summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
* Add container environment check to replicainstallTibor Dudlák2019-09-161-1/+5
| | | | | | | | Inside the container environment master's IP address does not resolve to its name. Resolves: https://pagure.io/freeipa/issue/6210 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* adtrust: add default read_keys permission for TDO objectsAlexander Bokovoy2019-09-121-0/+56
| | | | | | | | | | | | | | | | | If trusted domain object (TDO) is lacking ipaAllowedToPerform;read_keys attribute values, it cannot be used by SSSD to retrieve TDO keys and the whole communication with Active Directory domain controllers will not be possible. This seems to affect trusts which were created before ipaAllowedToPerform;read_keys permission granting was introduced (FreeIPA 4.2). Add back the default setting for the permissions which grants access to trust agents and trust admins. Resolves: https://pagure.io/freeipa/issue/8067 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* add default access control when migrating trust objectsAlexander Bokovoy2019-09-121-2/+12
| | | | | | | | | | | | It looks like for some cases we do not have proper set up keytab retrieval configuration in the old trusted domain object. This mostly affects two-way trust cases. In such cases, create default configuration as ipasam would have created when trust was established. Resolves: https://pagure.io/freeipa/issue/8067 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Modify webUI to adhere to new IPA server APIChangmin Teng2019-09-101-0/+2
| | | | | | | | | | | | Given the changes in IPA server API changes, whebUI is modified to utilize new authentication indicators, and disabled custom indicators for services' white list. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Move certauth configuration into a server krb5.conf templateRobbie Harwood2019-09-102-30/+12
| | | | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Extend the list of supported pre-auth mechanisms in IPA server APIChangmin Teng2019-09-104-9/+24
| | | | | | | | | | | | | As new authentication indicators implemented, we also modified server API to support those new values. Also, "krbprincipalauthind" attribute is modified to use a pre-defined set of values instead of arbitrary strings. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* adtrust: avoid using timestamp in klist outputAlexander Bokovoy2019-09-101-4/+4
| | | | | | | | | | | When parsing a keytab to copy keys to a different keytab, we don't need the timestamp, so don't ask klist to output it. In some locales (en_IN, for example), the timestamp is output in a single field without a space between date and time. In other locales it can be represented with date and time separated by a space. Fixes: https://pagure.io/freeipa/issue/8066 Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Add missing timeout option to logging statementRob Crittenden2019-09-051-1/+1
| | | | Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Log dogtag auth timeout in install, provide hint to increase itRob Crittenden2019-09-041-1/+5
| | | | | | | | | | | | There is a loop which keeps trying to bind as the admin user which will fail until it is replicated. In the case where there is a lot to replicate the default 5 minute timeout may be insufficient. Provide a hint for tuning. Fixes: https://pagure.io/freeipa/issue/7971 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Log the replication wait timeout for debugging purposesRob Crittenden2019-09-041-1/+2
| | | | | Related: https://pagure.io/freeipa/issue/7971 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Replace replication_wait_timeout with certmonger_wait_timeoutRob Crittenden2019-09-045-5/+5
| | | | | | | | | | | | The variable is intended to control the timeout for replication events. If someone had significantly reduced it via configuration then it could have caused certmogner requests to fail due to timeouts. Add replication_wait_timeout, certmonger_wait_timeout and http_timeout to the default.conf man page. Related: https://pagure.io/freeipa/issue/7971 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* config plugin: replace 'is 0' with '== 0'Florence Blanc-Renaud2019-09-041-2/+2
| | | | | | | | | Since python3.8, identity checks with literal produce syntax warnings. Replace the check 'if .. is 0' with 'if .. == 0' Related: https://pagure.io/freeipa/issue/8057 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Move ipachangeconf from ipaclient.install to ipapythonRob Critenden2019-08-283-4/+4
| | | | | | | | | This will let us call it from ipaplatform. Mark the original location as deprecated. Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix ca_initialize_hsm_stateChristian Heimes2019-08-211-1/+1
| | | | | | | | | | | Fixup for commit eb2313920e20bb4a74fc0abc52c496ccf2822dab. configparser's set() method does not convert boolean to string automatically. Use string '"False"', which is then interpreted as boolean 'False' by getboolean(). Related: https://pagure.io/freeipa/issue/5608 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Store HSM token and stateChristian Heimes2019-08-193-10/+54
