summaryrefslogtreecommitdiffstats
path: root/ipapython
Commit message (Collapse)AuthorAgeFilesLines
...
* ipaldap: merge external_bind into LDAPClientTomas Krizek2016-11-071-7/+3
| | | | | | | | | | | * Rename do_external_bind to external_bind * Remove user_name argument in external_bind() and always set it to effective user name https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: merge simple_bind into LDAPClientTomas Krizek2016-11-071-7/+4
| | | | | | | | | | | | * Use LDAPClient.simple_bind instead of extra call to IPAdmin.do_simple_bind * Rename binddn to bind_dn * Rename bindpw to bind_password * Explicitly specify bind_dn in all calls https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: remove wait/timeout during bindsTomas Krizek2016-11-071-38/+12
| | | | | | | | | | Testing whether it is possible to connect to directory server is already done in RedHatDirectoryService.restart(). https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add __name__ == __main__ guards to setup.pysChristian Heimes2016-10-251-16/+16
| | | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* pylint: enable the import-error checkJan Cholasta2016-10-246-2/+16
| | | | | | | | | | Check for import errors with pylint to make sure new python package dependencies are not overlooked. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove ipapython/ipa.confChristian Heimes2016-10-202-5/+0
| | | | | | | | | The file ipapython/ipa.conf is no longer used and not installed. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Port all setup.py to setuptoolsChristian Heimes2016-10-204-81/+48
| | | | | | | | | | | All setup.py files are now using setuptools through a common file ipasetup.py. The file is auto-generated and contain all common settings. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* UnsafeIPAddress: Implement __(g|s)etstate__ and to ensure proper (un)picklingDavid Kupka2016-10-121-0/+22
| | | | | | | | | | Missing attributes in instance created by pickle.load cause AttributeError in second part of ipa-server-install --external-ca. https://fedorahosted.org/freeipa/ticket/6385 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* do not use keys() method when iterating through dictionariesMartin Babinsky2016-10-123-5/+5
| | | | | | | | | pylint-1.6.4-1.fc26.noarch reports "C0201(consider-iterating-dictionary)" when building FreeIPA, we have to fix these errors https://fedorahosted.org/freeipa/ticket/6391 Reviewed-By: Martin Basti <mbasti@redhat.com>
* remove trailing newlines form python modulesMartin Babinsky2016-10-121-2/+0
| | | | | | | | | pylint-1.6.4-1.fc26.noarch reports these, hence they should be fixed in order to build FreeIPA with this version https://fedorahosted.org/freeipa/ticket/6391 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Pylint: fix the rest of unused local variablesMartin Basti2016-10-118-55/+35
| | | | Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Pylint: remove unused variables from installers and scriptsMartin Basti2016-10-061-7/+5
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add iSecStore.spanChristian Heimes2016-10-061-0/+3
| | | | | | | | In the future Custodia is going to make CSStore.span an abstract method. Closes: https://fedorahosted.org/freeipa/ticket/6365 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move character escaping function to ipautilMartin Babinsky2016-10-032-27/+29
| | | | | | | | | | Functions `escape_seq` and `unescape_seq` have a generic use-case so it makes sense to move them from `kerberos` to ipautil module so that other modules can reuse them more readily. https://fedorahosted.org/freeipa/ticket/5809 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Pylint: enable check for unused-variablesMartin Basti2016-09-279-0/+18
| | | | | | | | | | | | | | | Unused variables may: * make code less readable * create dead code * potentialy hide issues/errors Enabled check should prevent to leave unused variable in code Check is locally disabled for modules that fix is not clear or easy or have too many occurences of unused variables Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove unused variables in the codeMartin Basti2016-09-276-12/+11
| | | | | | | | | | | This commit removes unused variables or rename variables as "expected to be unused" by using "_" prefix. This covers only cases where fix was easy or only one unused variable was in a module Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Make Continuous installer continuous only during execution phaseMartin Babinsky2016-09-262-6/+3
| | | | | | | | | | | | | | `common.Continuous` class is a basis for uninstallers, which should execute all the steps regardless of occuring errors. However, we would like the installer to raise exceptions and return non-zero exit code during validation phase when some preconditions are not met. Add a separate exception handler which catches exceptions and logs them as errors during execution phase only. https://fedorahosted.org/freeipa/ticket/5725 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* use separate exception handlers for executors and validatorsMartin Babinsky2016-09-261-4/+18
| | | | | | | | | installer framework has been modified to allow for different error handling during validation and execution phases. https://fedorahosted.org/freeipa/ticket/5725 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Update man/help for --server optionTomas Krizek2016-09-231-1/+2
