IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 15:40:01 -06:00
Code Issues Packages Projects Releases Wiki Activity
0708f603e2
freeipa/install/oddjob/Makefile.am

43 lines
1.1 KiB
Makefile
Raw Normal View History

trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
NULL =
build: put oddjob scripts into separate directory https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:17:07 -06:00
oddjobdir = $(libexecdir)/ipa/oddjob
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
oddjobconfdir = $(sysconfdir)/oddjobd.conf.d
dbusconfdir = $(sysconfdir)/dbus-1/system.d
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
dist_noinst_DATA = \
com.redhat.idm.trust-fetch-domains.in \
ipa-adtrust-install: run remote configuration for new agents When ipa-adtrust-install is run, the tool detects masters that are not enabled as trust agents and propose to configure them. With the current code, the Schema Compat plugin is not enabled on these new trust agents and a manual restart of LDAP server + SSSD is required. With this commit, ipa-adtrust-install now calls remote code on the new agents through JSON RPC api, in order to configure the missing parts. On the remote agent, the command is using DBus and oddjob to launch a new command, /usr/libexec/ipa/oddjob/org.freeipa.server.trust-enable-agent [--enable-compat] This command configures the Schema Compat plugin if --enable-compat is provided, then restarts LDAP server and SSSD. If the remote agent is an older version and does not support remote enablement, or if the remote server is not responding, the tool ipa-adtrust-install prints a WARNING explaining the steps that need to be manually executed in order to complete the installation, and exits successfully (keeping the current behavior). Fixes: https://pagure.io/freeipa/issue/7600 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
2020-02-18 09:24:32 -06:00
org.freeipa.server.trust-enable-agent.in \
ipa config: add --enable-sid option Add new options to ipa config-mod, allowing to enable SID generation on upgraded servers: ipa config-mod --enable-sid --add-sids --netbios-name NAME The new option uses Dbus to launch an oddjob command, org.freeipa.server.config-enable-sid that runs the installation steps related to SID generation. --add-sids is optional and triggers the sid generation task that populates SID for existing users / groups. --netbios-name is optional and allows to specify the NetBIOS Name. When not provided, the NetBIOS name is generated based on the leading component of the DNS domain name. This command can be run multiple times. Fixes: https://pagure.io/freeipa/issue/8995 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-10-08 08:47:06 -05:00
org.freeipa.server.config-enable-sid.in \
Debian: auto-generate config files for oddjobd The oddjobd config files are now auto-generated with automake to have correct path to libexec on all platforms. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2019-04-23 02:21:37 -05:00
etc/oddjobd.conf.d/oddjobd-ipa-trust.conf.in \
etc/oddjobd.conf.d/ipa-server.conf.in \
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
$(NULL)
Build: fix distribution of oddjob files https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 11:05:54 -05:00
dist_oddjob_SCRIPTS = \
replica install: add remote connection check over API Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:18:21 -06:00
org.freeipa.server.conncheck \
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
$(NULL)
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
nodist_oddjob_SCRIPTS = \
com.redhat.idm.trust-fetch-domains \
ipa-adtrust-install: run remote configuration for new agents When ipa-adtrust-install is run, the tool detects masters that are not enabled as trust agents and propose to configure them. With the current code, the Schema Compat plugin is not enabled on these new trust agents and a manual restart of LDAP server + SSSD is required. With this commit, ipa-adtrust-install now calls remote code on the new agents through JSON RPC api, in order to configure the missing parts. On the remote agent, the command is using DBus and oddjob to launch a new command, /usr/libexec/ipa/oddjob/org.freeipa.server.trust-enable-agent [--enable-compat] This command configures the Schema Compat plugin if --enable-compat is provided, then restarts LDAP server and SSSD. If the remote agent is an older version and does not support remote enablement, or if the remote server is not responding, the tool ipa-adtrust-install prints a WARNING explaining the steps that need to be manually executed in order to complete the installation, and exits successfully (keeping the current behavior). Fixes: https://pagure.io/freeipa/issue/7600 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
2020-02-18 09:24:32 -06:00
org.freeipa.server.trust-enable-agent \
ipa config: add --enable-sid option Add new options to ipa config-mod, allowing to enable SID generation on upgraded servers: ipa config-mod --enable-sid --add-sids --netbios-name NAME The new option uses Dbus to launch an oddjob command, org.freeipa.server.config-enable-sid that runs the installation steps related to SID generation. --add-sids is optional and triggers the sid generation task that populates SID for existing users / groups. --netbios-name is optional and allows to specify the NetBIOS Name. When not provided, the NetBIOS name is generated based on the leading component of the DNS domain name. This command can be run multiple times. Fixes: https://pagure.io/freeipa/issue/8995 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-10-08 08:47:06 -05:00
org.freeipa.server.config-enable-sid \
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
$(NULL)
Build: fix distribution of oddjob files https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 11:05:54 -05:00
dist_dbusconf_DATA = \
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
etc/dbus-1/system.d/oddjob-ipa-trust.conf \
replica install: add remote connection check over API Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:18:21 -06:00
etc/dbus-1/system.d/org.freeipa.server.conf \
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
$(NULL)
Build: fix distribution of oddjob files https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 11:05:54 -05:00
dist_oddjobconf_DATA = \
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
etc/oddjobd.conf.d/oddjobd-ipa-trust.conf \
replica install: add remote connection check over API Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:18:21 -06:00
etc/oddjobd.conf.d/ipa-server.conf \
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
$(NULL)
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
Debian: auto-generate config files for oddjobd The oddjobd config files are now auto-generated with automake to have correct path to libexec on all platforms. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2019-04-23 02:21:37 -05:00
$(dist_oddjobconf_DATA):%: %.in Makefile
$(AM_V_GEN)sed -e 's|@ODDJOBDIR[@]|$(oddjobdir)|g' $< > $@
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
PYTHON_SHEBANG = $(nodist_oddjob_SCRIPTS)
CLEANFILES = $(PYTHON_SHEBANG)
include $(top_srcdir)/Makefile.pythonscripts.am
Reference in New Issue Copy Permalink