| | | | | | | | | | | The HSM state is stored in fstore, so that CA and KRA installer use the correct token names for internal certificates. The default token is "internal", meaning the keys are stored in a NSSDB as usual. Related: https://pagure.io/freeipa/issue/5608 Co-authored-by: Magnus K Karlsson <magnus-ka.karlsson@polisen.se> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Allow insecure binds for migrationChristian Heimes2019-08-131-5/+4
| | | | | | | | | | | | | | Commit 5be9341fbabaf7bcb396a2ce40f17e1ccfa54b77 disallowed simple bind over an insecure connection. Password logins were only allowed over LDAPS or LDAP+STARTTLS. The restriction broke 'ipa migrate-ds' in some cases. This commit lifts the restriction and permits insecure binds over plain LDAP. It also makes the migrate-ds plugin use STARTTLS when a CA certificate is configured with a plain LDAP connection. Fixes: https://pagure.io/freeipa/issue/8040 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Don't move keys when key backup is disabledChristian Heimes2019-08-132-4/+7
| | | | | | | | | The CA_BACKUP_KEYS_P12 file is not enabled when pki_backup_keys is set to False. It's the case when FreeIPA is configured with HSM support. Related: https://pagure.io/freeipa/issue/7677 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Update comments to explain caSubsystemCert switchChristian Heimes2019-08-081-1/+1
| | | | | | | Related: https://bugzilla.redhat.com/1670239 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Don't return SSH keys with ipa host-find --pkey-onlyRob Crittenden2019-08-071-1/+2
| | | | | | | | This was introduced in 14ee02dcbd6cbb6c221ac7526e471a9fc58fcc82 https://pagure.io/freeipa/issue/8029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* user-stage: transfer all attributes from preserved to stage userFlorence Blanc-Renaud2019-07-311-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The user-stage command is internally implemented as: - user_show(all=True) in order to read the user attributes - loop on the attributes defined as possible to add using stageuser-add and transform them into new options for stageuser_add (for instance stageuser-add provides the option --shell for the attribute loginshell, but there is no option for the attribute businesscategory). - call stageuser_add in order to create a new entry in the active users subtree - user-del to remove the previous entry in the staged users subtree The issue is in the 2nd step. Only the attributes with a stageuser-add option are processed. The logic of the code should be slightly modified, so that all the attributes read in the first step are processed: - if they correspond to an option of stageuser-add, process them like it's currently done. For instance if the entry contains displayname, then it should be processed as --displayName=value in the stageuser-add cmd - if they do not correspond to an option of stageuser-add, add them with --setattr=<attrname>=<attrvalue> Note that some attributes may need to be filtered, for instance user-show returns has_password or has_keytab, which do not correspond to attributes in the LDAP entry. Fixes: https://pagure.io/freeipa/issue/7597 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* WebUI: Add PKINIT status field to 'Configuration' pageSerhii Tsymbaliuk2019-07-261-0/+1
| | | | | | | | | | - Add 'Server Options' section to the page - Add 'IPA master capable of PKINIT' field to the 'Server Options' Ticket: https://pagure.io/freeipa/issue/7305 Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Add PKCS#11 module name to p11helper errorsChristian Heimes2019-07-251-3/+5
| | | | | | | | | | The p11helper module now includes the name of the PKCS#11 shared library in error messages. Fixes: https://pagure.io/freeipa/issue/8015 Co-Authored-By: Mikhail Novosyolov <m.novosyolov@rosalinux.ru> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* dsinstance: add proflie when tracking certificateFraser Tweedale2019-07-222-5/+10
| | | | | | | | | | | | When the DS certificate gets untracked then tracked again (via dsinstance.start_tracking_certificate()), it loses its profile configuration. Although it is the default profile, we want to retain the explicit reference. Ensure we add the profile when re-tracking the DS certificate. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* httpinstance: add pinfile when tracking certificateRob Crittenden2019-07-221-1/+4
| | | | | | | | | | When the HTTP certificate gets untracked then tracked again, it loses its pin file. Ensure we add the pin file when (re-)tracking the HTTP certificate. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use RENEWAL_CA_NAME and RA_AGENT_PROFILE constantsFraser Tweedale2019-07-223-10/+10
