summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
* Configure Anonymous PKINIT on server installkdc-pkinitSimo Sorce2016-12-0811-51/+179
| | | | | | | | | | Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com>
* server install: fix external CA installJan Cholasta2016-12-084-63/+51
| | | | | | | | | | | | | Replace the dual definitions of domain_name, dm_password and admin_password knobs in server install with single definitions using the original names without the 'new_' prefix. This fixes the options read from the installer option cache in step 2 of external CA install to use the correct knob names. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Fix permission-find with sizelimit setStanislav Laznicka2016-12-071-0/+7
| | | | | | | | | | | If permission-find is fired with an argument and sizelimit set a message about truncation will be sent along with the result as the search in post_callback() does general search instead of having its filter properly set. https://fedorahosted.org/freeipa/ticket/5640 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Generalize filter generation in LDAPSearchStanislav Laznicka2016-12-071-20/+34
| | | | | | | | | Make it easier to generate search filters properly and in a unified way in any inheriting method https://fedorahosted.org/freeipa/ticket/5640 Reviewed-By: Martin Basti <mbasti@redhat.com>
* bindinstance: use data in named.conf to determine configuration statusMartin Babinsky2016-12-071-0/+7
| | | | | | | | | | Instead of checking sysrestore status which leads to incorrect evaluation of DNS configuration status during 4.2 -> 4.4 upgrade, look into named.conf to see whther it was already modified by IPA installer. https://fedorahosted.org/freeipa/ticket/6503 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert-request: match names against principal aliasesFraser Tweedale2016-12-061-28/+85
| | | | | | | | | | | | | | | Currently we do not check Kerberos principal aliases when validating a CSR. Enhance cert-request to accept the following scenarios: - for hosts and services: CN and SAN dnsNames match a principal alias (realm and service name must be same as nominated principal) - for all principal types: UPN or KRB5PrincipalName othername match any principal alias. Fixes: https://fedorahosted.org/freeipa/ticket/6295 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* fix missing translation stringshanyin2016-12-061-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* replica-conncheck: improve error message during replicainstallTomas Krizek2016-12-061-1/+1
| | | | | | | | | | | Replica conncheck may fail for other reasons then network misconfiguration. For example, an incorrect admin password might be provided. Since conncheck is ran as a separate script in quiet mode, no insightful error message can be displayed. https://fedorahosted.org/freeipa/ticket/6497 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* permission-find: fix a sizelimit off-by-one bugStanislav Laznicka2016-12-061-9/+9
| | | | | | | | | permission-find: sizelimit option set to number of permissions -1 could return all permissions anyway https://fedorahosted.org/freeipa/ticket/5640 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* fix permission_find fail on low search size limitStanislav Laznicka2016-12-061-2/+2
| | | | | | | | | | | permission_find() method would have failed if size_limit in config is too small caused by a search in post_callback. This search should also respect the passed sizelimit or the sizelimit from ipa config if no sizelimit is passed. https://fedorahosted.org/freeipa/ticket/5640 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make `env` and `plugins` commands local againMartin Babinsky2016-12-021-118/+5
| | | | | | | | | | | | | | During thin client refactoring, LocalOrRemote class implementation of `run` method was overriden by default Command implementation during instantiation of client plugins from schema. This caused these commands to always forward this request to IPA master. This patch restores the original behavior: unless `--server` option was specified, the commands will always print out local config. https://fedorahosted.org/freeipa/ticket/6490 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Adjustments for setup requirements v2Pavel Vomacka2016-12-021-3/+0
| | | | | | | | Remove setup requirement on wheel since it triggers download. https://fedorahosted.org/freeipa/ticket/6468 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Set explicit confdir option for global contextsChristian Heimes2016-12-028-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | Some API contexts are used to modify global state (e.g. files in /etc and /var). These contexts do not support confdir overrides. Initialize the API with an explicit confdir argument to paths.ETC_IPA. The special contexts are: * backup * cli_installer * installer * ipctl * renew * restore * server * updates The patch also corrects the context of the ipa-httpd-kdcproxy script to 'server'. https://fedorahosted.org/freeipa/ticket/6389 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Check the result of cert request in replica installerFlorence Blanc-Renaud2016-11-301-7/+5
| | | | | | | | | | | | | | | | | | | | | | When running ipa-replica-install in domain-level 1, the installer requests the LDAP and HTTP certificates using certmonger but does not check the return code. The installer goes on and fails when restarting dirsrv. Fix: when certmonger was not able to request the certificate, raise an exception and exit from the installer: [28/45]: retrieving DS Certificate [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE) Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Certificate issuance failed (CA_UNREACHABLE) ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information https://fedorahosted.org/freeipa/ticket/6514 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* replica install: track the RA agent certificate againJan Cholasta2016-11-301-1/+5
