IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-26 00:41:25 -06:00
Code Issues Packages Projects Releases Wiki Activity
ef68c02c6a
freeipa/freeipa.spec.in

1054 lines
36 KiB
RPMSpec
Raw Normal View History

Add a separate client-only target
2009-10-12 15:00:00 -05:00
# Define ONLY_CLIENT to only make the ipa-client and ipa-python subpackages
Replace uses of %define with %global in the .spec file Fixes rawhide builds per https://www.redhat.com/archives/fedora-devel-list/2010-January/msg00093.html Contributed by Nalin Dahyabhai
2010-01-07 13:12:52 -06:00
%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}
Add a separate client-only target
2009-10-12 15:00:00 -05:00
Replace uses of %define with %global in the .spec file Fixes rawhide builds per https://www.redhat.com/archives/fedora-devel-list/2010-January/msg00093.html Contributed by Nalin Dahyabhai
2010-01-07 13:12:52 -06:00
%global httpd_conf /etc/httpd/conf.d
%global plugin_dir %{_libdir}/dirsrv/plugins
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
%if ! (0%{?fedora} > 12 || 0%{?rhel} > 5)
%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from
distutils.sysconfig import get_python_lib; print(get_python_lib())")}
%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from
distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
%endif
Replace uses of %define with %global in the .spec file Fixes rawhide builds per https://www.redhat.com/archives/fedora-devel-list/2010-January/msg00093.html Contributed by Nalin Dahyabhai
2010-01-07 13:12:52 -06:00
%global POLICYCOREUTILSVER 1.33.12-1
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
%global gettext_domain ipa
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Name: freeipa
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Version: __VERSION__
Release: __RELEASE__%{?dist}
Summary: The Identity, Policy and Audit system
Group: System Environment/Base
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
License: GPLv3+
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
URL: http://www.freeipa.org/
Source0: freeipa-%{version}.tar.gz
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
slapi-plugins: use thread-safe ldap library
2011-12-20 11:39:34 -06:00
BuildRequires: 389-ds-base-devel >= 1.2.10-0.6.a6
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: svrcore-devel
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: /usr/share/selinux/devel/Makefile
BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER}
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
BuildRequires: systemd-units
%endif
Fix dependency for samba4-devel package
2011-12-09 08:56:53 -06:00
BuildRequires: samba4-devel
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: nspr-devel
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: nss-devel
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: openssl-devel
BuildRequires: openldap-devel
BuildRequires: krb5-devel
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: krb5-workstation
BuildRequires: libuuid-devel
Fix client enrollment Enable GSSAPI credentials delegation in xmlrpc-c/curl to fix client enrollment. The unconditional GSSAPI was previously dropped from curl because of CVE-2011-2192. https://fedorahosted.org/freeipa/ticket/1452
2011-08-11 03:42:29 -05:00
%if 0%{?fedora} >= 16
BuildRequires: libcurl-devel >= 7.21.7-2
BuildRequires: xmlrpc-c-devel >= 1.27.4
%else
%if 0%{?fedora} == 15
BuildRequires: libcurl-devel >= 7.21.3-9
BuildRequires: xmlrpc-c-devel >= 1.25.4
%else
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: libcurl-devel
Fix client enrollment Enable GSSAPI credentials delegation in xmlrpc-c/curl to fix client enrollment. The unconditional GSSAPI was previously dropped from curl because of CVE-2011-2192. https://fedorahosted.org/freeipa/ticket/1452
2011-08-11 03:42:29 -05:00
BuildRequires: xmlrpc-c-devel
%endif
%endif
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: popt-devel
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: m4
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: libtool
BuildRequires: gettext
BuildRequires: python-devel
BuildRequires: authconfig
BuildRequires: python-ldap
Add missing buildrequires
2009-02-23 11:41:00 -06:00
BuildRequires: python-setuptools
BuildRequires: python-krbV
Add API version and have server reject incompatible clients. This patch contains 2 parts. The first part is a small utility to create and validate the current API. To do this it needs to load ipalib which on a fresh system introduces a few problems, namely that it relies on a python plugin to set the default encoding to utf8. For our purposes we can skip that. It is also important that any optional plugins be loadable so the API can be examined. The second part is a version exchange between the client and server. The version has a major and a minor version. The major verion is updated whenever existing API changes. The minor version is updated when new API is added. A request will be rejected if either the major versions don't match or if the client major version is higher than then server major version (though by implication new API would return a command not found if allowed to proceed). To determine the API version of the server from a client use the ping command. ticket 584
2011-01-13 13:29:16 -06:00
BuildRequires: python-nss
Update minimum required version of python-netaddr. ticket 1288
2011-06-28 04:15:26 -05:00
%if 0%{?fedora} >= 15
BuildRequires: python-netaddr >= 0.7.5-3
%else
Add API version and have server reject incompatible clients. This patch contains 2 parts. The first part is a small utility to create and validate the current API. To do this it needs to load ipalib which on a fresh system introduces a few problems, namely that it relies on a python plugin to set the default encoding to utf8. For our purposes we can skip that. It is also important that any optional plugins be loadable so the API can be examined. The second part is a version exchange between the client and server. The version has a major and a minor version. The major verion is updated whenever existing API changes. The minor version is updated when new API is added. A request will be rejected if either the major versions don't match or if the client major version is higher than then server major version (though by implication new API would return a command not found if allowed to proceed). To determine the API version of the server from a client use the ping command. ticket 584
2011-01-13 13:29:16 -06:00
BuildRequires: python-netaddr
Update minimum required version of python-netaddr. ticket 1288
2011-06-28 04:15:26 -05:00
%endif
Add API version and have server reject incompatible clients. This patch contains 2 parts. The first part is a small utility to create and validate the current API. To do this it needs to load ipalib which on a fresh system introduces a few problems, namely that it relies on a python plugin to set the default encoding to utf8. For our purposes we can skip that. It is also important that any optional plugins be loadable so the API can be examined. The second part is a version exchange between the client and server. The version has a major and a minor version. The major verion is updated whenever existing API changes. The minor version is updated when new API is added. A request will be rejected if either the major versions don't match or if the client major version is higher than then server major version (though by implication new API would return a command not found if allowed to proceed). To determine the API version of the server from a client use the ping command. ticket 584
2011-01-13 13:29:16 -06:00
BuildRequires: python-kerberos
Update spec with missing BuildRequires for pylint check https://fedorahosted.org/freeipa/ticket/1203
2011-05-05 08:06:54 -05:00
BuildRequires: python-rhsm
Add pyOpenSSL as a BuildRequires
2011-02-11 08:34:57 -06:00
BuildRequires: pyOpenSSL
Update spec with missing BuildRequires for pylint check https://fedorahosted.org/freeipa/ticket/1203
2011-05-05 08:06:54 -05:00
BuildRequires: pylint
Add hbactest command. https://fedorahosted.org/freeipa/ticket/386 HBAC rules control who can access what services on what hosts and from where. You can use HBAC to control which users or groups on a source host can access a service, or group of services, on a target host. Since applying HBAC rules implies use of a production environment, this plugin aims to provide simulation of HBAC rules evaluation without having access to the production environment. Test user coming from source host to a service on a named host against existing enabled rules. ipa hbactest --user= --srchost= --host= --service= [--rules=rules-list] [--nodetail] [--enabled] [--disabled] --user, --srchost, --host, and --service are mandatory, others are optional. If --rules is specified simulate enabling of the specified rules and test the login of the user using only these rules. If --enabled is specified, all enabled HBAC rules will be added to simulation If --disabled is specified, all disabled HBAC rules will be added to simulation If --nodetail is specified, do not return information about rules matched/not matched. If both --rules and --enabled are specified, apply simulation to --rules _and_ all IPA enabled rules. If no --rules specified, simulation is run against all IPA enabled rules. EXAMPLES: 1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 2. Disable detailed summary of how rules were applied: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail -------------------- Access granted: True -------------------- 3. Test explicitly specified HBAC rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: myrule 4. Use all enabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 5. Test all disabled HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled --------------------- Access granted: False --------------------- notmatched: new-rule 6. Test all disabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule 7. Test all (enabled and disabled) HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule notmatched: new-rule matched: allow_all Only rules existing in IPA database are tested. They may be in enabled or disabled disabled state. Specifying them through --rules option explicitly enables them only in simulation run. Specifying non-existing rules will not grant access and report non-existing rules in output.
