summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix --auto-reverse option in --unattended mode.Petr Spacek2016-01-081-1/+2
| | | | | | | | | | | | | Now the option correctly adds missing reverse zones even in unattended mode. Still, this is not sufficient in all cases because 'automatic empty zones' created by BIND (as specified in RFC 6303) can shadow the reverse zones hosted on other servers. This needs to be solved in a separate patch. https://fedorahosted.org/freeipa/ticket/5559 Reviewed-By: David Kupka <dkupka@redhat.com>
* update_uniqueness plugin: fix referenced before assigment errorMartin Basti2016-01-071-2/+2
| | | | | | | This error may potentially happen when plugin migration is skipped due an error. In that case variable 'update' was undefined. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Enable pylint unnecessary-pass checkMartin Basti2015-12-239-9/+1
| | | | | | Enables check and removes extra pass statement from code. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint missing-final-newline checkMartin Basti2015-12-231-1/+1
| | | | | | | | Enables check and fixes: ipaserver/install/otpdinstance.py:25: [C0304(missing-final-newline), ] Final newline missing) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint lost exception checkMartin Basti2015-12-231-2/+2
| | | | | | | | | Commit enables check and also fixes: ipaserver/dcerpc.py:718: [W0150(lost-exception), DomainValidator.__search_in_dc] return statement in finally block may swallow exception) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove wildcard importsMartin Basti2015-12-2319-20/+22
| | | | | | | | | | | Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-2328-62/+9
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-dns-install: Do not check for zone overlap when DNS installed.David Kupka2015-12-223-19/+11
| | | | | | | | | | | When DNS is already installed somewhere in topology we should not check for zone overlap because it would always say that we are overlapping our own domain. ipa-replica-install already does that but ipa-dns-install did not. https://fedorahosted.org/freeipa/ticket/5564 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Remove unused code in server installer related to KRAMartin Basti2015-12-221-21/+3
| | | | | | The first instance of KRA system should be allowed to install only by ipa-kra-install. This commit removes TODO and unneeded parts in code. Reviewed-By: David Kupka <dkupka@redhat.com>
* installer: Fix logic of reading option values from cache.David Kupka2015-12-211-4/+3
| | | | | | | | | | Only options explicitly set must be stored before installer exits first step of external CA setup. When installer continues all stored option values must be restored. https://fedorahosted.org/freeipa/ticket/5556 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installer: Propagate option values from components instead of copying them.David Kupka2015-12-211-31/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5556 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* harden domain level 1 topology connectivity checksMartin Babinsky2015-12-211-8/+33
| | | | | | | | | this patch makes the check_last_link_managed() function more resistant to both orphaned topology suffixes and also to cases when there are IPA masters do not seem to manage any suffix. The function will now only complain loudly about these cases and not cause crashes. Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns: Handle SERVFAIL in check if domain already exists.Petr Spacek2015-12-162-3/+5
| | | | | | | | In cases where domain is already delegated to IPA prior installation we might get timeout or SERVFAIL. The answer depends on the recursive server we are using for the check. Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: Add --auto-reverse option.David Kupka2015-12-142-1/+18
| | | | | | | | Introducing '--auto-reverse' option. When specified reverse records for all server's IP addresses are checked and when record nor reverse zone does not exist reverse zone is created. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* dns: Check if domain already exists.David Kupka2015-12-143-59/+164
| | | | | | | | | Raise an error when the domain already exists. This can be overriden using --force or --allow-zone-overlap options. https://fedorahosted.org/freeipa/ticket/3681 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* replica promotion: let ipa-client-install validate enrollment optionsJan Cholasta2015-12-141-9/+0
| | | | | | | | | ipa-client-install output is redirected to standard output, so let it print its own error message for missing options. https://fedorahosted.org/freeipa/ticket/5542 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Explicitly call chmod on newly created directoriesMartin Basti2015-12-144-8/+13
