summaryrefslogtreecommitdiffstats
path: root/ipaserver/install
Commit message (Collapse)AuthorAgeFilesLines
...
* install: drop support for Dogtag 9Jan Cholasta2015-11-2519-627/+260
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* Install: Force service add during replica promotionMartin Basti2015-11-242-2/+4
| | | | | | | | | Replica does not need to have A/AAAA records during install, so we cannot enforce it and service must be added with --force option. https://fedorahosted.org/freeipa/ticket/5420 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* do not disconnect when using existing connection to check default CA ACLsMartin Babinsky2015-11-241-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* disconnect ldap2 backend after adding default CA ACL profilesMartin Babinsky2015-11-241-0/+3
| | | | | | | | | | ensure_default_caacl() was leaking open api.Backend.ldap2 connection which could crash server/replica installation at later stages. This patch ensures that after checking default CA ACL profiles the backend is disconnected. https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add profiles and default CA ACL on migrationFraser Tweedale2015-11-245-44/+81
| | | | | | | | | | | | | | | | | | | | Profiles and the default CA ACL were not being added during replica install from pre-4.2 servers. Update ipa-replica-install to add these if they are missing. Also update the caacl plugin to prevent deletion of the default CA ACL and instruct the administrator to disable it instead. To ensure that the cainstance installation can add profiles, supply the RA certificate as part of the instance configuration. Certmonger renewal setup is avoided at this point because the NSSDB gets reinitialised later in installation procedure. Also move the addition of the default CA ACL from dsinstance installation to cainstance installation. Fixes: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-otptoken-import: Fix connection to ldap.David Kupka2015-11-231-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5475 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-cacert-renew: Fix connection to ldap.David Kupka2015-11-231-17/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/5468 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Check if IPA is configured before attempting a winsync migrationGabe2015-11-231-1/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5470 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Avoid race condition caused by profile delete and recreateFraser Tweedale2015-11-231-2/+1
| | | | | | | | | | | | | | | When importing IPA-managed certificate profiles into Dogtag, profiles with the same name (usually caIPAserviceCert) are removed, then immediately recreated with the new profile data. This causes a race condition - Dogtag's LDAPProfileSystem profileChangeMonitor thread could observe and process the deletion after the profile was recreated, disappearing it again. Update the profile instead of deleting and recreating it to avoid this race condition. Fixes: https://fedorahosted.org/freeipa/ticket/5269 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* suppress errors arising from adding existing LDAP entries during KRA installMartin Babinsky2015-11-192-3/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/5346 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert renewal: make renewal of ipaCert atomicJan Cholasta2015-11-192-3/+3
| | | | | | | | | This prevents errors when renewing other certificates during the renewal of ipaCert. https://fedorahosted.org/freeipa/ticket/5436 Reviewed-By: David Kupka <dkupka@redhat.com>
* install: export KRA agent PEM file in ipa-kra-installJan Cholasta2015-11-191-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5462 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Drop configure.jarMartin Basti2015-11-133-44/+0
| | | | | | | | | Configure.jar used to be used with firefox version < 10 which is not supported anymore, thus this can be removed. https://fedorahosted.org/freeipa/ticket/5144 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* remove an unneccesary check from IPA server uninstallerMartin Babinsky2015-11-121-7/+0
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* remove Kerberos authenticators when installing/uninstalling service instanceMartin Babinsky2015-11-117-8/+56
| | | | | | | | | | each service possessing Kerberos keytab/ccache will now perform their removal before service principal creation and during service uninstall https://fedorahosted.org/freeipa/ticket/5243 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Remove unused constant NEW_MASTER_MARK from ipaserver.install.dnsPetr Spacek2015-11-111-2/+0
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Remove dead code in ipaserver/install/installutils: read_ip_address()Petr Spacek2015-11-101-14/+0
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* adtrustinstance: Do not use bare except clausesTomas Babej2015-11-101-8/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/5134 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrustinstance: Restart samba service at the end of adtrust-installTomas Babej2015-11-101-0/+7
| | | | | | | | | | Errors related to establishing trust can occur if samba service is not restarted after ipa-adtrust-install has been run. Restart the service at the end of the installer to avoid such issues. https://fedorahosted.org/freeipa/ticket/5134 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrustinstance: Wait for sidgen task completionTomas Babej2015-11-101-3/+15
| | | | | | | | | | As part of hardening of adtrust installer, we should wait until the sidgen task is completed before continuing, as it can take considerable amount of time for a larger deployment. https://fedorahosted.org/freeipa/ticket/5134 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Upgrade: enable custodia service during upgradeMartin Basti2015-11-101-4/+6
| | | | | | | | There was missing step in upgrade that enables the service in LDAP https://fedorahosted.org/freeipa/ticket/5429 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* ipa-replica-prepare: domain level check improvementsMartin Babinsky2015-11-051-4/+17
| | | | | | | | | | | | ipa-replica-prepare command is disabled in non-zero domain-level. Instead of raising and exception with the whole message instructing the user to promote replicas from enrolled clients in level 1+ topologies, the exception itself contains only a brief informative message and the rest is logged at error level. https://fedorahosted.org/freeipa/ticket/5175 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipaplatform: Add NTPD_OPTS_VAR and NTPD_OPTS_QUOTE to constantsTimo Aaltonen2015-11-041-5/+9
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* httpinstance: Use full path via HTTPD_IPA_REWRITE_CONF for Include.Timo Aaltonen2015-11-041-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaplatform: Add NAMED_USER to constantsTimo Aaltonen2015-11-041-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaplatform: Add HTTPD_USER to constants, and use it.Timo Aaltonen2015-11-044-9/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNSSEC: remove sysrestore state after uninstallMartin Basti2015-11-031-0/+2