2011-07-22 08:30:44 -05:00
BuildRequires: libipa_hbac-python
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof).
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%package server
Summary: The IPA authentication server
Group: System Environment/Base
Requires: %{name}-python = %{version}-%{release}
Requires: %{name}-client = %{version}-%{release}
Requires: %{name}-admintools = %{version}-%{release}
Change the Requires for the server and server-selinux for proper order The server package needs to be installed before the server-selinux package otherwise the SELinux contexts won't get set properly. The (postun) is so you can continue to do yum erase freeipa-python and it will pick up everything else. https://fedorahosted.org/freeipa/ticket/1779
2011-09-15 14:57:41 -05:00
Requires: %{name}-server-selinux = %{version}-%{release}
Create skeleton CLDAP server as a DS plugin
2011-11-09 18:03:48 -06:00
Requires(pre): 389-ds-base >= 1.2.10-0.5.a5
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: openldap-clients
Requires: nss
Requires: nss-tools
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
Requires: krb5-server >= 1.9.1-15
%else
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: krb5-server
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%endif
Add krb5-pkinit-openssl as a Requires on ipa-server package ticket 599
2010-12-13 13:46:09 -06:00
Requires: krb5-pkinit-openssl
Add an arch-specific Requires on cyrus-sasl-gssapi If you had a 64-bit system and installed a 32-bit version of IPA then ipa-getkeytab probably wouldn't work because yum wouldn't know to pull in the 32-bit version of cyrus-sasl-gssapi. https://fedorahosted.org/freeipa/ticket/1499
2011-07-22 08:06:13 -05:00
Requires: cyrus-sasl-gssapi%{?_isa}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: ntp
Requires: httpd
Run ipaserver under mod_wsgi
2010-02-24 12:29:23 -06:00
Requires: mod_wsgi
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
Requires: mod_auth_kerb >= 5.4-9
Update minimum version of 389-ds-base, mod_nss and selinux-policy. * Set min version of 389-ds-base to 1.2.8 * Set min version of mod_nss 1.0.8-10 * Set min version of selinux-policy to 3.9.7-27
2011-02-02 15:32:39 -06:00
Requires: mod_nss >= 1.0.8-10
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: python-ldap
Requires: python-krbV
Requires: acl
Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1 Any type
2009-12-01 13:02:46 -06:00
Requires: python-pyasn1 >= 0.0.9a
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
Requires: systemd-units >= 36-3
Requires(pre): systemd-units
Requires(post): systemd-units
%endif
Update min nvr for selinux-policy and pki-ca for F-15+ Done with conditionals so still installable on F-14. ticket 1200
2011-05-12 21:45:29 -05:00
%if 0%{?fedora} >= 15
Requires: selinux-policy >= 3.9.16-18
%else
Update minimum version of 389-ds-base, mod_nss and selinux-policy. * Set min version of 389-ds-base to 1.2.8 * Set min version of mod_nss 1.0.8-10 * Set min version of selinux-policy to 3.9.7-27
2011-02-02 15:32:39 -06:00
Requires: selinux-policy >= 3.9.7-27
Update min nvr for selinux-policy and pki-ca for F-15+ Done with conditionals so still installable on F-14. ticket 1200
2011-05-12 21:45:29 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires(post): selinux-policy-base
sudo and netgroup schema compat updates - fix quoting of netgroup entries - don't bother looking for members of netgroups by looking for entries which list "memberOf: $netgroup" -- the netgroup should list them as "member" values - use newer slapi-nis functionality to produce cn=sudoers - drop the real cn=sudoers container to make room for the compat container
2010-11-30 17:25:33 -06:00
Requires: slapi-nis >= 0.21
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
Requires: pki-ca >= 9.0.15
Requires: pki-silent >= 9.0.15
# Only tomcat6 greater than this version provides proper systemd support
Requires: tomcat6 >= 6.0.32-17
%else
Update min nvr for selinux-policy and pki-ca for F-15+ Done with conditionals so still installable on F-14. ticket 1200
2011-05-12 21:45:29 -05:00
%if 0%{?fedora} >= 15
Force the upgrade of pki-setup when upgrading the RPMS
2011-10-07 13:54:57 -05:00
Requires: pki-ca >= 9.0.15
Requires: pki-silent >= 9.0.15
Requires: pki-setup >= 9.0.15
Update min nvr for selinux-policy and pki-ca for F-15+ Done with conditionals so still installable on F-14. ticket 1200
2011-05-12 21:45:29 -05:00
%else
Requires: pki-ca >= 9.0.5
Requires: pki-silent >= 9.0.5
%endif
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%endif
Add requires for the pki First part of: https://fedorahosted.org/freeipa/ticket/855
2011-01-26 15:34:44 -06:00
Requires: dogtag-pki-common-theme
Requires: dogtag-pki-ca-theme
Add subscription-manager dependency for RHEL. ticket 1664
2011-08-23 07:15:27 -05:00
%if 0%{?rhel}
Requires: subscription-manager
%endif
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
Requires(preun): python systemd-units
Requires(postun): python systemd-units
%else
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
Requires(preun): python initscripts chkconfig
Requires(postun): python initscripts chkconfig
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Set bind and bind-dyndb-ldap min nvr This is a soft dependency, min nvr version will only be required when bind/bind-dyndb-ldap are installed. https://fedorahosted.org/freeipa/ticket/1121 https://fedorahosted.org/freeipa/ticket/1573
2011-09-09 05:30:00 -05:00
# We have a soft-requires on bind. It is an optional part of
# IPA but if it is configured we need a way to require versions
# that work for us.
Conflicts: bind-dyndb-ldap < 1.0.0-0.1.b1
Conflicts: bind < 9.8.1-1
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
Obsoletes: ipa-server >= 1.0
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description server
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). If you are installing an IPA server you need
to install this package (in other words, most people should NOT install
this package).
%package server-selinux
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Summary: SELinux rules for freeipa-server daemons
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Group: System Environment/Base
Change the Requires for the server and server-selinux for proper order The server package needs to be installed before the server-selinux package otherwise the SELinux contexts won't get set properly. The (postun) is so you can continue to do yum erase freeipa-python and it will pick up everything else. https://fedorahosted.org/freeipa/ticket/1779
2011-09-15 14:57:41 -05:00
Requires(post): %{name}-server = %{version}-%{release}
Requires(postun): %{name}-server = %{version}-%{release}
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
Obsoletes: ipa-server-selinux >= 1.0
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description server-selinux
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). This package provides SELinux rules for the
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
daemons included in freeipa-server
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%package client
Summary: IPA authentication for use on clients
Group: System Environment/Base
Requires: %{name}-python = %{version}-%{release}
Requires: python-ldap
Add an arch-specific Requires on cyrus-sasl-gssapi If you had a 64-bit system and installed a 32-bit version of IPA then ipa-getkeytab probably wouldn't work because yum wouldn't know to pull in the 32-bit version of cyrus-sasl-gssapi. https://fedorahosted.org/freeipa/ticket/1499
2011-07-22 08:06:13 -05:00
Requires: cyrus-sasl-gssapi%{?_isa}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: ntp
Requires: krb5-workstation
Requires: authconfig
Requires: pam_krb5
Use OpenSSL for SSL instead of the built-in python version.