| | | | | | | | | Without calling os.chmod(), umask is effective and may cause that directory is created with permission that causes failure. This can be related to https://fedorahosted.org/freeipa/ticket/5520 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNS: fix file permissionsMartin Basti2015-12-141-1/+3
| | | | | | | | With non default umask named-pkcs11 cannot access the softhsm token storage https://fedorahosted.org/freeipa/ticket/5520 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* server install: redirect ipa-client-install output to standard outputJan Cholasta2015-12-142-16/+15
| | | | | | https://fedorahosted.org/freeipa/ticket/5527 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* dogtaginstance: remove unused function 'check_inst'Fraser Tweedale2015-12-141-17/+0
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* replica promotion: notify user about ignoring client enrollment optionsJan Cholasta2015-12-141-0/+6
| | | | | | | | | When IPA client is already installed, notify the user that the enrollment options are ignored in ipa-replica-install. https://fedorahosted.org/freeipa/ticket/5530 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Install RA cert during replica promotionMartin Basti2015-12-142-4/+8
| | | | | | | | This cert is needed with KRA to be able store and retrieve secrets. https://fedorahosted.org/freeipa/ticket/5512 Reviewed-By: David Kupka <dkupka@redhat.com>
* Refactor ipautil.runPetr Viktorin2015-12-1410-97/+121
| | | | | | | | | | | | | | | | | | | | | The ipautil.run function now returns an object with returncode and output are accessible as attributes. The stdout and stderr of all commands are logged (unless skip_output is given). The stdout/stderr contents must be explicitly requested with a keyword argument, otherwise they are None. This is because in Python 3, the output needs to be decoded, and that can fail if it's not decodable (human-readable) text. The raw (bytes) output is always available from the result object, as is "leniently" decoded output suitable for logging. All calls are changed to reflect this. A use of Popen in cainstance is changed to ipautil.run. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* prevent crashes of server uninstall check caused by failed LDAP connectionsMartin Babinsky2015-12-111-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5409 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Migrate wget references and usage to curlGabe2015-12-111-7/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5458 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replica promotion: use host credentials for connection checkJan Cholasta2015-12-111-17/+8
| | | | | | | https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* replica install: add remote connection check over APIJan Cholasta2015-12-118-56/+37
| | | | | | | | | | Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-replica-install prints incorrect error message when replica is already ↵Gabe2015-12-111-3/+12
| | | | | | | | | | installed https://fedorahosted.org/freeipa/ticket/5022 https://fedorahosted.org/freeipa/ticket/5320 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replicainstall: Make sure the enrollment state is preservedTomas Babej2015-12-111-0/+32
| | | | | | | | | | | | | | | During the promote_check phase, the subsequent checks after the machine is enrolled may cause the installation to abort, hence leaving it enrolled even though it might not have been prior to the execution of the ipa-replica-install command. Make sure that ipa-client-install --uninstall is called on the machine that has not been enrolled before in case of failure during the promote_check phase. https://fedorahosted.org/freeipa/ticket/5529 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replicainstall: Add check for domain if server is specifiedTomas Babej2015-12-111-0/+6
| | | | | | | Avoids failing in the later stages during the ipa-client-install command. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* server uninstall: ignore --ignore-topology-disconnect in domain level 0Jan Cholasta2015-12-111-5/+0
| | | | | | | | | Topology disconnect is always ignored in domain level 0, so the option can be safely ignored. https://fedorahosted.org/freeipa/ticket/5409 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica promotion: check domain level before ipaservers membershipJan Cholasta2015-12-111-14/+14
| | | | | | | | | Check domain level before checking ipaservers membership to prevent "not found" error when attempting replica promotion in domain level 0. https://fedorahosted.org/freeipa/ticket/5401 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica install: add ipaservers if it does not existJan Cholasta2015-12-111-5/+4
| | | | | | | | | This prevents crash when adding the host entry to ipaservers when installing replica of a 4.2 or older server. https://fedorahosted.org/freeipa/ticket/3416 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica: Fix ipa-replica-install with replica file (domain level 0).David Kupka2015-12-101-4/+6
