IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-24 16:10:02 -06:00
Code Issues Packages Projects Releases Wiki Activity
180414d64d
freeipa/freeipa.spec.in

830 lines
30 KiB
RPMSpec
Raw Normal View History

Add a separate client-only target
2009-10-12 15:00:00 -05:00
# Define ONLY_CLIENT to only make the ipa-client and ipa-python subpackages
Replace uses of %define with %global in the .spec file Fixes rawhide builds per https://www.redhat.com/archives/fedora-devel-list/2010-January/msg00093.html Contributed by Nalin Dahyabhai
2010-01-07 13:12:52 -06:00
%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}
Add a separate client-only target
2009-10-12 15:00:00 -05:00
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
%global alt_name ipa
Replace uses of %define with %global in the .spec file Fixes rawhide builds per https://www.redhat.com/archives/fedora-devel-list/2010-January/msg00093.html Contributed by Nalin Dahyabhai
2010-01-07 13:12:52 -06:00
%global plugin_dir %{_libdir}/dirsrv/plugins
Clean spec file for Fedora 19 This patch includes several cleanups needed for Fedora 19 build: * ipa-kdb is compatible with both krb5 1.10 and 1.11 which contains an updated DAL interface. Remove the conflict from spec file. * Fix ipa-ldap-updater call to produce errors only to avoid cluttering rpm update output * Remove httpd_conf constant which was not used https://fedorahosted.org/freeipa/ticket/3502
2013-03-12 09:25:40 -05:00
%global POLICYCOREUTILSVER 2.1.12-5
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
%global gettext_domain ipa
Use hardening flags for ipa-optd. https://fedorahosted.org/freeipa/ticket/4010
2013-11-27 07:13:16 -06:00
%define _hardened_build 1
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Name: freeipa
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Version: __VERSION__
Release: __RELEASE__%{?dist}
Summary: The Identity, Policy and Audit system
Group: System Environment/Base
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
License: GPLv3+
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
URL: http://www.freeipa.org/
Source0: freeipa-%{version}.tar.gz
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Update SSL ciphers configured in 389-ds-base use configuration parameters to enable ciphers provided by NSS and not considered weak. This requires 389-ds version 1.3.3.2 or later https://fedorahosted.org/freeipa/ticket/4395 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-09-12 05:43:31 -05:00
BuildRequires: 389-ds-base-devel >= 1.3.3.2
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: svrcore-devel
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER}
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
BuildRequires: systemd-units
Require new samba and krb5 Require samba 4.0.5 (passdb API changed). Make sure that we use the right epoch number with samba so that the Requires is correctly enforced. Require krb5 1.11.2-1 to fix missing PAC issue. Also fix backup dir permissions.
2013-04-16 02:44:28 -05:00
BuildRequires: samba-devel >= 2:4.0.5-1
Add support for unified samba packages Fedora 18 and later has moved unified samba and samba4 packages. Update Requires and BuildRequires in spec file to require correct versions. Also require libwbclient-devel which now provides libwbclient.h instead of samba4-devel package. https://fedorahosted.org/freeipa/ticket/3118
2012-10-01 08:32:36 -05:00
BuildRequires: samba-python
BuildRequires: libwbclient-devel
Add all external samba libraries to BuildRequires Also move them in the right spot (if ! only client) so that they are required only when building the server.
2012-07-25 10:23:11 -05:00
BuildRequires: libtalloc-devel
BuildRequires: libtevent-devel
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: nspr-devel
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: nss-devel
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: openssl-devel
BuildRequires: openldap-devel
Clean spec file for Fedora 19 This patch includes several cleanups needed for Fedora 19 build: * ipa-kdb is compatible with both krb5 1.10 and 1.11 which contains an updated DAL interface. Remove the conflict from spec file. * Fix ipa-ldap-updater call to produce errors only to avoid cluttering rpm update output * Remove httpd_conf constant which was not used https://fedorahosted.org/freeipa/ticket/3502
2013-03-12 09:25:40 -05:00
BuildRequires: krb5-devel >= 1.11
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: krb5-workstation
BuildRequires: libuuid-devel
Fix client enrollment Enable GSSAPI credentials delegation in xmlrpc-c/curl to fix client enrollment. The unconditional GSSAPI was previously dropped from curl because of CVE-2011-2192. https://fedorahosted.org/freeipa/ticket/1452
2011-08-11 03:42:29 -05:00
BuildRequires: libcurl-devel >= 7.21.7-2
BuildRequires: xmlrpc-c-devel >= 1.27.4
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: popt-devel
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: m4
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: libtool
BuildRequires: gettext
BuildRequires: python-devel
BuildRequires: python-ldap
Add missing buildrequires
2009-02-23 11:41:00 -06:00
BuildRequires: python-setuptools
BuildRequires: python-krbV
Add API version and have server reject incompatible clients. This patch contains 2 parts. The first part is a small utility to create and validate the current API. To do this it needs to load ipalib which on a fresh system introduces a few problems, namely that it relies on a python plugin to set the default encoding to utf8. For our purposes we can skip that. It is also important that any optional plugins be loadable so the API can be examined. The second part is a version exchange between the client and server. The version has a major and a minor version. The major verion is updated whenever existing API changes. The minor version is updated when new API is added. A request will be rejected if either the major versions don't match or if the client major version is higher than then server major version (though by implication new API would return a command not found if allowed to proceed). To determine the API version of the server from a client use the ping command. ticket 584
2011-01-13 13:29:16 -06:00
BuildRequires: python-nss
BuildRequires: python-netaddr
Implement an IPA Foreman smartproxy server This currently server supports only host and hostgroup commands for retrieving, adding and deleting entries. The incoming requests are completely unauthenticated and by default requests must be local. Utilize GSS-Proxy to manage the TGT. Configuration information is in the ipa-smartproxy man page. Design: http://www.freeipa.org/page/V3/Smart_Proxy https://fedorahosted.org/freeipa/ticket/4128 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2013-12-03 10:14:00 -06:00
BuildRequires: python-kerberos >= 1.1-14
Update spec with missing BuildRequires for pylint check https://fedorahosted.org/freeipa/ticket/1203
2011-05-05 08:06:54 -05:00
BuildRequires: python-rhsm
Add pyOpenSSL as a BuildRequires
2011-02-11 08:34:57 -06:00
BuildRequires: pyOpenSSL
Update spec with missing BuildRequires for pylint check https://fedorahosted.org/freeipa/ticket/1203
2011-05-05 08:06:54 -05:00
BuildRequires: pylint
Replace broken i18n shell test with Python test We had been using shell scripts and sed to test our translations. But trying to edit pot and po files with sed is nearly impossible because the file format can vary significantly and the sed editing was failing and gettext tools were complaining about our test strategy. We had been using a Python script (test_i18n.py) to perform the actual test after using shell, sed, and gettext tools to create the files. There is a Python library (polib) which can read/write/edit pot/po/mo files (used internally by Transifex, our translation portal). The strategy now is to do everything in Python (in test_i18n.py). This is easier, more robust and allows us to do more things. * add python-polib to BuildRequires * Remove the logic for creating the test lang from Makefile.in and replace it with calls to test_i18n.py * add argument parsing, usage, configuration parameters, etc. to test_i18n.py to make it easier to use and configurable. * add function to generate a test po and mo file. It also writes the files and creates the test directory structure. * Took the existing validate code and refactored it into validation function. It used to just pick one string and test it, now it iterates over all strings and all plural forms. * Validate anonymous Python format substitutions in pot file * added support for plural forms. * Add pot po file validation for variable substitution * In install/po subdir you can now do: $ make test $ make validate-pot $ make validate-po * The options for running test_i18n.py are: $ ./test_i18n.py --help Usage: test_i18n.py --test-gettext test_i18n.py --create-test test_i18n.py --validate-pot [pot_file1, ...] test_i18n.py --validate-po po_file1 [po_file2, ...] Options: -h, --help show this help message and exit -s, --show-strings show the offending string when an error is detected --pedantic be aggressive when validating -v, --verbose be informative --traceback print the traceback when an exception occurs Operational Mode: You must select one these modes to run in -g, --test-gettext create the test translation file(s) and exercise them -c, --create-test create the test translation file(s) -P, --validate-pot validate pot file(s) -p, --validate-po validate po file(s) Run Time Parameters: These may be used to modify the run time defaults --test-lang=TEST_LANG test po file uses this as it's basename (default=test) --lang=LANG lang used for locale, MUST be a valid lang (default=xh_ZA) --domain=DOMAIN translation domain used during test (default=ipa) --locale=LOCALE locale used during test (default=test_locale) --pot-file=POT_FILE default pot file, used when validating pot file or generating test po and mo files (default=ipa.pot) https://fedorahosted.org/freeipa/ticket/2044
2012-03-23 00:44:04 -05:00
BuildRequires: python-polib
Add hbactest command. https://fedorahosted.org/freeipa/ticket/386 HBAC rules control who can access what services on what hosts and from where. You can use HBAC to control which users or groups on a source host can access a service, or group of services, on a target host. Since applying HBAC rules implies use of a production environment, this plugin aims to provide simulation of HBAC rules evaluation without having access to the production environment. Test user coming from source host to a service on a named host against existing enabled rules. ipa hbactest --user= --srchost= --host= --service= [--rules=rules-list] [--nodetail] [--enabled] [--disabled] --user, --srchost, --host, and --service are mandatory, others are optional. If --rules is specified simulate enabling of the specified rules and test the login of the user using only these rules. If --enabled is specified, all enabled HBAC rules will be added to simulation If --disabled is specified, all disabled HBAC rules will be added to simulation If --nodetail is specified, do not return information about rules matched/not matched. If both --rules and --enabled are specified, apply simulation to --rules _and_ all IPA enabled rules. If no --rules specified, simulation is run against all IPA enabled rules. EXAMPLES: 1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 2. Disable detailed summary of how rules were applied: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail -------------------- Access granted: True -------------------- 3. Test explicitly specified HBAC rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: myrule 4. Use all enabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 5. Test all disabled HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled --------------------- Access granted: False --------------------- notmatched: new-rule 6. Test all disabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule 7. Test all (enabled and disabled) HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule notmatched: new-rule matched: allow_all Only rules existing in IPA database are tested. They may be in enabled or disabled disabled state. Specifying them through --rules option explicitly enables them only in simulation run. Specifying non-existing rules will not grant access and report non-existing rules in output.
2011-07-22 08:30:44 -05:00
BuildRequires: libipa_hbac-python
Tweak the session auth to reflect developer consensus. * Increase the session ID from 48 random bits to 128. * Implement the sesison_logout RPC command. It permits the UI to send a command that destroys the users credentials in the current session. * Restores the original web URL's and their authentication protections. Adds a new URL for sessions /ipa/session/json. Restores the original Kerberos auth which was for /ipa and everything below. New /ipa/session/json URL is treated as an exception and turns all authenticaion off. Similar to how /ipa/ui is handled. * Refactor the RPC handlers in rpcserver.py such that there is one handler per URL, specifically one handler per RPC and AuthMechanism combination. * Reworked how the URL names are used to map a URL to a handler. Previously it only permitted one level in the URL path hierarchy. We now dispatch on more that one URL path component. * Renames the api.Backend.session object to wsgi_dispatch. The use of the name session was historical and is now confusing since we've implemented sessions in a different location than the api.Backend.session object, which is really a WSGI dispatcher, hence the new name wsgi_dispatch. * Bullet-proof the setting of the KRB5CCNAME environment variable. ldap2.connect already sets it via the create_context() call but just in case that's not called or not called early enough (we now have other things besides ldap which need the ccache) we explicitly set it early as soon as we know it. * Rework how we test for credential validity and expiration. The previous code did not work with s4u2proxy because it assumed the existance of a TGT. Now we first try ldap credentials and if we can't find those fallback to the TGT. This logic was moved to the KRB5_CCache object, it's an imperfect location for it but it's the only location that makes sense at the moment given some of the current code limitations. The new methods are KRB5_CCache.valid() and KRB5_CCache.endtime(). * Add two new classes to session.py AuthManager and SessionAuthManager. Their purpose is to emit authication events to interested listeners. At the moment the logout event is the only event, but the framework should support other events as they arise. * Add BuildRequires python-memcached to freeipa.spec.in * Removed the marshaled_dispatch method, it was cruft, no longer referenced. https://fedorahosted.org/freeipa/ticket/2362
2012-02-15 09:26:42 -06:00
BuildRequires: python-memcached
Specify includedir in krb5.conf on new installs https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:59:04 -05:00
BuildRequires: sssd >= 1.9.2
Add missing BuildRequires Since our build process runs pylint, we need all Python dependencies installed at RPM creation time. This adds python-lxml and python-pyasn1 to BuildRequires. https://fedorahosted.org/freeipa/ticket/2538
2012-03-23 11:21:08 -05:00
BuildRequires: python-lxml
BuildRequires: python-pyasn1 >= 0.0.9a
Update qrcode support for newer python-qrcode This substantially reduces the FreeIPA dependencies and allows QR codes to fit in a standard terminal. https://fedorahosted.org/freeipa/ticket/4430 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-10 16:35:37 -05:00
BuildRequires: python-qrcode-core >= 5.0.0
Replace DNS client based on acutil with python-dns IPA client and server tool set used authconfig acutil module to for client DNS operations. This is not optimal DNS interface for several reasons: - does not provide native Python object oriented interface but but rather C-like interface based on functions and structures which is not easy to use and extend - acutil is not meant to be used by third parties besides authconfig and thus can break without notice Replace the acutil with python-dns package which has a feature rich interface for dealing with all different aspects of DNS including DNSSEC. The main target of this patch is to replace all uses of acutil DNS library with a use python-dns. In most cases, even though the larger parts of the code are changed, the actual functionality is changed only in the following cases: - redundant DNS checks were removed from verify_fqdn function in installutils to make the whole DNS check simpler and less error-prone. Logging was improves for the remaining checks - improved logging for ipa-client-install DNS discovery https://fedorahosted.org/freeipa/ticket/2730 https://fedorahosted.org/freeipa/ticket/1837
2012-05-11 07:38:09 -05:00
BuildRequires: python-dns
trusts: replace use of python-crypto by m2crypto python-crypto package is not available everywhere, use m2crypto instead. Originally we thought to extend python-krbV to provide krb5_c_encrypt() wrapper but m2crypto is readily available. https://fedorahosted.org/freeipa/ticket/3271
2012-11-21 10:33:49 -06:00
BuildRequires: m2crypto
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
BuildRequires: check
Add external domain extop DS plugin This extop can be used by clients of the IPA domain, e.g. sssd, to retrieve data from trusted external domains. It can be used e.g. to map Windows SIDs to user or groups names and back.