| | | | | | | | | | | | | During the rebase of commit 822e1bc82af3a6c1556546c4fbe96eeafad45762 on top of commit 808b1436b4158cb6f926ac2b5bd0979df6ea7e9f, the call to track the RA agent certificate with certmonger was accidentally removed from ipa-replica-install. Put the call back so that the certificate is tracked after replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Adjustments for setup requirementsChristian Heimes2016-11-301-1/+1
| | | | | | | | | | | | | | * Fix some typos, missing or surplus dependencies. * Remove setup requirement on wheel since it triggers download. ipatests is now installable. Tests need further changes to be runable. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Accept server host names resolvable only using /etc/hostsPetr Spacek2016-11-291-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Apparently "files" implementation of hosts NSS database cannot deal with trailing period in host names. Previously name server.example.com which is was resolvable neither using dns nor myhostname NSS modules were rejected by installer (despite having matching line in /etc/hosts). These names which are resolvable purely using "files" database are now accepted. The problem is that I had to remove trailing period from names passed to getaddrinfo() function. This effectivelly enables search list processing. This means that items from the search list might be silently appended to the query and we might get an IP address for totally different names than we asked for. Unfortunatelly I see no way around this while keeping ability to use names from NSS hosts database. https://fedorahosted.org/freeipa/ticket/6518 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replication: ensure bind DN group check interval is set on replica configMartin Babinsky2016-11-291-0/+6
| | | | | | | | | | This is a safeguard ensuring valid replica configuration against incorrectly upgraded masters lacking 'nsds5replicabinddngroupcheckinterval' attribute on their domain/ca topology config. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* ipaclient: move install modules to the install subpackageJan Cholasta2016-11-293-14/+15
| | | | | | | | | | | | The ipa_certupdate, ipachangeconf, ipadiscovery and ntpconf modules depend on ipaplatform. Move them to ipaclient.install as they are used only from the client installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* constants: remove CACERTJan Cholasta2016-11-298-30/+30
| | | | | | | | | | CACERT depends on ipaplatform. Replace all uses of CACERT with paths.IPA_CA_CRT and remove CACERT. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib: move certstore to the install subpackageJan Cholasta2016-11-296-10/+11
| | | | | | | | | | The certstore module depends on ipaplatform. Move it to ipalib.install, as it is used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move file encryption functions to installutilsJan Cholasta2016-11-293-6/+89
| | | | | | | | | | | The encrypt_file() and decrypt_file() functions depend on ipaplatform. Move them to ipaserver.install.installutils, as they are only used for the server installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-293-10/+13
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move is_fips_enabled() to ipaplatform.tasksJan Cholasta2016-11-292-4/+3
| | | | | | | | The FIPS setting is platform-specific. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove get_domain_name()Jan Cholasta2016-11-293-11/+2
| | | | | | | | | | | get_domain_name() and related code depends on ipaplatform. Replace all uses of get_domain_name() with api.env.domain and remove get_domain_name() and all of the related code. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-2913-29/+50
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: move IPA NSS DB install functions to ipaclient.installJan Cholasta2016-11-291-2/+3
| | | | | | | | | | | The create_ipa_nssdb() and update_ipa_nssdb() depend on ipaplatform. Move them to ipaclient.install.client as they are used only from the client installer and ipa-restore. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-2915-20/+22
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move dnssec, p11helper and secrets to ipaserverJan Cholasta2016-11-2920-5/+4047
| | | | | | | | | | | The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* custodiainstance: automatic restart on config file updateJan Cholasta2016-11-291-0/+8
| | | | | | | | | | | Automatically restart Custodia during IPA server upgrade if custodia.conf was updated. Use the new store class name in custodia.conf.template. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* wrap long lineChristian Heimes2016-11-251-1/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Silence import warnings for Samba bindingsChristian Heimes2016-11-251-1/+6
| | | | | | | | | | Python 3 Samba bindings are not available yet. Let's silence the warnings to make pylint pass under Python 3. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix Python 3 bugs discovered by pylintChristian Heimes2016-11-253-4/+4
| | | | | | | | | | | | In Python 3 exception instances no longer have a message attribute. For most exceptions, str(e) or string formatting give the same result. Fix some renamed modules, module members and functions. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-254-3/+9
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix ipa-replica-install when upgrade from ca-less to ca-fullFlorence Blanc-Renaud2016-11-252-5/+12
| | | | | | | | | | | | | | | | | When ipa-replica-prepare is run on a master upgraded from CA-less to CA-full, it creates the replica file with a copy of the local /etc/ipa/ca.crt. This causes issues if this file hasn't been updated with ipa-certupdate, as it contains the external CA that signed http/ldap certs, but not the newly installed IPA CA. As a consequence, ipa-replica-install fails with "Could not find a CA cert". The fix consists in retrieving the CA certificates from LDAP instead of the local /etc/ipa/ca.crt. https://fedorahosted.org/freeipa/ticket/6375 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Do not log DM password in ca/kra installation logsStanislav Laznicka2016-11-253-11/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Break ipaplatform / ipalib import cycle of hellChristian Heimes2016-11-2413-20/+21
