IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-26 00:41:25 -06:00
Code Issues Packages Projects Releases Wiki Activity
0075c8b8f6
freeipa/install/share/Makefile.am

118 lines
2.6 KiB
Makefile
Raw Normal View History

Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
NULL =
Add ipa-advise plugins for legacy clients Old versions of SSSD do not directly support cross-realm trusts between IPA and AD. This patch introduces plugins for the ipa-advise tool, which should help with configuring an old version of SSSD (1.5-1.8) to gain access to resources in trusted domain. Since the configuration steps differ depending on whether the platform includes the authconfig tool, two plugins are needed: * config-redhat-sssd-before-1-9 - provides configuration for Red Hat based systems, as these system include the autconfig utility * config-generic-sssd-before-1-9 - provides configuration for other platforms https://fedorahosted.org/freeipa/ticket/3671 https://fedorahosted.org/freeipa/ticket/3672
2013-08-01 07:12:39 -05:00
SUBDIRS = \
advise \
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-11 20:17:48 -05:00
profiles \
support schema files from third-party plugins Allow upgrade process to include schema files from third-party plugins installed in /usr/share/ipa/schema.d/*.schema. The directory /usr/shar/eipa/schema.d is owned by the server-common subpackage and therefore third-party plugins should depend on freeipa-server-common (ipa-server-common) package in their package dependencies. Resolves: https://fedorahosted.org/freeipa/ticket/5864 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-05 05:04:19 -05:00
schema.d \
Add ipa-advise plugins for legacy clients Old versions of SSSD do not directly support cross-realm trusts between IPA and AD. This patch introduces plugins for the ipa-advise tool, which should help with configuring an old version of SSSD (1.5-1.8) to gain access to resources in trusted domain. Since the configuration steps differ depending on whether the platform includes the authconfig tool, two plugins are needed: * config-redhat-sssd-before-1-9 - provides configuration for Red Hat based systems, as these system include the autconfig utility * config-generic-sssd-before-1-9 - provides configuration for other platforms https://fedorahosted.org/freeipa/ticket/3671 https://fedorahosted.org/freeipa/ticket/3672
2013-08-01 07:12:39 -05:00
$(NULL)
Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
appdir = $(IPA_DATA_DIR)
Build: Remove spurious EXTRA_DIST from install/share/Makefile.am dist_ prefix can be used instead of EXTRA_DIST magic. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 09:00:54 -05:00
dist_app_DATA = \
Incorporate new schema for IPAv2 Loading this via LDIF is a temporary measure until we can load it online. This requires removing the dNSRecord declarations from 05rfc2247.ldif so a replacement copy is included for now. Also add the netgroups container.
2009-02-10 14:52:25 -06:00
05rfc2247.ldif \
Add formerly update-only schema Some schema was only delivered in updates. Add it back as ldif files. https://fedorahosted.org/freeipa/ticket/3454
2013-04-29 11:09:45 -05:00
15rfc2307bis.ldif \
15rfc4876.ldif \
merge initial radius work
2007-11-03 11:22:20 -05:00
60kerberos.ldif \
60samba.ldif \
Fix installation Add missing schema for GUI Config, and missing objectclass for cn=accounts container
2007-11-18 14:02:26 -06:00
60ipaconfig.ldif \
Incorporate new schema for IPAv2 Loading this via LDIF is a temporary measure until we can load it online. This requires removing the dNSRecord declarations from 05rfc2247.ldif so a replacement copy is included for now. Also add the netgroups container.
2009-02-10 14:52:25 -06:00
60basev2.ldif \
v3-schema: Add new ipaExternalGroup objectclass This construct allows to have a group of ipaExternalMember attributes, that can be nested in a normal ipa Group ('memberOf' is allowed). It cannot contain normal ipa users/groups and cannot be nested with another group of the same type ('member' is not allowed).