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix typo in ods-exporter uninstall to restore stateMartin Basti2015-11-031-1/+1
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: improve log messages in uninstallerPetr Spacek2015-10-301-1/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: on uninstall, do not restore OpenDNSSEC kasp.db if backup failedPetr Spacek2015-10-301-4/+9
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* KRA: fix check that CA is installedMartin Basti2015-10-291-18/+24
| | | | | | https://fedorahosted.org/freeipa/ticket/5345 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Check early if a CA is already installed locallySimo Sorce2015-10-271-3/+1
| | | | | | | | | | There is no reason to proceed if a CA is already installed, and the check does not involve a lot of setup, so do it early on. Ticket: https://fedorahosted.org/freeipa/ticket/5397 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Domain levels: use constants rather than hardcoded valuesMartin Basti2015-10-275-11/+12
| | | | | | | | | | | Added constants for domain levels DOMAIN_LEVEL_0 = 0 DOMAIN_LEVEL_1 = 1 This allows to search for domain level easier in code. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Remove executable bit from ipa_kra_install.pyMartin Basti2015-10-261-0/+0
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* always ask the resolver for the reverse zone when manipulating PTR recordsMartin Babinsky2015-10-221-2/+0
| | | | | | | | | | | | | Instead of searching for all zones to identify the correct reverse zone, we will first ask the resolver to return the name of zone that should contain the desired record and then see if IPA manages this zone. This patch also removes a duplicate function in bindinstance.py that is not used anywhere. https://fedorahosted.org/freeipa/ticket/5200 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix left-over Python 3 syntax errorsPetr Viktorin2015-10-221-2/+2
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix more bytes/unicode issuesPetr Viktorin2015-10-221-23/+23
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Handle binascii.Error from base64.b64decode()Petr Viktorin2015-10-222-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In Python 3, the base64.b64decode function raises binascii.Error (a ValueError subclass) when it finds incorrect padding. In Python 2 it raises TypeError. Callers should usually handle ValueError; unless they are specifically concerned with handling base64 padding issues). In some cases, callers should handle ValueError: - ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should handle ValueError - ipalib.x509 (load_certificate*, get_*): callers should handle ValueError In other cases ValueError is handled: - ipalib.parameters - ipapython.ssh - ipalib.rpc (json_decode_binary - callers already expect ValueError) - ipaserver.install.ldapupdate Elsewhere no error handling is done, because values come from trusted sources, or are pre-validated: - vault plugin - ipaserver.install.cainstance - ipaserver.install.certs - ipaserver.install.ipa_otptoken_import Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNSSEC: warn user if DNSSEC key master is not installedMartin Basti2015-10-221-0/+5
| | | | | | | | | Warning user that DNSSEC key master is not installed when commands dnszone-add, dnszone-mod, dnszone-show when option dnssec=true https://fedorahosted.org/freeipa/ticket/5290 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: Remove service containers from LDAP after uninstallingMartin Basti2015-10-222-0/+16
| | | | | | | | | | The service containers are no needed there after uninstall anymore. Removing these service also allows to detect if DNSSEC master is installed on any replica for any user. https://fedorahosted.org/freeipa/ticket/5290 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: store status of services only before first installMartin Basti2015-10-222-5/+8
| | | | | | | DNS installer allows to reinstall DNS and DNSSEC, so the status of services should be stored only for first time. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow to install the KRA on a promoted serverSimo Sorce2015-10-228-150/+298
| | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Warn if no installation found when running ipa-server-install --uninstallGabe2015-10-221-0/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/5341 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow ipa-ca-install to use the new promotion codeSimo Sorce2015-10-221-2/+0
| | | | | | | | | | | This makes it possible to install a CA after-the-fact on a server that has been promoted (and has no replica file available). https://fedorahosted.org/freeipa/ticket/2888 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* disable ipa-replica-prepare in non-zero IPA domain levelMartin Babinsky2015-10-201-1/+27
| | | | | | | | | | | | the original replica installation path (ipa-replica-prepare + ipa-replica-install) remains valid only when IPA domain level is zero. When this is not the case, ipa-replica-prepare will print out an error message which instructs the user to use the new replica promotion machinery to setup replicas. https://fedorahosted.org/freeipa/ticket/5175 Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix dsinstance.py:get_domain_level functionMartin Babinsky2015-10-201-2/+2
| | | | | | | This patch cleans up an unused parameter and fixes the return value when 'ipaDomainLevel' is found: instead of a dict we should return an integer. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Rename option --dirsrv-config-mods to --dirsrv-config-fileMartin Basti2015-10-193-6/+6
| | | | | | | | | | | Option is renamed to be consistent with other options. Affected tickets: https://fedorahosted.org/freeipa/ticket/4949 https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add option to specify LDIF file that contains DS configuration changesMartin Basti2015-10-154-14/+58
| | | | | | | | | | | | | This allows to user modify configuration changes of the directory server instance during installation of DS https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add method to read changes from LDIFMartin Basti2015-10-151-0/+40
| | | | | | | | | | | | | | | | modifications_from_ldif will read LDIF file and changes in LDIF will be cached until parse() is called. After calling parse() method changes will be applied into destination LDIF. Only changetype modify is supported, the default operation is add. https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Make offline LDIF modify more robustMartin Basti2015-10-152-101/+109
| | | | | | | | | | | | | | * move code to installutils * add replace_value method * use lists instead of single values for add_value, remove_value methods https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 07:57:08 +0000