summaryrefslogtreecommitdiffstats
path: root/ipaserver/dcerpc.py
Commit message (Collapse)AuthorAgeFilesLines
* Use new LDAPClient constructorsChristian Heimes2019-02-051-3/+4
| | | | | | | | | | | | | | | | | | Replace get_ldap_uri() + LDAPClient() with new LDAPClient constructors like LDAPClient.from_realm(). Some places now use LDAPI with external bind instead of LDAP with simple bind. Although the FQDN *should* resolve to 127.0.0.1 / [::1], there is no hard guarantee. The draft https://tools.ietf.org/html/draft-west-let-localhost-be-localhost-04#section-5.1 specifies that applications must verify that the resulting IP is a loopback API. LDAPI is always local and a bit more efficient, too. The simple_bind() method also prevents the caller from sending a password over an insecure line. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returnedAlexander Bokovoy2019-01-101-9/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When looking through the topology of a trusted forest, we should support all types of forest trust records. Since Samba Python bindings parse the data into a typed structure, a type of the record has to be taken into account or there will be type mismatch when accessing elements of the union: typedef [switch_type(lsa_ForestTrustRecordType)] union { [case(LSA_FOREST_TRUST_TOP_LEVEL_NAME)] lsa_StringLarge top_level_name; [case(LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX)] lsa_StringLarge top_level_name_ex; [case(LSA_FOREST_TRUST_DOMAIN_INFO)] lsa_ForestTrustDomainInfo domain_info; [default] lsa_ForestTrustBinaryData data; } lsa_ForestTrustData; typedef struct { lsa_ForestTrustRecordFlags flags; lsa_ForestTrustRecordType type; NTTIME_hyper time; [switch_is(type)] lsa_ForestTrustData forest_trust_data; } lsa_ForestTrustRecord; typedef [public] struct { [range(0,4000)] uint32 count; [size_is(count)] lsa_ForestTrustRecord **entries; } lsa_ForestTrustInformation; Each entry in the lsa_ForestTrustInformation has forest_trust_data member but its content depends on the value of a type member (forest_trust_data is a union of all possible structures). Previously we assumed only TLN or TLN exclusion record which were of the same type (lsa_StringLarge). Access to forest_trust_data.string fails when forest_trust_data's type is lsa_ForestTrustDomainInfo as it has no string member. Fix the code by properly accessing the dns_domain_name from the lsa_ForestTrustDomainInfo structure. Fixes: https://pagure.io/freeipa/issue/7828 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* pylint 2.2: Fix unnecessary pass statementChristian Heimes2018-11-261-1/+0
| | | | | | | | | | pylint 2.2.0 has a new checker for unnecessary pass statements. There is no need to have a pass statement in functions or classes with a doc string. Fixes: https://pagure.io/freeipa/issue/7772 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Py3: Remove subclassing from objectChristian Heimes2018-09-271-3/+3
| | | | | | | | | Python 2 had old style and new style classes. Python 3 has only new style classes. There is no point to subclass from object any more. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Fix Pylint 2.0 violationsArmando Neto2018-07-141-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following violations aiming to support Pylint 2.0 - `unneeded-not` (C0113): Consider changing "not item in items" to "item not in items" used when a boolean expression contains an unneeded negation. - `useless-import-alias` (C0414): Import alias does not rename original package Used when an import alias is same as original package.e.g using import numpy as numpy instead of import numpy as np - `raising-format-tuple` (W0715): Exception arguments suggest string formatting might be intended Used when passing multiple arguments to an exception constructor, the first of them a string literal containing what appears to be placeholders intended for formatting - `bad-continuation` (C0330): This was already included on the disable list, although with current version of pylint (2.0.0.dev2) violations at the end of the files are not being ignored. See: https://github.com/PyCQA/pylint/issues/2278 - `try-except-raise` (E0705): The except handler raises immediately Used when an except handler uses raise as its first or only operator. This is useless because it raises back the exception immediately. Remove the raise operator or the entire try-except-raise block! - `consider-using-set-comprehension` (R1718): Consider using a set comprehension Although there is nothing syntactically wrong with this code, it is hard to read and can be simplified to a set comprehension.Also it is faster since you don't need to create another transient list - `dict-keys-not-iterating` (W1655): dict.keys referenced when not iterating Used when dict.keys is referenced in a non-iterating context (returns an iterator in Python 3) - `comprehension-escape` (W1662): Using a variable that was bound inside a comprehension Emitted when using a variable, that was bound in a comprehension handler, outside of the comprehension itself. On Python 3 these variables will be deleted outside of the comprehension. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix pylint 2.0 return-related violationsArmando Neto2018-07-111-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | Aiming to support pylint 2.0 some functions and methods must have their return statements updated in order to fix two new violations: - `useless-return` (R1711): Useless return at end of function or method Emitted when a single "return" or "return None" statement is found at the end of function or method definition. This statement can safely be removed because Python will implicitly return None - `inconsistent-return-statements` (R1710): Either all return statements in a function should return an expression, or none of them should. According to PEP8, if any return statement returns an expression, any return statements where no value is returned should explicitly state this as return None, and an explicit return statement should be present at the end of the function (if reachable) Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaserver/dcerpc.py: handle indirect topology conflictsAlexander Bokovoy2018-06-271-8/+27
| | | | | | | | | | | | When AD forest A has a trust with a forest B that claims ownership of a domain name (TLN) owned by an IPA forest, we need to build exclusion record for that specific TLN, not our domain name. Use realmdomains to find a correct exclusion entry to build. Fixes: https://pagure.io/freeipa/issue/7370 Reviewed-By: Armando Neto <abiagion@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use intended format() method of translation objectStanislav Levin2018-06-211-1/+1
| | | | | | | | Translation objects have support for format(). This allows to get rid of unicode() which is deprecated in Python3. Fixes: https://pagure.io/freeipa/issue/7586 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Sort and shuffle SRV record by priority and weightChristian Heimes2018-06-191-2/+2
| | | | | | | | | | | | | | | On multiple occasions, SRV query answers were not properly sorted by priority. Records with same priority weren't randomized and shuffled. This caused FreeIPA to contact the same remote peer instead of distributing the load across all available servers. Two new helper functions now take care of SRV queries. sort_prio_weight() sorts SRV and URI records. query_srv() combines SRV lookup with sort_prio_weight(). Fixes: https://pagure.io/freeipa/issue/7475 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use sane default settings for ldap connectionsChristian Heimes2018-05-291-5/+2
| | | | | | | | | | LDAP connections no longer depend on sane settings in global ldap.conf and use good default settings for cert validation, CA, and SASL canonization. https://pagure.io/freeipa/issue/7418 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add absolute_import future importsStanislav Laznicka2018-04-201-0/+2
| | | | | | | | | Add absolute_import from __future__ so that pylint does not fail and to achieve python3 behavior in python2. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Unified ldap_initialize() functionChristian Heimes2018-02-151-1/+2
| | | | | | | | | | | Replace all ldap.initialize() calls with a helper function ldap_initialize(). It handles cacert and cert validation correctly. It also provides a unique place to handle python-ldap 3.0 bytes warnings in the future. Fixes: https://pagure.io/freeipa/issue/7411 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* trust: detect and error out when non-AD trust with IPA domain name existsAlexander Bokovoy2017-12-071-12/+25
| | | | | | | | | | | | | | | | | | | | | | | Quite often users choose wrong type of trust on Active Directory side when setting up a trust to freeIPA. The trust type supported by freeIPA is just a normal forest trust to another Active Directory. However, some people follow old internet recipes that force using a trust to MIT Kerberos realm. This is a wrong type of trust. Unfortunately, when someone used MIT Kerberos realm trust, there is no way to programmatically remote the trust from freeIPA side. As result, we have to detect such situation and report an error. To do proper reporting, we need reuse some constants and trust type names we use in IPA CLI/Web UI. These common components were moved to a separate ipaserver/dcerpc_common.py module that is imported by both ipaserver/plugins/trust.py and ipaserver/dcerpc.py. Fixes https://pagure.io/freeipa/issue/7264 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Update to python-ldap 3.0.0Christian Heimes2017-12-061-10/+6
| | | | | | | | | Replace python3-pyldap with python3-ldap. Remove some old code for compatibility with very old python-ldap. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* adtrust: filter out subdomains when defining our topology to ADAlexander Bokovoy2017-11-161-0/+16