2009-02-19 16:20:37 -06:00
Requires: wget
Fix client enrollment Enable GSSAPI credentials delegation in xmlrpc-c/curl to fix client enrollment. The unconditional GSSAPI was previously dropped from curl because of CVE-2011-2192. https://fedorahosted.org/freeipa/ticket/1452
2011-08-11 03:42:29 -05:00
%if 0%{?fedora} >= 16
Requires: libcurl >= 7.21.7-2
Requires: xmlrpc-c >= 1.27.4
%else
%if 0%{?fedora} == 15
Requires: libcurl >= 7.21.3-9
Requires: xmlrpc-c >= 1.25.4
%else
Requires: libcurl
Requires: xmlrpc-c
%endif
%endif
Set minimum version of sssd to 1.5.1 ticket 926
2011-02-09 13:26:45 -06:00
Requires: sssd >= 1.5.1
Break out install into more steps, add -key_algorithm to pkisilent Installing dogtag is quite slow and it isn't always clear that things are working. This breaks out some restart calls into separate steps to show some amount of progress. There are still some steps that take more than a minute (pkicreate and pkisilent). Add new argument to pkisilent, -key_algorithm Update a bunch of minimum required versions in the spec file. tickets 139 (time) and 144 (key_algorithm)
2010-08-16 16:55:07 -05:00
Requires: certmonger >= 0.26
Clean up the spec file, add Requires for nss-pam-ldapd for F14+ Also do the following: - Remove conflicts on mod_ssl - Remove a lot of version checking for EOL'd Fedora versions - Add a few conditionals for rhel6 - Add Requires of nss-tools on ipa-client
2010-09-09 17:10:14 -05:00
Requires: nss-tools
Try to register DNS name through a DNS Update on install. Fixes: https://fedorahosted.org/freeipa/ticket/935
2011-02-17 07:30:36 -06:00
Requires: bind-utils
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
Obsoletes: ipa-client >= 1.0
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description client
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). If your network uses IPA for authentication,
this package should be installed on every client machine.
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%package admintools
Summary: IPA administrative tools
Group: System Environment/Base
Requires: %{name}-python = %{version}-%{release}
Add Requires on ipa-client to ipa-admintools, ensure ipa client is configured It makes little sense to install ipa-admintools without ipa-client, require it. Also see if the client has been configured. This is a bit tricky since we have a full set of defaults. Add a new env option that gets set if at least one configuration file is loaded. ticket 213
2010-10-15 14:03:51 -05:00
Requires: %{name}-client = %{version}-%{release}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: python-krbV
Requires: python-ldap
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
Obsoletes: ipa-admintools >= 1.0
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description admintools
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). This package provides command-line tools for
IPA administrators.
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%package python
Summary: Python libraries used by IPA
Group: System Environment/Libraries
Clean up the spec file, add Requires for nss-pam-ldapd for F14+ Also do the following: - Remove conflicts on mod_ssl - Remove a lot of version checking for EOL'd Fedora versions - Add a few conditionals for rhel6 - Add Requires of nss-tools on ipa-client
2010-09-09 17:10:14 -05:00
%if 0%{?fedora} >= 12 || 0%{?rhel} >= 6
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: python-kerberos >= 1.1-3
%endif
Requires: authconfig
Requires: gnupg
Parse netmasks in IP addresses passed to server install. ticket 1212
2011-05-27 13:17:22 -05:00
Requires: iproute
Use OpenSSL for SSL instead of the built-in python version.
2009-02-19 16:20:37 -06:00
Requires: pyOpenSSL
Make nsslib IPv6 aware
2011-02-02 06:57:16 -06:00
Requires: python-nss >= 0.11
Require current versions of python-nss & python-lxml ipa.spec.in | 3 ++- ipapython/nsslib.py | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
2009-11-23 15:52:06 -06:00
Requires: python-lxml
Update minimum required version of python-netaddr. ticket 1288
2011-06-28 04:15:26 -05:00
%if 0%{?fedora} >= 15
Requires: python-netaddr >= 0.7.5-3
%else
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
Requires: python-netaddr
Update minimum required version of python-netaddr. ticket 1288
2011-06-28 04:15:26 -05:00
%endif
Add hbactest command. https://fedorahosted.org/freeipa/ticket/386 HBAC rules control who can access what services on what hosts and from where. You can use HBAC to control which users or groups on a source host can access a service, or group of services, on a target host. Since applying HBAC rules implies use of a production environment, this plugin aims to provide simulation of HBAC rules evaluation without having access to the production environment. Test user coming from source host to a service on a named host against existing enabled rules. ipa hbactest --user= --srchost= --host= --service= [--rules=rules-list] [--nodetail] [--enabled] [--disabled] --user, --srchost, --host, and --service are mandatory, others are optional. If --rules is specified simulate enabling of the specified rules and test the login of the user using only these rules. If --enabled is specified, all enabled HBAC rules will be added to simulation If --disabled is specified, all disabled HBAC rules will be added to simulation If --nodetail is specified, do not return information about rules matched/not matched. If both --rules and --enabled are specified, apply simulation to --rules _and_ all IPA enabled rules. If no --rules specified, simulation is run against all IPA enabled rules. EXAMPLES: 1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 2. Disable detailed summary of how rules were applied: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail -------------------- Access granted: True -------------------- 3. Test explicitly specified HBAC rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: myrule 4. Use all enabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 5. Test all disabled HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled --------------------- Access granted: False --------------------- notmatched: new-rule 6. Test all disabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule 7. Test all (enabled and disabled) HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule notmatched: new-rule matched: allow_all Only rules existing in IPA database are tested. They may be in enabled or disabled disabled state. Specifying them through --rules option explicitly enables them only in simulation run. Specifying non-existing rules will not grant access and report non-existing rules in output.
2011-07-22 08:30:44 -05:00
Requires: libipa_hbac-python
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
Obsoletes: ipa-python >= 1.0
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description python
IPA is an integrated solution to provide centrally managed Identity (machine,
user, virtual machines, groups, authentication credentials), Policy
(configuration settings, access control information) and Audit (events,
logs, analysis thereof). If you are using IPA you need to install this
package.
%prep
%setup -n freeipa-%{version} -q
%build
export CFLAGS="$CFLAGS %{optflags}"
export CPPFLAGS="$CPPFLAGS %{optflags}"
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
export SUPPORTED_PLATFORM=fedora16
# Force re-generate of platform support
rm -f ipapython/services.py
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
make version-update
Drop --with-openldap option in the client. This is no longer optional.
2010-06-02 13:54:58 -05:00
cd ipa-client; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Make use of mozldap vs openldap for plugins selectable
2010-12-03 14:02:29 -06:00
cd daemons; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir} --with-openldap; cd ..
Complete consolidation into a single autogen.sh
2009-02-03 15:56:41 -06:00
cd install; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Multi-process build problems Fix a problem when a target missed a version-update requirement. This caused build problems, especially in a parallel build environment. https://fedorahosted.org/freeipa/ticket/1215
2011-06-17 03:58:01 -05:00
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} all
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
cd selinux
# This isn't multi-process make capable yet
make all
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%else
Multi-process build problems Fix a problem when a target missed a version-update requirement. This caused build problems, especially in a parallel build environment. https://fedorahosted.org/freeipa/ticket/1215
2011-06-17 03:58:01 -05:00
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} client
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%install
rm -rf %{buildroot}
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
export SUPPORTED_PLATFORM=fedora16
# Force re-generate of platform support
rm -f ipapython/services.py
%endif
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
make install DESTDIR=%{buildroot}
cd selinux
make install DESTDIR=%{buildroot}
Bash tab completion script
2009-11-23 15:19:14 -06:00
cd ..
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%else
make client-install DESTDIR=%{buildroot}
%endif
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
%find_lang %{gettext_domain}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
# Remove .la files from libtool - we don't want to package
# these files
rm %{buildroot}/%{plugin_dir}/libipa_pwd_extop.la
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_enrollment_extop.la
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_winsync.la
Replication version checking. Whenever we upgrade IPA such that any data incompatibilities might occur then we need to bump the DATA_VERSION value so that data will not replicate to other servers. The idea is that you can do an in-place upgrade of each IPA server and the different versions own't pollute each other with bad data.
2010-06-24 09:31:52 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_repl_version.la
ipa-uuid: DNA-like plugin that generates uuids
2010-10-15 09:49:29 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_uuid.la
Add new plugin used to modify related attributes after a modrdn operation.
