IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-26 08:51:50 -06:00
Code Issues Packages Projects Releases Wiki Activity
543040a71d
freeipa/install/tools/Makefile.am

93 lines
1.8 KiB
Makefile
Raw Normal View History

Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
NULL =
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
SUBDIRS = \
man \
$(NULL)
Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
dist_noinst_DATA = \
ipa-ca-install.in \
Generate a unique cache for each connection Rather than having a shared ccache per user, configure mod_auth_gssapi to create a unique one. This requires cleanup to remove expired caches. A new script is added, ipa-ccache-sweeper to do this. It will be invoked by a new service, ipa-ccache-sweep, which will be executed every 12 hours by an equally-named timer. https://pagure.io/freeipa/issue/8589 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2020-11-19 15:29:05 -06:00
ipa-ccache-sweeper.in \
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
ipa-dns-install.in \
ipa-kra-install.in \
ipa-server-install.in \
ipa-adtrust-install.in \
ipa-replica-conncheck.in \
ipa-replica-install.in \
ipa-replica-manage.in \
ipa-csreplica-manage.in \
ipa-server-certinstall.in \
ipa-server-upgrade.in \
ipactl.in \
ipa-compat-manage.in \
ipa-nis-manage.in \
ipa-managed-entries.in \
ipa-ldap-updater.in \
ipa-otptoken-import.in \
ipa-backup.in \
ipa-restore.in \
ipa-advise.in \
ipa-cacert-manage.in \
ipa-winsync-migrate.in \
ipa-pkinit-manage.in \
CRL generation master: new utility to enable|disable Implement a new command ipa-clrgen-manage to enable, disable, or check the status of CRL generation on the localhost. The command automates the manual steps described in the wiki https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master Fixes: https://pagure.io/freeipa/issue/5803 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2019-02-22 10:19:22 -06:00
ipa-crlgen-manage.in \
Add ipa-cert-fix tool The ipa-cert-fix tool wraps `pki-server cert-fix`, performing additional certificate requests for non-Dogtag IPA certificates and performing additional actions. In particular: - Run cert-fix with arguments particular to the IPA deployment. - Update IPA RA certificate in the ipara user entry (if renewed). - Add shared certificates (if renewed) to the ca_renewal LDAP container for replication. - Become the CA renewal master if shared certificates were renewed. This ensures other CA replicas, including the previous CA renewal master if not the current host, pick up those new certificates when Certmonger attempts to renew them. Fixes: https://pagure.io/freeipa/issue/7885 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2019-03-22 00:53:53 -05:00
ipa-cert-fix.in \
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
ipa-custodia.in \
ipa-custodia-check.in \
ipa-httpd-kdcproxy.in \
Convert ipa-httpd-pwdreader into Python script and use paths from ipaplatform. Fixes: https://pagure.io/freeipa/issue/8401 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2020-07-28 07:04:34 -05:00
ipa-httpd-pwdreader.in \
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
ipa-pki-retrieve-key.in \
Add ExecStartPost hook to wait for Dogtag PKI Dogtag PKI typically takes around 10 seconds to start and respond to requests. Dogtag uses a simple systemd service, which means systemd is unable to detect when Dogtag is ready. Commands like ``systemctl start`` and ``systemctl restart`` don't block and wait until the CA is up. There have been various workarounds in Dogtag and IPA. Systemd has an ExecStartPost hook to run programs after the main service is started. The post hook blocks systemctl start and restart until all post hooks report ready, too. The new ipa-pki-wait-running script polls on port 8080 and waits until the CA subsystem returns ``running``. Related: https://pagure.io/freeipa/issue/7916 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2019-04-17 00:45:18 -05:00
ipa-pki-wait-running.in \
acme: add ipa-acme-manage command Add the ipa-acme-manage command which can be used to enable or disable the IPA ACME service. It must be used on each server. In the future we will implement deployment-wide configuration (including enable/disable) of the ACME service via IPA API, with configuration stored in and replicated by LDAP. But until then, we need a simple command for administrators to use. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-06-02 05:34:17 -05:00
ipa-acme-manage.in \
Add basic support for subordinate user/group ids New LDAP object class "ipaUserSubordinate" with four new fields: - ipasubuidnumber / ipasubuidcount - ipasubgidnumber / ipasgbuidcount New self-service permission to add subids. New command user-auto-subid to auto-assign subid The code hard-codes counts to 65536, sets subgid equal to subuid, and does not allow removal of subids. There is also a hack that emulates a DNA plugin with step interval 65536 for testing. Work around problem with older SSSD clients that fail with unknown idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571 Related: https://pagure.io/freeipa/issue/8361 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-03-19 05:48:38 -05:00
ipa-subids.in \
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
$(NULL)
nodist_sbin_SCRIPTS = \
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
ipa-ca-install \
Add ipa-dns-install script Unfortunately, for now there is no --uninstall option.
