summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
* Use https to get security domain from DogtagChristian Heimes2017-03-031-1/+5
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Extract method to map principal to princpal typeFraser Tweedale2017-03-031-15/+14
| | | | | | Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove redundant principal_type argumentFraser Tweedale2017-03-032-9/+12
| | | | | | | | | Minor refactor to remove the redundant 'principal_type' argument from 'caacl_check' and associated functions. Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-03-025-9/+596
| | | | | | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Cleanup certdbChristian Heimes2017-03-021-62/+55
| | | | | | | | | * use with statement to open/close files * prefer fchmod/fchown when a file descriptor is available * set permission before data is written to file Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server install: do not attempt to issue PKINIT cert in CA-lessJan Cholasta2017-03-023-23/+46
| | | | | | | | | | | | Require the user to provide the PKINIT cert with --pkinit-cert-file or disable PKINIT with --no-pkinit in CA-less ipa-server-install, ipa-replica-prepare and ipa-replica-install. Do not attempt to issue the PKINIT cert in CA-less ipa-server-upgrade. https://pagure.io/freeipa/issue/5678 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix CA-less upgradeStanislav Laznicka2017-03-011-1/+1
| | | | | | | | | | In CA-less mode there's no /etc/pki/pki-tomcat/password.conf so it does not make sense to try to create a password file for an NSS database from it (the NSS database does not exist either). https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Merge AD trust configurator into replica installerMartin Babinsky2017-03-011-1/+11
| | | | | | | | | | | | | | | `ipa-replica-install` is now able to configure Samba and winbind services in order to manage Active Directory trusts. `--add-agents` option is exposed in replica installer, while `--add-sids` now defaults to `False` since adding a first AD trust controller to an existing sizeable deployment can result in stuck installation as sidgen tasks can take a long time to complete. That's why adding SIDs should be a conscious decision in this case. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Merge AD trust configurator into server installerMartin Babinsky2017-03-011-9/+18
| | | | | | | | | | | | | | | | | | ipa-server-install is now able to configure Samba and winbind services and manage trusts to Active Directory right off the bat with following alterations from standalone installer: * sidgen task is always triggered since there are only a few entries to tag in the beginning * the `--add-agents` option is hardcoded to False, as there are no potential agents to resolve and addd when setting up the first master in topology https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* expose AD trust related knobs in composite installersMartin Babinsky2017-03-011-1/+15
| | | | | Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add AD trust installer interface for composite installerMartin Babinsky2017-03-011-0/+50
| | | | | | | | | | This interface is to be used to provide AD trust-related options in server and replica installer. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* check for installed dependencies when *not* in standalone modeMartin Babinsky2017-03-011-1/+1
| | | | | | | | | | | | The condition that controls when to check for samba dependencies was misformulated. The check should be run when the installer is *not* run as standalone. In standalone mode the check is already made in different place so the original code triggered it twice. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* print the installation info only in standalone modeMartin Babinsky2017-03-011-2/+2
| | | | | | | | | | There is no point in emitting this message during server/replica install. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* adtrust.py: Use logging to emit error messagesMartin Babinsky2017-03-011-10/+10
| | | | | | | | | | Plain print messages are a) not logged into files and b) get lost in the output from composite installer. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor the code searching and presenting missing trust agentsMartin Babinsky2017-03-011-90/+106
| | | | | | | | | | Use newly implemented APIs for searching and presenting potential trust agents. https://fedorahosted.org/freeipa/ticket/6639 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* only check for netbios name when LDAP backend is connectedMartin Babinsky2017-03-011-10/+19
| | | | | | | | | | This is to prevent errors due to non-existent LDAP connection such as when installing first IPA master. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor the code checking for missing SIDsMartin Babinsky2017-03-011-43/+64
| | | | | | | | | | Decompose the individual sub-tasks into separate functions. Also perform the lookup only when LDAP is connected. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix replica with --setup-ca issuesStanislav Laznicka2017-03-011-3/+3
| | | | | | | | nolog argument of ipautil.run requires tuple, not a string. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dogtag: remove redundant property definitionFraser Tweedale2017-03-011-20/+0