2011-08-15 14:02:19 -05:00
60basev3.ldif \
Add basic support for subordinate user/group ids New LDAP object class "ipaUserSubordinate" with four new fields: - ipasubuidnumber / ipasubuidcount - ipasubgidnumber / ipasgbuidcount New self-service permission to add subids. New command user-auto-subid to auto-assign subid The code hard-codes counts to 65536, sets subgid equal to subuid, and does not allow removal of subids. There is also a hack that emulates a DNA plugin with step interval 65536 for testing. Work around problem with older SSSD clients that fail with unknown idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571 Related: https://pagure.io/freeipa/issue/8361 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-03-19 05:48:38 -05:00
60basev4.ldif \
schema: Split ipadns definitions from basev2 ones
2011-08-15 13:18:50 -05:00
60ipadns.ldif \
DNSSEC: schema Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 08:33:32 -05:00
60ipapk11.ldif \
Add schema for certificate profiles The certprofile object class is used to track IPA-managed certificate profiles in Dogtag and store IPA-specific settings. Part of: https://fedorahosted.org/freeipa/ticket/57 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-21 01:24:10 -05:00
60certificate-profiles.ldif \
Perform case-insensitive searches for principals on TGS requests We want to always resolve TGS requests even if the user mistakenly sends a request for a service ticket where the fqdn part contain upper case letters. The actual implementation follows hints set by KDC. When AP_REQ is done, KDC sets KRB5_FLAG_ALIAS_OK and we obey it when looking for principals on TGS requests. https://fedorahosted.org/freeipa/ticket/1577
2012-03-26 06:23:42 -05:00
61kerberos-ipav3.ldif \
Add LDAP schema for certificate store. Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-06-10 07:04:36 -05:00
65ipacertstore.ldif \
Add support for sudoOrder Update ipaSudoRule objectClass on upgrades to add new attributes. Ensure uniqueness of sudoOrder in rules. The attributes sudoNotBefore and sudoNotAfter are being added to schema but not as Params. https://fedorahosted.org/freeipa/ticket/1314
2012-03-01 13:02:28 -06:00
65ipasudo.ldif \
Add IPA OTP schema and ACLs This commit adds schema support for two factor authentication via OTP devices, including RADIUS or TOTP. This schema will be used by future patches which will enable two factor authentication directly. https://fedorahosted.org/freeipa/ticket/3365 http://freeipa.org/page/V3/OTP
2013-04-11 12:24:46 -05:00
70ipaotp.ldif \
ds plugin - manage replication topology in the shared tree Implementation of ticket: https://fedorahosted.org/freeipa/ticket/4302 Design page: http://www.freeipa.org/page/V4/Manage_replication_topology Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
2015-05-20 10:28:39 -05:00
70topology.ldif \
idviews: Add necessary schema for the ID views Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-07-31 04:57:53 -05:00
71idviews.ldif \
Add Domain Level feature https://fedorahosted.org/freeipa/ticket/5018 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-05-14 03:49:55 -05:00
72domainlevels.ldif \
Support for Certificate Identity Mapping See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2016-12-20 09:21:58 -06:00
73certmap.ldif \
Use Anonymous user to obtain FAST armor ccache The anonymous user allows the framework to obtain an armor ccache without relying on usable credentials, either via a keytab or a pkinit and public certificates. This will be needed once the HTTP keytab is moved away for privilege separation. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-02 05:48:35 -06:00
anon-princ-aci.ldif \
merge initial radius work
2007-11-03 11:22:20 -05:00
bootstrap-template.ldif \
topology: manage ca replication agreements Configure IPA so that topology plugin will manage also CA replication agreements. upgrades if CA is congigured: - ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX - ipaReplTopoManagedSuffix: o=ipaca is added to master entry - binddngroup is added to o=ipaca replica entry Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-15 04:17:14 -05:00
ca-topology.uldif \
Add ipa-custodia service Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-05-08 12:39:29 -05:00
custodia.conf.template \
merge initial radius work
2007-11-03 11:22:20 -05:00
default-aci.ldif \
Create default HBAC rule allowing any user to access any host from any host This is to make initial installation and testing easier. Use the --no_hbac_allow option on the command-line to disable this when doing an install. To remove it from a running server do: ipa hbac-del allow_all
2010-05-04 14:24:54 -05:00
default-hbac.ldif \
ipa-adtrust-install: create fallback group with ldif file Currently the framework is used to add the group but we want to avoid that users are added explicitly to the group by removing the objectclasses groupofnames, ipausergroup and nestedgroup and we want to use a name with spaces in it. Both it not easy possible with the framework, a LDIF file is used instead to create the group. Fixes https://fedorahosted.org/freeipa/ticket/3147
2012-10-08 03:44:07 -05:00
default-smb-group.ldif \
idviews: Add Default Trust View as part of adtrustinstall Add a Default Trust View, which is used by SSSD as default mapping for AD users. Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-09-22 05:19:26 -05:00
default-trust-view.ldif \
Make --setup-dns work on replica installation The ipa-replica-install script will setup the DNS if user specifies the --setup-dns option. It will only add the zone into LDAP if the cn=dns,$SUFFIX container doesn't exist. For now, however, we do not add the records.
