimes2016-11-161-0/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Make api.env.nss_dir relative to api.env.confdirChristian Heimes2016-11-162-2/+4
| | | | | | | | | | | | | api.env.nss_dir is no longer hard-coded to paths.IPA_NSSDB_DIR. Instead the path is calculated relatively to api.env.confdir. The default value is still /etc/ipa/nssdb. The change makes it a bit easier to run FreeIPA's API with a custom configuration directory. See https://fedorahosted.org/freeipa/ticket/6386 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert-request: accept CSRs with extraneous dataFraser Tweedale2016-11-111-1/+1
| | | | | | | | | | | | | | | The cert-request command used to accept CSRs that had extra data surrounding the PEM data, e.g. commentary about the contents of the CSR. Recent commits that switch to using python-cryptography for cert and CSR handling broke this. Our acceptance tests use such CSRs, hence the tests are now failing. To avoid the issue, freshly encode the python-cryptography CertificateSigningRequest object as PEM. This avoids re-using the user-supplied data, in case it has extraneous data. Fixes: https://fedorahosted.org/freeipa/ticket/6472 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* install: introduce installer class hierarchyJan Cholasta2016-11-114-0/+241
| | | | | | | | | Add class hierarchy which allows inherting knob definitions between the various client and server install scripts. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove __main__ code from ipalib.x509 and ipalib.pkcs10Fraser Tweedale2016-11-102-25/+0
| | | | | | | | | | This code was presumably once used for testing, but has been subsumed by the actual test suite. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-102-171/+168
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: use pyasn1-modules X.509 specsFraser Tweedale2016-11-101-96/+7
| | | | | | | | | | | | | Remove our hand-rolled pyasn1 specifications for X.509 in favour of those provided by the pyasn1-modules library. This also avoids a bug in our _Extension spec wherein parsing fails if the 'critical' field is absent. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: avoid use of nss.data_to_hexFraser Tweedale2016-11-101-0/+23
| | | | | | | | | | | Avoid use of the nss.data_to_hex function for formatting certificate fingerprints. Add our own helper functions to format the fingerprints as hex (with colons). Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pkcs10: remove pyasn1 PKCS #10 specFraser Tweedale2016-11-101-50/+0
| | | | | | | | | | | | | | | In the dogtag-ipa-ca-renew-agent-submit certmonger renewal helper, we currently use our hand-rolled PKCS #10 pyasn1 specification to parse the friendlyName out of CSRs generated by certmonger (it contains the NSSDB nickname of the cert). Use other information from the renewal helper process environment to determine the nickname and remove our PKCS #10 pyasn1 spec. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pkcs10: use python-cryptography for CSR processingFraser Tweedale2016-11-102-78/+55
| | | | | | | | | | Update ``ipalib.pkcs10`` module to use python-cryptography for CSR processing instead of NSS. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Build: Makefiles for Python packagesPetr Spacek2016-11-092-24/+1
| | | | | | | | | | | | | | | | | | | | | | | This version builds only one version of Python packages. If you want to build for Python 2 & 3 call configure twice using different --with-python or specify PYTHON variable when calling make. dist-hook is using SOURCES.txt file from egg-info. According to Petr Viktorin this should be enough for our purposes and avoids need to create plugins for setuptools. Currently VPATH builds do not work for various reasons. This should be fixed later on. Most credit goes to these guys: Christian Heimes <cheimes@redhat.com> Petr Viktorin <pviktori@redhat.com> Kevin Brown <kevin@kevin-brown.com> https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ldap2: change default time/size limitTomas Krizek2016-11-071-1/+3
| | | | | | | | | | | * Set default time_limit and size_limit in ldap2 to unlimited. * Set time_limit and size_limit to None in backend. This will respect ipaconfig values. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add __name__ == __main__ guards to setup.pysChristian Heimes2016-10-251-13/+13
| | | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* Fix error message encodingSimo Sorce2016-10-251-1/+2
| | | | | | | | | - Use the correct unicode string for an error message, otherwise an exception will generate another exception about incorrect type, masking the original error. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pylint: enable the import-error checkJan Cholasta2016-10-243-1/+6
| | | | | | | | | | Check for import errors with pylint to make sure new python package dependencies are not overlooked. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Port all setup.py to setuptoolsChristian Heimes2016-10-204-73/+44
| | | | | | | | | | | All setup.py files are now using setuptools through a common file ipasetup.py. The file is auto-generated and contain all common settings. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* remove trailing newlines form python modulesMartin Babinsky2016-10-121-1/+0
