summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
* Make sure remote hosts have our keyscakeysfixSimo Sorce2017-05-032-1/+38
| | | | | | | | | | | | | In complex replication setups a replica may try to obtain CA keys from a host that is not the master we initially create the keys against. In this case race conditions may happen due to replication. So we need to make sure the server we are contacting to get the CA keys has our keys in LDAP. We do this by waiting to positively fetch our encryption public key (the last one we create) from the target host LDAP server. Fixes: https://pagure.io/freeipa/issue/6838 Signed-off-by: Simo Sorce <simo@redhat.com>
* Refresh Dogtag RestClient.ca_host propertyStanislav Laznicka2017-05-022-15/+20
| | | | | | | | | | | | | | | | Refresh the ca_host property of the Dogtag's RestClient class when it's requested as a context manager. This solves the problem which would occur on DL0 when installing CA which needs to perform a set of steps against itself accessing 8443 port. This port should however only be available locally so trying to connect to remote master would fail. We need to make sure the right CA host is accessed. https://pagure.io/freeipa/issue/6878 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* kerberos session: use CA cert with full cert chain for obtaining cookiePetr Vobornik2017-05-021-1/+2
| | | | | | | | | | | | | | | Http request performed in finalize_kerberos_acquisition doesn't use CA certificate/certificate store with full certificate chain of IPA server. So it might happen that in case that IPA is installed with externally signed CA certificate, the call can fail because of certificate validation and e.g. prevent session acquisition. If it will fail for sure is not known - the use case was not discovered, but it is faster and safer to fix preemptively. https://pagure.io/freeipa/issue/6876 Reviewed-By: Martin Basti <mbasti@redhat.com>
* restore: restart/reload gssproxy after restorePetr Vobornik2017-04-281-0/+3
| | | | | | | | | So that gssproxy picks up new configuration and therefore related usages like authentication of CLI against server works https://pagure.io/freeipa/issue/6902 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Do not test anonymous PKINIT after install/upgradeMartin Babinsky2017-04-282-10/+0
| | | | | | | | | | | | | Local FAST armoring will now work regardless of PKINIT status so there is no need to explicitly test for working PKINIT. If there is, there should be a test case for that. https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Upgrade: configure local/full PKINIT depending on the master statusMartin Babinsky2017-04-281-6/+9
| | | | | | | | | | | | | | The upgrader has been modified to configure either local or full PKINIT depending on the CA status. Additionally, the new PKINIT configuration will be written to the master's KDC entry. https://pagure.io/freeipa/issue/6830 http://www.freeipa.org/page/V4/Kerberos_PKINIT Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Use local anchor when armoring password requestsMartin Babinsky2017-04-281-1/+1
| | | | | | | | | https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Stop requesting anonymous keytab and purge all references of itMartin Babinsky2017-04-283-19/+0
| | | | | | | | | | | | anonymous kinit using keytab never worked so we may safely remove all code that requests/uses it. https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* API for retrieval of master's PKINIT status and publishing it in LDAPMartin Babinsky2017-04-281-0/+41
| | | | | | | | | | | | | | | | An API was provided to report whether PKINIT is enabled for clients or not. If yes, the pkinitEnabled value will be added to the ipaConfigString attribute of master's KDC entry. See http://www.freeipa.org/page/V4/Kerberos_PKINIT#Configuration for more details. https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Allow for configuration of all three PKINIT variants when deploying KDCMartin Babinsky2017-04-281-52/+93
| | | | | | | | | | | | | | | The PKINIT setup code now can configure PKINIT using IPA CA signed certificate, 3rd party certificate and local PKINIT with self-signed keypair. The local PKINIT is also selected as a fallback mechanism if the CSR is rejected by CA master or `--no-pkinit` is used. http://www.freeipa.org/page/V4/Kerberos_PKINIT https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* separate function to set ipaConfigString values on service entryMartin Babinsky2017-04-282-84/+94
| | | | | | | | | | | | | | | | | There is some code duplication regarding setting ipaConfigString values when: * LDAP-enabling a service entry * advertising enabled KDCProxy in LDAP We can delegate the common work to a single re-usable function and thus expose it to future use-cases (like PKINIT advertising). https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Vault: Explicitly default to 3DES CBCChristian Heimes2017-04-281-2/+10
| | | | | | | | | | | The server-side plugin for IPA Vault relied on the fact that the default oid for encryption algorithm is 3DES in CBC mode (DES-EDE3-CBC). Dogtag 10.4 has changed the default from 3DES to AES. Pass the correct algorithm OID to KeyClient.archive_encrypted_data(). Closes: https://pagure.io/freeipa/issue/6899 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Correct PyPI package dependenciesChristian Heimes2017-04-261-1/+4