2009-06-26 12:37:49 -05:00
delegation.ldif \
Add replication related acis to all replicas Fixes: https://fedorahosted.org/freeipa/ticket/617
2010-12-11 10:02:08 -06:00
replica-acis.ldif \
ds: ignore time skew during initial replication step Initial replica creation can go with ignoring time skew checks. We should, however, force time skew checks during normal operation. Fixes https://pagure.io/freeipa/issue/7211 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-16 05:32:38 -05:00
replica-prevent-time-skew.ldif \
Autotune directory server to use a greater number of files This changes the system limits for the dirsrv user as well as configuring DS to allow by default 8192 max files and 64 reserved files (for replication indexes, etc..). Fixes: https://fedorahosted.org/freeipa/ticket/464
2010-11-16 11:45:21 -06:00
ds-nfiles.ldif \
Move DS's Kerberos env vars to unit file The IPA specific env vars KRB5_KTNAME and KRB5CCNAME are now defined in a instance specific ipa-env.conf unit file. Fixes: https://pagure.io/freeipa/issue/7860 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2019-04-02 08:37:27 -05:00
ds-ipa-env.conf.template \
Use LDAP instead of flat file for zone storage
2009-05-12 08:20:24 -05:00
dns.ldif \
DNSSEC: DNS key synchronization daemon Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 08:43:29 -05:00
dnssec.ldif \
Add Domain Level feature https://fedorahosted.org/freeipa/ticket/5018 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-05-14 03:49:55 -05:00
domainlevel.ldif \
merge initial radius work
2007-11-03 11:22:20 -05:00
kerberos.ldif \
Overhaul bind upgrade process /etc/named.conf is now owned by IPA. The file is overwritten on installation and all subsequent updates. All user modification will be lost. Config file creation and update use the same code paths. This simplifies upgrade process a lot. There is no errprone fiddling with config settings any more. During upgrade there is a one-time backup of named.conf to named.conf.ipa-backup. It allows users to salvage their customization and move them to one of two user config files which are included by named.conf. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-06-10 04:16:07 -05:00
bind.ipa-ext.conf.template \
Split named custom config to allow changes in options stanza Upgrade path to add additional include to named.conf is not handled. Remove bindkeys-file directive from named config The ISC DVL service was shut down (https://www.isc.org/bind-keys/). BIND versions since April 2017 (i.e. 9.9.10, 9.10.5, 9.11.1 and later) include a hard-coded copy of the root KSK which gets updates automatically according to RFC 5011. Move dnssec-enable directive to custom named config Move comment named config being managed by FreeIPA to the top Move settings which could be changed by administrators to ipa-options-ext.conf. Settings defined there are sole responsibility of the administrator. We do not check if they might collide with our settings in named.conf. Fixes: https://pagure.io/freeipa/issue/8287 Co-authored-by: Peter Keresztes Schmidt <carbenium@outlook.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-04-25 11:06:45 -05:00
bind.ipa-options-ext.conf.template \
BIND: Setup logging - allow BIND's logging customization - preconfig logging with ISC recommendations: https://kb.isc.org/docs/aa-01526 Fixes: https://pagure.io/freeipa/issue/8856 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-05-13 10:16:04 -05:00
bind.ipa-logging-ext.conf.template \
merge initial radius work
2007-11-03 11:22:20 -05:00
bind.named.conf.template \
named: Allow using of a custom OpenSSL engine for BIND For now Debian, Fedora, RHEL, etc. build BIND with 'native PKCS11' support. Till recently, that was the strict requirement of DNSSEC. The problem is that this restricts cross-platform features of FreeIPA. With the help of libp11, which provides `pkcs11` engine plugin for the OpenSSL library for accessing PKCS11 modules in a semi- transparent way, FreeIPA could utilize OpenSSL version of BIND. BIND in turn provides ability to specify the OpenSSL engine on the command line of `named` and all the BIND `dnssec-*` tools by using the `-E engine_name`. Fixes: https://pagure.io/freeipa/issue/8094 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-09-30 08:47:08 -05:00
bind.openssl.cnf.template \
named: Include crypto policy in openssl config On platforms which have system-wide crypto policy the latter has to be included in openssl config. Fixes: https://pagure.io/freeipa/issue/8094 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2020-08-13 05:54:40 -05:00
bind.openssl.cryptopolicy.cnf.template \
merge initial radius work
2007-11-03 11:22:20 -05:00
certmap.conf.template \
kdc.conf.template \
Add support for configuring KDC certs for PKINIT This patch adds support only for the selfsign case. Replica support is also still missing at this stage.