2010-10-19 16:11:31 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la
Update kerberos password policy values on LDAP binds. On a failed bind this will update krbLoginFailedCount and krbLastFailedAuth and will potentially fail the bind altogether. On a successful bind it will zero krbLoginFailedCount and set krbLastSuccessfulAuth. This will also enforce locked-out accounts. See http://k5wiki.kerberos.org/wiki/Projects/Lockout for details on kerberos lockout. ticket 343
2011-01-18 13:58:58 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_lockout.la
Create skeleton CLDAP server as a DS plugin
2011-11-09 18:03:48 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_cldap.la
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la
Add ipasam samba passdb backend https://fedorahosted.org/freeipa/ticket/1874
2011-10-25 03:33:30 -05:00
rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
# Some user-modifiable HTML files are provided. Move these to /etc
# and link back.
mkdir -p %{buildroot}/%{_sysconfdir}/ipa/html
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysrestore
mkdir %{buildroot}%{_usr}/share/ipa/html/
ln -s ../../../..%{_sysconfdir}/ipa/html/ssbrowser.html \
%{buildroot}%{_usr}/share/ipa/html/ssbrowser.html
ln -s ../../../..%{_sysconfdir}/ipa/html/unauthorized.html \
%{buildroot}%{_usr}/share/ipa/html/unauthorized.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
ln -s ../../../..%{_sysconfdir}/ipa/html/browserconfig.html \
%{buildroot}%{_usr}/share/ipa/html/browserconfig.html
ln -s ../../../..%{_sysconfdir}/ipa/html/ipa_error.css \
%{buildroot}%{_usr}/share/ipa/html/ipa_error.css
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Own the Apache configuration files that ipa-server-install creates
2009-05-14 08:29:16 -05:00
# So we can own our Apache configuration
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
daemons: Remove ipa_kpasswd Now that we have our own database we can properly enforce stricter constraints on how the db can be changed. Stop shipping our own kpasswd daemon and instead use the regular kadmin daemon.
2011-07-20 17:11:05 -05:00
mkdir -p %{buildroot}%{_initrddir}
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
# Default to systemd initscripts for F16 and above
mkdir -p %{buildroot}%{_unitdir}
install -m 644 init/systemd/ipa.service %{buildroot}%{_unitdir}/ipa.service
%else
install -m755 init/SystemV/ipa.init %{buildroot}%{_initrddir}/ipa
%endif
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%endif
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/ipa/
/bin/touch %{buildroot}%{_sysconfdir}/ipa/default.conf
Add a separate client-only target
2009-10-12 15:00:00 -05:00
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa-client/sysrestore
Own the Apache configuration files that ipa-server-install creates
2009-05-14 08:29:16 -05:00
Bash tab completion script
2009-11-23 15:19:14 -06:00
%if ! %{ONLY_CLIENT}
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/bash_completion.d
install -pm 644 contrib/completion/ipa.bash_completion %{buildroot}%{_sysconfdir}/bash_completion.d/ipa
Add support for tracking and counting entitlements Adds a plugin, entitle, to register to the entitlement server, consume entitlements and to count and track them. It is also possible to import an entitlement certificate (if for example the remote entitlement server is unaviailable). This uses the candlepin server from https://fedorahosted.org/candlepin/wiki for entitlements. Add a cron job to validate the entitlement status and syslog the results. tickets 28, 79, 278
2011-02-01 13:24:46 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/cron.d
install -pm 644 ipa-compliance.cron %{buildroot}%{_sysconfdir}/cron.d/ipa-compliance
Bash tab completion script
2009-11-23 15:19:14 -06:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%clean
rm -rf %{buildroot}
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%post server
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
# Use systemd scheme
/bin/systemctl --system daemon-reload 2>&1 || :
%else
# Use SystemV scheme only before F16
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
if [ $1 = 1 ]; then
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
/sbin/chkconfig --add ipa
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
fi
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%endif
Automatically update IPA LDAP on rpm upgrades Re-enable ldapi code in ipa-ldap-updater and remove the searchbase restriction when run in --upgrade mode. This allows us to autobind giving root Directory Manager powers. This also: * corrects the ipa-ldap-updater man page * remove automatic --realm, --server, --domain options * handle upgrade errors properly * saves a copy of dse.ldif before we change it so it can be recovered * fixes an error discovered by pylint ticket 1087
2011-03-18 10:19:53 -05:00
if [ $1 -gt 1 ] ; then
/usr/sbin/ipa-upgradeconfig || :
fi
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add plugin framework to LDAP updates. There are two reasons for the plugin framework: 1. To provide a way of doing manual/complex LDAP changes without having to keep extending ldapupdate.py (like we did with managed entries). 2. Allows for better control of restarts. There are two types of plugins, preop and postop. A preop plugin runs before any file-based updates are loaded. A postop plugin runs after all file-based updates are applied. A preop plugin may update LDAP directly or craft update entries to be applied with the file-based updates. Either a preop or postop plugin may attempt to restart the dirsrv instance. The instance is only restartable if ipa-ldap-updater is being executed as root. A warning is printed if a restart is requested for a non-root user. Plugins are not executed by default. This is so we can use ldapupdate to apply simple updates in commands like ipa-nis-manage. https://fedorahosted.org/freeipa/ticket/1789 https://fedorahosted.org/freeipa/ticket/1790 https://fedorahosted.org/freeipa/ticket/2032
2011-11-23 15:52:40 -06:00
%posttrans server
# This must be run in posttrans so that updates from previous
# execution that may no longer be shipped are not applied.
/usr/sbin/ipa-ldap-updater --upgrade >/dev/null 2>&1 || :
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%preun server
if [ $1 = 0 ]; then
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
# Use systemd scheme
/bin/systemctl --quiet stop ipa.service || :
/bin/systemctl --quiet disable ipa.service || :
%else
# Use SystemV scheme only before F16
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
/sbin/chkconfig --del ipa
/sbin/service ipa stop >/dev/null 2>&1 || :
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
fi
%postun server
if [ "$1" -ge "1" ]; then
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
# Use systemd scheme
/bin/systemctl --quiet is-active ipa.service >/dev/null && \
/bin/systemctl try-restart ipa.service >/dev/null 2>&1 || :
%else
# Use SystemV scheme only before F16
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
/sbin/service ipa condrestart >/dev/null 2>&1 || :
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
fi
%pre server-selinux
if [ -s /etc/selinux/config ]; then
. %{_sysconfdir}/selinux/config
FILE_CONTEXT=%{_sysconfdir}/selinux/targeted/contexts/files/file_contexts
if [ "${SELINUXTYPE}" == targeted -a -f ${FILE_CONTEXT} ]; then \
cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.%{name}
fi
fi
%post server-selinux
daemons: Remove ipa_kpasswd Now that we have our own database we can properly enforce stricter constraints on how the db can be changed. Stop shipping our own kpasswd daemon and instead use the regular kadmin daemon.
2011-07-20 17:11:05 -05:00
semodule -s targeted -i /usr/share/selinux/targeted/ipa_httpd.pp /usr/share/selinux/targeted/ipa_dogtag.pp
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
. %{_sysconfdir}/selinux/config
FILE_CONTEXT=%{_sysconfdir}/selinux/targeted/contexts/files/file_contexts
selinuxenabled
if [ $? == 0 -a "${SELINUXTYPE}" == targeted -a -f ${FILE_CONTEXT}.%{name} ]; then
fixfiles -C ${FILE_CONTEXT}.%{name} restore
rm -f ${FILE_CONTEXT}.%name
fi
%preun server-selinux
if [ $1 = 0 ]; then
if [ -s /etc/selinux/config ]; then
. %{_sysconfdir}/selinux/config
FILE_CONTEXT=%{_sysconfdir}/selinux/targeted/contexts/files/file_contexts
if [ "${SELINUXTYPE}" == targeted -a -f ${FILE_CONTEXT} ]; then \
cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.%{name}
fi
fi
fi
%postun server-selinux
if [ $1 = 0 ]; then
daemons: Remove ipa_kpasswd Now that we have our own database we can properly enforce stricter constraints on how the db can be changed. Stop shipping our own kpasswd daemon and instead use the regular kadmin daemon.