| | | | | | | | | | | | | * Remove unused install requires from ipapython * Add missing requirements to ipaserver * Correct dependencies for yubico otptoken * Add explicit dependency on cffi for csrgen * Python 2 uses python-ldap, Python 3 pyldap https://pagure.io/freeipa/issue/6875 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Update get_attr_filter in LDAPSearch to handle nsaccountlock user searchesGabe2017-04-262-1/+11
| | | | | | | | | | - Update get_attr_filter in LDAPSearch to handle nsaccountlock by setting the default value for nsaccountlock to false as well as update the filter to check for the default value - Remove pytest xfail for test_find_enabled_user https://pagure.io/freeipa/issue/6896 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move the compat plugin setup at the end of installStanislav Laznicka2017-04-241-9/+0
| | | | | | | | | | The compat plugin was causing deadlocks with the topology plugin. Move its setup at the end of the installation and remove the cn=topology,cn=ipa,cn=etc subtree from its scope. https://pagure.io/freeipa/issue/6821 Reviewed-By: Martin Basti <mbasti@redhat.com>
* upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is installedFlorence Blanc-Renaud2017-04-241-0/+5
| | | | | | | | | | | During upgrade, the plugin update_tdo_gidnumber is launched in order to add a gidnumber to the Trusted Domain Object. This plugin should not be run when ad trust is not installed, otherwise an error message is displayed. https://pagure.io/freeipa/issue/6881 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix CAInstance.import_ra_cert for empty passwordsStanislav Laznicka2017-04-201-1/+1
| | | | | | | | OpenSSL can't cope with empty files, add a newline after each password https://pagure.io/freeipa/issue/6878 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix RA cert import during DL0 replicationStanislav Laznicka2017-04-192-25/+35
| | | | | | | | | | Previous versions of FreeIPA add password to the ra.p12 file contained in the password-protected tarball. This was forgotten about in the recent changes and fixed now. https://pagure.io/freeipa/issue/6878 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ext. CA: correctly write the cert chainStanislav Laznicka2017-04-191-2/+3
| | | | | | | | | The cert file would have been rewritten all over again with any of the cert in the CA cert chain without this patch. https://pagure.io/freeipa/issue/6872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* server-install: No double Kerberos installStanislav Laznicka2017-04-191-5/+6
| | | | | | | | | | | When we're installing server with an external CA, the installation would have failed in the second step where it's passed the required CA cert file because it would have tried to perform the Kerberos installation for the second time. https://pagure.io/freeipa/issue/6757 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert: defer cert-find result post-processingJan Cholasta2017-04-192-37/+66
| | | | | | | | | | | | | Rather than post-processing the results of each internal search, post-process the combined result. This avoids expensive per-certificate searches when cert-find is executed with the --all option on certificates which won't even be included in the combined result. https://pagure.io/freeipa/issue/6808 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix CA-less to CA-full upgradeStanislav Laznicka2017-04-123-11/+31
| | | | | | | | | | CertDB would have always created a directory on initialization. This behavior changes here by replacing the truncate argument with create which will only create the database when really required. https://pagure.io/freeipa/issue/6853 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* replicainstall: better client install exception handlingStanislav Laznicka2017-04-121-42/+41
| | | | | | | | | | | | | The exception handling of client install inside replica installation was rather promiscuous, hungrily eating any possible exception thrown at it. Scoped down the try-except block and reduced its promiscuity. This change should improve the future development experience debugging this part of the code. https://pagure.io/freeipa/issue/6183 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add the force-join option to replica installStanislav Laznicka2017-04-122-1/+3
| | | | | | | | | | | | When installing client from inside replica installation on DL1, it's possible that the client installation would fail and recommend using --force-join option which is not available in replica installer. Add the option there. https://pagure.io/freeipa/issue/6183 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* server-install: remove broken no-pkinit checkStanislav Laznicka2017-04-121-5/+0
| | | | | | | | | | | Don't check for no-pkinit option in case pkinit cert file was provided. Setting no-pkinit is prohibited in this case, so without this fix we have an impossible option-check if we want to provide an own pkinit certificate and private key. https://pagure.io/freeipa/issue/6807 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix PKCS11 helperMartin Basti2017-04-124-21/+108
