summaryrefslogtreecommitdiffstats
path: root/ipapython
Commit message (Collapse)AuthorAgeFilesLines
...
* DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAPPetr Spacek2016-01-072-9/+31
| | | | | | | | | | This filtering is useful in cases where LDAP contains DNS zones which have old metadata objects and DNSSEC disabled. Such zones must be ignored to prevent errors while calling dnssec-keyfromlabel or rndc. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAPPetr Spacek2016-01-071-11/+61
| | | | | | | | | | Key purging has to be only only after key metadata purging so ipa-dnskeysyncd on replices does not fail while dereferencing non-existing keys. https://fedorahosted.org/freeipa/ticket/5334 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: add debug mode to ldapkeydb.pyPetr Spacek2016-01-071-2/+52
| | | | | | | | | | | | ldapkeydb.py can be executed directly now. In that case it will print out key metadata as obtained using IPA LDAP API. Kerberos credential cache has to be filled with principal posessing appropriate access rights before the script is execured. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: remove obsolete TODO notePetr Spacek2016-01-071-1/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Make sure that current key state in LDAP matches key state in BINDPetr Spacek2016-01-071-1/+5
| | | | | | | | | | | | | We have to explicitly specify "none" value to prevent dnssec-keyfromlabel utility from using current time for keys without "publish" and "activate" timestamps. Previously this lead to situation where key was in (intermediate) state "generated" in OpenDNSSEC but BIND started to use this key for signing. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Enable pylint trailing-whitespace checkMartin Basti2015-12-231-1/+1
| | | | | | | | | | | | | | | | | | | Enables check and fixes: ************* Module ipapython.log_manager ipapython/log_manager.py:808: [C0303(trailing-whitespace), ] Trailing whitespace) ************* Module ipachangeconf contrib/RHEL4/ipachangeconf.py:28: [C0303(trailing-whitespace), ] Trailing whitespace) contrib/RHEL4/ipachangeconf.py:116: [C0303(trailing-whitespace), ] Trailing whitespace) ************* Module ipalib.plugins.pwpolicy ipalib/plugins/pwpolicy.py:174: [C0303(trailing-whitespace), ] Trailing whitespace) ipalib/plugins/pwpolicy.py:180: [C0303(trailing-whitespace), ] Trailing whitespace) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove wildcard importsMartin Basti2015-12-235-5/+5
| | | | | | | | | | | Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-2315-39/+10
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installer: Propagate option values from components instead of copying them.David Kupka2015-12-211-3/+18
| | | | | | https://fedorahosted.org/freeipa/ticket/5556 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Package ipapython, ipalib, ipaplatform, ipatests for Python 3Petr Viktorin2015-12-173-27/+23
| | | | | | | | | | Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dns: Handle SERVFAIL in check if domain already exists.Petr Spacek2015-12-161-6/+5
| | | | | | | | In cases where domain is already delegated to IPA prior installation we might get timeout or SERVFAIL. The answer depends on the recursive server we are using for the check. Reviewed-By: David Kupka <dkupka@redhat.com>
* ipautil: remove unused import causing cyclic import in testsJan Cholasta2015-12-151-1/+0
| | | | https://fedorahosted.org/freeipa/ticket/5551
* dns: Check if domain already exists.David Kupka2015-12-141-1/+17
| | | | | | | | | Raise an error when the domain already exists. This can be overriden using --force or --allow-zone-overlap options. https://fedorahosted.org/freeipa/ticket/3681 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* dns: do not add (forward)zone if it is already resolvable.David Kupka2015-12-141-2/+93
| | | | | | | | | Check if the zone user wants to add is already resolvable and refuse to create it if yes. --skip-overlap-check and --force options suppress this check. https://fedorahosted.org/freeipa/ticket/5087 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipautil: allow redirecting command output to standard output in run()Jan Cholasta2015-12-141-2/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/5527 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Refactor ipautil.runPetr Viktorin2015-12-145-63/+179
| | | | | | | | | | | | | | | | | | | | | The ipautil.run function now returns an object with returncode and output are accessible as attributes. The stdout and stderr of all commands are logged (unless skip_output is given). The stdout/stderr contents must be explicitly requested with a keyword argument, otherwise they are None. This is because in Python 3, the output needs to be decoded, and that can fail if it's not decodable (human-readable) text. The raw (bytes) output is always available from the result object, as is "leniently" decoded output suitable for logging. All calls are changed to reflect this. A use of Popen in cainstance is changed to ipautil.run. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: Run all validators at once.David Kupka2015-12-081-12/+19