2010-10-29 15:23:21 -05:00
kdc_extensions.template \
kdc_req.conf.template \
merge initial radius work
2007-11-03 11:22:20 -05:00
krb5.conf.template \
Move certauth configuration into a server krb5.conf template Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
2019-04-11 17:11:06 -05:00
freeipa-server.template \
merge initial radius work
2007-11-03 11:22:20 -05:00
krb5.ini.template \
krb.con.template \
krbrealm.con.template \
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619
2011-09-07 03:17:12 -05:00
smb.conf.template \
Write state dir to smb.conf smb.conf now sets state and cache directory, then includes the registry. This also allows us to write the final smb.conf before importing remaining settings into the Samba registry. Fixes: https://pagure.io/freeipa/issue/8401 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2020-07-09 03:56:51 -05:00
smb.conf.registry.template \
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
smb.conf.empty \
Introduce service base class and clean up ipa-server-install 1) Add a base class for all of the instance objects. 2) Normalize usage of logging. 3) General cleanups of ipa-server-install. 4) Make better use of httpinstance. 5) Add webguiinstance. 6) Improve progress reporting during installation. Works Here (TM), but it would be nice to get someone else to test since this moves code around a bit.
0000-12-31 18:09:24 -05:50
referint-conf.ldif \
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
dna.ldif \
Add posix auto gen for single master case
2007-11-06 17:57:15 -06:00
master-entry.ldif \
Initialize memberof patch from Pete Rowley.
0000-12-31 18:09:24 -05:50
memberof-task.ldif \
No longer use the IPA-specific memberof plugin. Use the DS-supplied one.
2009-10-09 16:07:03 -05:00
memberof-conf.ldif \
New tool to enable/disable DS plugin to act as NIS server
2009-05-07 09:51:44 -05:00
nis.uldif \
Upgrade: Fix upgrade of NIS Server configuration Former upgrade file always created the NIS Server container, that caused the ipa-nis-manage did not set all required NIS maps. Default creation of container has been removed. Updating of NIS Server configuration and NIS maps is done only if the NIS Server container exists. https://fedorahosted.org/freeipa/ticket/5507 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-01-06 12:47:22 -06:00
nis-update.uldif \
DNSSEC: opendnssec services Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 09:03:46 -05:00
opendnssec_conf.template \
opendnssec_kasp.template \
Make sure KrbPrincipalName is unique server-wide
2008-02-21 21:31:16 -06:00
unique-attributes.ldif \
Run ipaserver under mod_wsgi
2010-02-24 12:29:23 -06:00
wsgi.py \
Move Managed Entries into their own container in the replicated space. Repoint cn=Managed Entries,cn=plugins,cn=config in common_setup Create: cn=Managed Entries,cn=etc,$SUFFIX Create: cn=Definitions,cn=Managed Entries,cn=etc,$SUFFIX Create: cn=Templates,cn=Managed Entries,cn=etc,$SUFFIX Create method for dynamically migrating any and all custom Managed Entries from the cn=config space into the new container. Separate the connection creation during update so that a restart can be performed to initialize changes before performing a delete. Add wait_for_open_socket() method in installutils https://fedorahosted.org/freeipa/ticket/1708
2011-09-08 14:07:26 -05:00
repoint-managed-entries.ldif \
managed-entries.ldif \
install part - manage topology in shared tree https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-05-20 10:12:04 -05:00
topology-entries.ldif \
Add support for User-Private Groups This uses a new 389-ds plugin, Managed Entries, to automatically create a group entry when a user is created. The DNA plugin ensures that the group has a gidNumber that matches the users uidNumber. When the user is removed the group is automatically removed as well. If the managed entries plugin is not available or if a specific, separate range for gidNumber is passed in at install time then User-Private Groups will not be configured. The code checking for the Managed Entries plugin may be removed at some point. This is there because this plugin is only available in a 389-ds alpha release currently (1.2.6-a4).
