summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* Abstract procedures for IP address warningsMartin Basti2016-09-141-1/+26
| | | | | | | | | | | Originaly there should be only two occurencees of this warning, one for server, one for client. But obviously is not possible with current installers to achive this goal, so I have to extract code to not mess with 5 times copy and paste. https://fedorahosted.org/freeipa/ticket/5814 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add HTTPRequestError classFraser Tweedale2016-09-071-0/+10
| | | | | | | | | | | | | | | Currently, HTTP requests that respond with status not in the 2xx range raise RemoteRetrieveError. The exception includes no information about the response status. Add the 'HTTPRequestError' class which extends 'RemoteRequestError' with an attribute for the response status, and update the Dogtag RestClient to raise the new error. Part of: https://fedorahosted.org/freeipa/ticket/6260 Part of: https://fedorahosted.org/freeipa/ticket/3473 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Track lightweight CAs on replica installationFraser Tweedale2016-09-061-0/+2
| | | | | | | | | | Add Certmonger tracking requests for lightweight CAs on replica installation. As part of this change, extract most of the lightweight CA tracking code out of ipa-certupdate and into cainstance. Fixes: https://fedorahosted.org/freeipa/ticket/6019 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* cli: use full name when executing a commandJan Cholasta2016-09-051-1/+1
| | | | | | | | | Fixes the CLI not to always call the default version of a command even when the version was explicitly specified. https://fedorahosted.org/freeipa/ticket/6279 Reviewed-By: Martin Basti <mbasti@redhat.com>
* raise ValidationError when deprecated param is passed to commandMartin Babinsky2016-09-051-4/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/6190 Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* x509: include otherName DER value in GeneralNameInfoFraser Tweedale2016-08-261-4/+9
| | | | | | | | | | We want to include the whole DER value when we pretty-print unrecognised otherNames, so add a field to the GeneralNameInfo namedtuple and populate it for otherNames. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* x509: use NSS enums and OIDs to identify SAN typesFraser Tweedale2016-08-261-7/+23
| | | | | | | | | | GeneralName parsing currently relies heavily on strings from NSS. Make the code hopefully less brittle by identifying GeneralName types by NSS enums and, for otherName, the name-type OID also. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* x509: fix SAN directoryName parsingFraser Tweedale2016-08-261-3/+9
| | | | | | | | | | | | | | The subjectAltName extension parsing code in ipalib.x509 fails on directoryName values because the Choice structure is not endowed with an inner type. Implement the Name structure, whose inner type is a CHOICE { SEQUENCE OF RelativeDistinguishedName }, to resolve. Note that the structure still does not get fully parsed; only enough to recognise the SequenceOf tag and not fail. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move GeneralName parsing code to ipalib.x509Fraser Tweedale2016-08-262-91/+116
| | | | | | | | | | | GeneralName parsing code is primarily relevant to X.509. An upcoming change will add SAN parsing to the cert-show command, so first move the GeneralName parsing code from ipalib.pkcs10 to ipalib.x509. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove Custodia server keys from LDAPChristian Heimes2016-08-241-0/+1
| | | | | | | | | The server-del plugin now removes the Custodia keys for encryption and key signing from LDAP. https://fedorahosted.org/freeipa/ticket/6015 Reviewed-By: Martin Basti <mbasti@redhat.com>
* trust: automatically resolve DNS trust conflicts for triangle trustsAlexander Bokovoy2016-08-221-1/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For configuration where: - AD example.com trusts IPA at ipa.example.com - AD example.org trusts AD example.com - a trust is tried to be established between ipa.example.com and example.org, there will be a trust topology conflict detected by example.org domain controller because ipa.example.com DNS namespace overlaps with example.com DNS namespace. This type of trust topology conflict is documented in MS-ADTS 6.1.6.9.3.2 "Building Well-Formed msDS-TrustForestTrustInfo Message". A similar conflict can arise for SID and NetBIOS namespaces. However, unlike SID and NetBIOS namespaces, we can solve DNS namespace conflict automatically if there are administrative credentials for example.org available. A manual sequence to solve the DNS namespace conflict is described in https://msdn.microsoft.com/it-it/library/cc786254%28v=ws.10%29.aspx. This sequence boils down to the following steps: 1. As an administrator of the example.org, you need to add an exclusion entry for ipa.example.com in the properties of the trust to example.com 2. Establish trust between ipa.example.com and example.org It is important to add the exclusion entry before step 4 or there will be conflict recorded which cannot be cleared easily right now due to a combination of bugs in both IPA and Active Directory. This patchset implements automated solution for the case when we have access to the example.org's administrator credentials: 1. Attempt to establish trust and update trust topology information. 