| | | | | | | | | Replace renewal CA and profile name literals with corresponding symbols from ipalib.constants. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* cainstance: add profile to IPA RA tracking requestFraser Tweedale2019-07-222-0/+3
| | | | | | | | | | | | | Profile-based renewal means we should always explicitly specify the profile in tracking requests that use the dogtag-ipa-ca-renew-agent renewal helper. This includes the IPA RA agent certificate. Update CAInstance.configure_agent_renewal() to add the profile to the tracking request. This also covers the upgrade scenario (because the same method gets invoked). Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* upgrade: fix spurious certmonger re-trackingFraser Tweedale2019-07-221-1/+1
| | | | | | | | | | | The search for the HTTP Certmonger tracking request uses an incorrect parameter ('key-storage'), triggering removal and recreation of tracking requests on every upgrade. Replace 'key-storage' with the correct parameter, 'key-file'. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* upgrade: log missing/misconfigured tracking requestsFraser Tweedale2019-07-221-2/+15
| | | | | | | | | | For better diagnostics during upgrade, log the Certmonger tracking requests that were not found (either because they do not exist, or do not have the expected configuration). Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* upgrade: update KRA tracking requestsFraser Tweedale2019-07-221-3/+12
| | | | | | | | | | | | | | | The upgrade routine checks tracking requests for CA system certificates, IPA RA and HTTP/LDAP/KDC service certificates. If a tracking request matching our expectations is not found, we stop tracking all certificates, then create new tracking requests with the correct configuration. But the KRA was left out. Add checks for KRA certificates, and remove/recreate KRA tracking requests when appropriate. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* upgrade: always add profile to tracking requestsFraser Tweedale2019-07-222-5/+3
| | | | | | | | | | The profile for every Dogtag system cert tracking request is now explicitly specified. So remove the code that handled unspecified profiles. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* dogtaginstance: avoid special cases for Server-CertFraser Tweedale2019-07-223-44/+22
| | | | | | | | | | | | | The Dogtag "Server-Cert cert-pki-ca" certificate is treated specially, with its own track_servercert() method and other special casing. But there is no real need for this - the only (potential) difference is the token name. Account for the token name difference with a lookup method and treat all Dogtag system certs equally w.r.t. tracking request creation and removal. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* upgrade: add profile to Dogtag tracking requestsFraser Tweedale2019-07-223-39/+24
| | | | | | | | | | | | | | | | To use profile-based renewal (rather than "renewal existing cert" renewal which is brittle against database corruption or deleted certificate / request objects), Certmonger tracking requests for Dogtag system certs must record the profile to be used. Update the upgrade method that checks tracking requests to look for the profile. Tracking requests will be recreated if the expected data are not found. The code that actually adds the tracking requests was updated in a previous commit. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* dogtaginstance: add profile to tracking requestsFraser Tweedale2019-07-223-8/+18
| | | | | | | | | | | | | | | | | | | | | | Enabling "fresh" renewals (c.f. "renewal"-based renewals that reference the expired certificate and its associated request object) will improve renewal robustness. To use fresh renewals the tracking request must record the profile to be used. Make dogtaginstance record the profile when creating tracking requests for both CA and KRA. Note that 'Server-Cert cert-pki-ca' and the 'IPA RA' both use profile 'caServerCert', which is the default (according to dogtag-ipa-renew-agent which is part of Certmonger). So we do not need any special handling for those certificates. This commit does not handle upgrade. It will be handled in a subsequent commit. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Remove posixAccount from service_find search filterRob Crittenden2019-07-191-1/+0
| | | | | | | | | | | | | | This will allow cifs principals to be found. They were suppressed because they include objectclass=posixAccount. This is a bit of a historical anomaly. This was included in the filter from the initial commit (though it was person, not posixAccount). I believe it was a mistake from the beginning but it wasn't noticed because it didn't cause any obvious issues. https://pagure.io/freeipa/issue/8013 Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
* Fix use of incorrect variableFraser Tweedale2019-07-171-1/+1
| | | | | | Part of: https://pagure.io/freeipa/issue/7548 Related: https://pagure.io/freeipa/issue/5608 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* move MSCSTemplate classes to ipalibFraser Tweedale2019-07-173-191/+14