2010-06-25 15:14:46 -05:00
user_private_groups.ldif \
managed entry hostgroup netgroup support https://fedorahosted.org/freeipa/ticket/543
2010-12-10 17:21:39 -06:00
host_nis_groups.ldif \
DNSSEC: DNS key synchronization daemon Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 08:43:29 -05:00
uuid.ldif \
ipa-modrdn: Enable plugin to handle krbPrincipalName on renames
2010-10-22 15:03:18 -05:00
modrdn-krbprinc.ldif \
Enable EntryUSN plugin by default, with global scope This will allow clients to use entryusn values to track what changed in the directory regardles of replication delays. Fixes: https://fedorahosted.org/freeipa/ticket/526
2010-11-23 09:35:49 -06:00
entryusn.ldif \
Switch nsslapd-unhashed-pw-switch to nolog 389-ds will change the default value of nsslapd-unhashed-pw-switch from 'on' to 'off' For new or upgraded IPA instance, in case of winsync deployment the attribute is set to 'on' and a warning is displayed. Else the attribute is set to 'nolog' https://pagure.io/freeipa/issue/4812 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2019-03-27 11:36:57 -05:00
pw-logging-conf.ldif \
Create default disabled sudo bind user Read access is denied to the sudo container for unauthenticated users. This shared user can be used to provide authenticated access to the sudo information. https://fedorahosted.org/freeipa/ticket/998
2011-02-23 13:37:07 -06:00
sudobind.ldif \
34 Create FreeIPA CLI Plugin for the 389 Auto Membership plugin Added new container in etc to hold the automembership configs. Modified constants to point to the new container Modified dsinstance to create the container Created automember.py to add the new commands Added xmlrpc test to verify functionality Added minor fix to user.py for constant behavior between memberof and automember https://fedorahosted.org/freeipa/ticket/1272
2011-08-30 19:48:15 -05:00
automember.ldif \
replica-automember.ldif \
Enable SASL mapping fallback. Assign a default priority of 10 to our SASL mappings. https://fedorahosted.org/freeipa/ticket/3330
2013-03-22 05:15:51 -05:00
sasl-mapping-fallback.ldif \
Fix nsslapdPlugin object class after initial replication. This is a workaround for <https://fedorahosted.org/389/ticket/47490>. https://fedorahosted.org/freeipa/ticket/3915
2013-09-09 03:15:11 -05:00
schema-update.ldif \
install: support KRA update https://fedorahosted.org/freeipa/ticket/5250 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-14 00:56:44 -05:00
vault.ldif \
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
kdcproxy-enable.uldif \
kdcproxy-disable.uldif \
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
ipa-httpd.conf.template \
Replace wsgi package conflict with config file Instead of a package conflict, freeIPA now uses an Apache config file to enforce the correct wsgi module. The workaround only applies to Fedora since it is the only platform that permits parallel installation of Python 2 and Python 3 mod_wsgi modules. RHEL 7 has only Python 2 and Debian doesn't permit installation of both variants. See: https://pagure.io/freeipa/issue/7161 Fixes: https://pagure.io/freeipa/issue/7394 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-02-06 03:05:49 -06:00
ipa-httpd-wsgi.conf.template \
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
gssapi.login \
Configure HTTPD to work via Gss-Proxy https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-29 10:10:22 -06:00
gssproxy.conf.template \
Replace hard-coded kdcproxy path with WSGI script mod_wsgi has no way to import a WSGI module by dotted module name. A new kdcproxy.wsgi script is used to import kdcproxy from whatever Python version mod_wsgi is compiled against. This will simplify moving FreeIPA to Python 3 and solves an import problem on Debian. Resolves: https://pagure.io/freeipa/issue/6834 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-29 10:58:47 -05:00
kdcproxy.wsgi \
install: introduce generic Kerberos Augeas lens Introduce new IPAKrb5 lens to handle krb5.conf and kdc.conf changes using Augeas. The stock Krb5 lens does not work on our krb5.conf and kdc.conf. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-05-18 02:57:40 -05:00
ipakrb5.aug \
Move config templates from install/conf to install/share Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-15 12:28:07 -05:00
ipa.conf.template \
ipa-kdc-proxy.conf.template \
ipa-pki-proxy.conf.template \
ipa-rewrite.conf.template \
Use new pki_ipaca.ini to spawn instances Note: Some configuration stanzas are deprecated and have been replaced with new stanzas, e.g. pki_cert_chain_path instead of pki_external_ca_cert_chain_path. Fixes: https://pagure.io/freeipa/issue/5608 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-30 09:42:40 -05:00
ipaca_default.ini \
