summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/cainstance.py
Commit message (Collapse)AuthorAgeFilesLines
* Refresh Dogtag RestClient.ca_host propertyStanislav Laznicka2017-05-021-3/+2
| | | | | | | | | | | | | | | | Refresh the ca_host property of the Dogtag's RestClient class when it's requested as a context manager. This solves the problem which would occur on DL0 when installing CA which needs to perform a set of steps against itself accessing 8443 port. This port should however only be available locally so trying to connect to remote master would fail. We need to make sure the right CA host is accessed. https://pagure.io/freeipa/issue/6878 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix CAInstance.import_ra_cert for empty passwordsStanislav Laznicka2017-04-201-1/+1
| | | | | | | | OpenSSL can't cope with empty files, add a newline after each password https://pagure.io/freeipa/issue/6878 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix RA cert import during DL0 replicationStanislav Laznicka2017-04-191-17/+26
| | | | | | | | | | Previous versions of FreeIPA add password to the ra.p12 file contained in the password-protected tarball. This was forgotten about in the recent changes and fixed now. https://pagure.io/freeipa/issue/6878 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ext. CA: correctly write the cert chainStanislav Laznicka2017-04-191-2/+3
| | | | | | | | | The cert file would have been rewritten all over again with any of the cert in the CA cert chain without this patch. https://pagure.io/freeipa/issue/6872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Create system users for FreeIPA services during package installationDavid Kupka2017-04-111-12/+0
| | | | | | | | | | | | | | | | | | | | Previously system users needed by FreeIPA server services was created during ipa-server-install. This led to problem when DBus policy was configured during package installation but the user specified in the policy didn't exist yet (and potentionally similar ones). Now the users will be created in package %pre section so all users freeipa-server package needs exist before any installation or configuration begins. Another possibility would be using systemd-sysusers(8) for this purpose but given that systemd is not available during container build the traditional approach is superior. Also dirsrv and pkiuser users are no longer created by FreeIPA instead it depends on 389ds and dogtag to create those users. https://pagure.io/freeipa/issue/6743 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add pki_pin only when neededStanislav Laznicka2017-04-051-3/+7
| | | | | | | | | | If both the pki-tomcat NSS database and its password.conf have been created, don't try to override the password.conf file. https://pagure.io/freeipa/issue/6839 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Hide PKI Client database password in log fileAbhijeet Kasurde2017-03-301-1/+4
| | | | | Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Generate PIN for PKI to help Dogtag in FIPSStanislav Laznicka2017-03-281-1/+5
| | | | | | | | | | Dogtag is currently unable to generate a PIN it could use for an NSS database creation in FIPS. Generate it for them so that we don't fail. https://pagure.io/freeipa/issue/6824 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove copy-schema-to-ca.py from master branchMartin Basti2017-03-141-4/+2
| | | | | | | | | This script is used only for IPA <3.1, so it must be compatible with ipa-3-0 branch, so it should be placed there https://pagure.io/freeipa/issue/6540 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* installer: update time estimatesTomas Krizek2017-03-101-1/+6
| | | | | | | | | | Time estimates have been updated to be more accurate. Only tasks that are estimated to take longer than 10 seconds have the estimate displayed. https://pagure.io/freeipa/issue/6596 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-011-74/+56
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor certmonger for OpenSSL certificatesStanislav Laznicka2017-03-011-6/+4
| | | | | | | | | | Currently, it was only possible to request an NSS certificate via certmonger. Merged start_tracking methods and refactored them to allow for OpenSSL certificates tracking. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from DogtagStanislav Laznicka2017-03-011-6/+0
| | | | | | | | | | | | | Replaced NSSConnection with Python's httplib.HTTPSConnection. This class is OpenSSL-based. A client certificate with a private key is required to authenticate against the certificate server. We facilitate the RA_AGENT_PEM which already exists. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move publishing of CA cert to cainstance creation on masterStanislav Laznicka2017-03-011-0/+6
| | | | | | | | | IPAHTTPSConnection which is set up first time in certificate profiles migration to LDAP requires CA cert to be stored in a file. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move RA agent certificate file export to a different locationStanislav Laznicka2017-03-011-1/+4