| | | | | | | | | | | | | As we expand the integration tests for external CA functionality, it is helpful (and avoids duplication) to use the MSCSTemplate* classes. These currently live in ipaserver.install.cainstance, but ipatests is no longer permitted to import from ipaserver (see commit 81714976e5e13131654c78eb734746a20237c933). So move these classes to ipalib. Part of: https://pagure.io/freeipa/issue/7548 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* certmap rules: altSecurityIdentities should only be used for trusted domainsAlexander Bokovoy2019-07-171-0/+73
| | | | | | | | | | | IPA LDAP has no altSecurityIdentities in use, it only should apply to identities in trusted Active Directory domains. Add checks to enforce proper certmap rule attribution for specific Active Directory domains. Related: https://pagure.io/freeipa/issue/7932 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* upgrade: remove ipaCert and key from /etc/httpd/aliasFlorence Blanc-Renaud2019-07-151-1/+1
| | | | | | | | | | | | | With ipa 4.5+, the RA cert is stored in files in /var/lib/ipa/ra-agent.{key|pem}. The upgrade code handles the move from /etc/httpd/alias to the files but does not remove the private key from /etc/httpd/alias. The fix calls certutil -F -n ipaCert to remove cert and key, instead of -D -n ipaCert which removes only the cert. Fixes: https://pagure.io/freeipa/issue/7329 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Fix `test_webui.test_selinuxusermap`Stanislav Levin2019-07-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | A previous refactoring of SELinux tests has have a wrong assumption about the user field separator within ipaSELinuxUserMapOrder. That was '$$', but should be just '$'. Actually, '.ldif' and '.update' files are passed through Python template string substitution: > $$ is an escape; it is replaced with a single $. > $identifier names a substitution placeholder matching > a mapping key of "identifier" This means that the text to be substituted on should not be escaped. The wrong ipaSELinuxUserMapOrder previously set will be replaced on upgrade. Fixes: https://pagure.io/freeipa/issue/7996 Fixes: https://pagure.io/freeipa/issue/8005 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Don't configure disabled krb5 enctypes in FIPS modeRob Crittenden2019-07-021-1/+2
| | | | | | | | | | | | | | | | | The only permitted ciphers are the AES family (called aes, which is the combination of: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128). DES, RC4, and Camellia are not permitted in FIPS mode. While 3DES is permitted, the KDF used for it in krb5 is not, and Microsoft doesn't implement 3DES anyway. This is only applied on new installations because we don't allow converting a non-FIPS install into a FIPS one. Reviewed-By: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* For Fedora and RHEL use system-wide crypto policy for mod_sslRob Crittenden2019-07-011-4/+2
| | | | | | | | | | | | | | Drop the SSLProtocol directive for Fedora and RHEL systems. mod_ssl will use crypto policies for the set of protocols. For Debian systems configure a similar set of protocols for what was previously configured, but do it in a different way. Rather than iterating the allowed protocols just include the ones not allowed. Fixes: https://pagure.io/freeipa/issue/7667 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Make use of single configuration point for SELinuxStanislav Levin2019-07-013-17/+49
| | | | | | | | | | | | | | | | | | | | | For now, FreeIPA supports SELinux things as they are in RedHat/Fedora. But different distributions may have their own SELinux customizations. This moves SELinux configuration out to platform constants: - SELINUX_MCS_MAX - SELINUX_MCS_REGEX - SELINUX_MLS_MAX - SELINUX_MLS_REGEX - SELINUX_USER_REGEX - SELINUX_USERMAP_DEFAULT - SELINUX_USERMAP_ORDER and applies corresponding changes to the test code. Fixes: https://pagure.io/freeipa/issue/7996 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add SMB attributes for usersTibor Dudlák2019-07-012-2/+71
| | | | | | | | | | | | | | | SMB attributes are used by Samba domain controller when reporting details about IPA users via LSA DCE RPC calls. Based on the initial work from the external plugin: https://github.com/abbra/freeipa-user-trust-attributes Related: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Signed-off-by: Tibor Dudlák <tdudlak@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Remove unreachable codeTibor Dudlák2019-07-011-9/+0