2011-11-30 06:29:10 -06:00
BuildRequires: libsss_idmap-devel
Add libsss_nss_idmap-devel to BuildRequires
2013-07-11 06:33:31 -05:00
BuildRequires: libsss_nss_idmap-devel
Change BuildRequires for Java Requiring a specific version of Java leads to breakages, like the one happening on nightly builds in Fedora Rawhide right now. We should use the more generic 'java' BuildRequires instead of the versioned one. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-08-20 06:56:59 -05:00
BuildRequires: java-headless
Add missing dependency We use Java classes which are bundled with rhino when uglifying Javascript sources at build-time, so we need rhino at build-time. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-03-13 16:09:49 -05:00
BuildRequires: rhino
Add the krb5/FreeIPA RADIUS companion daemon This daemon listens for RADIUS packets on a well known UNIX domain socket. When a packet is received, it queries LDAP to see if the user is configured for RADIUS authentication. If so, then the packet is forwarded to the 3rd party RADIUS server. Otherwise, a bind is attempted against the LDAP server. https://fedorahosted.org/freeipa/ticket/3366 http://freeipa.org/page/V3/OTP
2013-04-11 13:03:25 -05:00
BuildRequires: libverto-devel
BuildRequires: systemd
Use libunistring ulc_casecmp() on unicode strings https://fedorahosted.org/freeipa/ticket/3772
2013-07-16 10:47:27 -05:00
BuildRequires: libunistring-devel
RCUE initial commit https://fedorahosted.org/freeipa/ticket/3902
2013-10-10 06:41:31 -05:00
BuildRequires: python-lesscpy
Add python-yubico to BuildRequires python-yubico needs to be on a machine to be able to build FreeIPA. Without it, even ./makeapi and ./makeaci fails.
2014-06-27 03:16:41 -05:00
BuildRequires: python-yubico
freeipa.spec.in: Add python-backports-ssl_match_hostname to BuildRequires This patch adds an explicit build dependency to python-backports-ssl_match_hostname. Without it, the build-time lint would fail. https://fedorahosted.org/freeipa/ticket/4515 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-09-02 09:43:10 -05:00
BuildRequires: python-backports-ssl_match_hostname
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof).
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%package server
Summary: The IPA authentication server
Group: System Environment/Base
Requires: %{name}-python = %{version}-%{release}
Requires: %{name}-client = %{version}-%{release}
Requires: %{name}-admintools = %{version}-%{release}
Update SSL ciphers configured in 389-ds-base use configuration parameters to enable ciphers provided by NSS and not considered weak. This requires 389-ds version 1.3.3.2 or later https://fedorahosted.org/freeipa/ticket/4395 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-09-12 05:43:31 -05:00
Requires: 389-ds-base >= 1.3.3.2
Fix SASL_NOCANON behavior for LDAPI Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for socket based connections (#960222).
2013-05-10 06:50:21 -05:00
Requires: openldap-clients > 2.4.35-4
Require version of NSS that properly parses base64-encoded certs There were cases where a base64-encoded cert with no header/footer would not be handled properly and rejected. This was causing the CA install to fail. https://fedorahosted.org/freeipa/ticket/3586
2013-04-26 11:36:05 -05:00
Requires: nss >= 3.14.3-12.0
Requires: nss-tools >= 3.14.3-12.0
Update freeipa-server krb5-server dependency to 1.11.5-5 Previous versions of libkrb5 can't handle expired passwords inside the FAST tunnel. This breaks the password change UI in FreeIPA. Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-21 11:32:03 -05:00
Requires: krb5-server >= 1.11.5-5
Add krb5-pkinit-openssl as a Requires on ipa-server package ticket 599
2010-12-13 13:46:09 -06:00
Requires: krb5-pkinit-openssl
Add an arch-specific Requires on cyrus-sasl-gssapi If you had a 64-bit system and installed a 32-bit version of IPA then ipa-getkeytab probably wouldn't work because yum wouldn't know to pull in the 32-bit version of cyrus-sasl-gssapi. https://fedorahosted.org/freeipa/ticket/1499
2011-07-22 08:06:13 -05:00
Requires: cyrus-sasl-gssapi%{?_isa}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: ntp
Remove mod_ssl port workaround. https://fedorahosted.org/freeipa/ticket/4021
2013-11-26 02:53:34 -06:00
Requires: httpd >= 2.4.6-6
Run ipaserver under mod_wsgi
2010-02-24 12:29:23 -06:00
Requires: mod_wsgi
Fix compatibility with Fedora 18. We need a Requires on openssl, the mod_rewrite syntax has changed so we can dump some unused configuration and we need a newer version of mod_auth_kerb to pick up the new location of delegated ccache. https://fedorahosted.org/freeipa/ticket/2839
2012-06-20 13:09:55 -05:00
Requires: mod_auth_kerb >= 5.4-16
Remove mod_ssl port workaround. https://fedorahosted.org/freeipa/ticket/4021
2013-11-26 02:53:34 -06:00
Requires: mod_nss >= 1.0.8-26
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: python-ldap
Requires: python-krbV
Requires: acl
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
Requires: python-pyasn1
Add ipa_memcached service * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
2012-02-06 12:15:06 -06:00
Requires: memcached
Requires: python-memcached
Use certmonger D-Bus API to configure certmonger in CA install. Before, certmonger was configured by modifying its internal database directly. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2013-10-15 13:49:07 -05:00
Requires: dbus-python
Remove syslog.target from ipa.server This required target is no longer needed as systemd from version 38 has its own journal which is also in the basic set of service unit requirementes. https://fedorahosted.org/freeipa/ticket/3511
2013-03-27 08:58:16 -05:00
Requires: systemd-units >= 38
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
Requires(pre): systemd-units
Requires(post): systemd-units
Use autobind when updating CA people entries during certificate renewal Requires fix for <https://bugzilla.redhat.com/show_bug.cgi?id=1122110>, bump selinux-policy in the spec file. https://fedorahosted.org/freeipa/ticket/4005 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-09-02 04:28:16 -05:00
Requires: selinux-policy >= 3.12.1-179
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires(post): selinux-policy-base
Add requires for slapi-nis and SSSD Require slapi-nis 0.47.7 and sssd 1.11.0-0.1.beta2 required for core features of 3.3.0 release.
2013-08-08 07:39:14 -05:00
Requires: slapi-nis >= 0.47.7
Dogtag 10.2 to spec.file Dogtag 10.2 is required due to support a Vault feature Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-09-12 06:19:40 -05:00
Requires: pki-ca >= 10.2.0
Requires: pki-kra >= 10.2.0
Add subscription-manager dependency for RHEL. ticket 1664
2011-08-23 07:15:27 -05:00
%if 0%{?rhel}
Requires: subscription-manager
%endif
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
Requires(preun): python systemd-units
Requires(postun): python systemd-units
Replace DNS client based on acutil with python-dns IPA client and server tool set used authconfig acutil module to for client DNS operations. This is not optimal DNS interface for several reasons: - does not provide native Python object oriented interface but but rather C-like interface based on functions and structures which is not easy to use and extend - acutil is not meant to be used by third parties besides authconfig and thus can break without notice Replace the acutil with python-dns package which has a feature rich interface for dealing with all different aspects of DNS including DNSSEC. The main target of this patch is to replace all uses of acutil DNS library with a use python-dns. In most cases, even though the larger parts of the code are changed, the actual functionality is changed only in the following cases: - redundant DNS checks were removed from verify_fqdn function in installutils to make the whole DNS check simpler and less error-prone. Logging was improves for the remaining checks - improved logging for ipa-client-install DNS discovery https://fedorahosted.org/freeipa/ticket/2730 https://fedorahosted.org/freeipa/ticket/1837
2012-05-11 07:38:09 -05:00
Requires: python-dns
Create Firefox extension on upgrade and replica-install If the signing cert is not available, create an unsigned extension. Add a zip dependency to the specfile. https://fedorahosted.org/freeipa/ticket/3150
2012-10-08 06:54:47 -05:00
Requires: zip
Avoid uninstalling dependencies during package lifetime Requires(pre) only guarantees that package will be present before package scriptlets are run. However, the package can be removed after installation is finished without removing also IPA. Add standard Requires for these dependencies. Remove PRE version number from VERSION. This update and following is done on a top of IPA 3.0.0 GA. https://fedorahosted.org/freeipa/ticket/3189
2012-10-24 05:35:36 -05:00
Requires: policycoreutils >= %{POLICYCOREUTILSVER}
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
Requires: tar
Use certmonger D-Bus API instead of messing with its files. FreeIPA certmonger module changed to use D-Bus to communicate with certmonger. Using the D-Bus API should be more stable and supported way of using cermonger than tampering with its files. >=certmonger-0.75.13 is needed for this to work. https://fedorahosted.org/freeipa/ticket/4280 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-09-03 02:07:16 -05:00
Requires(pre): certmonger >= 0.75.13
Update SSL ciphers configured in 389-ds-base use configuration parameters to enable ciphers provided by NSS and not considered weak. This requires 389-ds version 1.3.3.2 or later https://fedorahosted.org/freeipa/ticket/4395 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-09-12 05:43:31 -05:00
Requires(pre): 389-ds-base >= 1.3.3.2
Use only system fonts This commit changes how fonts are used. - remove usage of bundled fonts and only system fonts are used instead - by using alias in httpd conf - by using local("Font Name") directive in font-face - removed usage of overpass font - redefined Open Sans font-face declarations. Note: upstream is doing the same change so we will be fine on upgrade. - introduce variable.less for variable definitions and overrides. This file will be very useful when we upgrade to newer RCUE so we will be able to redefine their and bootstrap's variables. Fixes: https://fedorahosted.org/freeipa/ticket/2861
2013-12-04 09:15:20 -06:00
Requires: fontawesome-fonts
Requires: open-sans-fonts
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-server
Obsoletes: %{alt_name}-server < %{version}
Drop SELinux subpackage All SELinux policy needed by FreeIPA server is now part of the global system SELinux policy which makes the subpackage redundant and slowing down the installation. This patch drops it. https://fedorahosted.org/freeipa/ticket/3683 https://fedorahosted.org/freeipa/ticket/3684
2013-06-13 07:40:52 -05:00
# With FreeIPA 3.3, package freeipa-server-selinux was obsoleted as the
# entire SELinux policy is stored in the system policy
Obsoletes: freeipa-server-selinux < 3.3.0
Set bind and bind-dyndb-ldap min nvr This is a soft dependency, min nvr version will only be required when bind/bind-dyndb-ldap are installed. https://fedorahosted.org/freeipa/ticket/1121 https://fedorahosted.org/freeipa/ticket/1573
2011-09-09 05:30:00 -05:00
# We have a soft-requires on bind. It is an optional part of
# IPA but if it is configured we need a way to require versions
# that work for us.
Prepare spec for 4.0 release - Bump 389-ds-base requires to fix the deref call with new ACIs: https://fedorahosted.org/freeipa/ticket/4389 - Bump bind-dyndb-ldap Conflicts to fetch the DNSSEC capability - Bump selinux-policy to fix the CRL retrieval: https://fedorahosted.org/freeipa/ticket/4369 - Remove conditionals for Fedora < 20 as FreeIPA 4.0 is not planned to be released on these platforms. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:35:17 -05:00
Conflicts: bind-dyndb-ldap < 5.0
Allow port numbers for idnsForwarders Let user enter custom ports for zone conditional forwarders or global forwarders in dnsconfig. Ports can be specified in a standard BIND format: IP_ADDRESS [port PORT] https://fedorahosted.org/freeipa/ticket/2462
2012-03-20 09:35:54 -05:00
Conflicts: bind < 9.8.2-0.4.rc2
Set bind and bind-dyndb-ldap min nvr This is a soft dependency, min nvr version will only be required when bind/bind-dyndb-ldap are installed. https://fedorahosted.org/freeipa/ticket/1121 https://fedorahosted.org/freeipa/ticket/1573
2011-09-09 05:30:00 -05:00
Drop uniqueMember mapping with nss-pam-ldapd. nss-pam-ldapd in 0.8.4 changed the default to map uniqueMember to member so it is no longer needed in the config file, and in fact causes an error to be raised. Add a Conflicts on older versions. https://fedorahosted.org/freeipa/ticket/3589
2013-04-30 13:35:19 -05:00
# Versions of nss-pam-ldapd < 0.8.4 require a mapping from uniqueMember to
# member.
Conflicts: nss-pam-ldapd < 0.8.4
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description server
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). If you are installing an IPA server you need
to install this package (in other words, most people should NOT install
this package).