| | | | | | | | | | Attribute _ca_enabled is set in promote_check() and is not available in install(). When installing replica in domain level 0 we can determine existence of CA service based on existence of cacert.p12 file in provided replica-file. https://fedorahosted.org/freeipa/ticket/5531 Reviewed-By: Oleg Fayans <ofayans@redhat.com>
* replica promotion: allow OTP bulk client enrollmentJan Cholasta2015-12-091-14/+31
| | | | | | https://fedorahosted.org/freeipa/ticket/5498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Force creation of services during replica installMartin Basti2015-12-071-1/+2
| | | | | | Missing A record should not prevent replica to be installed. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replicainstall: Admin password should not conflict with replica fileTomas Babej2015-12-071-1/+0
| | | | | | | | The --admin-password (-w) has its use both in domain level 0 and 1. https://fedorahosted.org/freeipa/ticket/5517 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* replica promotion: automatically add the local host to ipaserversJan Cholasta2015-12-071-2/+46
| | | | | | | | | | If the user is authorized to modify members of the ipaservers host group, add the local host to ipaservers automatically. https://fedorahosted.org/freeipa/ticket/5401 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* replica promotion: use host credentials when setting up replicationJan Cholasta2015-12-071-11/+45
| | | | | | | | | | | Use the local host credentials rather than the user credentials when setting up replication. The host must be a member of the ipaservers host group. The user credentials are still required for connection check. https://fedorahosted.org/freeipa/ticket/5401 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* aci: replace per-server ACIs with ipaserver-based ACIsJan Cholasta2015-12-071-111/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/3416 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* aci: add IPA servers host group 'ipaservers'Jan Cholasta2015-12-071-0/+7
| | | | | | | https://fedorahosted.org/freeipa/ticket/3416 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* replica install: improvements in the handling of CA-related IPA config entriesMartin Babinsky2015-12-043-17/+25
| | | | | | | | | | | | When a CA-less replica is installed, its IPA config file should be updated so that ca_host points to nearest CA master and all certificate requests are forwarded to it. A subsequent installation of CA subsystem on the replica should clear this entry from the config so that all certificate requests are handled by freshly installed local CA. https://fedorahosted.org/freeipa/ticket/5506 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-install support caless install with promotion.David Kupka2015-12-035-42/+199
| | | | | | https://fedorahosted.org/freeipa/ticket/5441 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modify error message to install first instance of KRAMartin Basti2015-12-021-1/+3
| | | | | | | | First instance of KRA should be installed by ipa-kra-install. https://fedorahosted.org/freeipa/ticket/5460 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-kra-install: allow to install first KRA on replicaMartin Basti2015-12-021-6/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/5460 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* implement domain level 1 specific topology checks into IPA server uninstallerMartin Babinsky2015-12-021-27/+166
| | | | | | | | | | | | | When uninstalling domain level 1 master its removal from topology is checked on remote masters. The uninstaller also checks whether the uninstallation disconnects the topology and if yes aborts the procedure. The '--ignore-disconnected-topology' options skips this check. https://fedorahosted.org/freeipa/ticket/5377 https://fedorahosted.org/freeipa/ticket/5409 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* extract domain level 1 topology-checking code from ipa-replica-manageMartin Babinsky2015-12-021-0/+90
| | | | | | | | | | This facilitates reusability of this code in other components, e.g. IPA server uninstallers. https://fedorahosted.org/freeipa/ticket/5409 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* replicainstall: Add possiblity to install client in one commandTomas Babej2015-12-012-10/+86
| | | | | | https://fedorahosted.org/freeipa/ticket/5310 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove global variable dns_forwarders from ipaserver.install.dnsPetr Spacek2015-12-012-18/+14
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-dns-install offer IP addresses from resolv.conf as default forwardersPetr Spacek2015-12-015-8/+39
| | | | | | | | | In non-interactive more option --auto-forwarders can be used to do the same. --forward option can be used to supply additional IP addresses. https://fedorahosted.org/freeipa/ticket/5438 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 20:59:41 +0000