2. If trust topology conflict is detected as result of (1): 2.1. Fetch trust topology infromation for the conflicting forest trust 2.2. Add exclusion entry to our domain to the trust topology obtained in (2.1) 2.3. Update trust topology for the conflicting forest trust 3. Re-establish trust between ipa.example.com and example.org We cannot do the same for shared secret trust and for external trust, though: 1. For shared secret trust we don't have administrative credentials in the forest reporting the conflict 2. For the external trust we cannot set topology information due to MS-LSAD 3.1.4.7.16 because external trust is non-transitive by definition and thus setting topology information will fail. To test this logic one can use two Samba AD forests with FreeIPA using a sub-domain of one of them. Fixes: https://fedorahosted.org/freeipa/ticket/6076 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Tests: Fix failing tests in test_ipalib/test_frontendLenka Doudova2016-08-171-1/+1
| | | | | | | | | | | Some tests in ipatests/test_ipalib/test_frontend.py are failing due to changes related to thin client implementation. Providing fix for: ipa.test_ipalib.test_frontend.test_Attribute.test_init ipa.test_ipalib.test_frontend.test_LocalOrRemote.test_run https://fedorahosted.org/freeipa/ticket/6188 Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Fix malformed or missing docstrings in ipalib/messagesLenka Doudova2016-08-161-3/+12
| | | | | | | | | | Some of the docstrings in ipalib/messages.py are malformed or missing entirely. This causes test_ipalib/test_messages to fail due to non-matching regex. https://fedorahosted.org/freeipa/ticket/6215 Reviewed-By: Martin Basti <mbasti@redhat.com>
* parameters: move the `confirm` kwarg to ParamJan Cholasta2016-08-101-4/+2
| | | | | | | | | | | | | | | | | | | Whether a parameter is treated like password is determined by the `password` class attribute defined in the Param class. Whether the CLI will asks for confirmation of a password parameter depends on the value of the `confirm` kwarg of the Password class. Move the `confirm` kwarg from the Password class to the Param class, so that it can be used by any Param subclass which has the `password` class attribute set to True. This fixes confirmation of the --key option of otptoken-add, which is a Bytes subclass with `password` set to True. https://fedorahosted.org/freeipa/ticket/6174 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* help: Do not create instances to get information about commands and topicsDavid Kupka2016-08-032-9/+13
| | | | | | | | | | | | Creating instance requires that complete schema for the command is read from schema cache and passed to constructor. This operation takes a lot of time. Utilizing class properties and pregenerated help bits allows to get the necessary information directly from classes reducing time it takes significantly. https://fedorahosted.org/freeipa/ticket/6048 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* frontend: Change doc, summary, topic and NO_CLI to class propertiesDavid Kupka2016-08-032-11/+16
| | | | | | | | | Avoid need to instantiate all commands just to get information for displaying help. https://fedorahosted.org/freeipa/ticket/6048 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* harden the check for trust namespace overlap in new principalsMartin Babinsky2016-07-281-3/+7
| | | | | | | | | | This check must handle the possibility of optional attributes (ipantadditionalsuffixes and ipantflatname) missing in the trusted domain entry. https://fedorahosted.org/freeipa/ticket/6099 Reviewed-By: David Kupka <dkupka@redhat.com>
* allow multiple dashes in the components of server hostnameMartin Babinsky2016-07-201-3/+10
| | | | | | | | | | | Relax the check for valid hostname component by allowing multiple consecutive '-' or '/' characters int he middle of the label (the first/last character must still be alphanumeric or underscore). Also use verbose regex format to document its structure. https://fedorahosted.org/freeipa/ticket/4710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* allow 'value' output param in commands without primary keyMartin Babinsky2016-07-201-0/+10
| | | | | | | | | | | | | | | | | `PrimaryKey` output param works only for API objects that have primary keys, otherwise it expects None (nothing is associated with this param). Since the validation of command output was tightened durng thin client effort, some commands not honoring this contract began to fail output validation. A custom output was implemented for them to restore their functionality. It should however be considered as a fix for broken commands and not used further. https://fedorahosted.org/freeipa/ticket/6037 https://fedorahosted.org/freeipa/ticket/6061 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* messages: specify message type for ResultFormattingErrorMartin Babinsky2016-07-151-0/+1
