summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
...
* py3: _ptrrecord_precallaback: use bytes with labelsMartin Basti2017-02-081-1/+1
| | | | | | | | DNS labels are bytes so bytes must be used for comparison https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: remove_entry_from_group: attribute name must be stringMartin Basti2017-02-081-1/+1
| | | | | | | | Do not encode attribute names https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: base64 encoding/decoding returns always bytes don't mix itMartin Basti2017-02-084-7/+7
| | | | | | | | | Using unicode(bytes) call causes undesired side effect that is inserting `b` character to result. This obviously causes issues with binary base64 data https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* stageuser: Add stageuser-{add,remove}-principalDavid Kupka2017-02-071-0/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/6623 Reviewed-By: Martin Basti <mbasti@redhat.com>
* stageuser: Add stageuser-{add,remove}-certDavid Kupka2017-02-073-38/+54
| | | | | | | | | Move {add,remove}-cert implementation from user to baseuser and inherit {,stage}user-{add,remove}-cert from it. https://fedorahosted.org/freeipa/ticket/6623 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replica install: do not log host OTPJan Cholasta2017-02-071-1/+3
| | | | | | | | | | Do not log the value of the --password option of ipa-client-install when it is run from ipa-replica-install before replica promotion. https://fedorahosted.org/freeipa/ticket/6633 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Abhijeet Kasurde <akasurde@redhat.com>
* ipa-kra-install must create directory if it does not existFlorence Blanc-Renaud2017-02-021-0/+4
| | | | | | | | | | | | | ipa-kra-install creates an admin cert file in /root/.dogtag/pki-tomcat/ca_admin.cert but does not check that the parent directory exists. This situation can happen when uninstall + restore has been run. The fix creates the directory if not present. https://fedorahosted.org/freeipa/ticket/6606 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: fix CSR encoding inside frameworkMartin Basti2017-01-312-2/+4
| | | | | | | | | csr must be in string because framework excpects only strings, so we have to decode it back https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: can_read: attributelevelrights is already stringMartin Basti2017-01-311-1/+1
| | | | | | | | | Remove decode() as it causes error in py3 because the attribute is already string not bytes https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: get_effective_rights: values passed to ldap must be bytesMartin Basti2017-01-311-1/+4
| | | | | | | | Values passed to LDAP must be bytes https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: rpcserver fix undefined variableMartin Basti2017-01-311-1/+2
| | | | | | | | | variable 'e' is valid only in except block in py3, so it must be assigned to different variable for further usage https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: WSGI executioners must return bytes in listMartin Basti2017-01-311-10/+12
| | | | | | | | | WSGI prints TypeError into error log when IPA doesn't return bytes in list as result https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: session: fix r/w ccache dataMartin Basti2017-01-311-6/+5
| | | | | | | | | ccache contains binary data, so it should be read and write in binary mode https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Py3: Fix undefined variableMartin Basti2017-01-311-1/+1
| | | | | | | | Variable 'e' has only local scope in except block in Py3 https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: rpcserver: decode input because json requires stringMartin Basti2017-01-311-1/+1
| | | | | | | | json library parses string so input must be decoded https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: session.py decode server name to strMartin Basti2017-01-311-1/+1
| | | | | | | | | This fix is temporal because Memcache will be removed soon, so it is more workaround than fix https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use proper logging for error messagesMartin Basti2017-01-311-4/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/6588r Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* wait_for_entry: use only DN as parameterMartin Basti2017-01-312-5/+3
| | | | | | | | | Using the whole entry is not needed as parameter because only DN is used and it prevents easier usage of this function https://fedorahosted.org/freeipa/ticket/6588 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Explicitly handle quoting/unquoting of NSSNickname directiveMartin Babinsky2017-01-252-4/+14
| | | | | | | | | | | Improve the single/double quote handling during parsing/unparsing of nss.conf's NSSNickname directive. Single quotes are now added/stripped explicitly when handling the certificate nickname. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Delegate directive value quoting/unquoting to separate functionsMartin Babinsky2017-01-251-27/+43