| | | | | | | | | pylint-1.6.4-1.fc26.noarch reports these, hence they should be fixed in order to build FreeIPA with this version https://fedorahosted.org/freeipa/ticket/6391 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Pylint: fix the rest of unused local variablesMartin Basti2016-10-115-44/+18
| | | | Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Tests: Fix failing test_ipalib/test_parametersLenka Doudova2016-10-111-1/+1
| | | | | | | | | | | Parameters test fails because of KeyError caused by improper manipulation with kwargs in Param.__init__ method. During initialization, if kwargs['required'] or kwargs['multivalue'] is None, it is delete from dictionary and hence the missing key. Small change of the condition prevents this from happening. Partially fixes https://fedorahosted.org/freeipa/ticket/6292 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa: check if provided config file existsTomas Krizek2016-10-061-2/+11
| | | | | | | | | | | Add a parser check to verify config file supplied to the ipa command exists. Previously, invalid file paths would not results in any error and would just silently proceed with default config. https://fedorahosted.org/freeipa/ticket/6114 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa: allow relative paths for config fileTomas Krizek2016-10-061-14/+1
| | | | | | | | | Remove unnecessary check for absolute file paths for config file. https://fedorahosted.org/freeipa/ticket/6114 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Pylint: enable check for unused-variablesMartin Basti2016-09-275-0/+8
| | | | | | | | | | | | | | | Unused variables may: * make code less readable * create dead code * potentialy hide issues/errors Enabled check should prevent to leave unused variable in code Check is locally disabled for modules that fix is not clear or easy or have too many occurences of unused variables Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove unused variables in the codeMartin Basti2016-09-272-3/+1
| | | | | | | | | | | This commit removes unused variables or rename variables as "expected to be unused" by using "_" prefix. This covers only cases where fix was easy or only one unused variable was in a module Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* pylint: fix old-style-classJan Barta2016-09-221-1/+2
| | | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pylint: fix unneeded-notJan Barta2016-09-222-5/+5
| | | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pylint: fix simplifiable-if-statement warningsJan Barta2016-09-221-6/+2
| | | | | | | fix inefficient if statements, enable pylint check Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Use constant for user and group patternsMartin Basti2016-09-201-0/+3
| | | | | | | | | | User and groups regexp are the same and constant should be used to avoid any future misconfigurations. https://fedorahosted.org/freeipa/ticket/5822 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Abstract procedures for IP address warningsMartin Basti2016-09-141-1/+26
| | | | | | | | | | | Originaly there should be only two occurencees of this warning, one for server, one for client. But obviously is not possible with current installers to achive this goal, so I have to extract code to not mess with 5 times copy and paste. https://fedorahosted.org/freeipa/ticket/5814 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add HTTPRequestError classFraser Tweedale2016-09-071-0/+10
| | | | | | | | | | | | | | | Currently, HTTP requests that respond with status not in the 2xx range raise RemoteRetrieveError. The exception includes no information about the response status. Add the 'HTTPRequestError' class which extends 'RemoteRequestError' with an attribute for the response status, and update the Dogtag RestClient to raise the new error. Part of: https://fedorahosted.org/freeipa/ticket/6260 Part of: https://fedorahosted.org/freeipa/ticket/3473 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Track lightweight CAs on replica installationFraser Tweedale2016-09-061-0/+2
| | | | | | | | | | Add Certmonger tracking requests for lightweight CAs on replica installation. As part of this change, extract most of the lightweight CA tracking code out of ipa-certupdate and into cainstance. Fixes: https://fedorahosted.org/freeipa/ticket/6019 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* cli: use full name when executing a commandJan Cholasta2016-09-051-1/+1
| | | | | | | | | Fixes the CLI not to always call the default version of a command even when the version was explicitly specified. https://fedorahosted.org/freeipa/ticket/6279 Reviewed-By: Martin Basti <mbasti@redhat.com>
* raise ValidationError when deprecated param is passed to commandMartin Babinsky2016-09-051-4/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/6190 Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* x509: include otherName DER value in GeneralNameInfoFraser Tweedale2016-08-261-4/+9
| | | | | | | | | | We want to include the whole DER value when we pretty-print unrecognised otherNames, so add a field to the GeneralNameInfo namedtuple and populate it for otherNames. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* x509: use NSS enums and OIDs to identify SAN typesFraser Tweedale2016-08-261-7/+23
| | | | | | | | | | GeneralName parsing currently relies heavily on strings from NSS. Make the code hopefully less brittle by identifying GeneralName types by NSS enums and, for otherName, the name-type OID also. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 15:12:51 +0000