| | | | | | | | | | the ResultFormattingError message class was missing a `type` member which could cause `otptoken-add` command to crash during QR image rendering using suboptimal TTY settings https://fedorahosted.org/freeipa/ticket/6081 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Provide API for management of host, service, and user principal aliasesMartin Babinsky2016-07-011-0/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | New commands (*-{add,remove}-principal [PKEY] [PRINCIPAL ...]) were added to manage principal aliases. 'add' commands will check the following: * the correct principal type is supplied as an alias * the principals have correct realm and the realm/alternative suffix (e.g. e-mail) do not overlap with those of trusted AD domains If the entry does not have canonical principal name, the first returned principal name will be set as one. This is mostly to smoothly operate on entries created on older servers. 'remove' commands will check that there is at least one principal alias equal to the canonical name left on the entry. See also: http://www.freeipa.org/page/V4/Kerberos_principal_aliases https://fedorahosted.org/freeipa/ticket/1365 https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: introduce Principal parameterMartin Babinsky2016-07-012-0/+43
| | | | | | | | | | | This patch introduces a separate Principal parameter that allows the framework to syntactically validate incoming/outcoming principals by using a single shared codebase. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* client: add support for pre-schema serversJan Cholasta2016-07-011-2/+4
| | | | | | | | | | | | | | | Bundle remote plugin interface definitions for servers which lack API schema support. These server API versions are included: * 2.49: IPA 3.1.0 on RHEL/CentOS 6.5+, * 2.114: IPA 4.1.4 on Fedora 22, * 2.156: IPA 4.2.0 on RHEL/CentOS 7.2 and IPA 4.2.4 on Fedora 23, * 2.164: IPA 4.3.1 on Fedora 23. For servers with other API versions, the closest lower API version is used. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: do not crash when overriding remote command as methodJan Cholasta2016-07-011-6/+13
| | | | | | | | | Do not crash during API initialization when overriding remote command that is not a method with MethodOverride. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: add option to ignore override errorsJan Cholasta2016-06-301-13/+19
| | | | | | | | | Add new `no_fail` option to API.add_plugin. When set to True, override errors are ignored and the affected plugins are skipped. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert-request: better error msg when 'add' not supportedFraser Tweedale2016-06-301-0/+10
| | | | | | | | | | | | cert-request supports adding service principals that don't exist. If add is requested for other principal types, the error message just says "the principal doesn't exist". Add a new error type with better error message to explain that 'add' is not supported for host or user principals. Fixes: https://fedorahosted.org/freeipa/ticket/5991 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* session: move the session module from ipalib to ipaserverJan Cholasta2016-06-301-1278/+0
| | | | | | | | | The module is used only on the server, so there's no need to have it in ipalib, which is shared by client and server. https://fedorahosted.org/freeipa/ticket/5988 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* CA replica promotion: add proper CA DNS recordsMartin Basti2016-06-281-0/+1
| | | | | | | | Update 'ipa-ca' records with A/AAAA records of the newly added replica https://fedorahosted.org/freeipa/ticket/5966 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* schema: Caching on schema on clientDavid Kupka2016-06-281-0/+3
| | | | | | | | | Store schema in per user cache. Together with schemas also information about mapping between server and fingerprint is stored to reduce traffic. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* env: Add 'server' variable to api.envDavid Kupka2016-06-282-0/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* frontend: forward command calls using full nameJan Cholasta2016-06-281-1/+6
| | | | | | | | Forward commands to remote server using the full versioned name. https://fedorahosted.org/freeipa/ticket/4427 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: support plugin versioningJan Cholasta2016-06-283-6/+48
| | | | | | | | | | | | | | Allow multiple incompatible versions of a plugin using the same name. The current plugins are assumed to be version '1'. The unique identifier of plugins was changed from plugin name to plugin name and version. By default, the highest version available at build time is used. If the plugin is an unknown remote plugin, version of '1' is used by default. https://fedorahosted.org/freeipa/ticket/4427 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: use plugin class as the key in API namespacesJan Cholasta2016-06-283-68/+82
| | | | | | | | | When iterating over APINameSpace objects, use plugin class rather than its name as the key. https://fedorahosted.org/freeipa/ticket/4427 Reviewed-By: David Kupka <dkupka@redhat.com>
* misc: generate `plugins` result directly in the commandJan Cholasta2016-06-281-5/+0
| | | | | | | | | Move the code that generated result of the `plugins` command from API to the command itself. https://fedorahosted.org/freeipa/ticket/4427 Reviewed-By: David Kupka <dkupka@redhat.com>
* IPA API: set krbcanonicalname instead of ipakrbprincipalalias on new entitiesMartin Babinsky2016-06-231-0/+11