| | | | | | | Removing same elsif from install_check method. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* ipa-client-samba: a tool to configure Samba domain member on IPA clientAlexander Bokovoy2019-06-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduces new utility to configure Samba on an IPA domain member. The tool sets up Samba configuration and internal databases, creates cifs/... Kerberos service and makes sure that a keytab for this service contains the key with the same randomly generated password that is set in the internal Samba databases. Samba configuration is created by querying an IPA master about details of trust to Active Directory configuration. All known identity ranges added to the configuration to allow Samba to properly handle them (read-only) via idmap_sss. Resulting configuration allows connection with both NTLMSSP and Kerberos authentication for IPA users. Access controls for the shared content should be set by utilizing POSIX ACLs on the file system under a specific share. The utility is packaged as freeipa-client-samba package to allow pulling in all required dependencies for Samba and cifs.ko (smb3.ko) kernel module. This allows an IPA client to become both an SMB server and an SMB client. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaserver.plugins.service: add service-add-smb to set up an SMB serviceAlexander Bokovoy2019-06-291-2/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | SMB service has a number of predefined properties that must be set at a creation time. Thus, we provide a special command that handles all the needed changes. In addition, since SMB principal name is predefined, it is generated automatically based on the machine hostname. Since we generate the service's object primary key, its argument/option should be removed from the list of the command's arguments and options. We also remove those options that make no sense in the context of SMB service. Most controversial would probably be a lack of the authentication indicator that could be associated with the service. However, this is intended: SMB service on the domain member is used by both humans and other SMB services in the domain. Thus, it is not possible to require a specific authentication indicator to be present: automated acquisition of the credentials by a domain controller or other domain member machine accounts is based on a single factor creds and cannot be changed. Access to SMB service should be regulated on the SMB protocol level, with access controls in share ACLs. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* adtrust: update Samba domain controller keytab with host keysAlexander Bokovoy2019-06-292-0/+107
| | | | | | | | | | | | | | | | | | | | | | | When DCERPC clients use Kerberos authentication, they use a service ticket to host/domain.controller because in Active Directory any service on the host is an alias to the machine account object. In FreeIPA each Kerberos service has own keys so host/.. and cifs/.. do not share the same keys. It means Samba suite needs to have access to host/.. keytab entries to validate incoming DCERPC requests. Unfortunately, MIT Kerberos has no means to operate on multiple keytabs at the same time and Samba doesn't implement this either. We cannot use GSS-Proxy as well because Samba daemons are running under root. As a workaround, copy missing aes256 and aes128 keys from the host keytab. SMB protocol doesn't use other encryption types and we don't have rc4-hmac for the host either. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaserver.install.installutils: move commonly used utils to ipapython.ipautilAlexander Bokovoy2019-06-2913-65/+56
| | | | | | | | | | | | When creating ipa-client-samba tool, few common routines from the server installer code became useful for the client code as well. Move them to ipapython.ipautil and update references as well. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* trust-fetch-domains: make sure we use right KDC when --server is specifiedAlexander Bokovoy2019-06-281-9/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | Since we are authenticating against AD DC before talking to it (by using trusted domain object's credentials), we need to override krb5.conf configuration in case --server option is specified. The context is a helper which is launched out of process with the help of oddjobd. The helper takes existing trusted domain object, uses its credentials to authenticate and then runs LSA RPC calls against that trusted domain's domain controller. Previous code directed Samba bindings to use the correct domain controller. However, if a DC visible to MIT Kerberos is not reachable, we would not be able to obtain TGT and the whole process will fail. trust_add.execute() was calling out to the D-Bus helper without passing the options (e.g. --server) so there was no chance to get that option visible by the oddjob helper. Also we need to make errors in the oddjob helper more visible to error_log. Thus, move error reporting for a normal communication up from the exception catching. Resolves: https://pagure.io/freeipa/issue/7895 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
* ipa_client_automount.py and ipactl.py: fix codestyleFrançois Cami2019-06-281-90/+192
| | | | | | | | | | Updating ipa_client_automount.py and ipactl.py's codestyle is mandatory to make pylint pass as these are considered new files. Fixes: https://pagure.io/freeipa/issue/7984 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 08:38:12 +0000