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
%package server-trust-ad
Summary: Virtual package to install packages required for Active Directory trusts
Group: System Environment/Base
Requires: %{name}-server = %version-%release
trusts: replace use of python-crypto by m2crypto python-crypto package is not available everywhere, use m2crypto instead. Originally we thought to extend python-krbV to provide krb5_c_encrypt() wrapper but m2crypto is readily available. https://fedorahosted.org/freeipa/ticket/3271
2012-11-21 10:33:49 -06:00
Requires: m2crypto
Add support for unified samba packages Fedora 18 and later has moved unified samba and samba4 packages. Update Requires and BuildRequires in spec file to require correct versions. Also require libwbclient-devel which now provides libwbclient.h instead of samba4-devel package. https://fedorahosted.org/freeipa/ticket/3118
2012-10-01 08:32:36 -05:00
Requires: samba-python
Require new samba and krb5 Require samba 4.0.5 (passdb API changed). Make sure that we use the right epoch number with samba so that the Requires is correctly enforced. Require krb5 1.11.2-1 to fix missing PAC issue. Also fix backup dir permissions.
2013-04-16 02:44:28 -05:00
Requires: samba >= 2:4.0.5-1
Add support for unified samba packages Fedora 18 and later has moved unified samba and samba4 packages. Update Requires and BuildRequires in spec file to require correct versions. Also require libwbclient-devel which now provides libwbclient.h instead of samba4-devel package. https://fedorahosted.org/freeipa/ticket/3118
2012-10-01 08:32:36 -05:00
Requires: samba-winbind
Requires: libsss_idmap
Resolve SIDs in Web UI Introduce new command, 'trust-resolve', to aid resolving SIDs to names in the Web UI. The command uses new SSSD interface, nss_idmap, to resolve actual SIDs. SSSD caches resolved data so that future requests to resolve same SIDs are returned from a memory cache. Web UI code is using Dojo/Deferred to deliver result of SID resolution out of band. Once resolved names are available, they replace SID values. Since Web UI only shows ~20 records per page, up to 20 SIDs are resolved at the same time. They all sent within the single request to the server. https://fedorahosted.org/freeipa/ticket/3302
2013-05-06 10:10:56 -05:00
Requires: libsss_nss_idmap-python
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
# We use alternatives to divert winbind_krb5_locator.so plugin to libkrb5
# on the installes where server-trust-ad subpackage is installed because
# IPA AD trusts cannot be used at the same time with the locator plugin
# since Winbindd will be configured in a different mode
Requires(post): %{_sbindir}/update-alternatives
Restart httpd if ipa-server-trust-ad is installed or updated If ipa-server-trust-ad is installed after the ipa server is installed and configured, httpd needs a restart for additional python modules to be loaded into httpd on IPA initialization. Fixes https://fedorahosted.org/freeipa/ticket/3185
2012-10-26 06:12:17 -05:00
Requires(post): python
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
Requires(postun): %{_sbindir}/update-alternatives
Requires(preun): %{_sbindir}/update-alternatives
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-server-trust-ad
Obsoletes: %{alt_name}-server-trust-ad < %{version}
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
%description server-trust-ad
Fix selected minor issues in the spec file and license This patch fixes: - too long description for server-trust-ad subpackage - adds (noreplace) flag %{_sysconfdir}/tmpfiles.d/ipa.conf to avoid overwriting potential user changes - changes permissions on default_encoding_utf8.so to prevent it pollute python subpackage Provides. - wrong address in GPL v2 license preamble in 2 distributed files https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:59:57 -05:00
Cross-realm trusts with Active Directory in IPA require working Samba 4
installation. This package is provided for convenience to install all required
dependencies at once.
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%package client
Summary: IPA authentication for use on clients
Group: System Environment/Base
Requires: %{name}-python = %{version}-%{release}
Requires: python-ldap
Add an arch-specific Requires on cyrus-sasl-gssapi If you had a 64-bit system and installed a 32-bit version of IPA then ipa-getkeytab probably wouldn't work because yum wouldn't know to pull in the 32-bit version of cyrus-sasl-gssapi. https://fedorahosted.org/freeipa/ticket/1499
2011-07-22 08:06:13 -05:00
Requires: cyrus-sasl-gssapi%{?_isa}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: ntp
Requires: krb5-workstation
Requires: authconfig
Requires: pam_krb5
Use OpenSSL for SSL instead of the built-in python version.
2009-02-19 16:20:37 -06:00
Requires: wget
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
Requires: libcurl >= 7.21.7-2
Requires: xmlrpc-c >= 1.27.4
Require new SSSD to pull required AD subdomain fixes
2013-10-04 03:23:14 -05:00
Requires: sssd >= 1.11.1
Add CA certificate management tool ipa-cacert-manage. Part of https://fedorahosted.org/freeipa/ticket/3737 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-03-13 04:28:27 -05:00
Requires: certmonger >= 0.75.6
Clean up the spec file, add Requires for nss-pam-ldapd for F14+ Also do the following: - Remove conflicts on mod_ssl - Remove a lot of version checking for EOL'd Fedora versions - Add a few conditionals for rhel6 - Add Requires of nss-tools on ipa-client
2010-09-09 17:10:14 -05:00
Requires: nss-tools
Try to register DNS name through a DNS Update on install. Fixes: https://fedorahosted.org/freeipa/ticket/935
2011-02-17 07:30:36 -06:00
Requires: bind-utils
Add Requires to ipa-client on oddjob-mkhomedir https://fedorahosted.org/freeipa/ticket/2337
2012-02-27 03:59:25 -06:00
Requires: oddjob-mkhomedir
Add requires on python-krbV to client subpackage This is needed since ipa-client-install initializes the ipalib api. https://fedorahosted.org/freeipa/ticket/2577
2012-03-28 01:51:02 -05:00
Requires: python-krbV
Replace DNS client based on acutil with python-dns IPA client and server tool set used authconfig acutil module to for client DNS operations. This is not optimal DNS interface for several reasons: - does not provide native Python object oriented interface but but rather C-like interface based on functions and structures which is not easy to use and extend - acutil is not meant to be used by third parties besides authconfig and thus can break without notice Replace the acutil with python-dns package which has a feature rich interface for dealing with all different aspects of DNS including DNSSEC. The main target of this patch is to replace all uses of acutil DNS library with a use python-dns. In most cases, even though the larger parts of the code are changed, the actual functionality is changed only in the following cases: - redundant DNS checks were removed from verify_fqdn function in installutils to make the whole DNS check simpler and less error-prone. Logging was improves for the remaining checks - improved logging for ipa-client-install DNS discovery https://fedorahosted.org/freeipa/ticket/2730 https://fedorahosted.org/freeipa/ticket/1837
2012-05-11 07:38:09 -05:00
Requires: python-dns
Configure automount using autofs or sssd. This script edits nsswitch.conf to use either ldap (autofs) or sss (sssd) to find automount maps. NFSv4 services are started so Kerberos encryption and/or integrity can be used on the maps. https://fedorahosted.org/freeipa/ticket/1233 https://fedorahosted.org/freeipa/ticket/2193
2012-05-29 13:20:38 -05:00
Requires: libsss_autofs
Requires: autofs
Requires: libnfsidmap
Requires: nfs-utils
CLIENT: Explicitly require python-backports-ssl_match_hostname Without python-backports-ssl_match_hostname installed, an ipa-client installation could have failed with: from backports.ssl_match_hostname import match_hostname ImportError: No module named ssl_match_hostname This patch adds an explicit dependency to python-backports-ssl_match_hostname. https://fedorahosted.org/freeipa/ticket/4515 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-09-01 06:01:41 -05:00
Requires: python-backports-ssl_match_hostname
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
Requires(post): policycoreutils
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-client
Obsoletes: %{alt_name}-client < %{version}
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description client
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). If your network uses IPA for authentication,
this package should be installed on every client machine.
%package admintools
Summary: IPA administrative tools
Group: System Environment/Base
Requires: %{name}-python = %{version}-%{release}
Add Requires on ipa-client to ipa-admintools, ensure ipa client is configured It makes little sense to install ipa-admintools without ipa-client, require it. Also see if the client has been configured. This is a bit tricky since we have a full set of defaults. Add a new env option that gets set if at least one configuration file is loaded. ticket 213
2010-10-15 14:03:51 -05:00
Requires: %{name}-client = %{version}-%{release}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: python-krbV
Requires: python-ldap
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-admintools
Obsoletes: %{alt_name}-admintools < %{version}
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description admintools
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). This package provides command-line tools for
IPA administrators.
%package python
Summary: Python libraries used by IPA
Group: System Environment/Libraries
Python-kerberos update in freeipa.spec.in Remove duplicated entry in BuildRequires Minimal version 1.1-14 is required for ipapython Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-06-09 08:41:45 -05:00
Requires: python-kerberos >= 1.1-14
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: gnupg
Parse netmasks in IP addresses passed to server install. ticket 1212
2011-05-27 13:17:22 -05:00
Requires: iproute
Move requirement for keyutils to freeipa-python package There was already a dependency in server package, however, the correct place for such dependency is in freeipa-python, since the relevant code using keyutils resides there. Both freeipa-server and freeipa-client require freeipa-python. https://fedorahosted.org/freeipa/ticket/3808
2013-07-23 10:21:47 -05:00
Requires: keyutils
Use OpenSSL for SSL instead of the built-in python version.
2009-02-19 16:20:37 -06:00
Requires: pyOpenSSL
Support requests with SAN in cert-request. For each SAN in a request there must be a matching service entry writable by the requestor. Users can request certificates with SAN only if they have "Request Certificate With SubjectAltName" permission. https://fedorahosted.org/freeipa/ticket/3977 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-18 02:02:03 -05:00
Requires: python-nss >= 0.15
Require current versions of python-nss & python-lxml ipa.spec.in | 3 ++- ipapython/nsslib.py | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
2009-11-23 15:52:06 -06:00
Requires: python-lxml
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
Requires: python-netaddr
Add hbactest command. https://fedorahosted.org/freeipa/ticket/386 HBAC rules control who can access what services on what hosts and from where. You can use HBAC to control which users or groups on a source host can access a service, or group of services, on a target host. Since applying HBAC rules implies use of a production environment, this plugin aims to provide simulation of HBAC rules evaluation without having access to the production environment. Test user coming from source host to a service on a named host against existing enabled rules. ipa hbactest --user= --srchost= --host= --service= [--rules=rules-list] [--nodetail] [--enabled] [--disabled] --user, --srchost, --host, and --service are mandatory, others are optional. If --rules is specified simulate enabling of the specified rules and test the login of the user using only these rules. If --enabled is specified, all enabled HBAC rules will be added to simulation If --disabled is specified, all disabled HBAC rules will be added to simulation If --nodetail is specified, do not return information about rules matched/not matched. If both --rules and --enabled are specified, apply simulation to --rules _and_ all IPA enabled rules. If no --rules specified, simulation is run against all IPA enabled rules. EXAMPLES: 1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 2. Disable detailed summary of how rules were applied: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail -------------------- Access granted: True -------------------- 3. Test explicitly specified HBAC rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: myrule 4. Use all enabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 5. Test all disabled HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled --------------------- Access granted: False --------------------- notmatched: new-rule 6. Test all disabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule 7. Test all (enabled and disabled) HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule notmatched: new-rule matched: allow_all Only rules existing in IPA database are tested. They may be in enabled or disabled disabled state. Specifying them through --rules option explicitly enables them only in simulation run. Specifying non-existing rules will not grant access and report non-existing rules in output.
2011-07-22 08:30:44 -05:00
Requires: libipa_hbac-python
Update qrcode support for newer python-qrcode This substantially reduces the FreeIPA dependencies and allows QR codes to fit in a standard terminal. https://fedorahosted.org/freeipa/ticket/4430 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-10 16:35:37 -05:00
Requires: python-qrcode-core >= 5.0.0
Add missing dependencies to freeipa-python package python-pyasn1 and python-qrcode were imported by ipalib but not required by python subpackage. https://fedorahosted.org/freeipa/ticket/4275 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-26 06:49:56 -05:00
Requires: python-pyasn1
Implement OTP token importing This patch adds support for importing tokens using RFC 6030 key container files. This includes decryption support. For sysadmin sanity, any tokens which fail to add will be written to the output file for examination. The main use case here is where a small subset of a large set of tokens fails to validate or add. Using the output file, the sysadmin can attempt to recover these specific tokens. This code is implemented as a server-side script. However, it doesn't actually need to run on the server. This was done because importing is an odd fit for the IPA command framework: 1. We need to write an output file. 2. The operation may be long-running (thousands of tokens). 3. Only admins need to perform this task and it only happens infrequently. https://fedorahosted.org/freeipa/ticket/4261 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-08 10:06:16 -05:00
Requires: python-dateutil
Add the otptoken-add-yubikey command This command behaves almost exactly like otptoken-add except: 1. The new token data is written directly to a YubiKey 2. The vendor/model/serial fields are populated from the YubiKey Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-06-19 11:28:32 -05:00
Requires: python-yubico
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-python
Obsoletes: %{alt_name}-python < %{version}
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description python
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). If you are using IPA you need to install this
package.