| | | | | | | | | | | Hosts, services, and (stage)-users will now have krbcanonicalname attribute set to the same value as krbprincipalname on creation. Moreover, new services will not have ipakrbprincipalalias set anymore. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* host/service-show/find shouldn't fail on invalid certificateStanislav Laznicka2016-06-221-0/+10
| | | | | | | | | | | host/service-show/find methods would have failed if the first certificate they had in userCertificate attribute were invalid. Expected behavior is that they just show the rest of the reqested attributes. https://fedorahosted.org/freeipa/ticket/5797 Reviewed-By: Martin Basti <mbasti@redhat.com>
* schema: Add known_fingerprints option to schema commandDavid Kupka2016-06-211-0/+18
| | | | | | | | | | When client requests schema it can list fingerprints of cached schemas and server responds with SchemaUpToDate exception specifying fingeprint of schema to use. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* pylint: fix: multiple-statementsJan Barta2016-06-211-1/+2
| | | | Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* dns: do not rely on custom param fields in record attributesJan Cholasta2016-06-201-7/+25
| | | | | | | | | Obtain the information provided by the `hint` kwarg and `dnsrecord_part` and `dnsrecord_extra` flags by other means. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: do not crash on missing output in output_for_cliJan Cholasta2016-06-201-1/+1
| | | | | | | | Do not crash in Command.output_for_cli when an output value is missing. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: skip `value` output in output_for_cliJan Cholasta2016-06-201-1/+3
| | | | | | | | | Do not include the `value` output value in CLI output in Command.output_for_cli by default. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: don't copy command arguments to output paramsJan Cholasta2016-06-201-12/+1
| | | | | | | | | | | | | | Use only object params and params defined in has_output_params as output params. This removes unnecessary duplication of params defined both in object plugins and as command arguments. This requires all command output params to be properly defined in either the object plugins or the command's has_output_params. Fix the plugins where this wasn't true. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix minor typosYuri Chornoivan2016-06-201-2/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* server-del: perform full master removal in managed topologyMartin Babinsky2016-06-172-1/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements most of the del_master_managed() functionality as a part of `server-del` command. `server-del` nows performs these actions: * check topology connectivity * check that at least one CA/DNS server and DNSSec masters are left after removal * cleanup all LDAP entries/attributes exposing information about the master * cleanup master DNS records * remove master and service principals * remove master entry from LDAP * check that all segments pointing to the master were removed `server-del` now accepts the following options: * `--force`: force master removal even if it doesn't exist * `--ignore-topology-disconnect`: ignore errors arising from disconnected topology before and after master removal * `--ignore-last-of-role`: remove master even if it is last DNS server, and DNSSec key master. The last CA will *not* be removed regardless of this option. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver module for working with managed topologyMartin Babinsky2016-06-171-50/+0
| | | | | | | | | This module should aggregate common functionality utilized in the commands managing domain-level 1 topology. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: show warning if there is no DNS servers in locationMartin Basti2016-06-171-0/+9
| | | | | | | | | DNS servers must be in each location, otherwise DNS location without DNS server assigned will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: require to restart named-pkcs11 affter location changeMartin Basti2016-06-171-0/+9
| | | | | | | | | Send a warning message that named-pkcs11 service must be restarted after changes related to locations or server weight https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: dnsserver-* commandsMartin Basti2016-06-172-0/+54
| | | | | | | | | | | | | New commands for manipulation with DNS server configuration were added: * dnsserver-show * dnsserver-mod * dnsserver-find https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/PerServerConfigInLDAP https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: server-mod: add automatic records updateMartin Basti2016-06-171-0/+10
| | | | | | | | | For any location or server weight change is required to update records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: command dns-update-system-recordsMartin Basti2016-06-171-0/+23
| | | | | | | | | | | | | | command dns-update-system-records updates/fixes DNS records for IPA services: * updating A, AAAA records for CA * updating SRV records for LDAP, kerberos and AD trust * updating TXT record in _kerberos with proper realm * updating dns locations if used https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2024-07-02 12:11:19 +0000