2009-11-23 02:26:50 -06:00
ipa-dns-install \
Add a KRA to IPA This patch adds the capability of installing a Dogtag KRA to an IPA instance. With this patch, a KRA is NOT configured by default when ipa-server-install is run. Rather, the command ipa-kra-install must be executed on an instance on which a Dogtag CA has already been configured. The KRA shares the same tomcat instance and DS instance as the Dogtag CA. Moreover, the same admin user/agent (and agent cert) can be used for both subsystems. Certmonger is also confgured to monitor the new subsystem certificates. To create a clone KRA, simply execute ipa-kra-install <replica_file> on a replica on which a Dogtag CA has already been replicated. ipa-kra-install will use the security domain to detect whether the system being installed is a replica, and will error out if a needed replica file is not provided. The install scripts have been refactored somewhat to minimize duplication of code. A new base class dogtagintance.py has been introduced containing code that is common to KRA and CA installs. This will become very useful when we add more PKI subsystems. The KRA will install its database as a subtree of o=ipaca, specifically o=ipakra,o=ipaca. This means that replication agreements created to replicate CA data will also replicate KRA data. No new replication agreements are required. Added dogtag plugin for KRA. This is an initial commit providing the basic vault functionality needed for vault. This plugin will likely be modified as we create the code to call some of these functions. Part of the work for: https://fedorahosted.org/freeipa/ticket/3872 The uninstallation option in ipa-kra-install is temporarily disabled. Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-18 10:23:30 -05:00
ipa-kra-install \
Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
ipa-server-install \
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619
2011-09-07 03:17:12 -05:00
ipa-adtrust-install \
Connection check program for replica installation When connection between a master machine and future replica is not sane, the replica installation may fail unexpectedly with inconvenient error messages. One common problem is misconfigured firewall. This patch adds a program ipa-replica-conncheck which tests the connection using the following procedure: 1) Execute the on-replica check testing the connection to master 2) Open required ports on local machine 3) Ask user to run the on-master part of the check OR run it automatically: a) kinit to master as default admin user with given password b) run the on-master part using ssh 4) When master part is executed, it checks connection back to the replica and prints the check result This program is run by ipa-replica-install as mandatory part. It can, however, be skipped using --skip-conncheck option. ipa-replica-install now requires password for admin user to run the command on remote master. https://fedorahosted.org/freeipa/ticket/1107
2011-05-22 12:17:07 -05:00
ipa-replica-conncheck \
Initial replication setup. This add replication setup through two new commands: ipa-replica-prepare and ipa-replica-install. The procedure is to run ipa-replica-prepare on an existing master. This will collect information about the realm and the current master and create a file storing all of the information. After copying that file to the new replica, ipa-replica-install is run (with -r to create a read-only replica). This version of the patch also includes fixes for the sasl mappings on the replicas. Remaining features: - ssl for replication. - automatic configuration of mesh topology for master (or a simpler way to replicate multiple masters. - tool for view / configuring current replication.
0000-12-31 18:09:24 -05:50
ipa-replica-install \
- Enable ssl for replication. - Add replication management script that allows listing adding, and deleting replicas.