| | | | | | | | | The --server option now specifically mentions that it expects the FQDN of the IPA server. https://fedorahosted.org/freeipa/ticket/6202 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* pylint: fix bad-mcs-method-argumentJan Barta2016-09-221-24/+24
| | | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pylint: fix bad-mcs-classmethod-argumentJan Barta2016-09-221-2/+2
| | | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pylint: fix old-style-classJan Barta2016-09-223-4/+7
| | | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pylint: fix simplifiable-if-statement warningsJan Barta2016-09-223-16/+4
| | | | | | | fix inefficient if statements, enable pylint check Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Show error message for invalid IPs in client installTomas Krizek2016-09-211-1/+4
| | | | | | | | | | Re-raise the thrown exception to get an error message instead of a traceback during ipa-client-install with invalid IP address. https://fedorahosted.org/freeipa/ticket/6340 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow broadcast ip addressesMartin Basti2016-09-071-6/+4
| | | | | | | | | | | | | | | | | Currently environments may use prefix /31 on point-to-point connections what makes IPA validators to fail. IPA should not care if IP address is broadcast or not. In some cases (when prefix is not specified) IPA cannot decide properly if broadcast address is really broadcast. This commit allows usage of broadcast addresses in: * host plugin * dns plugin * server-installer * client-installer https://fedorahosted.org/freeipa/ticket/5814 Reviewed-By: David Kupka <dkupka@redhat.com>
* Allow network ip addressesMartin Basti2016-09-071-4/+5
| | | | | | | | | | | | | | Currently cloud environments uses heavily prefix /32 (/128) what makes IPA validators to fail. IPA should not care if IP address is network or not. This commit allows usage of network addresses in: * host plugin * dns plugin * server-installer * client-installer https://fedorahosted.org/freeipa/ticket/5814 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix parse errors with link-local addressesMartin Basti2016-09-061-1/+6
| | | | | | | | | | Link-local addresses received from netifaces contains '%suffix' that causes parse error in IPNetwork class. We must remove %suffix before it us used in IPNetwork objects. https://fedorahosted.org/freeipa/ticket/6296 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix ScriptError to always return string from __str__Martin Basti2016-09-051-3/+4
| | | | | | | | | Use super for proper handling of exceptions. msg property was added due compatibility with the current code. https://fedorahosted.org/freeipa/ticket/6294 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Use RSA-OAEP instead of RSA PKCS#1 v1.5Christian Heimes2016-09-051-1/+1
| | | | | | | | | | | jwcrypto's RSA1-5 (PKCS#1 v1.5) is vulnerable to padding oracle side-channel attacks. OAEP (PKCS#1 v2.0) is a safe, more modern alternative. https://fedorahosted.org/freeipa/ticket/6278 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Secure permissions of Custodia server.keysChristian Heimes2016-08-241-1/+4
| | | | | | | | | | | | | Custodia's server.keys file contain the private RSA keys for encrypting and signing Custodia messages. The file was created with permission 644 and is only secured by permission 700 of the directory /etc/ipa/custodia. The installer and upgrader ensure that the file has 600. https://bugzilla.redhat.com/show_bug.cgi?id=1353936 https://fedorahosted.org/freeipa/ticket/6056 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove forgotten print from DN.__str__ implementationMartin Basti2016-08-191-6/+1
| | | | | | | | These debug prints were forgotten there and should be removed, because str(DN) is often operation and we may save time with handling exceptions and printing unwanted debug Reviewed-By: David Kupka <dkupka@redhat.com>
* Increase default length of auto generated passwordsMartin Basti2016-08-031-1/+2
| | | | | | | | | | | | | | | Installer/IPA generates passwords for warious purpose: * KRA * kerberos master key * NSSDB password * temporary passwords during installation Length of passwords should be increased to 22, ~128bits of entropy, to be safe nowadays. https://fedorahosted.org/freeipa/ticket/6116 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipapython: Extend kinit_password to support principal canonicalizationMilan Kubík2016-07-291-1/+10
| | | | | | | | | | | | In order to authenticate with a principal alias it is necessary to request canonicalization of the principal. This patch extends the kinit_password with this option. The option to indicate enterprise principal has been added as well. https://fedorahosted.org/freeipa/ticket/6142 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use copy when replacing files to keep SELinux contextMartin Basti2016-07-221-1/+5
| | | | | | | | | When installer replaces any file with newer, it must use 'copy' instead of 'mv' to keep SELinux context valid. https://fedorahosted.org/freeipa/ticket/6111 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix session cookiesFlorence Blanc-Renaud2016-07-221-7/+8