| | | | | | | | | | | | HTTPS connection to certificate server requires client authentication so we need a file with client certificate and private key prior to its first occurence which happens during migration of certificate profiles to LDAP. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove DM password files after successfull pkispawn runStanislav Laznicka2017-02-231-5/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove ra_db argument from CAInstance initStanislav Laznicka2017-02-231-22/+10
| | | | | | | | | | | | The ra_db argument to CAInstance init is a constant so it can be removed. This constant corresponds to the default CertDB directory and since CertDB now passes passwords to its inner NSSDatabase instance we do need to care about having our own run_certutil() method. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Do not configure PKI ajp redirection to use "::1"Florence Blanc-Renaud2017-02-171-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | When ipa-server-install configures PKI, it provides a configuration file with the parameter pki_ajp_host set to ::1. This parameter is used to configure Tomcat redirection in /etc/pki/pki-tomcat/server.xml: <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="::1" /> ie all requests to port 8009 are redirected to port 8443 on address ::1. If the /etc/hosts config file does not define ::1 for localhost, then AJP redirection fails and replica install is not able to request a certificate for the replica. Since PKI has been fixed (see PKI ticket 2570) to configure by default the AJP redirection with "localhost", FreeIPA does not need any more to override this setting. The code now depends on pki 10.3.5-11 which provides the fix in the template and the upgrade. https://fedorahosted.org/freeipa/ticket/6575 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add password to certutil calls in NSSDatabaseStanislav Laznicka2017-02-171-0/+23
| | | | | | | | | | NSSDatabases should call certutil with a password. Also, removed `password_filename` argument from `.create_db()`. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Separate RA cert store from the HTTP cert storeSimo Sorce2017-02-151-14/+4
| | | | | | | | | | | | | | | This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cryptography has deprecated serial in favor of serial_numberChristian Heimes2017-02-101-2/+2
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* py3: __add_acl: use standard ipaldap methodsMartin Basti2017-01-241-8/+5
| | | | | | | | | | Using raw pyldap interface we have to keep vaules as bytes. Is easier to migrate to ipaldap and use strings without decoding and encoding. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: cainstance: replace mkstemp with NamedTemporaryFileMartin Basti2017-01-241-24/+25
| | | | | | | | | | | With Python3 files must be opened in textual mode to write text, and best practise is to use fileobject instead fo os.write() and manual encodig https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: write CA/KRA config into file opened in text modeMartin Basti2017-01-241-1/+1
| | | | | | | | | | config parser writes data as text so CA/KRA should be opened in textual mode otherwise type errors are raised from installer https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: CA/KRA: config parser requires stringMartin Basti2017-01-241-1/+2
| | | | | | | | | | basedn is DN object it has to be converted to string before it can be used with config parser https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cainstance: do not configure renewal guardJan Cholasta2017-01-161-38/+14
| | | | | | | | | | Do not configure renewal guard for dogtag-ipa-renew-agent, as it is not used in IPA anymore. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-111-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Extract function for computing default subject baseFraser Tweedale2017-01-111-4/+4
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Configure Anonymous PKINIT on server installSimo Sorce2016-12-121-1/+1
| | | | | | | | | | | | Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add function for extracting PEM certs from PKCS #7Fraser Tweedale2016-12-121-33/+19
| | | | | | | | | | | Add a single function for extracting X.509 certs in PEM format from a PKCS #7 object. Refactor sites that execute ``openssl pkcs7`` to use the new function. Part of: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* replica install: track the RA agent certificate againJan Cholasta2016-11-301-1/+5
| | | | | | | | | | | | | During the rebase of commit 822e1bc82af3a6c1556546c4fbe96eeafad45762 on top of commit 808b1436b4158cb6f926ac2b5bd0979df6ea7e9f, the call to track the RA agent certificate with certmonger was accidentally removed from ipa-replica-install. Put the call back so that the certificate is tracked after replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-291-1/+1
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-291-2/+1
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move dnssec, p11helper and secrets to ipaserverJan Cholasta2016-11-291-1/+1
| | | | | | | | | | | The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Do not log DM password in ca/kra installation logsStanislav Laznicka2016-11-251-1/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* services: replace admin_conn with api.Backend.ldap2Tomas Krizek2016-11-221-11/+11