| | | | | | | | | | | | | | | | | Separate functions were added to installutils module to quote/unquote a string in arbitrary characters. `installutils.get/set_directive` functions will use them to enclose the directive values in double quotes/strip the double quotes from retrieved values to maintain the original behavior. These functions can be used also for custom quoting/unquoting of retrieved values when desired. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* installutils: improve directive value parsing in `get_directive`Martin Babinsky2017-01-251-2/+17
| | | | | | | | | | | | | `get_directive` value parsing was improved in order to bring its logic more in-line to changes in `set_directive`: a specified quoting character is now unquoted and stripped from the retrieved value. The function will now also error out when malformed directive is encountered. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix the installutils.set_directive docstringMartin Babinsky2017-01-251-5/+8
| | | | | | | | | Add missing parameter descriptions and fix incorrect indentation https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* cert: fix search limit handling in cert-findJan Cholasta2017-01-241-4/+17
| | | | | | | | | | | | | | If search limits are not specified in cert-find, use the configured limits. This applies to the certificate search in the CA as well. Detect and report if size limit was exceeded in the certificate search in the CA. Do not apply limits to the internal ca-find call. https://fedorahosted.org/freeipa/ticket/6564 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* dogtag: search past the first 100 certificatesJan Cholasta2017-01-241-1/+1
| | | | | | | | | | | | | Dogtag requires a size limit to be specified when searching for certificates. When no limit is specified in the dogtag plugin, a limit of 100 entries is assumed. As a result, an unlimited certificate search returns data only for a maximum of 100 certificates. Raise the "unlimited" limit to the maximum value Dogtag accepts. https://fedorahosted.org/freeipa/ticket/6564 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* py3: decode bytes for json.loads()Martin Basti2017-01-241-4/+5
| | | | | | | | | | | | In py 3.5 json.loads requires to have string as input, all bytes must be decoded. Note: python 3.6 supports bytes for json.loads() https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dogtag.py: fix exception logging of JSON dataMartin Basti2017-01-241-4/+8
| | | | | | | | 'read_ca' and 'create_ca' have no logging when exception happened and it masks real reason why it failed. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: convert_attribute_members: don't use bytes as parameter for DNMartin Basti2017-01-241-1/+1
| | | | | | | | | | due perfomance improvement in e4930b3235e5d61d227a7e43d30a8feb7f35664d we have to decode value before it can be used in DN() constructor. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: __add_acl: use standard ipaldap methodsMartin Basti2017-01-241-8/+5
| | | | | | | | | | Using raw pyldap interface we have to keep vaules as bytes. Is easier to migrate to ipaldap and use strings without decoding and encoding. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: add_entry_to_group: attribute name must be string not bytesMartin Basti2017-01-241-1/+1
| | | | | | | | | With bytes as attribute name pyldap raises type error https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: cainstance: replace mkstemp with NamedTemporaryFileMartin Basti2017-01-241-24/+25
| | | | | | | | | | | With Python3 files must be opened in textual mode to write text, and best practise is to use fileobject instead fo os.write() and manual encodig https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: write CA/KRA config into file opened in text modeMartin Basti2017-01-242-2/+2
| | | | | | | | | | config parser writes data as text so CA/KRA should be opened in textual mode otherwise type errors are raised from installer https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: CA/KRA: config parser requires stringMartin Basti2017-01-242-2/+4
| | | | | | | | | | basedn is DN object it has to be converted to string before it can be used with config parser https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: open temporary ldif file in text modeMartin Basti2017-01-241-2/+3
| | | | | | | | | | | | ldif parser uses file in text mode, so we have to open it in text mode in py3 Also values passed to parser should be bytes https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: service.py: replace mkstemp by NamedTemporaryFileMartin Basti2017-01-241-3/+4
| | | | | | | | | | NamedTemporaryfile can be used in more pythonic way and file can be opened in textual mode that is required with PY3 https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: create_cert_db: write to file in a compatible wayMartin Basti2017-01-241-3/+3