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
%if ! %{ONLY_CLIENT}
%package tests
Summary: IPA tests and test tools
Requires: %{name}-client = %{version}-%{release}
Requires: %{name}-python = %{version}-%{release}
Add tar and xz dependencies to the freeipa-tests package The beakerLib plugin collects log files via compressed tarballs, so these dependencies are needed
2013-07-24 07:43:43 -05:00
Requires: tar
Requires: xz
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
Requires: python-nose
Requires: python-paste
Requires: python-coverage
Requires: python-polib
Allow freeipa-tests to work with older paramiko versions The integration testing framework used Paramiko SFTP files as context managers. This feature is only available in Paramiko 1.10+. Use an explicit context manager so that we don't rely on the feature.
2013-08-12 08:38:32 -05:00
Requires: python-paramiko >= 1.7.7
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-tests
Obsoletes: %{alt_name}-tests < %{version}
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
%description tests
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof).
This package contains tests that verify IPA functionality.
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%prep
%setup -n freeipa-%{version} -q
%build
Increase Java stack size for Web UI build on aarch64 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-21 03:06:03 -05:00
%ifarch ppc %{power64} s390 s390x aarch64
Increase Java stack size on s390 platforms As reported in https://bugzilla.redhat.com/show_bug.cgi?id=1040576, the default stack trace needs to be also increased on s390 platforms to prevent rhino segfault.
2014-01-03 06:52:54 -06:00
# UI compilation segfaulted on some arches when the stack was lower (#1040576)
Increase Java stack size on PPC platforms Wit the default stack size, rhino segfaulted on PPC platforms. https://bugzilla.redhat.com/show_bug.cgi?id=1040576
2013-12-13 08:20:40 -06:00
export JAVA_STACK_SIZE="8m"
%endif
Prefer user CFLAGS/CPPFLAGS over those provided by rpmbuild in the spec file. https://fedorahosted.org/freeipa/ticket/3896
2013-12-04 11:37:18 -06:00
export CFLAGS="%{optflags} $CFLAGS"
Include LDFLAGS provided by rpmbuild in global LDFLAGS in the spec file. Remove explicitly specified hardening flags from LDFLAGS in ipa-otpd. https://fedorahosted.org/freeipa/ticket/3896
2013-12-04 11:39:44 -06:00
export LDFLAGS="%{__global_ldflags} $LDFLAGS"
ipalib.version: Add VENDOR_VERSION This will allow us to make vendors' lives easier by embedding a vendor tag to installation logs. Part of the work for: https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-03-13 08:39:03 -05:00
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
# Force re-generate of platform support
ipalib.version: Add VENDOR_VERSION This will allow us to make vendors' lives easier by embedding a vendor tag to installation logs. Part of the work for: https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-03-13 08:39:03 -05:00
export IPA_VENDOR_VERSION_SUFFIX=-%{release}
ipaplatform: Change makefiles to accomodate for new platform package https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-02 00:50:12 -05:00
rm -f ipapython/version.py
rm -f ipaplatform/services.py
rm -f ipaplatform/tasks.py
rm -f ipaplatform/paths.py
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
make version-update
Drop --with-openldap option in the client. This is no longer optional.
2010-06-02 13:54:58 -05:00
cd ipa-client; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Make use of mozldap vs openldap for plugins selectable
2010-12-03 14:02:29 -06:00
cd daemons; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir} --with-openldap; cd ..
Complete consolidation into a single autogen.sh
2009-02-03 15:56:41 -06:00
cd install; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Multi-process build problems Fix a problem when a target missed a version-update requirement. This caused build problems, especially in a parallel build environment. https://fedorahosted.org/freeipa/ticket/1215
2011-06-17 03:58:01 -05:00
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} all
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%else
Multi-process build problems Fix a problem when a target missed a version-update requirement. This caused build problems, especially in a parallel build environment. https://fedorahosted.org/freeipa/ticket/1215
2011-06-17 03:58:01 -05:00
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} client
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%install
rm -rf %{buildroot}
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
# Force re-generate of platform support
ipalib.version: Add VENDOR_VERSION This will allow us to make vendors' lives easier by embedding a vendor tag to installation logs. Part of the work for: https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-03-13 08:39:03 -05:00
export IPA_VENDOR_VERSION_SUFFIX=-%{release}
ipaplatform: Change makefiles to accomodate for new platform package https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-02 00:50:12 -05:00
rm -f ipapython/version.py
rm -f ipaplatform/services.py
rm -f ipaplatform/tasks.py
rm -f ipaplatform/paths.py
ipalib.version: Add VENDOR_VERSION This will allow us to make vendors' lives easier by embedding a vendor tag to installation logs. Part of the work for: https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-03-13 08:39:03 -05:00
make version-update
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
make install DESTDIR=%{buildroot}
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%else
make client-install DESTDIR=%{buildroot}
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
%find_lang %{gettext_domain}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Include ipaplatform in client-only build https://fedorahosted.org/freeipa/ticket/4533 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 04:49:51 -05:00
mkdir -p %{buildroot}%{_usr}/share/ipa
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
# Remove .la files from libtool - we don't want to package
# these files
rm %{buildroot}/%{plugin_dir}/libipa_pwd_extop.la
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_enrollment_extop.la
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_winsync.la
Replication version checking. Whenever we upgrade IPA such that any data incompatibilities might occur then we need to bump the DATA_VERSION value so that data will not replicate to other servers. The idea is that you can do an in-place upgrade of each IPA server and the different versions own't pollute each other with bad data.
2010-06-24 09:31:52 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_repl_version.la
ipa-uuid: DNA-like plugin that generates uuids
2010-10-15 09:49:29 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_uuid.la
Add new plugin used to modify related attributes after a modrdn operation.
2010-10-19 16:11:31 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la
Update kerberos password policy values on LDAP binds. On a failed bind this will update krbLoginFailedCount and krbLastFailedAuth and will potentially fail the bind altogether. On a successful bind it will zero krbLoginFailedCount and set krbLastSuccessfulAuth. This will also enforce locked-out accounts. See http://k5wiki.kerberos.org/wiki/Projects/Lockout for details on kerberos lockout. ticket 343
2011-01-18 13:58:58 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_lockout.la
Create skeleton CLDAP server as a DS plugin
2011-11-09 18:03:48 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_cldap.la
Add 389 DS plugin for special idnsSOASerial attribute handling Default value "1" is added to replicated idnsZone objects if idnsSOASerial attribute is missing. https://fedorahosted.org/freeipa/ticket/3347 Signed-off-by: Petr Spacek <pspacek@redhat.com>
2013-03-08 11:54:58 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_dns.la
Add sidgen postop and task A postop plugin is added to create the SID for new created users and groups. A directory server task allows to set the SID for existing users and groups. Fixes https://fedorahosted.org/freeipa/ticket/2825
2012-06-21 05:54:34 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_sidgen.la
rm %{buildroot}/%{plugin_dir}/libipa_sidgen_task.la
Add external domain extop DS plugin This extop can be used by clients of the IPA domain, e.g. sssd, to retrieve data from trusted external domains. It can be used e.g. to map Windows SIDs to user or groups names and back.
2011-11-30 06:29:10 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la
Add range check preop plugin To make sure that ID ranges do not overlap this plugin checks new additions and changes for conflicts with existing ranges. https://fedorahosted.org/freeipa/ticket/2185
2012-06-18 14:25:31 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_range_check.la
Add OTP last token plugin This plugin prevents the deletion or deactivation of the last valid token for a user. This prevents the user from migrating back to single factor authentication once OTP has been enabled. Thanks to Mark Reynolds for helping me with this patch. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2013-12-16 15:19:08 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_otp_lasttoken.la
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la
Add ipasam samba passdb backend https://fedorahosted.org/freeipa/ticket/1874
2011-10-25 03:33:30 -05:00
rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
# Some user-modifiable HTML files are provided. Move these to /etc
# and link back.
mkdir -p %{buildroot}/%{_sysconfdir}/ipa/html
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysrestore
Add sysupgrade state file When IPA package is being updated, some of the configuration files are also updated. Sometimes it may be useful to store upgrade meta information for next package upgrades. For example an information that some config file was already updated and we don't want to update it again if user purposedly reverted the change. This patch adds a new StateFile in /var/lib/ipa/sysupgrade which is capable of holding this information. New sysupgrade.py module was created to provide simple API to access the upgrade state information.
2012-06-08 01:31:37 -05:00
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysupgrade
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
mkdir %{buildroot}%{_usr}/share/ipa/html/
Configuration pages changed to use new FF extension browserconfig.html was changed to use new FF extension. The page is completely Firefox specific therefore the title was changed from 'Configure browser' to 'Firefox configuration'. Instruction to import CA cert in unauthorized.html are FF specific too, so they were moved to browserconfig.html. Unauthorized.html text was changed to distinguish FF config and other browsers. Now the page shows link for FF (browserconfig.html) and other browsers (ssbrowser.html). Ssbrowser.html should be enhanced by more configurations and browsers later [1]. Old configuration method was moved to ssbrowser.html. Unauthorized dialog in Web UI now links to http://../unauthorized.html instead of https. This change is done because of FF strange handling of extension installations from https sites [2]. Firefox allows ext. installation from https sites only when the certificate is signed by some build-in CA. To allow custom CAs an option in about:config has to be changed which don't help us at all because we wants to avoid manual changes in about:config. The design of browserconfig is inspired by Kyle Baker's design (2.1 Enhancements_v2.odt). It is not exactly the same. Highlighting of the steps wasn't used because in some cases we can switch some steps. Ticket: https://fedorahosted.org/freeipa/ticket/3094 [1] https://fedorahosted.org/freeipa/ticket/823 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=688383
2012-10-01 10:36:42 -05:00
ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig.js \
%{buildroot}%{_usr}/share/ipa/html/ffconfig.js
ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig_page.js \
%{buildroot}%{_usr}/share/ipa/html/ffconfig_page.js
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
ln -s ../../../..%{_sysconfdir}/ipa/html/ssbrowser.html \
%{buildroot}%{_usr}/share/ipa/html/ssbrowser.html
ln -s ../../../..%{_sysconfdir}/ipa/html/unauthorized.html \
%{buildroot}%{_usr}/share/ipa/html/unauthorized.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
ln -s ../../../..%{_sysconfdir}/ipa/html/browserconfig.html \
%{buildroot}%{_usr}/share/ipa/html/browserconfig.html
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Own the Apache configuration files that ipa-server-install creates
2009-05-14 08:29:16 -05:00
# So we can own our Apache configuration
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
mkdir -p %{buildroot}%{_usr}/share/ipa/html/
/bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt
/bin/touch %{buildroot}%{_usr}/share/ipa/html/configure.jar
Build and installation of Kerberos authentication extension This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
2012-10-04 10:08:17 -05:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con
Build and installation of Kerberos authentication extension This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
2012-10-04 10:08:17 -05:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con
/bin/touch %{buildroot}%{_usr}/share/ipa/html/preferences.html
daemons: Remove ipa_kpasswd Now that we have our own database we can properly enforce stricter constraints on how the db can be changed. Stop shipping our own kpasswd daemon and instead use the regular kadmin daemon.
2011-07-20 17:11:05 -05:00
mkdir -p %{buildroot}%{_initrddir}
Add ipa_memcached service * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
2012-02-06 12:15:06 -06:00
mkdir %{buildroot}%{_sysconfdir}/sysconfig/
install -m 644 init/ipa_memcached.conf %{buildroot}%{_sysconfdir}/sysconfig/ipa_memcached
Web UI plugin loader https://fedorahosted.org/freeipa/ticket/3235
2013-03-20 11:28:17 -05:00
# Web UI plugin dir
mkdir -p %{buildroot}%{_usr}/share/ipa/ui/js/plugins
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Fix hardcoded lib dir in freeipa.spec - Migrate hardcoded tmpfiles.d paths to %{_tmpfilesdir} macro in spec file https://fedorahosted.org/freeipa/ticket/4528 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-09-08 08:57:50 -05:00
mkdir -p %{buildroot}%{_tmpfilesdir}
install -m 0644 init/systemd/ipa.conf.tmpfiles %{buildroot}%{_tmpfilesdir}/%{name}.conf
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Add ipa_memcached service * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
2012-02-06 12:15:06 -06:00
mkdir -p %{buildroot}%{_localstatedir}/run/
install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa_memcached/
Get list of service from LDAP only at startup We check (possibly different) data from LDAP only at (re)start. This way we always shutdown exactly the services we started even if the list changed in the meanwhile (we avoid leaving a service running even if it was removed from LDAP as the admin decided it should not be started in future). This should also fix a problematic deadlock with systemd when we try to read the list of service from LDAP at shutdown.