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* custodia: do not modify memberPrincipal on key updateJan Cholasta2015-12-071-2/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/5401 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipautil: use file in a temporary dir as ccache in private_ccacheJan Cholasta2015-12-071-2/+9
| | | | | | | | | | | python-gssapi chokes on empty ccache files, so instead of creating an empty temporary ccache file in private_ccache, create a temporary directory and use a non-existent file in that directory as the ccache. https://fedorahosted.org/freeipa/ticket/5401 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Removed duplicate domain name validating functionStanislav Laznicka2015-12-021-12/+0
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-client-install: add support for Ed25519 SSH keys (RFC 7479)Petr Spacek2015-12-011-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5471 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Upgrade: increase time limit for upgradesMartin Basti2015-12-011-2/+9
| | | | | | | | | | | | | | | | Default ldap search limit is now 30 sec by default during upgrade. Limits must be changed for the whole ldap2 connection, because this connection is used inside update plugins and commands called from upgrade. Together with increasing the time limit, also size limit should be unlimited during upgrade. With sizelimit=None we may get the TimeExceeded exception from getting default value of the sizelimit from LDAP. https://fedorahosted.org/freeipa/ticket/5267 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use absolute domain in detection of A/AAAA recordsMartin Basti2015-11-251-1/+4
| | | | | | | | | | | | Python dns resolver append configured domain to queries which may lead to false positive answer. Exmaple: resolving "ipa.example.com" may return records for "ipa.example.com.example.com" if domain is configured as "example.com" https://fedorahosted.org/freeipa/ticket/5421 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* private_ccache: Harden the removal of KRB5CCNAME env variableTomas Babej2015-11-251-1/+1
| | | | | | | | | | If the code within the private_ccache contextmanager does not set/removes the KRB5CCNAME, the pop method will raise KeyError, which will cause unnecessary termination of the code flow. Make sure the KRB5CCNAME is popped out of os.environ only if present. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-252-129/+4
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* Do not erroneously reinit NSS in Dogtag interfaceFraser Tweedale2015-11-241-1/+2
| | | | | | | | | | The Dogtag interface always attempts to (re)init NSS, which can fail with SEC_ERROR_BUSY. Do not reinitialise NSS when it has already been initialised with the given dbdir. Part of: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* TLS and Dogtag HTTPS request logging improvementsFraser Tweedale2015-11-232-8/+4
| | | | | | | | | | | | Pretty printing the TLS peer certificate to logs on every request introduces a lot of noise; do not log it (subject name, key usage and validity are still logged). Fix and tidy up some HTTP logging messages for Dogtag requests. Part of: https://fedorahosted.org/freeipa/ticket/5269 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* BUILD: provide check target in custom MakefilesLukas Slebodnik2015-11-181-0/+2
| | | | | | | | | The automake generated makefiles have already a target check. We need to provide this target also to non-generated Makefiles so we can recursively call make check from top level Makefile Reviewed-By: Martin Basti <mbasti@redhat.com>
* enable pem=True in export_pem_cert functionNiranjan MR2015-11-111-1/+1
| | | | | | | | | | export_pem_cert should export the certificate in pem format but instead exports the cert in der format as it doesn't enable pem=True. This patch specifies pem=True for export_pem_cert function Signed-off-by: Niranjan MR <mrniranjan@fedoraproject.org> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* fix error reporting when installer option is supplied with invalid choiceMartin Babinsky2015-11-111-1/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/5433 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: fix command line option validationJan Cholasta2015-11-052-3/+17
| | | | | | | | | | The code which calls the validators was accidentally removed, re-add it. https://fedorahosted.org/freeipa/ticket/5386 https://fedorahosted.org/freeipa/ticket/5391 https://fedorahosted.org/freeipa/ticket/5392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* interactive installer does not ignore leading/trailing whitespaceGabe2015-10-291-2/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5355 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipapython.secrets: Port to Python 3Petr Viktorin2015-10-271-1/+0