| | | | | | | | | Since service.admin_conn is only an alias to api.Backend.ldap2, replace it everywhere with the explicit api.Backend.ldap2 instead. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cainstance: use correct certificate for replica install checkTomas Krizek2016-11-141-1/+1
| | | | | | | | Incorrect certificate file extension caused DL0 replica install to fail. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Turn Kerberos-related properties to Service class membersMartin Babinsky2016-11-111-11/+10
| | | | | | | | | | | | | The Service class now accepts keytab path and service name part of Kerberos principal as members. Kerberos principal is turned into a property computed from service prefix, FQDN and realm. the handling of Kerberos principals and keytabs in service installers was changed to use class members instead of copy-pasted constants. This shall aid in the future refactoring of principal/keytab handling code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Make service user name a class member of ServiceMartin Babinsky2016-11-111-6/+6
| | | | | | | | | This will aid further refactoring of service installers, since the user will be defined only once during parent class initialization. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Move the pki-tomcat restart to cainstance creationStanislav Laznicka2016-11-111-0/+13
| | | | | | | | | | | pki-tomcat would have been restarted in install and replicainstall for backward compatibility reasons. As Dogtag 9 is not supported anymore, we can move this restart only for DL0 replica installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: use ldaps for pkispawn in ipa-ca-installJan Cholasta2016-11-111-1/+5
| | | | | | | | | | | | | Commit 822e1bc82af3a6c1556546c4fbe96eeafad45762 undone the fix from commit 276d16775a4ce8af5d39ca8a7bf5bcd638df343f, breaking ipa-ca-install on servers with hardened DS configuration. Put the fix back to make ipa-ca-install work on hardened DS configuration again. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica install: merge KRA agent cert export into KRA installJan Cholasta2016-11-111-4/+1
| | | | | | | | | Merge all KRA agent cert export code paths into a single code path in KRA install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: merge RA cert import into CA installJan Cholasta2016-11-111-61/+71
| | | | | | | | Merge all RA cert import code paths into a single code path in CA install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: merge all CA install code paths into oneJan Cholasta2016-11-111-174/+29
| | | | | | | | | Merge CA install code paths use in ipa-server-install, ipa-replica-install in either domain level and ipa-ca-install into one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: use one remote CA host name everywhereJan Cholasta2016-11-111-2/+2
| | | | | | | | | Remote master and CA host names may differ. Always use the remote CA host name and never the remote master host name in CA replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* initialize empty /etc/http/alias during server/replica installMartin Babinsky2016-11-111-37/+0
| | | | | | | | | | In order to reduce coupling between httpinstance and other service installers, the HTTP installer is now tasked with initialization of /etc/httpd/alias (RA agent database) in the beginning of server/replica installation Part of https://fedorahosted.org/freeipa/ticket/6429 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor installer code requesting certificatesFlorence Blanc-Renaud2016-11-101-154/+63
| | | | | | | | | | | | | | | | | | | | - Temporary modify certmonger dogtag-ipa-ca-renew helper to request the IPA RA agent cert, using the temp cert created during pkispawn. The cert request is now processed through certmonger, and the helper arguments are restored once the agent cert is obtained. - Modify the installer code creating HTTP and LDAP certificates to use certmonger's IPA helper with temporary parameters (calling dogtag-submit instead of ipa-submit) - Clean-up for the integration tests: sometimes ipa renewal.lock is not released during ipa-server-uninstall. Make sure that the file is removed to allow future installations. https://fedorahosted.org/freeipa/ticket/6433 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-101-11/+14
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* install: remove adhoc dis/connect from servicesTomas Krizek2016-11-071-14/+0
| | | | | | | | | | | Remove ldap_connect and ldap_disconnect from services. admin_conn is just an alias to api.Backend.ldap2 and therefore the connection should be managed elsewhere. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: remove adhoc api.Backend.ldap2 (dis)connectTomas Krizek2016-11-071-22/+0
| | | | | | | | | | | Remove adhoc connects and disconnects of api.Backend.ldap2. Connection should be established only at the start of the script, destroyed at the end of the script and re-established when directory server is restarted. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 23:20:58 +0000