2012-10-31 13:10:41 -05:00
install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa/
Add ipa_memcached service * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
2012-02-06 12:15:06 -06:00
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
mkdir -p %{buildroot}%{_libdir}/krb5/plugins/libkrb5
touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
mkdir -p %{buildroot}%{_unitdir}
install -m 644 init/systemd/ipa.service %{buildroot}%{_unitdir}/ipa.service
Add ipa_memcached service * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
2012-02-06 12:15:06 -06:00
install -m 644 init/systemd/ipa_memcached.service %{buildroot}%{_unitdir}/ipa_memcached.service
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Full system backup and restore This will allow one to backup and restore the IPA files and data. This does not cover individual entry restoration. http://freeipa.org/page/V3/Backup_and_Restore https://fedorahosted.org/freeipa/ticket/3128
2013-03-13 08:36:41 -05:00
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa/backup
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/ipa/
/bin/touch %{buildroot}%{_sysconfdir}/ipa/default.conf
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
/bin/touch %{buildroot}%{_sysconfdir}/ipa/ca.crt
Add a separate client-only target
2009-10-12 15:00:00 -05:00
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa-client/sysrestore
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/bash_completion.d
install -pm 644 contrib/completion/ipa.bash_completion %{buildroot}%{_sysconfdir}/bash_completion.d/ipa
Include the ipa command in client-only build https://fedorahosted.org/freeipa/ticket/4536 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 04:52:37 -05:00
%if ! %{ONLY_CLIENT}
Add support for tracking and counting entitlements Adds a plugin, entitle, to register to the entitlement server, consume entitlements and to count and track them. It is also possible to import an entitlement certificate (if for example the remote entitlement server is unaviailable). This uses the candlepin server from https://fedorahosted.org/candlepin/wiki for entitlements. Add a cron job to validate the entitlement status and syslog the results. tickets 28, 79, 278
2011-02-01 13:24:46 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/cron.d
Bash tab completion script
2009-11-23 15:19:14 -06:00
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
(cd %{buildroot}/%{python_sitelib}/ipaserver && find . -type f | \
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
grep -v dcerpc | grep -v adtrustinstance | \
sed -e 's,\.py.*$,.*,g' | sort -u | \
sed -e 's,\./,%%{python_sitelib}/ipaserver/,g' ) >server-python.list
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
(cd %{buildroot}/%{python_sitelib}/ipatests && find . -type f | \
sed -e 's,\.py.*$,.*,g' | sort -u | \
sed -e 's,\./,%%{python_sitelib}/ipatests/,g' ) >tests-python.list
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%clean
rm -rf %{buildroot}
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%post server
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
/bin/systemctl --system daemon-reload 2>&1 || :
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Automatically update IPA LDAP on rpm upgrades Re-enable ldapi code in ipa-ldap-updater and remove the searchbase restriction when run in --upgrade mode. This allows us to autobind giving root Directory Manager powers. This also: * corrects the ipa-ldap-updater man page * remove automatic --realm, --server, --domain options * handle upgrade errors properly * saves a copy of dse.ldif before we change it so it can be recovered * fixes an error discovered by pylint ticket 1087
2011-03-18 10:19:53 -05:00
if [ $1 -gt 1 ] ; then
Make certmonger a (pre) requires on server, restart it before upgrading certmonger may provide new CAs, as in the case from upgrading IPA 2.2 to 3.x. We need these new CAs available during the upgrade process. The certmonger package does its own condrestart as part of %postun which runs after the %post script of freeipa-server, so we need to restart it ourselves before upgrading. https://fedorahosted.org/freeipa/ticket/3378
2013-01-24 15:14:31 -06:00
/bin/systemctl condrestart certmonger.service 2>&1 || :
Automatically update IPA LDAP on rpm upgrades Re-enable ldapi code in ipa-ldap-updater and remove the searchbase restriction when run in --upgrade mode. This allows us to autobind giving root Directory Manager powers. This also: * corrects the ipa-ldap-updater man page * remove automatic --realm, --server, --domain options * handle upgrade errors properly * saves a copy of dse.ldif before we change it so it can be recovered * fixes an error discovered by pylint ticket 1087
2011-03-18 10:19:53 -05:00
fi
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add plugin framework to LDAP updates. There are two reasons for the plugin framework: 1. To provide a way of doing manual/complex LDAP changes without having to keep extending ldapupdate.py (like we did with managed entries). 2. Allows for better control of restarts. There are two types of plugins, preop and postop. A preop plugin runs before any file-based updates are loaded. A postop plugin runs after all file-based updates are applied. A preop plugin may update LDAP directly or craft update entries to be applied with the file-based updates. Either a preop or postop plugin may attempt to restart the dirsrv instance. The instance is only restartable if ipa-ldap-updater is being executed as root. A warning is printed if a restart is requested for a non-root user. Plugins are not executed by default. This is so we can use ldapupdate to apply simple updates in commands like ipa-nis-manage. https://fedorahosted.org/freeipa/ticket/1789 https://fedorahosted.org/freeipa/ticket/1790 https://fedorahosted.org/freeipa/ticket/2032
2011-11-23 15:52:40 -06:00
%posttrans server
# This must be run in posttrans so that updates from previous
# execution that may no longer be shipped are not applied.
Clean spec file for Fedora 19 This patch includes several cleanups needed for Fedora 19 build: * ipa-kdb is compatible with both krb5 1.10 and 1.11 which contains an updated DAL interface. Remove the conflict from spec file. * Fix ipa-ldap-updater call to produce errors only to avoid cluttering rpm update output * Remove httpd_conf constant which was not used https://fedorahosted.org/freeipa/ticket/3502
2013-03-12 09:25:40 -05:00
/usr/sbin/ipa-ldap-updater --upgrade --quiet >/dev/null || :
Run server upgrade and restart in posttrans Running server upgrade or restart in %post or %postun may cause issues when there are still parts of old FreeIPA software (like entitlements plugin). https://fedorahosted.org/freeipa/ticket/3739
2013-07-11 09:35:26 -05:00
/usr/sbin/ipa-upgradeconfig --quiet >/dev/null || :
# Restart IPA processes. This must be also run in postrans so that plugins
# and software is in consistent state
Use /usr/bin/python2 Part of the effort to port FreeIPA to Arch Linux, where Python 3 is the default. FreeIPA hasn't been ported to Python 3, so the code must be modified to run /usr/bin/python2 https://fedorahosted.org/freeipa/ticket/3438 Updated by pviktori@redhat.com
2013-11-27 07:53:57 -06:00
python2 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
Run server upgrade and restart in posttrans Running server upgrade or restart in %post or %postun may cause issues when there are still parts of old FreeIPA software (like entitlements plugin). https://fedorahosted.org/freeipa/ticket/3739
2013-07-11 09:35:26 -05:00
# NOTE: systemd specific section
if [ $? -eq 0 ]; then
Fix ipa.service restart Ticket: https://fedorahosted.org/freeipa/ticket/4243 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-17 09:12:47 -05:00
/bin/systemctl is-enabled ipa.service >/dev/null 2>&1
if [ $? -eq 0 ]; then
/bin/systemctl restart ipa.service >/dev/null 2>&1 || :
fi
Run server upgrade and restart in posttrans Running server upgrade or restart in %post or %postun may cause issues when there are still parts of old FreeIPA software (like entitlements plugin). https://fedorahosted.org/freeipa/ticket/3739
2013-07-11 09:35:26 -05:00
fi
# END
Add plugin framework to LDAP updates. There are two reasons for the plugin framework: 1. To provide a way of doing manual/complex LDAP changes without having to keep extending ldapupdate.py (like we did with managed entries). 2. Allows for better control of restarts. There are two types of plugins, preop and postop. A preop plugin runs before any file-based updates are loaded. A postop plugin runs after all file-based updates are applied. A preop plugin may update LDAP directly or craft update entries to be applied with the file-based updates. Either a preop or postop plugin may attempt to restart the dirsrv instance. The instance is only restartable if ipa-ldap-updater is being executed as root. A warning is printed if a restart is requested for a non-root user. Plugins are not executed by default. This is so we can use ldapupdate to apply simple updates in commands like ipa-nis-manage. https://fedorahosted.org/freeipa/ticket/1789 https://fedorahosted.org/freeipa/ticket/1790 https://fedorahosted.org/freeipa/ticket/2032
2011-11-23 15:52:40 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%preun server
if [ $1 = 0 ]; then
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
/bin/systemctl --quiet stop ipa.service || :
/bin/systemctl --quiet disable ipa.service || :
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
fi
Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.conf The ipa_kpasswd service was deprecated in 2.2, replaced by kadmin. On upgrade it will be left running by the previous installation, we need to stop it and uninstall the service. The dbmodules section needs to reflect that we're now using the new IPA kdb backend instead of the standard MIT ldap backend. https://fedorahosted.org/freeipa/ticket/2341
2012-02-13 08:16:26 -06:00
%pre server
# Stop ipa_kpasswd if it exists before upgrading so we don't have a
# zombie process when we're done.
if [ -e /usr/sbin/ipa_kpasswd ]; then
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.conf The ipa_kpasswd service was deprecated in 2.2, replaced by kadmin. On upgrade it will be left running by the previous installation, we need to stop it and uninstall the service. The dbmodules section needs to reflect that we're now using the new IPA kdb backend instead of the standard MIT ldap backend. https://fedorahosted.org/freeipa/ticket/2341
2012-02-13 08:16:26 -06:00
/bin/systemctl stop ipa_kpasswd.service >/dev/null 2>&1 || :
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.conf The ipa_kpasswd service was deprecated in 2.2, replaced by kadmin. On upgrade it will be left running by the previous installation, we need to stop it and uninstall the service. The dbmodules section needs to reflect that we're now using the new IPA kdb backend instead of the standard MIT ldap backend. https://fedorahosted.org/freeipa/ticket/2341
2012-02-13 08:16:26 -06:00
fi
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
%postun server-trust-ad
if [ "$1" -ge "1" ]; then
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
if [ "`readlink %{_sysconfdir}/alternatives/winbind_krb5_locator.so`" == "/dev/null" ]; then
%{_sbindir}/alternatives --set winbind_krb5_locator.so /dev/null
fi
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
fi
%post server-trust-ad
%{_sbindir}/update-alternatives --install %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so \
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
winbind_krb5_locator.so /dev/null 90
Run server upgrade and restart in posttrans Running server upgrade or restart in %post or %postun may cause issues when there are still parts of old FreeIPA software (like entitlements plugin). https://fedorahosted.org/freeipa/ticket/3739
2013-07-11 09:35:26 -05:00
%posttrans server-trust-ad
Use /usr/bin/python2 Part of the effort to port FreeIPA to Arch Linux, where Python 3 is the default. FreeIPA hasn't been ported to Python 3, so the code must be modified to run /usr/bin/python2 https://fedorahosted.org/freeipa/ticket/3438 Updated by pviktori@redhat.com
2013-11-27 07:53:57 -06:00
python2 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
Restart httpd if ipa-server-trust-ad is installed or updated If ipa-server-trust-ad is installed after the ipa server is installed and configured, httpd needs a restart for additional python modules to be loaded into httpd on IPA initialization. Fixes https://fedorahosted.org/freeipa/ticket/3185
2012-10-26 06:12:17 -05:00
if [ $? -eq 0 ]; then
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Restart httpd if ipa-server-trust-ad is installed or updated If ipa-server-trust-ad is installed after the ipa server is installed and configured, httpd needs a restart for additional python modules to be loaded into httpd on IPA initialization. Fixes https://fedorahosted.org/freeipa/ticket/3185
2012-10-26 06:12:17 -05:00
/bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Restart httpd if ipa-server-trust-ad is installed or updated If ipa-server-trust-ad is installed after the ipa server is installed and configured, httpd needs a restart for additional python modules to be loaded into httpd on IPA initialization. Fixes https://fedorahosted.org/freeipa/ticket/3185
2012-10-26 06:12:17 -05:00
fi
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
%preun server-trust-ad
if [ $1 -eq 0 ]; then
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
fi
Implement an IPA Foreman smartproxy server This currently server supports only host and hostgroup commands for retrieving, adding and deleting entries. The incoming requests are completely unauthenticated and by default requests must be local. Utilize GSS-Proxy to manage the TGT. Configuration information is in the ipa-smartproxy man page. Design: http://www.freeipa.org/page/V3/Smart_Proxy https://fedorahosted.org/freeipa/ticket/4128 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2013-12-03 10:14:00 -06:00
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
%post client
if [ $1 -gt 1 ] ; then
# Has the client been configured?
restore=0
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
if [ -f '/etc/sssd/sssd.conf' -a $restore -ge 2 ]; then
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
if ! grep -E -q '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf 2>/dev/null ; then
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf.ipanew
cat /etc/krb5.conf >> /etc/krb5.conf.ipanew
mv /etc/krb5.conf.ipanew /etc/krb5.conf
/sbin/restorecon /etc/krb5.conf
fi
fi
Fix ntpd config on clients. https://fedorahosted.org/freeipa/ticket/4094
2014-01-24 03:16:48 -06:00
if [ -f '/etc/sysconfig/ntpd' -a $restore -ge 2 ]; then
if grep -E -q 'OPTIONS=.*-u ntp:ntp' /etc/sysconfig/ntpd 2>/dev/null; then
sed -r '/OPTIONS=/ { s/\s+-u ntp:ntp\s+/ /; s/\s*-u ntp:ntp\s*// }' /etc/sysconfig/ntpd >/etc/sysconfig/ntpd.ipanew
mv /etc/sysconfig/ntpd.ipanew /etc/sysconfig/ntpd
/sbin/restorecon /etc/sysconfig/ntpd
/bin/systemctl condrestart ntpd.service 2>&1 || :
fi
fi
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
fi
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add support for OpenSSH 6.2. Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
2013-04-18 11:06:54 -05:00
%triggerin -n freeipa-client -- openssh-server
# Has the client been configured?
restore=0
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
if grep -E -q '^(AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys|PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u)$' /etc/ssh/sshd_config 2>/dev/null; then
Add support for OpenSSH 6.2. Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
2013-04-18 11:06:54 -05:00
sed -r '
/^(AuthorizedKeysCommand(User|RunAs)|PubKeyAgentRunAs)[ \t]/ d
' /etc/ssh/sshd_config >/etc/ssh/sshd_config.ipanew
if /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandUser=nobody'; then
sed -ri '
s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandUser nobody/
' /etc/ssh/sshd_config.ipanew
elif /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandRunAs=nobody'; then
sed -ri '
s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandRunAs nobody/
' /etc/ssh/sshd_config.ipanew
elif /usr/sbin/sshd -t -f /dev/null -o 'PubKeyAgent=/usr/bin/sss_ssh_authorizedkeys %u' -o 'PubKeyAgentRunAs=nobody'; then
sed -ri '
s/^AuthorizedKeysCommand (.+)$/PubKeyAgent \1 %u/
s/^PubKeyAgent .*$/\0\nPubKeyAgentRunAs nobody/
' /etc/ssh/sshd_config.ipanew
fi
mv /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
/sbin/restorecon /etc/ssh/sshd_config
chmod 600 /etc/ssh/sshd_config
/bin/systemctl condrestart sshd.service 2>&1 || :
fi
fi
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
%files server -f server-python.list
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%defattr(-,root,root,-)
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%doc COPYING README Contributors.txt
Full system backup and restore This will allow one to backup and restore the IPA files and data. This does not cover individual entry restoration. http://freeipa.org/page/V3/Backup_and_Restore https://fedorahosted.org/freeipa/ticket/3128
2013-03-13 08:36:41 -05:00
%{_sbindir}/ipa-backup
%{_sbindir}/ipa-restore
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
%{_sbindir}/ipa-ca-install
Add ipa-dns-install script Unfortunately, for now there is no --uninstall option.