2011-07-20 17:11:05 -05:00
semodule -s targeted -r ipa_httpd ipa_dogtag
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
. %{_sysconfdir}/selinux/config
FILE_CONTEXT=%{_sysconfdir}/selinux/targeted/contexts/files/file_contexts
selinuxenabled
if [ $? == 0 -a "${SELINUXTYPE}" == targeted -a -f ${FILE_CONTEXT}.%{name} ]; then
fixfiles -C ${FILE_CONTEXT}.%{name} restore
rm -f ${FILE_CONTEXT}.%name
fi
fi
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%files server
%defattr(-,root,root,-)
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%doc COPYING README Contributors.txt
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
%{_sbindir}/ipa-ca-install
Add ipa-dns-install script Unfortunately, for now there is no --uninstall option.
2009-11-23 02:26:50 -06:00
%{_sbindir}/ipa-dns-install
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619
2011-09-07 03:17:12 -05:00
%{_sbindir}/ipa-adtrust-install
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-server-install
Connection check program for replica installation When connection between a master machine and future replica is not sane, the replica installation may fail unexpectedly with inconvenient error messages. One common problem is misconfigured firewall. This patch adds a program ipa-replica-conncheck which tests the connection using the following procedure: 1) Execute the on-replica check testing the connection to master 2) Open required ports on local machine 3) Ask user to run the on-master part of the check OR run it automatically: a) kinit to master as default admin user with given password b) run the on-master part using ssh 4) When master part is executed, it checks connection back to the replica and prints the check result This program is run by ipa-replica-install as mandatory part. It can, however, be skipped using --skip-conncheck option. ipa-replica-install now requires password for admin user to run the command on remote master. https://fedorahosted.org/freeipa/ticket/1107
2011-05-22 12:17:07 -05:00
%{_sbindir}/ipa-replica-conncheck
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-replica-install
%{_sbindir}/ipa-replica-prepare
%{_sbindir}/ipa-replica-manage
Create tool to manage dogtag replication agreements For the most part the existing replication code worked with the following exceptions: - Added more port options - It assumed that initial connections were done to an SSL port. Added ability to use startTLS - It assumed that the name of the agreement was the same on both sides. In dogtag one is marked as master and one as clone. A new option is added, master, the determines which side we're working on or None if it isn't a dogtag agreement. - Don't set the attribute exclude list on dogtag agreements - dogtag doesn't set a schedule by default (which is actually recommended by 389-ds). This causes problems when doing a force-sync though so if one is done we set a schedule to run all the time. Otherwise the temporary schedule can't be removed (LDAP operations error). https://fedorahosted.org/freeipa/ticket/1250
2011-07-14 22:35:01 -05:00
%{_sbindir}/ipa-csreplica-manage
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-server-certinstall
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_sbindir}/ipa-ldap-updater
%{_sbindir}/ipa-compat-manage
%{_sbindir}/ipa-nis-manage
25 Create Tool for Enabling/Disabling Managed Entry Plugins Remove legacy ipa-host-net-manage Add ipa-managed-entries tool Add man page for ipa-managed-entries tool https://fedorahosted.org/freeipa/ticket/1181
2011-09-20 11:13:42 -05:00
%{_sbindir}/ipa-managed-entries
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipactl
%{_sbindir}/ipa-upgradeconfig
Add support for tracking and counting entitlements Adds a plugin, entitle, to register to the entitlement server, consume entitlements and to count and track them. It is also possible to import an entitlement certificate (if for example the remote entitlement server is unaviailable). This uses the candlepin server from https://fedorahosted.org/candlepin/wiki for entitlements. Add a cron job to validate the entitlement status and syslog the results. tickets 28, 79, 278
2011-02-01 13:24:46 -06:00
%{_sbindir}/ipa-compliance
%{_sysconfdir}/cron.d/ipa-compliance
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%if 0%{?fedora} >= 16
# Use systemd scheme
%attr(644,root,root) %{_unitdir}/ipa.service
%else
# Use SystemV scheme only before F16
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
%attr(755,root,root) %{_initrddir}/ipa
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
%endif
Include some directories in spec file Two directories were left out from package file list: ..../site-packages/ipalib ..../site-packages/ipaserver http://fedorahosted.org/freeipa/ticket/688
2011-01-05 14:51:56 -06:00
%dir %{python_sitelib}/ipaserver
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{python_sitelib}/ipaserver/*
%dir %{_usr}/share/ipa
Fixed ipa.spec.in to include share/ipa/wsgi.py*
2010-03-01 22:41:41 -06:00
%{_usr}/share/ipa/wsgi.py*
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/*.ldif
%{_usr}/share/ipa/*.uldif
%{_usr}/share/ipa/*.template
%dir %{_usr}/share/ipa/html
%{_usr}/share/ipa/html/ssbrowser.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%{_usr}/share/ipa/html/browserconfig.html
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/html/unauthorized.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%{_usr}/share/ipa/html/ipa_error.css
Add DS migration plugin and password migration page.
2010-01-12 09:40:09 -06:00
%dir %{_usr}/share/ipa/migration
%{_usr}/share/ipa/migration/error.html
%{_usr}/share/ipa/migration/index.html
%{_usr}/share/ipa/migration/invalid.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%{_usr}/share/ipa/migration/ipa_migration.css
Add DS migration plugin and password migration page.
2010-01-12 09:40:09 -06:00
%{_usr}/share/ipa/migration/migration.py*
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
%dir %{_usr}/share/ipa/ui
%{_usr}/share/ipa/ui/index.html
Fixed missing icons. The Makefile.am and the spec file have been fixed to include all icons in the install/ui folder. Ticket #1559
2011-08-02 12:42:42 -05:00
%{_usr}/share/ipa/ui/*.ico
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
%{_usr}/share/ipa/ui/*.css
%{_usr}/share/ipa/ui/*.js
Fixed build break. The Makefile.am freeipa.spec.in have been updated according to the recent file changes.
2011-06-15 09:18:05 -05:00
%{_usr}/share/ipa/ui/*.eot
%{_usr}/share/ipa/ui/*.svg
%{_usr}/share/ipa/ui/*.ttf
%{_usr}/share/ipa/ui/*.woff
Removed develop.js. The develop.js is no longer necessary because the code in it has been merged into the main code. An empty extension.js has been added to provide a place for UI customization. Ticket #2099
2011-11-09 18:48:04 -06:00
%config(noreplace) %{_usr}/share/ipa/ui/extension.js
Fixed inconsistent image names. The images have been renamed to be more consistent and moved into the "images" directory to mimic the original jQuery UI structure. Ticket #1613
2011-10-26 16:06:17 -05:00
%dir %{_usr}/share/ipa/ui/images
%{_usr}/share/ipa/ui/images/*.png
%{_usr}/share/ipa/ui/images/*.gif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_sysconfdir}/ipa
%dir %{_sysconfdir}/ipa/html
%config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%config(noreplace) %{_sysconfdir}/ipa/html/ipa_error.css
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html
Properly own (via ghost) the Apache configuration files.
2009-09-16 12:04:14 -05:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/ipa.conf
%{_usr}/share/ipa/ipa-rewrite.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
%{_usr}/share/ipa/ipa-pki-proxy.conf
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa/updates/
%{_usr}/share/ipa/updates/*
%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_winsync.so
Replication version checking. Whenever we upgrade IPA such that any data incompatibilities might occur then we need to bump the DATA_VERSION value so that data will not replicate to other servers. The idea is that you can do an in-place upgrade of each IPA server and the different versions own't pollute each other with bad data.
2010-06-24 09:31:52 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_repl_version.so
ipa-uuid: DNA-like plugin that generates uuids
2010-10-15 09:49:29 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
Add new plugin used to modify related attributes after a modrdn operation.