| | | | | | | | | | | The dogtag `ra' backend defines a `ca_host' property, which is also defined (identically) by the `RestClient' class, which recently became a superclass of `ra'. Remove the redundant property definition. Part of: https://pagure.io/freeipa/issue/3473 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Finish port to PyCA cryptographyChristian Heimes2017-03-012-34/+59
| | | | | | | | | | * add missing default_backend * unpad encrypted data * use cryptography's hashes and HMAC construct * remove hard dependency on python-nss from setup.py Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Migrate OTP import script to python-cryptographyNathaniel McCallum2017-03-011-62/+42
| | | | | | https://fedorahosted.org/freeipa/ticket/5192 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Define template version in certmap.confFlorence Blanc-Renaud2017-03-011-1/+4
| | | | | | | | | | | | | | | | | | | | A previous commit (ffb9a09a0d63f7edae2b647b5c1d503d1d4d7a6e) removed the definition of VERSION 2 in certmap.conf.template. ipa-server-upgrade tool compares the template version with the version in certmap.conf. As VERSION is not defined in either file, it concludes that version = 0 for both and does not make a backup of certmap.conf even though it prints that it will. The fix re-defines VERSION in the template and adapts the code because the template has changed (it is using $ISSUER_DN instead of CN=Certificate Authority,$SUBJECT_BASE). The fix also logs an error when a template file is not versioned. https://fedorahosted.org/freeipa/ticket/6354 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-0118-411/+315
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added a PEMFileHandler for Custodia storeStanislav Laznicka2017-03-011-0/+61
| | | | | | | | | This is a preparation step to be able to handle sending RA agent certificate over Custodia during domain level 1 replica installation. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Refactor certmonger for OpenSSL certificatesStanislav Laznicka2017-03-015-22/+14
| | | | | | | | | | Currently, it was only possible to request an NSS certificate via certmonger. Merged start_tracking methods and refactored them to allow for OpenSSL certificates tracking. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove pkcs12 handling functions from CertDBStanislav Laznicka2017-03-013-25/+24
| | | | | | | | | | These functions don't require anything from the CertDB instance, move them out so no needless instantiation of CertDB is performed in order to use them. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from DogtagStanislav Laznicka2017-03-014-49/+32
| | | | | | | | | | | | | Replaced NSSConnection with Python's httplib.HTTPSConnection. This class is OpenSSL-based. A client certificate with a private key is required to authenticate against the certificate server. We facilitate the RA_AGENT_PEM which already exists. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move publishing of CA cert to cainstance creation on masterStanislav Laznicka2017-03-012-6/+9
| | | | | | | | | IPAHTTPSConnection which is set up first time in certificate profiles migration to LDAP requires CA cert to be stored in a file. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Don't run kra.configure_instance if not necessaryStanislav Laznicka2017-03-012-41/+39
| | | | | | | | | | | | | | | | | | If kra should not be set up, don't run the code as it would only prolong the installations. Previously, krainstance configuration would be performed just to export the client certificate and private key to authenticate to certificate server. This is now performed somewhere else therefore there's no need to run KRAInstance.configure_instance. The kra.install() method still performs actions on replicas and we're keeping it in server installer to conform to the installers design. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move RA agent certificate file export to a different locationStanislav Laznicka2017-03-016-16/+14
| | | | | | | | | | | | HTTPS connection to certificate server requires client authentication so we need a file with client certificate and private key prior to its first occurence which happens during migration of certificate profiles to LDAP. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ca: correctly authorise ca-del, ca-enable and ca-disableFraser Tweedale2017-02-281-2/+14
| | | | | | | | | | | | | | | | | | | | CAs consist of a FreeIPA and a corresponding Dogtag object. When executing ca-del, ca-enable and ca-disable, changes are made to the Dogtag object. In the case of ca-del, the corresponding FreeIPA object is deleted after the Dogtag CA is deleted. These operations were not correctly authorised; the FreeIPA permissions are not checked before the Dogtag operations are executed. This allows any user to delete, enable or disable a lightweight CA (except the main IPA CA, for which there are additional check to prevent deletion or disablement). Add the proper authorisation checks to the ca-del, ca-enable and ca-disable commands. https://pagure.io/freeipa/issue/6713 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* added ssl verification using IPA trust anchorThorsten Scherf2017-02-271-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6686 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Remove md5_fingerprints from IPAStanislav Laznicka2017-02-234-18/+0