| | | | | | | | | | | StringIO was renamed in Python 3. The import was was unused, so remove it. Files need to be opened in binary mode if bytes are written to them. (For Python 2: on Linux, there's no practical difference between text and binary mode) Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.nsslib: Remove NSSHTTPSPetr Viktorin2015-10-271-68/+0
| | | | | | This workaround is unused in Python 2.7+. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.nsslib, ipalib.rpc: Remove code for Python 2.6 and belowPetr Viktorin2015-10-271-7/+1
| | | | | | IPA hasn't supported these pythons for a while now. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix more bytes/unicode issuesPetr Viktorin2015-10-222-3/+4
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Handle binascii.Error from base64.b64decode()Petr Viktorin2015-10-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In Python 3, the base64.b64decode function raises binascii.Error (a ValueError subclass) when it finds incorrect padding. In Python 2 it raises TypeError. Callers should usually handle ValueError; unless they are specifically concerned with handling base64 padding issues). In some cases, callers should handle ValueError: - ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should handle ValueError - ipalib.x509 (load_certificate*, get_*): callers should handle ValueError In other cases ValueError is handled: - ipalib.parameters - ipapython.ssh - ipalib.rpc (json_decode_binary - callers already expect ValueError) - ipaserver.install.ldapupdate Elsewhere no error handling is done, because values come from trusted sources, or are pre-validated: - vault plugin - ipaserver.install.cainstance - ipaserver.install.certs - ipaserver.install.ipa_otptoken_import Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add function to extract CA certs for installSimo Sorce2015-10-151-2/+6
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Implement replica promotion functionalitySimo Sorce2015-10-151-3/+8
| | | | | | | | | | | | | | | | | | This patch implements a new flag --promote for the ipa-replica-install command that allows an administrative user to 'promote' an already joined client to become a full ipa server. The only credentials used are that of an administrator. This code relies on ipa-custodia being available on the peer master as well as a number of other patches to allow a computer account to request certificates for its services. Therefore this feature is marked to work only with domain level 1 and above servers. Ticket: https://fedorahosted.org/freeipa/ticket/2888 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add ipa-custodia serviceSimo Sorce2015-10-156-0/+549
| | | | | | | | | | Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* admintool: Add error message with path to log on failure.David Kupka2015-10-151-0/+4
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaldap: Remove extraneous `long` (included in six.int_types)Petr Viktorin2015-10-131-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Alias long to int under Python 3Petr Viktorin2015-10-131-0/+5
| | | | | | In py3, the two types are unified under the name "int". Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.ssh: Port to Python 3Petr Viktorin2015-10-071-6/+9
| | | | | | | | | Sort out the accepted types. Handle Python 3's stricter separation between bytes and unicode. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove uses of the `types` modulePetr Viktorin2015-10-071-15/+10
| | | | | | | | | | | In Python 3, the types module no longer provide alternate names for built-in types, e.g. `types.StringType` can just be spelled `str`. NoneType is also removed; it needs to be replaced with type(None) Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.http_client instead of httplibPetr Viktorin2015-10-072-2/+16
| | | | | | | | The module was renamed in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.configparser instead of ConfigParserPetr Viktorin2015-10-073-10/+12
| | | | | | | | The module name was lowercased in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.xmlrpc.client instead of xmlrpclibPetr Viktorin2015-10-073-5/+4
| | | | | | | | The module is renamed to xmlrpc.client in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.urllib instead of urllib/urllib2/urlparsePetr Viktorin2015-10-074-8/+8
| | | | | | | | In Python 3, these modules are reorganized. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use sys.maxsize instead of sys.maxintPetr Viktorin2015-10-071-6/+6
| | | | | | | | | | | | In Python 3, integers don't have a maximum. The number called "sys.maxint" is now "sys.maxsize" (defined as larger than the largest possible list/string index). The new spelling is also available in Python 2.7. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 11:12:25 +0000