2010-10-19 16:11:31 -05:00
%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
Update kerberos password policy values on LDAP binds. On a failed bind this will update krbLoginFailedCount and krbLastFailedAuth and will potentially fail the bind altogether. On a successful bind it will zero krbLoginFailedCount and set krbLastSuccessfulAuth. This will also enforce locked-out accounts. See http://k5wiki.kerberos.org/wiki/Projects/Lockout for details on kerberos lockout. ticket 343
2011-01-18 13:58:58 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
Create skeleton CLDAP server as a DS plugin
2011-11-09 18:03:48 -06:00
%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_localstatedir}/lib/ipa
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysrestore
%dir %{_localstatedir}/cache/ipa
%attr(700,apache,apache) %dir %{_localstatedir}/cache/ipa/sessions
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
Add ipasam samba passdb backend https://fedorahosted.org/freeipa/ticket/1874
2011-10-25 03:33:30 -05:00
%attr(755,root,root) %{_libdir}/samba/pdb/ipasam.so
Connection check program for replica installation When connection between a master machine and future replica is not sane, the replica installation may fail unexpectedly with inconvenient error messages. One common problem is misconfigured firewall. This patch adds a program ipa-replica-conncheck which tests the connection using the following procedure: 1) Execute the on-replica check testing the connection to master 2) Open required ports on local machine 3) Ask user to run the on-master part of the check OR run it automatically: a) kinit to master as default admin user with given password b) run the on-master part using ssh 4) When master part is executed, it checks connection back to the replica and prints the check result This program is run by ipa-replica-install as mandatory part. It can, however, be skipped using --skip-conncheck option. ipa-replica-install now requires password for admin user to run the command on remote master. https://fedorahosted.org/freeipa/ticket/1107
2011-05-22 12:17:07 -05:00
%{_mandir}/man1/ipa-replica-conncheck.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_mandir}/man1/ipa-replica-install.1.gz
%{_mandir}/man1/ipa-replica-manage.1.gz
Create tool to manage dogtag replication agreements For the most part the existing replication code worked with the following exceptions: - Added more port options - It assumed that initial connections were done to an SSL port. Added ability to use startTLS - It assumed that the name of the agreement was the same on both sides. In dogtag one is marked as master and one as clone. A new option is added, master, the determines which side we're working on or None if it isn't a dogtag agreement. - Don't set the attribute exclude list on dogtag agreements - dogtag doesn't set a schedule by default (which is actually recommended by 389-ds). This causes problems when doing a force-sync though so if one is done we set a schedule to run all the time. Otherwise the temporary schedule can't be removed (LDAP operations error). https://fedorahosted.org/freeipa/ticket/1250
2011-07-14 22:35:01 -05:00
%{_mandir}/man1/ipa-csreplica-manage.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_mandir}/man1/ipa-replica-prepare.1.gz
%{_mandir}/man1/ipa-server-certinstall.1.gz
%{_mandir}/man1/ipa-server-install.1.gz
Ship the ipa-dns-install man page ticket 734
2011-01-10 09:37:45 -06:00
%{_mandir}/man1/ipa-dns-install.1.gz
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619
2011-09-07 03:17:12 -05:00
%{_mandir}/man1/ipa-adtrust-install.1.gz
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
%{_mandir}/man1/ipa-ca-install.1.gz
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_mandir}/man1/ipa-compat-manage.1.gz
%{_mandir}/man1/ipa-nis-manage.1.gz
25 Create Tool for Enabling/Disabling Managed Entry Plugins Remove legacy ipa-host-net-manage Add ipa-managed-entries tool Add man page for ipa-managed-entries tool https://fedorahosted.org/freeipa/ticket/1181
2011-09-20 11:13:42 -05:00
%{_mandir}/man1/ipa-managed-entries.1.gz
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_mandir}/man1/ipa-ldap-updater.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_mandir}/man8/ipactl.8.gz
Update and package ipa-upgradeconfig man page. Require that the tool be run as root to avoid a permission-related backtrace. https://fedorahosted.org/freeipa/ticket/1758
2012-01-20 12:30:25 -06:00
%{_mandir}/man8/ipa-upgradeconfig.8.gz
Add support for tracking and counting entitlements Adds a plugin, entitle, to register to the entitlement server, consume entitlements and to count and track them. It is also possible to import an entitlement certificate (if for example the remote entitlement server is unaviailable). This uses the candlepin server from https://fedorahosted.org/candlepin/wiki for entitlements. Add a cron job to validate the entitlement status and syslog the results. tickets 28, 79, 278
2011-02-01 13:24:46 -06:00
%{_mandir}/man1/ipa-compliance.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%files server-selinux
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%defattr(-,root,root,-)
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
%doc COPYING README Contributors.txt
Generate CRLs and make them available from the IPA web server
2009-08-24 12:42:48 -05:00
%{_usr}/share/selinux/targeted/ipa_httpd.pp
Add SELinux policy for CRL file publishing. This policy should really be provided by dogtag. We don't want to grant read/write access to everything dogtag can handle so we change the context to cert_t instead. But we have to let dogtag read/write that too hence this policy. To top it off we can't load this policy unless dogtag is also loaded so we insert it in the IPA installer
2009-11-25 12:42:52 -06:00
%{_usr}/share/selinux/targeted/ipa_dogtag.pp
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%files client
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%defattr(-,root,root,-)
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
%doc COPYING README Contributors.txt
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-client-install
%{_sbindir}/ipa-getkeytab
A utility for removing principals from a keytab. When we un-enroll a client we'll do a bit of cleanup including removing any principals for the IPA realm from /etc/krb5.keytab. This removes principals in 2 ways: - By principal, only entries matching the full principal are removed - By realm. Any principal for that realm is removed This does not change the KDC at all, just removes entries from a file on the client machine.
2009-12-04 15:29:09 -06:00
%{_sbindir}/ipa-rmkeytab
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
%{_sbindir}/ipa-join
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa
%dir %{_usr}/share/ipa/ipaclient
%dir %{_localstatedir}/lib/ipa-client
%dir %{_localstatedir}/lib/ipa-client/sysrestore
%{_usr}/share/ipa/ipaclient/ipa.cfg
%{_usr}/share/ipa/ipaclient/ipa.js
%dir %{python_sitelib}/ipaclient
%{python_sitelib}/ipaclient/*.py*
%{_mandir}/man1/ipa-getkeytab.1.gz
A utility for removing principals from a keytab. When we un-enroll a client we'll do a bit of cleanup including removing any principals for the IPA realm from /etc/krb5.keytab. This removes principals in 2 ways: - By principal, only entries matching the full principal are removed - By realm. Any principal for that realm is removed This does not change the KDC at all, just removes entries from a file on the client machine.
2009-12-04 15:29:09 -06:00
%{_mandir}/man1/ipa-rmkeytab.1.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_mandir}/man1/ipa-client-install.1.gz
Add man page for ipa-join command
2009-10-08 10:10:21 -05:00
%{_mandir}/man1/ipa-join.1.gz
Add man page for the IPA configuration file ticket 969
2011-02-23 10:55:32 -06:00
%{_mandir}/man5/default.conf.5.gz
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%files admintools
%defattr(-,root,root,-)
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%doc COPYING README Contributors.txt
Replace TurboGears requirement with python-cherrypy Remove some commented-out files Move /usr/bin/ipa to admintools package
2009-02-04 09:50:52 -06:00
%{_bindir}/ipa
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
%config %{_sysconfdir}/bash_completion.d
Add ipa man page.
2010-03-29 07:25:57 -05:00
%{_mandir}/man1/ipa.1.gz
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%endif
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
%files python -f %{gettext_domain}.lang
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%defattr(-,root,root,-)
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%doc COPYING README Contributors.txt
Rename ipa-python directory to ipapython so it is a real python library We used to install it as ipa, now installing it as ipapython. The rpm is still ipa-python.