| | | | | | | | | | MD5 is a grandpa and FIPS does not like it at all. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove DM password files after successfull pkispawn runStanislav Laznicka2017-02-234-13/+52
| | | | | | | https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove ra_db argument from CAInstance initStanislav Laznicka2017-02-233-28/+14
| | | | | | | | | | | | The ra_db argument to CAInstance init is a constant so it can be removed. This constant corresponds to the default CertDB directory and since CertDB now passes passwords to its inner NSSDatabase instance we do need to care about having our own run_certutil() method. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix ipa-server-upgradeStanislav Laznicka2017-02-231-1/+2
| | | | | | | | | Running ipa-server-upgrade would fail to stop ipa_memcached if it's already uninstalled. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use newer Certificate.serial_number in krainstance.pyStanislav Laznicka2017-02-231-1/+1
| | | | Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* use the methods of the parent class to retrieve CIFS kerberos keysMartin Babinsky2017-02-221-19/+11
| | | | | | | | | | | | adtrustinstance will now use parent's methods to retrieve keys for CIFS principal. Since the keys are appended to the host keytab (/etc/krb5.keytab) we need to make sure that only the stale CIFS keys are purged from the file and that we do not re-set its ownership. https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* httpinstance: re-use parent's methods to retrieve anonymous keytabMartin Babinsky2017-02-221-1/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make request_service_keytab into a public methodMartin Babinsky2017-02-223-5/+5
| | | | | | | | | | a cosmetic change: we had private method comprising of calls to public ones, which did not make much sense in our case https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* allow for more flexibility when requesting service keytabMartin Babinsky2017-02-221-15/+26
| | | | | | | | | | | | | The service installers can now override the methods for cleaning up stale keytabs and changing file ownership of the newly acquired keytabs. The default actions should be usable by most installers without specific overriding. https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix session logoutSimo Sorce2017-02-222-5/+5
| | | | | | | | | | | There were 2 issues with session logouts, one is that the logout_cookie was checked and acted on in the wrong place, the other is that the wrong value was set in the IPASESSION header. Fixes https://fedorahosted.org/freeipa/ticket/6685 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* scripts, tests: explicitly set confdir in the rest of server codeJan Cholasta2017-02-227-8/+16
| | | | | | | | | | | Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir setting to api.bootstrap() calls of a randomly selected portion of server-side scripts and tests. This commit adds it to the rest of server-side code for consistency. https://fedorahosted.org/freeipa/ticket/6389 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* FIPS: perform replica installation checkTomas Krizek2017-02-211-0/+22
| | | | | | | | | | | Check status of remote server's FIPS mode and proceed with installation only if it matches the current replica's FIPS mode. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replicainstall: add context manager for rpc clientTomas Krizek2017-02-211-11/+22
| | | | | | | | Abstract creating rpc client into a context manager to allow re-use. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* check_remote_version: update exception and docstringTomas Krizek2017-02-211-1/+8
| | | | | | | | Refactor function to use ScriptError exception and provide docstring. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Minor typo fix in DNS install pluginAbhijeet Kasurde2017-02-211-2/+2
| | | | | Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server upgrade: uninstall ipa_memcached properlyJan Cholasta2017-02-201-4/+2
| | | | | | | | | Make sure ipa_memcached is not running and no stale state is left in the sysupgrade state file on server upgrade. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server upgrade: always upgrade KRA agent PEM fileJan Cholasta2017-02-201-3/+4
| | | | | | | | | | | | | | Before the KRA agent PEM file is exported in server upgrade, the sysupgrade state file is consulted. This causes the KRA agent PEM file not to be exported to the new location if the upgrade was executed in the past. Do not consult the sysupgrade state file to decide whether to upgrade the KRA agent PEM file or not, the existence of the file is enough to make this decision. https://fedorahosted.org/freeipa/ticket/6675 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server upgrade: fix upgrade from pre-4.0Jan Cholasta2017-02-201-1/+1
| | | | | | | | | | | | | | update_ca_renewal_master uses ipaCert certmonger tracking information to decide whether the local server is the CA renewal master or not. The information is lost when migrating from /etc/httpd/alias to /var/lib/ipa/radb in update_ra_cert_store. Make sure update_ra_cert_store is executed after update_ca_renewal_master so that correct information is used. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 14:38:14 +0000