Add pki.ini override option Allow to specify a pki.ini overlay file on the command line. The override file can be used to override pkispawn settings. Fixes: https://pagure.io/freeipa/issue/5608 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-09-03 05:45:30 -05:00
ipaca_customize.ini \
ipaca_softhsm2.ini \
acme: configure engine.conf and disable by default When deploying ACME set up configsources.conf to retrieve engine configuration from engine.conf. In the initial configuration, the ACME service is disabled (i.e. it will refuse to service requests). A subsequent commit will add command(s) for flipping the ACME service on or off (on a per-server basis). Later we will move to LDAP configuration so that management of the ACME service is deployment-wide. The default configuration also disables issuance of wildcard certificates. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-05-27 23:45:44 -05:00
pki-acme-configsources.conf.template \
acme: set up ACME service when configuring CA When configuring the CA, create, configure and deploy the PKI ACME service instance. This includes creation (if necessary) of the LDAP container object heirarchy in which ACME-related objects will be stored. Dogtag ACME RA account management will be added in a subsequent commit, removing the use of the 'uid=admin' account (which as of this commit just has a bogus password). Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-02-25 01:56:51 -06:00
pki-acme-database.conf.template \
acme: configure engine.conf and disable by default When deploying ACME set up configsources.conf to retrieve engine configuration from engine.conf. In the initial configuration, the ACME service is disabled (i.e. it will refuse to service requests). A subsequent commit will add command(s) for flipping the ACME service on or off (on a per-server basis). Later we will move to LDAP configuration so that management of the ACME service is deployment-wide. The default configuration also disables issuance of wildcard certificates. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-05-27 23:45:44 -05:00
pki-acme-engine.conf.template \
acme: set up ACME service when configuring CA When configuring the CA, create, configure and deploy the PKI ACME service instance. This includes creation (if necessary) of the LDAP container object heirarchy in which ACME-related objects will be stored. Dogtag ACME RA account management will be added in a subsequent commit, removing the use of the 'uid=admin' account (which as of this commit just has a bogus password). Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-02-25 01:56:51 -06:00
pki-acme-issuer.conf.template \
Centralize enable/disable of the ACME service The initial implementation of ACME in dogtag and IPA required that ACME be manually enabled on each CA. dogtag added a REST API that can be access directly or through the `pki acme` CLI tool to enable or disable the service. It also abstracted the database connection and introduced the concept of a realm which defines the DIT for ACME users and groups, the URL and the identity. This is configured in realm.conf. A new group was created, Enterprise ACME Administrators, that controls the users allowed to modify ACME configuration. The IPA RA is added to this group for the ipa-acme-manage tool to authenticate to the API to enable/disable ACME. Related dogtag installation documentation: https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Database.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Realm.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Installing_PKI_ACME_Responder.md ACME REST API: https://github.com/dogtagpki/pki/wiki/PKI-ACME-Enable-REST-API https://pagure.io/freeipa/issue/8524 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Mohammad Rizwan <myusuf@redhat.com>
2020-10-06 14:17:15 -05:00
pki-acme-realm.conf.template \
Fix nsslapd-db-lock tuning of BDB backend nsslapd-db-lock was moved from cn=config,cn=ldbm database,cn=plugins,cn=config entry to cn=bdb subentry. Manual patching of dse.ldif was no longer working. Installations with 389-DS 1.4.3 and newer are affected. Low lock count can affect performance during high load, e.g. mass-import of users or lots of concurrent connections. Bump minimal DS version to 1.4.3. Fedora 32 and RHEL 8.3 have 1.4.3. Fixes: https://pagure.io/freeipa/issue/8515 See: https://pagure.io/freeipa/issue/5914 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2020-09-24 05:32:37 -05:00
ldbm-tuning.ldif \
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
$(NULL)
Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
Build: fix KDC proxy installation and remove unused kdcproxy.conf The only useful file is /etc/ipa/kdcproxy/kdcproxy.conf so I've removed the other copy of the file in /usr. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 08:00:01 -05:00
kdcproxyconfdir = $(IPA_SYSCONF_DIR)/kdcproxy
dist_kdcproxyconf_DATA = \
kdcproxy.conf
Reference in New Issue Copy Permalink