| | | | | | | | | | | | | | | | | | | | | When definining a topology of a forest to be visible over a cross-forest trust, we set *.<forest name> as all-catch top level name already. This means that all DNS subdomains of the forest will already be matched by this top level name (TLN). If we add more TLNs for subdomains, Active Directory will respond with NT_STATUS_INVALID_PARAMETER. Filter out all subdomains of the forest root domain. All other realm domains will be added with explicit TLN records. Also filter out single label domains. These aren't possible to add as TLNs to Windows Server 2016 as it considers them incorrect. Given that we do not allow single lable domains as part of freeIPA installs, this is another layer of protection here. Fixes https://pagure.io/freeipa/issue/6666 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: set samba dependenciesMartin Basti2017-09-141-3/+0
| | | | | | | | | Set proper python3 dependencies for samba package https://pagure.io/freeipa/issue/7131 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dcerpc: disable unbalanced-tuple-unpackingStanislav Laznicka2017-09-081-1/+3
| | | | | | | | | Disable unbalanced-tuple-unpacking for RuntimeException thrown by samba since this one should always contain two members. https://pagure.io/freeipa/issue/6874 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dcerpc: refactor assess_dcerpc_exceptionStanislav Laznicka2017-09-081-18/+19
| | | | | | | | | | | assess_dcerpc_exception was used in multiple places with a pre-step which was rather common. Move this to one spot. This also fixes pylint warning about unbalanced unpacking. https://pagure.io/freeipa/issue/6874 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dcerpc: support Python 3Alexander Bokovoy2017-08-231-1/+11
| | | | | | | | | | | | | | | | | | | Make 'ipa trust-add' work under Python 3. One needs patches from https://lists.samba.org/archive/samba-technical/2017-July/121746.html to Samba too. Since we haven't switched whole ipa server environment to Python 3 yet, following packages need to be installed to make trust code working under Python 3: - python3-libsss_nss_idmap - python3-sss - python3-samba - python3-mod_wsgi Fixes: https://pagure.io/freeipa/issue/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-46/+45
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: do not reference loggers in arguments and attributesJan Cholasta2017-07-141-2/+5
| | | | | | | | Remove logger arguments in all functions and logger attributes in all objects, with the exception of API object logger, which is now deprecated. Replace affected logger calls with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver/dcerpc: unify error processingAlexander Bokovoy2017-04-111-6/+17
| | | | | | | | | | | | | | | | | | | Samba error code reporting changes from version to version but we also did not provide proper input into DCE RPC error processing method we have. Unify error processing and add few more fallback entries. With Samba 4.7 we'll have to change it again because error code processing for Samba Python modules will change with introduction of samba.ntstatus and samba.werror modules. Note that this commit also changes a message returned for error code -1073741772 (NT_STATUS_OBJECT_NOT_FOUND) because it is more general one. Fixes https://pagure.io/freeipa/issue/6859 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver/dcerpc.py: use arcfour_encrypt from sambaAlexander Bokovoy2017-03-131-9/+1
| | | | | | | | | | | Samba Python bindings provide samba.arcfour_encrypt(key, data). Instead of implementing own wrapper, use Samba's. In future Samba versions this wrapper will be FIPS 140-2 compatible. Fixes https://pagure.io/freeipa/issue/6697 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Drop use of kinit_as_http from trust codeSimo Sorce2017-02-151-45/+3
| | | | | | | | | | | | | | The framework will not have direct access to the keytab anymore. This function was used in two places, to fetch the domain list and to re-initialize the PAC when enabling or disabling a domain trust. The domian list is normally fetched via oddjob anyway so this use is not necesary anymore, and the MS-PAC re-initialization can be moved later to oddjob if needed. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Generate tmpfiles config at install timeSimo Sorce2017-02-151-9/+8
| | | | | | | | | | | | | | We do not want to generate runtime directories just because the packages are installed, but only if the server is actually setup and run. Also this will be needed later because we will create a user at install time and some tmpfiles will need to be owned by this user. As we are changing this code also rationalize the directory structure and move it from the http rundir to the ipa specific rundir. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-291-2/+3
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Silence import warnings for Samba bindingsChristian Heimes2016-11-251-1/+6