2009-02-05 14:03:08 -06:00
%dir %{python_sitelib}/ipapython
Introduce platform-specific adaptation for services used by FreeIPA. Refactor FreeIPA code to allow abstracting all calls to external processes and dependencies on modification of system-wide configuration. A platform provider would give its own implementation of those methods and FreeIPA would use it based on what's built in packaging process. https://fedorahosted.org/freeipa/ticket/1605
2011-09-12 16:01:23 -05:00
%dir %{python_sitelib}/ipapython/platform
Rename ipa-python directory to ipapython so it is a real python library We used to install it as ipa, now installing it as ipapython. The rpm is still ipa-python.
2009-02-05 14:03:08 -06:00
%{python_sitelib}/ipapython/*.py*
Introduce platform-specific adaptation for services used by FreeIPA. Refactor FreeIPA code to allow abstracting all calls to external processes and dependencies on modification of system-wide configuration. A platform provider would give its own implementation of those methods and FreeIPA would use it based on what's built in packaging process. https://fedorahosted.org/freeipa/ticket/1605
2011-09-12 16:01:23 -05:00
%{python_sitelib}/ipapython/platform/*.py*
Include some directories in spec file Two directories were left out from package file list: ..../site-packages/ipalib ..../site-packages/ipaserver http://fedorahosted.org/freeipa/ticket/688
2011-01-05 14:51:56 -06:00
%dir %{python_sitelib}/ipalib
Move ipalib to the ipa-python subpackage and bump up min version of slapi-nis.
2009-05-21 14:25:57 -05:00
%{python_sitelib}/ipalib/*
Add default python encoding module to reset default from ascii to utf-8 Also clean up some duplicate files in the rpm for the UI.
2010-10-06 12:41:26 -05:00
%{python_sitearch}/default_encoding_utf8.so
Clean up the spec file, add Requires for nss-pam-ldapd for F14+ Also do the following: - Remove conflicts on mod_ssl - Remove a lot of version checking for EOL'd Fedora versions - Add a few conditionals for rhel6 - Add Requires of nss-tools on ipa-client
2010-09-09 17:10:14 -05:00
%if 0%{?fedora} >= 12 || 0%{?rhel} >= 6
Rename ipa-python directory to ipapython so it is a real python library We used to install it as ipa, now installing it as ipapython. The rpm is still ipa-python.
2009-02-05 14:03:08 -06:00
%{python_sitelib}/ipapython-*.egg-info
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%{python_sitelib}/freeipa-*.egg-info
Add default python encoding module to reset default from ascii to utf-8 Also clean up some duplicate files in the rpm for the UI.
2010-10-06 12:41:26 -05:00
%{python_sitearch}/python_default_encoding-*.egg-info
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%endif
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%changelog
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
* Wed Jan 11 2012 Rob Crittenden <rcritten@redhat.com> - 2.99.0-14
- Set min for mod_auth_kerb to 5.4-9 to pick up s4u2proxy support
Fix dependency for samba4-devel package
2011-12-09 08:56:53 -06:00
* Fri Dec 9 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.99.0-13
- Fix dependency for samba4-devel package
Create skeleton CLDAP server as a DS plugin
2011-11-09 18:03:48 -06:00
* Wed Nov 17 2011 Simo Sorce <simo@redhat.com> - 2.99.0-12
- Add CLDAP plugin
- Set min nvr of 389-ds-base to 1.2.10-0.5.a5 for SLAPI_PLUGIN_CONFIG_ENTRY
support
Removed develop.js. The develop.js is no longer necessary because the code in it has been merged into the main code. An empty extension.js has been added to provide a place for UI customization. Ticket #2099
2011-11-09 18:48:04 -06:00
* Wed Nov 14 2011 Endi S. Dewata <edewata@redhat.com> - 2.99.0-11
- Make sure changes to extension.js are not removed.
Fixed inconsistent image names. The images have been renamed to be more consistent and moved into the "images" directory to mimic the original jQuery UI structure. Ticket #1613
2011-10-26 16:06:17 -05:00
* Wed Oct 26 2011 Endi S. Dewata <edewata@redhat.com> - 2.99.0-10
- Moved UI images into install/ui/images
Removed HBAC deny rule warning. The HBAC deny rule is no longer supported so it's no longer necessary to show the warning. Ticket #1444
2011-10-24 18:18:10 -05:00
* Mon Oct 24 2011 Endi S. Dewata <edewata@redhat.com> - 2.99.0-9
- Removed hbac-deny-remove.html
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
* Fri Oct 21 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.99.0-8
- Default to systemd for Fedora 16 and onwards
Set min nvr of 389-ds-base to 1.2.10-0.4.a4 for limits fixes (740942, 742324)
2011-10-13 14:28:52 -05:00
* Fri Oct 14 2011 Rob Crittenden <rcritten@redhat.com> - 2.99.0-7
- Set min nvr of 389-ds-base to 1.2.10-0.4.a4 for limits fixes (740942, 742324)
Force the upgrade of pki-setup when upgrading the RPMS
2011-10-07 13:54:57 -05:00
* Fri Oct 7 2011 Adam Young <ayoung@redhat.com> - 2.99.0-6
- Add explicit dependency on pki-setup.
Introduce platform-specific adaptation for services used by FreeIPA. Refactor FreeIPA code to allow abstracting all calls to external processes and dependencies on modification of system-wide configuration. A platform provider would give its own implementation of those methods and FreeIPA would use it based on what's built in packaging process. https://fedorahosted.org/freeipa/ticket/1605
2011-09-12 16:01:23 -05:00
* Tue Sep 13 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.99.0-5
- Make sure platform adaptation is packaged in -python sub-package
Set bind and bind-dyndb-ldap min nvr This is a soft dependency, min nvr version will only be required when bind/bind-dyndb-ldap are installed. https://fedorahosted.org/freeipa/ticket/1121 https://fedorahosted.org/freeipa/ticket/1573
2011-09-09 05:30:00 -05:00
* Fri Sep 9 2011 Martin Kosek <mkosek@redhat.com> - 2.99.0-4
- Add soft dependency for bind and bind-dyndb-ldap required versions
Set min nvr of 389-ds-base to 1.2.9.7-1 for BZ 728605 https://fedorahosted.org/freeipa/ticket/1576
2011-08-30 19:42:29 -05:00
* Wed Aug 31 2011 Rob Crittenden <rcritten@redhat.com> - 2.99.0-3
- Set min nvr of 389-ds-base to 1.2.9.7-1 for BZ 728605
Set min nvr of pki-ca to 9.0.12 for fix in BZ 700505 https://fedorahosted.org/freeipa/ticket/1686
2011-08-29 09:27:17 -05:00
* Mon Aug 29 2011 Rob Crittenden <rcritten@redhat.com> - 2.99.0-2
- Set min nvr of pki-ca to 9.0.12 for fix in BZ 700505
* Wed Aug 25 2011 Simo Sorce <ssorce#redhat.com> - 2.99.0-1
daemons: Remove ipa_kpasswd Now that we have our own database we can properly enforce stricter constraints on how the db can be changed. Stop shipping our own kpasswd daemon and instead use the regular kadmin daemon.
2011-07-20 17:11:05 -05:00
- Remove ipa_kpasswd.
Add subscription-manager dependency for RHEL. ticket 1664
2011-08-23 07:15:27 -05:00
* Tue Aug 23 2011 Jan Cholasta <jcholast@redhat.com> - 2.1.0-1
- Add subscription-manager dependency for RHEL.