| | | | | | | | | | | | | | | | | | | | | | | Slots in HSM are not assigned statically, we have to chose proper slot from token label. Softhsm i2.2.0 changed this behavior and now slots can change over time (it is allowed by pkcs11 standard). Changelog: * created method get_slot() that returns slot number from used label * replaces usage of slot in __init__ method of P11_Helper with label * slot is dynamically detected from token label before session is opened * pkcs11-util --init-token now uses '--free' instead '--slot' which uses first free slot (we don't care about slot numbers anymore) https://pagure.io/freeipa/issue/6692 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Create system users for FreeIPA services during package installationDavid Kupka2017-04-118-68/+2
| | | | | | | | | | | | | | | | | | | | Previously system users needed by FreeIPA server services was created during ipa-server-install. This led to problem when DBus policy was configured during package installation but the user specified in the policy didn't exist yet (and potentionally similar ones). Now the users will be created in package %pre section so all users freeipa-server package needs exist before any installation or configuration begins. Another possibility would be using systemd-sysusers(8) for this purpose but given that systemd is not available during container build the traditional approach is superior. Also dirsrv and pkiuser users are no longer created by FreeIPA instead it depends on 389ds and dogtag to create those users. https://pagure.io/freeipa/issue/6743 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* trust: always use oddjobd helper for fetching trust informationAlexander Bokovoy2017-04-111-33/+10
| | | | | | | | | | | | | | Since introduction of privilege separation in IPA framework none of the operations that require direct access to the framework's credentials can be done. All authentication has to be performed with GSSAPI. As result, we cannot obtain TGT for HTTP/.. principal with kinit anymore, so it is better to re-route all types of trust to oddjobd helper and get rid of casing out two-way trust. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1438366 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver/dcerpc: unify error processingAlexander Bokovoy2017-04-111-6/+17
| | | | | | | | | | | | | | | | | | | Samba error code reporting changes from version to version but we also did not provide proper input into DCE RPC error processing method we have. Unify error processing and add few more fallback entries. With Samba 4.7 we'll have to change it again because error code processing for Samba Python modules will change with introduction of samba.ntstatus and samba.werror modules. Note that this commit also changes a message returned for error code -1073741772 (NT_STATUS_OBJECT_NOT_FOUND) because it is more general one. Fixes https://pagure.io/freeipa/issue/6859 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove surplus 'the' in output of ipa-adtrust-installMartin Basti2017-04-111-1/+1
| | | | | | | | Fixing the typo https://pagure.io/freeipa/issue/6864 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: request service certs after host keytab is set upJan Cholasta2017-04-073-24/+16
| | | | | | | | | | | | | The certmonger renew agent and restart scripts use host keytab for authentication. When they are executed during a certmonger request before the host keytab is set up, the authentication will fail. Make sure all certmonger requests in the installer are done after the host keytab is set up. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dsinstance, httpinstance: consolidate certificate request codeJan Cholasta2017-04-074-99/+43
| | | | | | | | | | | | A different code path is used for DS and httpd certificate requests in replica promotion. This is rather unnecessary and makes the certificate request code not easy to follow. Consolidate the non-promotion and promotion code paths into one. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* httpinstance: avoid httpd restart during certificate requestJan Cholasta2017-04-071-3/+4
| | | | | | | | | | | | httpd is restarted by certmonger in the restart_httpd script after the httpd certificate is saved if it was previously running. The restart will fail because httpd is not properly configured at this point. Stop httpd at the beginning of httpd install to avoid the restart. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dsinstance: reconnect ldap2 after DS is restarted by certmongerJan Cholasta2017-04-071-0/+4
| | | | | | | | | | | | | | DS is restarted by certmonger in the restart_dirsrv script after the DS certificate is saved. This breaks the ldap2 backend and makes any operation fail with NetworkError until it is reconnected. Reconnect ldap2 after the DS certificate request is finished to fix the issue. Make sure restart_dirsrv waits for the ldapi socket so that the reconnect does not fail. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Upgrade: add gidnumber to trusted domain entryFlorence Blanc-Renaud2017-04-071-0/+56
| | | | | | | | | | | The trusted domain entries created in earlier versions are missing gidnumber. During upgrade, a new plugin will read the gidnumber of the fallback group cn=Default SMB Group and add this value to trusted domain entries which do not have a gidNumber. https://pagure.io/freeipa/issue/6827 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* idrange-add: properly handle empty --dom-name optionFlorence Blanc-Renaud2017-04-051-1/+1
| | | | | | | | | | | | | When idrange-add is called with --dom-name=, the CLI exits with ipa: ERROR: an internal error has occurred This happens because the code checks if the option is provided but does not check if the value is None. We need to handle empty dom-name as if the option was not specified. https://pagure.io/freeipa/issue/6404 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add pki_pin only when neededStanislav Laznicka2017-04-052-6/+14