2009-11-23 02:26:50 -06:00
%{_sbindir}/ipa-dns-install
Add a KRA to IPA This patch adds the capability of installing a Dogtag KRA to an IPA instance. With this patch, a KRA is NOT configured by default when ipa-server-install is run. Rather, the command ipa-kra-install must be executed on an instance on which a Dogtag CA has already been configured. The KRA shares the same tomcat instance and DS instance as the Dogtag CA. Moreover, the same admin user/agent (and agent cert) can be used for both subsystems. Certmonger is also confgured to monitor the new subsystem certificates. To create a clone KRA, simply execute ipa-kra-install <replica_file> on a replica on which a Dogtag CA has already been replicated. ipa-kra-install will use the security domain to detect whether the system being installed is a replica, and will error out if a needed replica file is not provided. The install scripts have been refactored somewhat to minimize duplication of code. A new base class dogtagintance.py has been introduced containing code that is common to KRA and CA installs. This will become very useful when we add more PKI subsystems. The KRA will install its database as a subtree of o=ipaca, specifically o=ipakra,o=ipaca. This means that replication agreements created to replicate CA data will also replicate KRA data. No new replication agreements are required. Added dogtag plugin for KRA. This is an initial commit providing the basic vault functionality needed for vault. This plugin will likely be modified as we create the code to call some of these functions. Part of the work for: https://fedorahosted.org/freeipa/ticket/3872 The uninstallation option in ipa-kra-install is temporarily disabled. Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-18 10:23:30 -05:00
%{_sbindir}/ipa-kra-install
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-server-install
Connection check program for replica installation When connection between a master machine and future replica is not sane, the replica installation may fail unexpectedly with inconvenient error messages. One common problem is misconfigured firewall. This patch adds a program ipa-replica-conncheck which tests the connection using the following procedure: 1) Execute the on-replica check testing the connection to master 2) Open required ports on local machine 3) Ask user to run the on-master part of the check OR run it automatically: a) kinit to master as default admin user with given password b) run the on-master part using ssh 4) When master part is executed, it checks connection back to the replica and prints the check result This program is run by ipa-replica-install as mandatory part. It can, however, be skipped using --skip-conncheck option. ipa-replica-install now requires password for admin user to run the command on remote master. https://fedorahosted.org/freeipa/ticket/1107
2011-05-22 12:17:07 -05:00
%{_sbindir}/ipa-replica-conncheck
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-replica-install
%{_sbindir}/ipa-replica-prepare
%{_sbindir}/ipa-replica-manage
Create tool to manage dogtag replication agreements For the most part the existing replication code worked with the following exceptions: - Added more port options - It assumed that initial connections were done to an SSL port. Added ability to use startTLS - It assumed that the name of the agreement was the same on both sides. In dogtag one is marked as master and one as clone. A new option is added, master, the determines which side we're working on or None if it isn't a dogtag agreement. - Don't set the attribute exclude list on dogtag agreements - dogtag doesn't set a schedule by default (which is actually recommended by 389-ds). This causes problems when doing a force-sync though so if one is done we set a schedule to run all the time. Otherwise the temporary schedule can't be removed (LDAP operations error). https://fedorahosted.org/freeipa/ticket/1250
2011-07-14 22:35:01 -05:00
%{_sbindir}/ipa-csreplica-manage
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-server-certinstall
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_sbindir}/ipa-ldap-updater
Implement OTP token importing This patch adds support for importing tokens using RFC 6030 key container files. This includes decryption support. For sysadmin sanity, any tokens which fail to add will be written to the output file for examination. The main use case here is where a small subset of a large set of tokens fails to validate or add. Using the output file, the sysadmin can attempt to recover these specific tokens. This code is implemented as a server-side script. However, it doesn't actually need to run on the server. This was done because importing is an odd fit for the IPA command framework: 1. We need to write an output file. 2. The operation may be long-running (thousands of tokens). 3. Only admins need to perform this task and it only happens infrequently. https://fedorahosted.org/freeipa/ticket/4261 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-08 10:06:16 -05:00
%{_sbindir}/ipa-otptoken-import
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_sbindir}/ipa-compat-manage
%{_sbindir}/ipa-nis-manage
25 Create Tool for Enabling/Disabling Managed Entry Plugins Remove legacy ipa-host-net-manage Add ipa-managed-entries tool Add man page for ipa-managed-entries tool https://fedorahosted.org/freeipa/ticket/1181
2011-09-20 11:13:42 -05:00
%{_sbindir}/ipa-managed-entries
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipactl
%{_sbindir}/ipa-upgradeconfig
Provide ipa-advise tool Provides a pluggable framework for generating configuration scriptlets and instructions for various machine setups and use cases. Creates a new ipa-advise command, available to root user on the IPA server. Also provides an example configuration plugin, config-fedora-authconfig. https://fedorahosted.org/freeipa/ticket/3670
2013-06-10 07:43:24 -05:00
%{_sbindir}/ipa-advise
Add CA certificate management tool ipa-cacert-manage. Part of https://fedorahosted.org/freeipa/ticket/3737 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-03-13 04:28:27 -05:00
%{_sbindir}/ipa-cacert-manage
Add new certmonger CA helper dogtag-ipa-ca-renew-agent. The helper will be used to handle CA-related certificate renewal requests. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2013-10-16 02:26:39 -05:00
%{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
Add the krb5/FreeIPA RADIUS companion daemon This daemon listens for RADIUS packets on a well known UNIX domain socket. When a packet is received, it queries LDAP to see if the user is configured for RADIUS authentication. If so, then the packet is forwarded to the 3rd party RADIUS server. Otherwise, a bind is attempted against the LDAP server. https://fedorahosted.org/freeipa/ticket/3366 http://freeipa.org/page/V3/OTP
2013-04-11 13:03:25 -05:00
%{_libexecdir}/ipa-otpd
Add ipa_memcached service * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
2012-02-06 12:15:06 -06:00
%config(noreplace) %{_sysconfdir}/sysconfig/ipa_memcached
%dir %attr(0700,apache,apache) %{_localstatedir}/run/ipa_memcached/
Get list of service from LDAP only at startup We check (possibly different) data from LDAP only at (re)start. This way we always shutdown exactly the services we started even if the list changed in the meanwhile (we avoid leaving a service running even if it was removed from LDAP as the admin decided it should not be started in future). This should also fix a problematic deadlock with systemd when we try to read the list of service from LDAP at shutdown.
2012-10-31 13:10:41 -05:00
%dir %attr(0700,root,root) %{_localstatedir}/run/ipa/
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Fix hardcoded lib dir in freeipa.spec - Migrate hardcoded tmpfiles.d paths to %{_tmpfilesdir} macro in spec file https://fedorahosted.org/freeipa/ticket/4528 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-09-08 08:57:50 -05:00
%{_tmpfilesdir}/%{name}.conf
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%attr(644,root,root) %{_unitdir}/ipa.service
Add ipa_memcached service * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
2012-02-06 12:15:06 -06:00
%attr(644,root,root) %{_unitdir}/ipa_memcached.service
Add the krb5/FreeIPA RADIUS companion daemon This daemon listens for RADIUS packets on a well known UNIX domain socket. When a packet is received, it queries LDAP to see if the user is configured for RADIUS authentication. If so, then the packet is forwarded to the 3rd party RADIUS server. Otherwise, a bind is attempted against the LDAP server. https://fedorahosted.org/freeipa/ticket/3366 http://freeipa.org/page/V3/OTP
2013-04-11 13:03:25 -05:00
%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Include some directories in spec file Two directories were left out from package file list: ..../site-packages/ipalib ..../site-packages/ipaserver http://fedorahosted.org/freeipa/ticket/688
2011-01-05 14:51:56 -06:00
%dir %{python_sitelib}/ipaserver
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
%dir %{python_sitelib}/ipaserver/install
%dir %{python_sitelib}/ipaserver/install/plugins
Provide ipa-advise tool Provides a pluggable framework for generating configuration scriptlets and instructions for various machine setups and use cases. Creates a new ipa-advise command, available to root user on the IPA server. Also provides an example configuration plugin, config-fedora-authconfig. https://fedorahosted.org/freeipa/ticket/3670
2013-06-10 07:43:24 -05:00
%dir %{python_sitelib}/ipaserver/advise
%dir %{python_sitelib}/ipaserver/advise/plugins
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
%dir %{python_sitelib}/ipaserver/plugins
Configure certmonger to execute restart scripts on renewal. certmonger now has the ability to execute a script when it renews a certificate. This can be used to automatically restart servers so the certificate doesn't expire in the running server. https://fedorahosted.org/freeipa/ticket/2050
2012-04-10 14:21:08 -05:00
%dir %{_libdir}/ipa/certmonger
%attr(755,root,root) %{_libdir}/ipa/certmonger/*
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa
Fixed ipa.spec.in to include share/ipa/wsgi.py*
2010-03-01 22:41:41 -06:00
%{_usr}/share/ipa/wsgi.py*
Fix schema replication from old masters The new merged database will replicate with both the IPA and CA trees, so all DS instances (IPA and CA on the existing master, and the merged one on the replica) need to have the same schema. Dogtag does all its schema modifications online. Those are replicated normally. The basic IPA schema, however, is delivered in ldif files, which are not replicated. The files are not present on old CA DS instances. Any schema update that references objects in these files will fail. The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is replicated as a blob. If we updated the old master's CA schema dynamically during replica install, it would conflict with updates done during the installation: the one with the lower CSN would get lost. Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'. Turning it off tells Dogtag to create its schema in the clone, where the IPA modifications are taking place, so that it is not overwritten by the IPA schema on replication. The patch solves the problems by: - In __spawn_instance, turning off the pki_clone_replicate_schema flag. - Providing a script to copy the IPA schema files to the CA DS instance. The script needs to be copied to old masters and run there. - At replica CA install, checking if the schema is updated, and failing if not. The --skip-schema-check option is added to ipa-{replica,ca}-install to override the check. All pre-3.1 CA servers in a domain will have to have the script run on them to avoid schema replication errors. https://fedorahosted.org/freeipa/ticket/3213
2012-10-24 03:37:16 -05:00
%{_usr}/share/ipa/copy-schema-to-ca.py*
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/*.ldif
%{_usr}/share/ipa/*.uldif
%{_usr}/share/ipa/*.template
Add ipa-advise plugins for legacy clients Old versions of SSSD do not directly support cross-realm trusts between IPA and AD. This patch introduces plugins for the ipa-advise tool, which should help with configuring an old version of SSSD (1.5-1.8) to gain access to resources in trusted domain. Since the configuration steps differ depending on whether the platform includes the authconfig tool, two plugins are needed: * config-redhat-sssd-before-1-9 - provides configuration for Red Hat based systems, as these system include the autconfig utility * config-generic-sssd-before-1-9 - provides configuration for other platforms https://fedorahosted.org/freeipa/ticket/3671 https://fedorahosted.org/freeipa/ticket/3672
2013-08-01 07:12:39 -05:00
%dir %{_usr}/share/ipa/advise
%dir %{_usr}/share/ipa/advise/legacy
%{_usr}/share/ipa/advise/legacy/*.template
Kerberos authentication extension makefiles Makefiles for new FF kerberos authentication extension ihttps://fedorahosted.org/freeipa/ticket/3094
2012-10-02 09:47:28 -05:00
%dir %{_usr}/share/ipa/ffextension
%{_usr}/share/ipa/ffextension/bootstrap.js
%{_usr}/share/ipa/ffextension/install.rdf
%{_usr}/share/ipa/ffextension/chrome.manifest
%dir %{_usr}/share/ipa/ffextension/chrome
%dir %{_usr}/share/ipa/ffextension/chrome/content
%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth.js
%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth_overlay.xul
%dir %{_usr}/share/ipa/ffextension/locale
%dir %{_usr}/share/ipa/ffextension/locale/en-US
%{_usr}/share/ipa/ffextension/locale/en-US/kerberosauth.properties
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa/html
Configuration pages changed to use new FF extension browserconfig.html was changed to use new FF extension. The page is completely Firefox specific therefore the title was changed from 'Configure browser' to 'Firefox configuration'. Instruction to import CA cert in unauthorized.html are FF specific too, so they were moved to browserconfig.html. Unauthorized.html text was changed to distinguish FF config and other browsers. Now the page shows link for FF (browserconfig.html) and other browsers (ssbrowser.html). Ssbrowser.html should be enhanced by more configurations and browsers later [1]. Old configuration method was moved to ssbrowser.html. Unauthorized dialog in Web UI now links to http://../unauthorized.html instead of https. This change is done because of FF strange handling of extension installations from https sites [2]. Firefox allows ext. installation from https sites only when the certificate is signed by some build-in CA. To allow custom CAs an option in about:config has to be changed which don't help us at all because we wants to avoid manual changes in about:config. The design of browserconfig is inspired by Kyle Baker's design (2.1 Enhancements_v2.odt). It is not exactly the same. Highlighting of the steps wasn't used because in some cases we can switch some steps. Ticket: https://fedorahosted.org/freeipa/ticket/3094 [1] https://fedorahosted.org/freeipa/ticket/823 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=688383
2012-10-01 10:36:42 -05:00
%{_usr}/share/ipa/html/ffconfig.js
%{_usr}/share/ipa/html/ffconfig_page.js
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/html/ssbrowser.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%{_usr}/share/ipa/html/browserconfig.html
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/html/unauthorized.html
Add DS migration plugin and password migration page.