0000-12-31 18:09:24 -05:50
ipa-replica-manage \
Create tool to manage dogtag replication agreements For the most part the existing replication code worked with the following exceptions: - Added more port options - It assumed that initial connections were done to an SSL port. Added ability to use startTLS - It assumed that the name of the agreement was the same on both sides. In dogtag one is marked as master and one as clone. A new option is added, master, the determines which side we're working on or None if it isn't a dogtag agreement. - Don't set the attribute exclude list on dogtag agreements - dogtag doesn't set a schedule by default (which is actually recommended by 389-ds). This causes problems when doing a force-sync though so if one is done we set a schedule to run all the time. Otherwise the temporary schedule can't be removed (LDAP operations error). https://fedorahosted.org/freeipa/ticket/1250
2011-07-14 22:35:01 -05:00
ipa-csreplica-manage \
Web UI plugin loader https://fedorahosted.org/freeipa/ticket/3235
2013-03-20 11:28:17 -05:00
ipa-server-certinstall \
Server Upgrade: ipa-server-upgrade command https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2015-04-02 07:14:15 -05:00
ipa-server-upgrade \
Add small script to start/stop all of the services that IPA requires in the proper order. 435026
2008-02-28 10:37:06 -06:00
ipactl \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
ipa-compat-manage \
New tool to enable/disable DS plugin to act as NIS server
2009-05-07 09:51:44 -05:00
ipa-nis-manage \
25 Create Tool for Enabling/Disabling Managed Entry Plugins Remove legacy ipa-host-net-manage Add ipa-managed-entries tool Add man page for ipa-managed-entries tool https://fedorahosted.org/freeipa/ticket/1181
2011-09-20 11:13:42 -05:00
ipa-managed-entries \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
ipa-ldap-updater \
Implement OTP token importing This patch adds support for importing tokens using RFC 6030 key container files. This includes decryption support. For sysadmin sanity, any tokens which fail to add will be written to the output file for examination. The main use case here is where a small subset of a large set of tokens fails to validate or add. Using the output file, the sysadmin can attempt to recover these specific tokens. This code is implemented as a server-side script. However, it doesn't actually need to run on the server. This was done because importing is an odd fit for the IPA command framework: 1. We need to write an output file. 2. The operation may be long-running (thousands of tokens). 3. Only admins need to perform this task and it only happens infrequently. https://fedorahosted.org/freeipa/ticket/4261 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-08 10:06:16 -05:00
ipa-otptoken-import \
Full system backup and restore This will allow one to backup and restore the IPA files and data. This does not cover individual entry restoration. http://freeipa.org/page/V3/Backup_and_Restore https://fedorahosted.org/freeipa/ticket/3128
2013-03-13 08:36:41 -05:00
ipa-backup \
ipa-restore \
Provide ipa-advise tool Provides a pluggable framework for generating configuration scriptlets and instructions for various machine setups and use cases. Creates a new ipa-advise command, available to root user on the IPA server. Also provides an example configuration plugin, config-fedora-authconfig. https://fedorahosted.org/freeipa/ticket/3670
2013-06-10 07:43:24 -05:00
ipa-advise \
Add CA certificate management tool ipa-cacert-manage. Part of https://fedorahosted.org/freeipa/ticket/3737 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-03-13 04:28:27 -05:00
ipa-cacert-manage \
winsync-migrate: Include the tool parts in Makefile and friends https://fedorahosted.org/freeipa/ticket/4524 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-04-29 01:16:12 -05:00
ipa-winsync-migrate \
pkinit manage: introduce ipa-pkinit-manage Add the ipa-pkinit-manage tool to allow enabling / disabling PKINIT after the initial server install. https://pagure.io/freeipa/issue/7000 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-06-05 07:41:02 -05:00
ipa-pkinit-manage \
CRL generation master: new utility to enable|disable Implement a new command ipa-clrgen-manage to enable, disable, or check the status of CRL generation on the localhost. The command automates the manual steps described in the wiki https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master Fixes: https://pagure.io/freeipa/issue/5803 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2019-02-22 10:19:22 -06:00
ipa-crlgen-manage \