| | | | | | | | | | If both the pki-tomcat NSS database and its password.conf have been created, don't try to override the password.conf file. https://pagure.io/freeipa/issue/6839 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* httpinstance: make sure NSS database is backed upJan Cholasta2017-04-041-1/+2
| | | | | | | | | | | | | The NSS database at /etc/httpd/alias is not properly initialized and backed up in CA-less replica promotion. This might cause the install to fail after previous install and uninstall. Make sure the NSS database is initialized and backed up even in CA-less replica promotion to fix the issue. https://pagure.io/freeipa/issue/4639 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove publish_ca_cert() method from NSSDatabaseStanislav Laznicka2017-04-031-3/+0
| | | | | | | | NSSDatabase.publish_ca_cert() is not used anymore, remove it. https://pagure.io/freeipa/issue/6806 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Get correct CA cert nickname in CA-lessStanislav Laznicka2017-04-031-1/+6
| | | | | | | | | | | | During CA-less installation, we initialize the HTTPD alias database from a pkcs12 file. This means there's going to be different nicknames to the added certificates. Store the CA certificate nickname in HTTPInstance__setup_ssl() to be able to correctly export it later. https://pagure.io/freeipa/issue/6806 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add an option to build ipaserver wheelsChristian Heimes2017-04-032-10/+1
| | | | | | | | | | | | | | To create a wheel bundle with ipaserver and its dependencies: make wheel_bundle IPA_SERVER_WHEELS=1 To include additional dependencies: make wheel_bundle IPA_EXTRA_WHEELS=ipatests[webui] Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add extra_requires for additional dependenciesChristian Heimes2017-04-031-6/+8
| | | | | | | | ipaserver did not have extra_requires to state additional dependencies. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Conditionally import pyhbacChristian Heimes2017-04-033-90/+105
| | | | | | | | | | | | | | | | | | | | | | | | The pyhbac module is part of SSSD. It's not available as stand-alone PyPI package. It would take a lot of effort to package it because the code is deeply tight into SSSD. Let's follow the example of other SSSD Python packages and make the import of pyhbac conditionally. It's only necessary for caacl and hbactest plugins. I renamed convert_to_ipa_rule() to _convert_to_ipa_rule() because it does not check for presence of pyhbac package itself. The check is performed earlier in execute(). The prefix indicates that it is an internal function and developers have to think twice before using it in another place. This makes it much easier to install ipaserver with instrumented build of Python with a different ABI or in isolated virtual envs to profile and debug the server. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Hide request_type doc string in cert-request helpAbhijeet Kasurde2017-03-311-1/+1
| | | | | | | | | | | | Fix hides description of request_type argument in cert-request command help Fixes https://pagure.io/freeipa/issue/6494 Fixes https://pagure.io/freeipa/issue/5734 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Add --password-expiration to allow admin to force user password expirationGabe2017-03-312-1/+5
| | | | | | | - Allows an admin to easily force a user to expire their password forcing the user to change it immediately or at a specified time in the future Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove redundant option check for cert filesStanislav Laznicka2017-03-301-9/+1
| | | | | | | | | | There was a redundant check for CA-less install certificate files for replicas but the same check is done for all installers before that. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Don't allow setting pkinit-related options on DL0Stanislav Laznicka2017-03-301-0/+21
| | | | | | | | | pkinit is not supported on DL0, remove options that allow to set it from ipa-{server,replica}-install. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix the order of cert-files checkStanislav Laznicka2017-03-301-5/+5
| | | | | | | | | | | | Without this patch, if either of dirsrv_cert_files, http_cert_files or pkinit_cert_files is set along with no-pkinit, the user is first requested to add the remaining options and when they do that, they are told that they are using 'no-pkinit' along with 'pkinit-cert-file'. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove duplicate functionality in upgradeMartin Babinsky2017-03-301-15/+1
| | | | | | | | | | Since krbinstance code can now handle all operations of the `enabled_anonymous_principal` function from upgrade we can remove extraneous function altogether. https://pagure.io/freeipa/issue/6799 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Always check and create anonymous principal during KDC installMartin Babinsky2017-03-301-4/+13
| | | | | | | | | | | The anonymous principal will now be checked for presence and created on both server and replica install. This fixes errors caused during replica installation against older master that do not have anonymous principal present. https://pagure.io/freeipa/issue/6799 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 09:06:38 +0000