2010-01-12 09:40:09 -06:00
%dir %{_usr}/share/ipa/migration
%{_usr}/share/ipa/migration/error.html
%{_usr}/share/ipa/migration/index.html
%{_usr}/share/ipa/migration/invalid.html
%{_usr}/share/ipa/migration/migration.py*
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
%dir %{_usr}/share/ipa/ui
%{_usr}/share/ipa/ui/index.html
Separate reset password page This patch adds separate reset password page. It is a complement to separate login page. It differentiate from reset password capabilities in Web UI's anauthorized dialog by not performing login. This is useful for users who wants only to reset the password and not to use Web UI. And also for users who are using the separate login page. https://fedorahosted.org/freeipa/ticket/2755
2012-06-08 09:38:17 -05:00
%{_usr}/share/ipa/ui/reset_password.html
webui: add sync_otp.html standalone page for OTP token synchronization. It reuses SyncOTPScreen widget instead of reimplementing the logic as in other standalone pages. https://fedorahosted.org/freeipa/ticket/4218 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-06-05 11:50:03 -05:00
%{_usr}/share/ipa/ui/sync_otp.html
Fixed missing icons. The Makefile.am and the spec file have been fixed to include all icons in the install/ui folder. Ticket #1559
2011-08-02 12:42:42 -05:00
%{_usr}/share/ipa/ui/*.ico
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
%{_usr}/share/ipa/ui/*.css
%{_usr}/share/ipa/ui/*.js
Use only system fonts This commit changes how fonts are used. - remove usage of bundled fonts and only system fonts are used instead - by using alias in httpd conf - by using local("Font Name") directive in font-face - removed usage of overpass font - redefined Open Sans font-face declarations. Note: upstream is doing the same change so we will be fine on upgrade. - introduce variable.less for variable definitions and overrides. This file will be very useful when we upgrade to newer RCUE so we will be able to redefine their and bootstrap's variables. Fixes: https://fedorahosted.org/freeipa/ticket/2861
2013-12-04 09:15:20 -06:00
%dir %{_usr}/share/ipa/ui/css
RCUE initial commit https://fedorahosted.org/freeipa/ticket/3902
2013-10-10 06:41:31 -05:00
%{_usr}/share/ipa/ui/css/*.css
Own /usr/share/ipa/ui/js/ in the spec file. https://fedorahosted.org/freeipa/ticket/4010
2013-11-27 07:20:22 -06:00
%dir %{_usr}/share/ipa/ui/js
Updated makefiles to build FreeIPA Web UI layer Updated makefiles to comply to new directory structure and also to use builder for building Web UI. FreeIPA package spec is modified to use the output of the builder. https://fedorahosted.org/freeipa/ticket/112
2012-11-23 10:19:37 -06:00
%dir %{_usr}/share/ipa/ui/js/dojo
%{_usr}/share/ipa/ui/js/dojo/dojo.js
%dir %{_usr}/share/ipa/ui/js/libs
%{_usr}/share/ipa/ui/js/libs/*.js
%dir %{_usr}/share/ipa/ui/js/freeipa
%{_usr}/share/ipa/ui/js/freeipa/app.js
webui: layer for standalone pages which use WebUI framework Current compiled Web UI layer (app.js) contains every FreeIPA plugin and not just the UI framework. It's not possible to start just a simple facet. This commit creates a basis for a layer (core.js) which contains only framework code and not entity related code. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-06-05 10:12:41 -05:00
%{_usr}/share/ipa/ui/js/freeipa/core.js
Web UI plugin loader https://fedorahosted.org/freeipa/ticket/3235
2013-03-20 11:28:17 -05:00
%dir %{_usr}/share/ipa/ui/js/plugins
Fixed inconsistent image names. The images have been renamed to be more consistent and moved into the "images" directory to mimic the original jQuery UI structure. Ticket #1613
2011-10-26 16:06:17 -05:00
%dir %{_usr}/share/ipa/ui/images
webui: login screen widget Reimplementation of unauthorized dialog into separate widget. It uses RCUE design. New features compared to unauthorized dialog: - reflects auth methods from `auth` module - validation summary - differentiates Kerberos auth failure with session expiration - Caps Lock warning - form based method doesn't allow password only submission https://fedorahosted.org/freeipa/ticket/4017 https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2013-11-13 09:02:48 -06:00
%{_usr}/share/ipa/ui/images/*.jpg
Fixed inconsistent image names. The images have been renamed to be more consistent and moved into the "images" directory to mimic the original jQuery UI structure. Ticket #1613
2011-10-26 16:06:17 -05:00
%{_usr}/share/ipa/ui/images/*.png
Generate plugin index dynamically https://fedorahosted.org/freeipa/ticket/3235
2013-04-23 12:54:21 -05:00
%dir %{_usr}/share/ipa/wsgi
%{_usr}/share/ipa/wsgi/plugins.py*
%dir %{_sysconfdir}/ipa
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_sysconfdir}/ipa/html
Configuration pages changed to use new FF extension browserconfig.html was changed to use new FF extension. The page is completely Firefox specific therefore the title was changed from 'Configure browser' to 'Firefox configuration'. Instruction to import CA cert in unauthorized.html are FF specific too, so they were moved to browserconfig.html. Unauthorized.html text was changed to distinguish FF config and other browsers. Now the page shows link for FF (browserconfig.html) and other browsers (ssbrowser.html). Ssbrowser.html should be enhanced by more configurations and browsers later [1]. Old configuration method was moved to ssbrowser.html. Unauthorized dialog in Web UI now links to http://../unauthorized.html instead of https. This change is done because of FF strange handling of extension installations from https sites [2]. Firefox allows ext. installation from https sites only when the certificate is signed by some build-in CA. To allow custom CAs an option in about:config has to be changed which don't help us at all because we wants to avoid manual changes in about:config. The design of browserconfig is inspired by Kyle Baker's design (2.1 Enhancements_v2.odt). It is not exactly the same. Highlighting of the steps wasn't used because in some cases we can switch some steps. Ticket: https://fedorahosted.org/freeipa/ticket/3094 [1] https://fedorahosted.org/freeipa/ticket/823 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=688383
2012-10-01 10:36:42 -05:00
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig_page.js
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
%config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html
Properly own (via ghost) the Apache configuration files.
2009-09-16 12:04:14 -05:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/ipa.conf
%{_usr}/share/ipa/ipa-rewrite.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
%{_usr}/share/ipa/ipa-pki-proxy.conf
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/configure.jar
Build and installation of Kerberos authentication extension This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
2012-10-04 10:08:17 -05:00
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/kerberosauth.xpi
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.con
Build and installation of Kerberos authentication extension This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
2012-10-04 10:08:17 -05:00
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.js
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb5.ini
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/preferences.html
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa/updates/
%{_usr}/share/ipa/updates/*
%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_winsync.so
Replication version checking. Whenever we upgrade IPA such that any data incompatibilities might occur then we need to bump the DATA_VERSION value so that data will not replicate to other servers. The idea is that you can do an in-place upgrade of each IPA server and the different versions own't pollute each other with bad data.
2010-06-24 09:31:52 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_repl_version.so
ipa-uuid: DNA-like plugin that generates uuids
2010-10-15 09:49:29 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
Add new plugin used to modify related attributes after a modrdn operation.
2010-10-19 16:11:31 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
Update kerberos password policy values on LDAP binds. On a failed bind this will update krbLoginFailedCount and krbLastFailedAuth and will potentially fail the bind altogether. On a successful bind it will zero krbLoginFailedCount and set krbLastSuccessfulAuth. This will also enforce locked-out accounts. See http://k5wiki.kerberos.org/wiki/Projects/Lockout for details on kerberos lockout. ticket 343
2011-01-18 13:58:58 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
Create skeleton CLDAP server as a DS plugin
2011-11-09 18:03:48 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
Add 389 DS plugin for special idnsSOASerial attribute handling Default value "1" is added to replicated idnsZone objects if idnsSOASerial attribute is missing. https://fedorahosted.org/freeipa/ticket/3347 Signed-off-by: Petr Spacek <pspacek@redhat.com>
2013-03-08 11:54:58 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_dns.so
Add range check preop plugin To make sure that ID ranges do not overlap this plugin checks new additions and changes for conflicts with existing ranges. https://fedorahosted.org/freeipa/ticket/2185
2012-06-18 14:25:31 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
Add OTP last token plugin This plugin prevents the deletion or deactivation of the last valid token for a user. This prevents the user from migrating back to single factor authentication once OTP has been enabled. Thanks to Mark Reynolds for helping me with this patch. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2013-12-16 15:19:08 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_otp_lasttoken.so
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_localstatedir}/lib/ipa
Require new samba and krb5 Require samba 4.0.5 (passdb API changed). Make sure that we use the right epoch number with samba so that the Requires is correctly enforced. Require krb5 1.11.2-1 to fix missing PAC issue. Also fix backup dir permissions.
2013-04-16 02:44:28 -05:00
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/backup
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysrestore
Add sysupgrade state file When IPA package is being updated, some of the configuration files are also updated. Sometimes it may be useful to store upgrade meta information for next package upgrades. For example an information that some config file was already updated and we don't want to update it again if user purposedly reverted the change. This patch adds a new StateFile in /var/lib/ipa/sysupgrade which is capable of holding this information. New sysupgrade.py module was created to provide simple API to access the upgrade state information.