| | | | | | | | | | Py3 expect bytes to be writed using os.write. Instead of that using io module is more pythonic. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-restore must stop tracking PKINIT cert in the preparation phaseFlorence Blanc-Renaud2017-01-201-1/+3
| | | | | | | | | | | | | ipa-restore calls certmonger to stop tracking the PKI certs, HTTP and DS certs. It must also stop tracking the newly introduced PKINIT cert (stored in /var/kerberos/krb5kdc/kdc.crt). Otherwise the restore operation ends up with PKINIT cert tracked twice and uninstallation fails. https://fedorahosted.org/freeipa/ticket/6570 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update warning message for ipa server uninstallAbhijeet Kasurde2017-01-181-1/+3
| | | | | | | | | | | Fix adds an additional recommendation message for taking backup of existing data and configuration before proceeding to ipa server uninstallation procedures. Fixes https://fedorahosted.org/freeipa/ticket/6548 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix coverity issueTomas Krizek2017-01-161-1/+2
| | | | | | | A code path exists, where principal_obj is None. Add check principal_obj is not None to avoid dereferencing it. Reviewed-By: Martin Basti <mbasti@redhat.com>
* cainstance: do not configure renewal guardJan Cholasta2017-01-162-39/+15
| | | | | | | | | | Do not configure renewal guard for dogtag-ipa-renew-agent, as it is not used in IPA anymore. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dogtaginstance: track server certificate with our renew agentJan Cholasta2017-01-162-3/+3
| | | | | | | | | | Track Dogtag's server certificate with dogtag-ipa-ca-renew-agent instead of dogtag-ipa-renew-agent. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove duplicated step from DS installMartin Basti2017-01-121-2/+0
| | | | | | | "Adding SASL mappings.." is duplicated step in __common_setup in DS instance and should be removed. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add sanity checks for use of --ca-subject and --subject-baseFraser Tweedale2017-01-111-0/+7
| | | | | | | | | | Print an error and terminate if --ca-subject or --subject-base are used when installing a CA-less master or when performing standalone installation of a CA replica. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Indicate that ca subject / subject base uses LDAP RDN orderFraser Tweedale2017-01-111-2/+6
| | | | | | | | Update man pages and help output to indicate that --subject-base and --ca-subject options interpret their arguments in LDAP order. Fixes: https://fedorahosted.org/freeipa/ticket/6455 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-1110-97/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Reuse self.api when executing ca_enabled_checkFraser Tweedale2017-01-113-21/+21
| | | | | | | | | | | | | | The ca_enabled_check function is a wrapper around api.Command.ca_is_enabled. When using remote_api (e.g. during installer), ca_enabled_check invokes the *global* api instead of the remote_api. Update ca_enabled_check to explicitly receive an api object from the caller and invoke Command.ca_is_enabled through it. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dsinstance: extract function for writing certmap.confFraser Tweedale2017-01-111-5/+13
| | | | | | | | | | | | | | | | For full customisability of the IPA CA subject DN, we will need the ability to update DS `certmap.conf' when upgrading a deployment from CA-less to CA-ful. Extract the existing behaviour, which is private to DsInstance, to the `write_certmap_conf' top-level function. Also update `certmap.conf.template' for substition of the whole CA subject DN (not just the subject base). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-ca-install: add missing --subject-base optionFraser Tweedale2017-01-111-0/+8
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Extract function for computing default subject baseFraser Tweedale2017-01-116-11/+16
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installer: rename --subject to --subject-baseFraser Tweedale2017-01-113-18/+19
| | | | | | | | | | | | The --subject option is actually used to provide the "subject base". We are also going to add an option for fully specifying the IPA CA subject DN in a subsequent commit. So to avoid confusion, rename --subject to --subject-base, retaining --subject as a deprecated alias. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installutils: remove hardcoded subject DN assumptionFraser Tweedale2017-01-113-6/+12
| | | | | | | | | | | | `installutils.load_external_cert` assumes that the IPA CA subject DN is `CN=Certificate Authority, {subject_base}`. In preparation for full customisability of IPA CA subject DN, push this assumption out of this function to call sites (which will be updated in a subsequent commit). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 10:05:01 +0000