| | | | | | | | | | | | | | The CLI was not using session cookies for communication with IPA API. The kernel_keyring code was expecting the keyname to be a string, but in python 2 a unicode was supplied (the key is built using ipa_session_cookie:%principal and principal is a unicode). The patch fixes the assertions, allowing to store and retrieve the cookie. It also adds a test with unicode key name. https://fedorahosted.org/freeipa/ticket/5984 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Create server and host certs with DNS altnameFraser Tweedale2016-07-191-1/+8
| | | | | | | | | | | | | | Currently server (HTTP / LDAP) certs are created without a Subject Alternative Name extension during server install, replica prepare and host enrolment, a potentially problematic violation of RFC 2818. Add the hostname as a SAN dNSName when these certs are created. (Certmonger adds an appropriate request extension when renewing the certificate, so nothing needs to be done for renewal). Fixes: https://fedorahosted.org/freeipa/ticket/4970 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix internal errors in host-add and other commands caused by DNS resolutionPetr Spacek2016-07-012-68/+93
| | | | | | | | | | | | | | | | | | Previously resolver was returning CheckedIPAddress objects. This internal server error in cases where DNS actually returned reserved IP addresses. Now the resolver is returning UnsafeIPAddress objects which do syntactic checks but do not filter IP addresses. From now on we can decide if some IP address should be accepted as-is or if it needs to be contrained to some subset of IP addresses using CheckedIPAddress class. This regression was caused by changes for https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused is_local(), interface, and defaultnet from CheckedIPAddressPetr Spacek2016-07-011-9/+0
| | | | | | | | All these were unused so I'm removing them to keep the code clean and easier to read. At this point it is clear that only difference between netaddr.IPAddress and CheckedIPAddress is prefixlen attribute. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipalib: introduce Principal parameterMartin Babinsky2016-07-011-1/+5
| | | | | | | | | | | This patch introduces a separate Principal parameter that allows the framework to syntactically validate incoming/outcoming principals by using a single shared codebase. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipapython module for Kerberos principal manipulation and parsingMartin Babinsky2016-07-011-0/+208
| | | | | | | | | | | | This module implements a shared codebase to handle various types of Kerberos principal names encountered during management of users, hosts nad services. Common codebase aims to replace various ad-hoc functions and routines scattered along the management framework. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Do not allow installation in FIPS modeFlorence Blanc-Renaud2016-06-291-0/+19
| | | | | | | https://fedorahosted.org/freeipa/ticket/5761 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use NSS for name->resolution in IPA installerPetr Spacek2016-06-291-1/+1
| | | | | | | | | | | | This fixes scenarios where IPA server is not able to resolve own name and option --ip-address was not specified by the user. This partially reverts changes from commit dc405005f537cf278fd6ddfe6b87060bd13d9a67 https://fedorahosted.org/freeipa/ticket/5962 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaldap: turn LDAP filter utility functions into class methodsFraser Tweedale2016-06-291-16/+19
| | | | | | | | | The LDAP filter utilities do not use any instance attributes, so collectively turn them into class methods to promote reuse. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* plugable: support plugin versioningJan Cholasta2016-06-281-0/+5
| | | | | | | | | | | | | | Allow multiple incompatible versions of a plugin using the same name. The current plugins are assumed to be version '1'. The unique identifier of plugins was changed from plugin name to plugin name and version. By default, the highest version available at build time is used. If the plugin is an unknown remote plugin, version of '1' is used by default. https://fedorahosted.org/freeipa/ticket/4427 Reviewed-By: David Kupka <dkupka@redhat.com>
* pylint: fix: multiple-statementsJan Barta2016-06-211-1/+2
| | | | Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* ldap: fix handling of binary data in search filtersJan Cholasta2016-06-211-1/+6
| | | | | | | | | | This fixes a UnicodeDecodeError when passing non-UTF-8 binary data to LDAPClient.make_filter() and friends. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Fix minor typosYuri Chornoivan2016-06-201-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix minor typosYuri Chornoivan2016-06-161-1/+1
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* installer: index() raises ValueErrorDavid Kupka2016-06-131-2/+2
| | | | | | | | | Expecting IndexError instead of ValueError led to traceback instead of correctly reporting the error situation. https://fedorahosted.org/freeipa/ticket/5945 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix resolve_rrsets: RRSet is not hashableMartin Basti2016-06-091-2/+2
| | | | | | | | | We cannot use set() with RRSet objects, because RRSet object is not hashable. A set was replaced by list. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Petr Spacek <pspacek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 11:21:17 +0000