| | | | | | | | | | Python 3 Samba bindings are not available yet. Let's silence the warnings to make pylint pass under Python 3. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaldap: merge IPAdmin to LDAPClientTomas Krizek2016-11-071-6/+7
| | | | | | | | | | | | | | | | * move IPAdmin methods to LDAPClient * add extra arguments (cacert, sasl_nocanon) to LDAPClient.__init__() * add host, port, _protocol to LDAPClient (parsed from ldap_uri) * create get_ldap_uri() method to create ldap_uri from former IPAdmin.__init__() arguments * replace IPAdmin with LDAPClient + get_ldap_uri() * remove ununsed function argument hostname from enable_replication_version_checking() https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaldap: merge gssapi_bind to LDAPClientTomas Krizek2016-11-071-1/+1
| | | | | | | | | * Rename do_sasl_gssapi_bind to gssapi_bind https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* pylint: enable the import-error checkJan Cholasta2016-10-241-6/+5
| | | | | | | | | | Check for import errors with pylint to make sure new python package dependencies are not overlooked. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: replace ipaplatform magic with symlinks generated by configurePetr Spacek2016-10-241-1/+1
| | | | | | | | | | | | | | | The original approach with __path__ implemented by 8f98fa1bd5f1da207fab6f89b75e0cdc19d00797 broke Pylint: We decided to resort back to symlinks as it is easiest solution which does not break pylint in weird ways. This commit introduces configure --with-ipaplatform option. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Replace ipaplatform's symlinks with a meta importerChristian Heimes2016-10-201-1/+1
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Pylint: remove unused variables in ipaserver packageMartin Basti2016-10-061-32/+11
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Pylint: enable check for unused-variablesMartin Basti2016-09-271-0/+2
| | | | | | | | | | | | | | | Unused variables may: * make code less readable * create dead code * potentialy hide issues/errors Enabled check should prevent to leave unused variable in code Check is locally disabled for modules that fix is not clear or easy or have too many occurences of unused variables Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* factor out `populate_remote_domain` method into module-level functionMartin Babinsky2016-09-051-41/+53
| | | | | | | | | | This allows for re-use of this method in cases where the caller can not or wishes not to instantiate local Samba domain to retrieve information about remote ones. https://fedorahosted.org/freeipa/ticket/6057 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* trust: make sure external trust topology is correctly renderedAlexander Bokovoy2016-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | When external trust is established, it is by definition is non-transitive: it is not possible to obtain Kerberos tickets to any service outside the trusted domain. Reflect this reality by only accepting UPN suffixes from the external trust -- since the trusted domain is a part of another forest and UPN suffixes are forest-wide, there could be user accounts in the trusted domain that use forest-wide UPN suffix but it will be impossible to reach the forest root via the externally trusted domain. Also, an argument to netr_DsRGetForestTrustInformation() has to be either forest root domain name or None (NULL). Otherwise we'll get an error as explained in MS-NRPC 3.5.4.7.5. https://fedorahosted.org/freeipa/ticket/6021 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trust: automatically resolve DNS trust conflicts for triangle trustsAlexander Bokovoy2016-08-221-28/+192
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For configuration where: - AD example.com trusts IPA at ipa.example.com - AD example.org trusts AD example.com - a trust is tried to be established between ipa.example.com and example.org, there will be a trust topology conflict detected by example.org domain controller because ipa.example.com DNS namespace overlaps with example.com DNS namespace. This type of trust topology conflict is documented in MS-ADTS 6.1.6.9.3.2 "Building Well-Formed msDS-TrustForestTrustInfo Message". A similar conflict can arise for SID and NetBIOS namespaces. However, unlike SID and NetBIOS namespaces, we can solve DNS namespace conflict automatically if there are administrative credentials for example.org available. A manual sequence to solve the DNS namespace conflict is described in https://msdn.microsoft.com/it-it/library/cc786254%28v=ws.10%29.aspx. This sequence boils down to the following steps: 1. As an administrator of the example.org, you need to add an exclusion entry for ipa.example.com in the properties of the trust to example.com 2. Establish trust between ipa.example.com and example.org It is important to add the exclusion entry before step 4 or there will be conflict recorded which cannot be cleared easily right now due to a combination of bugs in both IPA and Active Directory. This patchset implements automated solution for the case when we have access to the example.org's administrator credentials: 1. Attempt to establish trust and update trust topology information. 