| | | | | | | | | | | Here is an attempt to break the import cycle of hell between ipaplatform and ipalib. All services now pass an ipalib.api object to services.service(). RedHatServices.__init__() still needs to do a local import because it initializes its wellknown service dict with service instances. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Replace LooseVersionChristian Heimes2016-11-242-8/+8
| | | | | | | | | | | | | | | | | | | | pylint is having a hard time with distutils.version in tox's virtual envs. virtualenv uses some tricks to provide a virtual distutils package, pylint can't cope with. https://github.com/PyCQA/pylint/issues/73 suggests to use pkg_resources instead. pkg_resources' version parser has some more benefits, e.g. PEP 440 conformity. But pkg_resources.parse_version() is a heavy weight solution with reduced functionality, e.g. no access to major version. For API_VERSION and plugin version we can use a much simpler and faster approach. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* upgrade: ldap conn managementTomas Krizek2016-11-223-22/+3
| | | | | | | | | | Clean up unnecessary starts/stops of DS and unnescessary attributes. If the DS is running, establish an LDAP connection and properly close it. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* services: replace admin_conn with api.Backend.ldap2Tomas Krizek2016-11-2212-117/+117
| | | | | | | | | Since service.admin_conn is only an alias to api.Backend.ldap2, replace it everywhere with the explicit api.Backend.ldap2 instead. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove references to ds_newinst.plFraser Tweedale2016-11-211-6/+6
| | | | | | | | ds_newinst.pl was removed from 389 DS over 9 years ago. Remove references to it. Fixes: https://fedorahosted.org/freeipa/ticket/6496 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* KRA: don't add KRA container when KRA replicaMartin Basti2016-11-211-10/+4
| | | | | | | | | | | | | | | | | | | This fixes regression caused by c56256e2a29f076e6afa559225a66f58b0773eb5 """ [9/11]: add vault container ipa : CRITICAL Failed to load vault.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpxxO9IC -H ldapi://%2fvar%2frun%2fslapd-IPA-TEST.socket -x -D cn=Directory Manager -y /tmp/tmpVKinCZ' returned non-zero exit status 68 [10/11]: apply LDAP updates """ and removes unneded steps during installation of KRA replica, because KRA container must be there since installation of first KRA instance. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* upgrade: do not explicitly set principal for servicesTomas Krizek2016-11-211-2/+0
| | | | | | | | After installer refactoring, principal is a property of service. https://fedorahosted.org/freeipa/ticket/6500 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix ipa migrate-ds when it finds a search referenceFlorence Blanc-Renaud2016-11-171-2/+1
| | | | | | | | | | | | | | | | | | | | When ipa migrate-ds finds user entries and a search reference, it complains that the LDAP search did not return any result and does not migrate the entries or the groups. The issue comes from LDAPClient._convert_result which returns an empty result list when the input is a search reference. In turn LDAPClient.find_entries assumes that the empty result list corresponds to a Search Result Done and returns without any entry. The fix examines first the objtype returned by self.conn.result3. If it is a search result done, then the loop can be exited. Otherwise (referral or entry), _convert_result is called and the result (if not empty) is appended to the list of returned entries. https://fedorahosted.org/freeipa/ticket/6358 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use common procedure to setup initial replication in both domain levelsMartin Babinsky2016-11-172-8/+20
| | | | | | | | | | | | | | Set up initial replication using GSSAPI also in domin level 0. For this to work, the supplied DM password is used to connect to remote master and set up agreements. The workflow is unchanged in DL1 where GSSAPI bind as host or admin is used. This obsoletes the conversion of replication agreements to GSSAPI made in DL0 during KDC installation. https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ensure that the initial sync using GSSAPI works agains old mastersMartin Babinsky2016-11-171-15/+31
| | | | | | | | | | | | | | IPA 3.x masters neither have 'cn=replication managers' sysaccount groups set, nor do they support adding nsds5ReplicaBinddnGroup attribute to the replica config objects. In order for common replication mechanism to work against them, the replica must be ready to supply the required information to the old master. https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replication: refactor the code setting principals as replica bind DNsMartin Babinsky2016-11-171-26/+21
| | | | | | | | | | In addition to improving the readability of `setup_krb_princs_as_replica_binddns` method, the re-usable bits were factored out to separate methods https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replication: augment setup_promote_replication methodMartin Babinsky2016-11-171-3/+7
| | | | | | | | | | | | | the method that sets up initial GSSAPI replication in DL1 was augmented so that the specified bind DN/bind password allows simple bind to remote master using STARTTLS. The CA certificate for the connection is also configurable. This facilitates the use of this method in DL0 where GSSAPI bind can not be used during DS bootstrap while DM credentials are available. https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Turn replication manager group into ReplicationManager class memberMartin Babinsky2016-11-171-6/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/6406 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add install requirements to Python packagesChristian Heimes2016-11-161-0/+26
| | | | | | | https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 19:47:34 +0000