Add ipa-cert-fix tool The ipa-cert-fix tool wraps `pki-server cert-fix`, performing additional certificate requests for non-Dogtag IPA certificates and performing additional actions. In particular: - Run cert-fix with arguments particular to the IPA deployment. - Update IPA RA certificate in the ipara user entry (if renewed). - Add shared certificates (if renewed) to the ca_renewal LDAP container for replication. - Become the CA renewal master if shared certificates were renewed. This ensures other CA replicas, including the previous CA renewal master if not the current host, pick up those new certificates when Certmonger attempts to renew them. Fixes: https://pagure.io/freeipa/issue/7885 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2019-03-22 00:53:53 -05:00
ipa-cert-fix \
acme: add ipa-acme-manage command Add the ipa-acme-manage command which can be used to enable or disable the IPA ACME service. It must be used on each server. In the future we will implement deployment-wide configuration (including enable/disable) of the ACME service via IPA API, with configuration stored in and replicated by LDAP. But until then, we need a simple command for administrators to use. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-06-02 05:34:17 -05:00
ipa-acme-manage \
Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
$(NULL)
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
appdir = $(libexecdir)/ipa/
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
nodist_app_SCRIPTS = \
Generate a unique cache for each connection Rather than having a shared ccache per user, configure mod_auth_gssapi to create a unique one. This requires cleanup to remove expired caches. A new script is added, ipa-ccache-sweeper to do this. It will be invoked by a new service, ipa-ccache-sweep, which will be executed every 12 hours by an equally-named timer. https://pagure.io/freeipa/issue/8589 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2020-11-19 15:29:05 -06:00
ipa-ccache-sweeper \
Use Custodia 0.3.1 features * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-28 05:07:19 -06:00
ipa-custodia \
Test script for ipa-custodia Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-08-01 04:33:32 -05:00
ipa-custodia-check \
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
ipa-httpd-kdcproxy \
Convert ipa-httpd-pwdreader into Python script and use paths from ipaplatform. Fixes: https://pagure.io/freeipa/issue/8401 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2020-07-28 07:04:34 -05:00
ipa-httpd-pwdreader \
Setup lightweight CA key retrieval on install/upgrade Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-05-31 17:07:33 -05:00
ipa-pki-retrieve-key \
Add ExecStartPost hook to wait for Dogtag PKI Dogtag PKI typically takes around 10 seconds to start and respond to requests. Dogtag uses a simple systemd service, which means systemd is unable to detect when Dogtag is ready. Commands like ``systemctl start`` and ``systemctl restart`` don't block and wait until the CA is up. There have been various workarounds in Dogtag and IPA. Systemd has an ExecStartPost hook to run programs after the main service is started. The post hook blocks systemctl start and restart until all post hooks report ready, too. The new ipa-pki-wait-running script polls on port 8080 and waits until the CA subsystem returns ``running``. Related: https://pagure.io/freeipa/issue/7916 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2019-04-17 00:45:18 -05:00
ipa-pki-wait-running \
Add basic support for subordinate user/group ids New LDAP object class "ipaUserSubordinate" with four new fields: - ipasubuidnumber / ipasubuidcount - ipasubgidnumber / ipasgbuidcount New self-service permission to add subids. New command user-auto-subid to auto-assign subid The code hard-codes counts to 65536, sets subgid equal to subuid, and does not allow removal of subids. There is also a hack that emulates a DNA plugin with step interval 65536 for testing. Work around problem with older SSSD clients that fail with unknown idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571 Related: https://pagure.io/freeipa/issue/8361 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-03-19 05:48:38 -05:00
ipa-subids \
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
$(NULL)
Generate scripts from templates Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-08-22 10:15:55 -05:00
PYTHON_SHEBANG = \
$(nodist_sbin_SCRIPTS) \
$(nodist_app_SCRIPTS) \
$(NULL)
CLEANFILES = $(PYTHON_SHEBANG)
include $(top_srcdir)/Makefile.pythonscripts.am
Reference in New Issue Copy Permalink