2012-06-08 01:31:37 -05:00
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysupgrade
Move CRL publish directory to IPA owned directory Currently, CRL files are being exported to /var/lib/pki-ca sub-directory, which is then served by httpd to clients. However, this approach has several disadvantages: * We depend on pki-ca directory structure and relevant permissions. If pki-ca changes directory structure or permissions on upgrade, IPA may break. This is also a root cause of the latest error, where the pki-ca directory does not have X permission for others and CRL publishing by httpd breaks. * Since the directory is not static and is generated during ipa-server-install, RPM upgrade of IPA packages report errors when defining SELinux policy for these directories. Move CRL publish directory to /var/lib/ipa/pki-ca/publish (common for both dogtag 9 and 10) which is created on RPM upgrade, i.e. SELinux policy configuration does not report any error. The new CRL publish directory is used for both new IPA installs and upgrades, where contents of the directory (CRLs) is first migrated to the new location and then the actual configuration change is made. https://fedorahosted.org/freeipa/ticket/3144
2012-10-08 08:58:48 -05:00
%attr(755,root,root) %dir %{_localstatedir}/lib/ipa/pki-ca
Change group ownership of CRL publish directory Spec file modified so that /var/lib/ipa/pki-ca/publish/ is no longer owned by created with package installation. The directory is rather created/removed with the CA instance itself. This ensures proper creation/removeal, group ownership and SELinux context. https://fedorahosted.org/freeipa/ticket/3727
2013-07-16 05:10:54 -05:00
%ghost %{_localstatedir}/lib/ipa/pki-ca/publish
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
Connection check program for replica installation When connection between a master machine and future replica is not sane, the replica installation may fail unexpectedly with inconvenient error messages. One common problem is misconfigured firewall. This patch adds a program ipa-replica-conncheck which tests the connection using the following procedure: 1) Execute the on-replica check testing the connection to master 2) Open required ports on local machine 3) Ask user to run the on-master part of the check OR run it automatically: a) kinit to master as default admin user with given password b) run the on-master part using ssh 4) When master part is executed, it checks connection back to the replica and prints the check result This program is run by ipa-replica-install as mandatory part. It can, however, be skipped using --skip-conncheck option. ipa-replica-install now requires password for admin user to run the command on remote master. https://fedorahosted.org/freeipa/ticket/1107
2011-05-22 12:17:07 -05:00
%{_mandir}/man1/ipa-replica-conncheck.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_mandir}/man1/ipa-replica-install.1.gz
%{_mandir}/man1/ipa-replica-manage.1.gz
Create tool to manage dogtag replication agreements For the most part the existing replication code worked with the following exceptions: - Added more port options - It assumed that initial connections were done to an SSL port. Added ability to use startTLS - It assumed that the name of the agreement was the same on both sides. In dogtag one is marked as master and one as clone. A new option is added, master, the determines which side we're working on or None if it isn't a dogtag agreement. - Don't set the attribute exclude list on dogtag agreements - dogtag doesn't set a schedule by default (which is actually recommended by 389-ds). This causes problems when doing a force-sync though so if one is done we set a schedule to run all the time. Otherwise the temporary schedule can't be removed (LDAP operations error). https://fedorahosted.org/freeipa/ticket/1250
2011-07-14 22:35:01 -05:00
%{_mandir}/man1/ipa-csreplica-manage.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_mandir}/man1/ipa-replica-prepare.1.gz
%{_mandir}/man1/ipa-server-certinstall.1.gz
%{_mandir}/man1/ipa-server-install.1.gz
Ship the ipa-dns-install man page ticket 734
2011-01-10 09:37:45 -06:00
%{_mandir}/man1/ipa-dns-install.1.gz
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
%{_mandir}/man1/ipa-ca-install.1.gz
Add man page for ipa-kra-install https://fedorahosted.org/freeipa/ticket/4504 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-08-24 11:19:55 -05:00
%{_mandir}/man1/ipa-kra-install.1.gz
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_mandir}/man1/ipa-compat-manage.1.gz
%{_mandir}/man1/ipa-nis-manage.1.gz
25 Create Tool for Enabling/Disabling Managed Entry Plugins Remove legacy ipa-host-net-manage Add ipa-managed-entries tool Add man page for ipa-managed-entries tool https://fedorahosted.org/freeipa/ticket/1181
2011-09-20 11:13:42 -05:00
%{_mandir}/man1/ipa-managed-entries.1.gz
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_mandir}/man1/ipa-ldap-updater.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_mandir}/man8/ipactl.8.gz
Update and package ipa-upgradeconfig man page. Require that the tool be run as root to avoid a permission-related backtrace. https://fedorahosted.org/freeipa/ticket/1758
2012-01-20 12:30:25 -06:00
%{_mandir}/man8/ipa-upgradeconfig.8.gz
Full system backup and restore This will allow one to backup and restore the IPA files and data. This does not cover individual entry restoration. http://freeipa.org/page/V3/Backup_and_Restore https://fedorahosted.org/freeipa/ticket/3128
2013-03-13 08:36:41 -05:00
%{_mandir}/man1/ipa-backup.1.gz
%{_mandir}/man1/ipa-restore.1.gz
Provide ipa-advise tool Provides a pluggable framework for generating configuration scriptlets and instructions for various machine setups and use cases. Creates a new ipa-advise command, available to root user on the IPA server. Also provides an example configuration plugin, config-fedora-authconfig. https://fedorahosted.org/freeipa/ticket/3670
2013-06-10 07:43:24 -05:00
%{_mandir}/man1/ipa-advise.1.gz
Add missing ipa-otptoken-import.1.gz to spec file Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-25 01:46:39 -05:00
%{_mandir}/man1/ipa-otptoken-import.1.gz
Add CA certificate management tool ipa-cacert-manage. Part of https://fedorahosted.org/freeipa/ticket/3737 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-03-13 04:28:27 -05:00
%{_mandir}/man1/ipa-cacert-manage.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
%files server-trust-ad
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
%{_sbindir}/ipa-adtrust-install
Add external domain extop DS plugin This extop can be used by clients of the IPA domain, e.g. sssd, to retrieve data from trusted external domains. It can be used e.g. to map Windows SIDs to user or groups names and back.
2011-11-30 06:29:10 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
%{_usr}/share/ipa/smb.conf.empty
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
%attr(755,root,root) %{_libdir}/samba/pdb/ipasam.so
Add sidgen postop and task A postop plugin is added to create the SID for new created users and groups. A directory server task allows to set the SID for existing users and groups. Fixes https://fedorahosted.org/freeipa/ticket/2825
2012-06-21 05:54:34 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_sidgen.so
%attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
%{_mandir}/man1/ipa-adtrust-install.1.gz
%{python_sitelib}/ipaserver/dcerpc*
%{python_sitelib}/ipaserver/install/adtrustinstance*
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
Implement an IPA Foreman smartproxy server This currently server supports only host and hostgroup commands for retrieving, adding and deleting entries. The incoming requests are completely unauthenticated and by default requests must be local. Utilize GSS-Proxy to manage the TGT. Configuration information is in the ipa-smartproxy man page. Design: http://www.freeipa.org/page/V3/Smart_Proxy https://fedorahosted.org/freeipa/ticket/4128 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2013-12-03 10:14:00 -06:00
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%files client
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%defattr(-,root,root,-)
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
%doc COPYING README Contributors.txt
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-client-install
Configure automount using autofs or sssd. This script edits nsswitch.conf to use either ldap (autofs) or sss (sssd) to find automount maps. NFSv4 services are started so Kerberos encryption and/or integrity can be used on the maps. https://fedorahosted.org/freeipa/ticket/1233 https://fedorahosted.org/freeipa/ticket/2193
2012-05-29 13:20:38 -05:00
%{_sbindir}/ipa-client-automount
Add client certificate update tool ipa-certupdate. Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-06-27 05:31:50 -05:00
%{_sbindir}/ipa-certupdate
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-getkeytab
A utility for removing principals from a keytab. When we un-enroll a client we'll do a bit of cleanup including removing any principals for the IPA realm from /etc/krb5.keytab. This removes principals in 2 ways: - By principal, only entries matching the full principal are removed - By realm. Any principal for that realm is removed This does not change the KDC at all, just removes entries from a file on the client machine.
2009-12-04 15:29:09 -06:00
%{_sbindir}/ipa-rmkeytab
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
%{_sbindir}/ipa-join
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa
%dir %{_localstatedir}/lib/ipa-client
%dir %{_localstatedir}/lib/ipa-client/sysrestore
%dir %{python_sitelib}/ipaclient
%{python_sitelib}/ipaclient/*.py*
%{_mandir}/man1/ipa-getkeytab.1.gz
A utility for removing principals from a keytab. When we un-enroll a client we'll do a bit of cleanup including removing any principals for the IPA realm from /etc/krb5.keytab. This removes principals in 2 ways: - By principal, only entries matching the full principal are removed - By realm. Any principal for that realm is removed This does not change the KDC at all, just removes entries from a file on the client machine.
2009-12-04 15:29:09 -06:00
%{_mandir}/man1/ipa-rmkeytab.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_mandir}/man1/ipa-client-install.1.gz
Configure automount using autofs or sssd. This script edits nsswitch.conf to use either ldap (autofs) or sss (sssd) to find automount maps. NFSv4 services are started so Kerberos encryption and/or integrity can be used on the maps. https://fedorahosted.org/freeipa/ticket/1233 https://fedorahosted.org/freeipa/ticket/2193
2012-05-29 13:20:38 -05:00
%{_mandir}/man1/ipa-client-automount.1.gz
Add client certificate update tool ipa-certupdate. Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-06-27 05:31:50 -05:00
%{_mandir}/man1/ipa-certupdate.1.gz
Add man page for ipa-join command
2009-10-08 10:10:21 -05:00
%{_mandir}/man1/ipa-join.1.gz
Add man page for the IPA configuration file ticket 969
2011-02-23 10:55:32 -06:00
%{_mandir}/man5/default.conf.5.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%files admintools
%defattr(-,root,root,-)
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%doc COPYING README Contributors.txt
Replace TurboGears requirement with python-cherrypy Remove some commented-out files Move /usr/bin/ipa to admintools package
2009-02-04 09:50:52 -06:00
%{_bindir}/ipa
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
%config %{_sysconfdir}/bash_completion.d
Add ipa man page.
2010-03-29 07:25:57 -05:00
%{_mandir}/man1/ipa.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
%files python -f %{gettext_domain}.lang
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%defattr(-,root,root,-)
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%doc COPYING README Contributors.txt
Rename ipa-python directory to ipapython so it is a real python library We used to install it as ipa, now installing it as ipapython. The rpm is still ipa-python.
2009-02-05 14:03:08 -06:00
%dir %{python_sitelib}/ipapython
%{python_sitelib}/ipapython/*.py*
Include some directories in spec file Two directories were left out from package file list: ..../site-packages/ipalib ..../site-packages/ipaserver http://fedorahosted.org/freeipa/ticket/688
2011-01-05 14:51:56 -06:00
%dir %{python_sitelib}/ipalib
Move ipalib to the ipa-python subpackage and bump up min version of slapi-nis.
2009-05-21 14:25:57 -05:00
%{python_sitelib}/ipalib/*
ipaplatform: Change makefiles to accomodate for new platform package https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-02 00:50:12 -05:00
%dir %{python_sitelib}/ipaplatform
ipaplatform: Fix build warnings The newly created ipaplatform subdirectories base and fedora were mentioned multiple times in the specfile, which produced build warnings. Part of: https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-19 08:09:37 -05:00
%{python_sitelib}/ipaplatform/*
Fix selected minor issues in the spec file and license This patch fixes: - too long description for server-trust-ad subpackage - adds (noreplace) flag %{_sysconfdir}/tmpfiles.d/ipa.conf to avoid overwriting potential user changes - changes permissions on default_encoding_utf8.so to prevent it pollute python subpackage Provides. - wrong address in GPL v2 license preamble in 2 distributed files https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:59:57 -05:00
%attr(0644,root,root) %{python_sitearch}/default_encoding_utf8.so
Rename ipa-python directory to ipapython so it is a real python library We used to install it as ipa, now installing it as ipapython. The rpm is still ipa-python.
2009-02-05 14:03:08 -06:00
%{python_sitelib}/ipapython-*.egg-info
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%{python_sitelib}/freeipa-*.egg-info
Include ipaplatform in client-only build https://fedorahosted.org/freeipa/ticket/4533 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 04:49:51 -05:00
%{python_sitelib}/ipaplatform-*.egg-info
Add default python encoding module to reset default from ascii to utf-8 Also clean up some duplicate files in the rpm for the UI.
2010-10-06 12:41:26 -05:00
%{python_sitearch}/python_default_encoding-*.egg-info
Fix the spec file Correct ownership for /etc/ipa and remove unnecessary %config directive. https://fedorahosted.org/freeipa/ticket/3551
2013-04-22 04:22:42 -05:00
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
%if ! %{ONLY_CLIENT}
%files tests -f tests-python.list
%defattr(-,root,root,-)
%doc COPYING README Contributors.txt
%dir %{python_sitelib}/ipatests
%dir %{python_sitelib}/ipatests/test_cmdline
%dir %{python_sitelib}/ipatests/test_install
%dir %{python_sitelib}/ipatests/test_ipalib
%dir %{python_sitelib}/ipatests/test_ipapython
%dir %{python_sitelib}/ipatests/test_ipaserver
Move tests to test directories Nose doesn't pick up directories that don't begin with 'test'. Rename ipatests/test_ipaserver/install to test_install so that it's run. Also, merge test_ipautil.py from ipapython/test into tests/test_ipapython, so the whole test suite is in one place.
2012-04-20 06:03:16 -05:00
%dir %{python_sitelib}/ipatests/test_ipaserver/test_install
test_ipaserver: Add OTP token test data to ipatests package The missing files caused test failures when running tests out of tree. Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-02 09:35:27 -05:00
%dir %{python_sitelib}/ipatests/test_ipaserver/data
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
%dir %{python_sitelib}/ipatests/test_pkcs10
Upstream Web UI tests Documentation: http://www.freeipa.org/page/Web_UI_Integration_Tests https://fedorahosted.org/freeipa/ticket/3744
2013-05-24 06:48:53 -05:00
%dir %{python_sitelib}/ipatests/test_webui
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
%dir %{python_sitelib}/ipatests/test_xmlrpc
Add ipa-run-tests command Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-22 04:08:10 -05:00
%{_bindir}/ipa-run-tests
Add a framework for integration test configuration Integration tests are configured via environment variables. Add a framework for parsing these variables and storing them in easy-to-use objects. Add an `ipa-test-config` executable that loads the configuration and prints out variables needed in shell scripts. Part of the work for https://fedorahosted.org/freeipa/ticket/3621
2013-05-24 12:55:21 -05:00
%{_bindir}/ipa-test-config
Add the ipa-test-task tool This script makes common testing tasks such as IPA installation and uninstallation available outside of Python. https://fedorahosted.org/freeipa/ticket/3721
2013-06-27 03:47:58 -05:00
%{_bindir}/ipa-test-task
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
%{python_sitelib}/ipatests-*.egg-info
Add man pages for testing tools Add man pages for ipa-run-tests, ipa-test-task, and ipa-test-config. https://fedorahosted.org/freeipa/ticket/3855 (part 5)
2013-08-13 11:32:36 -05:00
%{_mandir}/man1/ipa-run-tests.1.gz
%{_mandir}/man1/ipa-test-config.1.gz
%{_mandir}/man1/ipa-test-task.1.gz
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%changelog
Remove changelog from the spec The project's history is kept in Git. We used the spec changelog for changes to the spec itself, which doesn't make much sense. Downstreams like Fedora use their own changelog anyway. A single entry is left for tools that expect a changelog.
2013-11-26 06:06:07 -06:00
* Tue Nov 26 2013 Petr Viktorin<pviktori@redhat.com> - __VERSION__-__RELEASE__
- Remove changelog. The history is kept in Git, downstreams have own logs.
# note, this entry is here to placate tools that expect a non-empty changelog
Reference in New Issue Copy Permalink