2. If trust topology conflict is detected as result of (1): 2.1. Fetch trust topology infromation for the conflicting forest trust 2.2. Add exclusion entry to our domain to the trust topology obtained in (2.1) 2.3. Update trust topology for the conflicting forest trust 3. Re-establish trust between ipa.example.com and example.org We cannot do the same for shared secret trust and for external trust, though: 1. For shared secret trust we don't have administrative credentials in the forest reporting the conflict 2. For the external trust we cannot set topology information due to MS-LSAD 3.1.4.7.16 because external trust is non-transitive by definition and thus setting topology information will fail. To test this logic one can use two Samba AD forests with FreeIPA using a sub-domain of one of them. Fixes: https://fedorahosted.org/freeipa/ticket/6076 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipaserver/dcerpc: reformat to make the code closer to pep8Alexander Bokovoy2016-08-221-175/+298
| | | | | | | | | | | Because Samba Python bindings provide long-named methods and constants, sometimes it is impossible to fit into 80 columns without causing damage to readability of the code. This patchset attempts to reduce pep8 complaints to a minimum. https://fedorahosted.org/freeipa/ticket/6076 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* session: move the session module from ipalib to ipaserverJan Cholasta2016-06-301-1/+1
| | | | | | | | | The module is used only on the server, so there's no need to have it in ipalib, which is shared by client and server. https://fedorahosted.org/freeipa/ticket/5988 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-111-11/+29
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Add support for an external trust to Active Directory domainAlexander Bokovoy2016-06-091-13/+37
| | | | | | | | | | | | | | | External trust is a trust that can be created between Active Directory domains that are in different forests or between an Active Directory domain. Since FreeIPA does not support non-Kerberos means of communication, external trust to Windows NT 4.0 or earlier domains is not supported. The external trust is not transitive and can be established to any domain in another forest. This means no access beyond the external domain is possible via the trust link. Resolves: https://fedorahosted.org/freeipa/ticket/5743 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Pylint: import max one module per lineMartin Basti2016-03-221-1/+2
| | | | | Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: use list comprehension instead of iterationMartin Basti2016-03-221-4/+1
| | | | | | | | | Iteration over indexes without calling enumeration fuction is not pythonic and should not be used. In this case iteration can be replaced by list comprehension. Fixing this allows to enable pylint consider-using-enumerate check. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* logger: Use warning instead of warnTomas Babej2016-01-181-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Enable pylint unpacking-non-sequence checkMartin Basti2016-01-141-6/+6
| | | | | | | Enables check and marks occurences of runtime error in dcerpc.py as false positive. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Enable pylint unnecessary-pass checkMartin Basti2015-12-231-1/+1
| | | | | | Enables check and removes extra pass statement from code. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint lost exception checkMartin Basti2015-12-231-2/+2
| | | | | | | | | Commit enables check and also fixes: ipaserver/dcerpc.py:718: [W0150(lost-exception), DomainValidator.__search_in_dc] return statement in finally block may swallow exception) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove wildcard importsMartin Basti2015-12-231-2/+4
| | | | | | | | | | | Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-231-5/+2
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor ipautil.runPetr Viktorin2015-12-141-10/+6
| | | | | | | | | | | | | | | | | | | | | The ipautil.run function now returns an object with returncode and output are accessible as attributes. The stdout and stderr of all commands are logged (unless skip_output is given). The stdout/stderr contents must be explicitly requested with a keyword argument, otherwise they are None. This is because in Python 3, the output needs to be decoded, and that can fail if it's not decodable (human-readable) text. The raw (bytes) output is always available from the result object, as is "leniently" decoded output suitable for logging. All calls are changed to reflect this. A use of Popen in cainstance is changed to ipautil.run. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 15:14:38 +0000