Update 389-ds-base version Bump minimal 389-ds-base version in spec file to get in recent Directory Server bug fixes. https://fedorahosted.org/freeipa/ticket/1513 https://fedorahosted.org/freeipa/ticket/1525 https://fedorahosted.org/freeipa/ticket/1552
2011-08-11 07:01:11 -05:00
* Thu Aug 11 2011 Martin Kosek <mkosek@redhat.com> - 2.0.90-12
- Set min nvr of 389-ds-base to 1.2.9.6 for fix in BZ 725743,
723937, and 725542
Update pki-ca version Bump minimal pki-ca version in spec file to get fix for ipa cert-request command. https://fedorahosted.org/freeipa/ticket/1578
2011-08-11 10:54:41 -05:00
- Set min nvr of pki-ca to 9.0.11 for fix in BZ 728332
Update 389-ds-base version Bump minimal 389-ds-base version in spec file to get in recent Directory Server bug fixes. https://fedorahosted.org/freeipa/ticket/1513 https://fedorahosted.org/freeipa/ticket/1525 https://fedorahosted.org/freeipa/ticket/1552
2011-08-11 07:01:11 -05:00
Fix client enrollment Enable GSSAPI credentials delegation in xmlrpc-c/curl to fix client enrollment. The unconditional GSSAPI was previously dropped from curl because of CVE-2011-2192. https://fedorahosted.org/freeipa/ticket/1452
2011-08-11 03:42:29 -05:00
* Thu Aug 11 2011 Martin Kosek <mkosek@redhat.com> - 2.0.90-11
- Set min nvr of xmlrpc-c and libcurl to make sure GSSAPI delegation
support is in
Fixed missing icons. The Makefile.am and the spec file have been fixed to include all icons in the install/ui folder. Ticket #1559
2011-08-02 12:42:42 -05:00
* Tue Aug 2 2011 Endi S. Dewata <edewata@redhat.com> - 2.0.90-10
- Add *.ico files
Fix date order in changelog.
2011-07-28 17:52:46 -05:00
* Tue Jul 29 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.0.90-9
Add hbactest command. https://fedorahosted.org/freeipa/ticket/386 HBAC rules control who can access what services on what hosts and from where. You can use HBAC to control which users or groups on a source host can access a service, or group of services, on a target host. Since applying HBAC rules implies use of a production environment, this plugin aims to provide simulation of HBAC rules evaluation without having access to the production environment. Test user coming from source host to a service on a named host against existing enabled rules. ipa hbactest --user= --srchost= --host= --service= [--rules=rules-list] [--nodetail] [--enabled] [--disabled] --user, --srchost, --host, and --service are mandatory, others are optional. If --rules is specified simulate enabling of the specified rules and test the login of the user using only these rules. If --enabled is specified, all enabled HBAC rules will be added to simulation If --disabled is specified, all disabled HBAC rules will be added to simulation If --nodetail is specified, do not return information about rules matched/not matched. If both --rules and --enabled are specified, apply simulation to --rules _and_ all IPA enabled rules. If no --rules specified, simulation is run against all IPA enabled rules. EXAMPLES: 1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 2. Disable detailed summary of how rules were applied: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail -------------------- Access granted: True -------------------- 3. Test explicitly specified HBAC rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: myrule 4. Use all enabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 5. Test all disabled HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled --------------------- Access granted: False --------------------- notmatched: new-rule 6. Test all disabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule 7. Test all (enabled and disabled) HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule notmatched: new-rule matched: allow_all Only rules existing in IPA database are tested. They may be in enabled or disabled disabled state. Specifying them through --rules option explicitly enables them only in simulation run. Specifying non-existing rules will not grant access and report non-existing rules in output.
2011-07-22 08:30:44 -05:00
- Add libipa_hbac-python dependency for hbactest plugin
Set minimum version of pki-ca to 9.0.10 to pick up new ipa cert profile The caIPAserviceCert.cfg was updated to set the client cert flag on server certs we issue. https://fedorahosted.org/freeipa/ticket/1434
2011-07-28 13:28:38 -05:00
* Thu Jul 28 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.90-8
- Set min nvr of pki-ca to 9.0.10 on F-15+ to pick up updated
caIPAserviceCert.cfg profile
Add an arch-specific Requires on cyrus-sasl-gssapi If you had a 64-bit system and installed a 32-bit version of IPA then ipa-getkeytab probably wouldn't work because yum wouldn't know to pull in the 32-bit version of cyrus-sasl-gssapi. https://fedorahosted.org/freeipa/ticket/1499
2011-07-22 08:06:13 -05:00
* Wed Jul 20 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.90-7
- Make cyrus-sasl-gssapi requires arch-specific
Create tool to manage dogtag replication agreements For the most part the existing replication code worked with the following exceptions: - Added more port options - It assumed that initial connections were done to an SSL port. Added ability to use startTLS - It assumed that the name of the agreement was the same on both sides. In dogtag one is marked as master and one as clone. A new option is added, master, the determines which side we're working on or None if it isn't a dogtag agreement. - Don't set the attribute exclude list on dogtag agreements - dogtag doesn't set a schedule by default (which is actually recommended by 389-ds). This causes problems when doing a force-sync though so if one is done we set a schedule to run all the time. Otherwise the temporary schedule can't be removed (LDAP operations error). https://fedorahosted.org/freeipa/ticket/1250
2011-07-14 22:35:01 -05:00
* Thu Jul 14 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.90-6
- Add ipa-csreplica-manage tool.
* Wed Jul 6 2011 Adam Young <ayoung@redhat.com> - 2.0.90-5
HBAC deny warning shows dialog if there are any HBAC deny rules. Dialog provides option to navigate to the HBAC page. Deny rules have their rule type value show up in red. Only shows up fro administrators, not for self service users. https://fedorahosted.org/freeipa/ticket/1421
2011-07-05 16:59:05 -05:00
- Add HTML file describing issues with HBAC deny rules
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
* Fri Jun 17 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.90-4
- Ship ipa-ca-install utility
Update min nvr for selinux-policy and pki-ca for F-15+ Done with conditionals so still installable on F-14. ticket 1200
2011-05-12 21:45:29 -05:00
* Thu May 12 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.90-3
- Set min nvr of selinux-policy to 3.9.16-18 on F-15+
- Set min nvr of pki-ca to 9.0.7 on F-15+
Update spec with missing BuildRequires for pylint check https://fedorahosted.org/freeipa/ticket/1203
2011-05-05 08:06:54 -05:00
* Thu May 5 2011 Martin Kosek <mkosek@redhat.com> - 2.0.90-2
- Add BuildRequires on pylint, python-rhsm to enable a build with enforced
pylint check
Bump version to 2.0.90 to distinguish between 2.0.x
2011-05-03 09:48:38 -05:00
* Tue May 3 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.90-1
- Bump version to 2.0.90
Fix ORDERING in some attributetypes and remove other unnecessary elements. Looking at the schema in 60basev2.ldif there were many attributes that did not have an ORDERING matching rule specified correctly. There were also a number of attributeTypes that should have been just SUP distinguishedName that had a combination of SUP, SYNTAX, ORDERING, etc. This requires 389-ds-base-1.2.8.0-1+ ticket 1153
2011-04-05 15:28:59 -05:00
* Tue Apr 5 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-47
- Set min version of 389-ds-base to 1.2.8.0-1 for fix in BZ 693466.
* Thu Mar 17 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-46
Automatically update IPA LDAP on rpm upgrades Re-enable ldapi code in ipa-ldap-updater and remove the searchbase restriction when run in --upgrade mode. This allows us to autobind giving root Directory Manager powers. This also: * corrects the ipa-ldap-updater man page * remove automatic --realm, --server, --domain options * handle upgrade errors properly * saves a copy of dse.ldif before we change it so it can be recovered * fixes an error discovered by pylint ticket 1087
2011-03-18 10:19:53 -05:00
- Automatically apply updates when the package is upgraded.
Fix ORDERING in some attributetypes and remove other unnecessary elements. Looking at the schema in 60basev2.ldif there were many attributes that did not have an ORDERING matching rule specified correctly. There were also a number of attributeTypes that should have been just SUP distinguishedName that had a combination of SUP, SYNTAX, ORDERING, etc. This requires 389-ds-base-1.2.8.0-1+ ticket 1153
2011-04-05 15:28:59 -05:00
* Thu Feb 17 2011 Jakub Hrozek <jhrozek@redhat.com> - 1.99-45
Make nsslib IPv6 aware
2011-02-02 06:57:16 -06:00
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
Set minimum version of sssd to 1.5.1 ticket 926
2011-02-09 13:26:45 -06:00
* Wed Feb 9 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-44
- Set minimum version of sssd to 1.5.1
Update minimum version of 389-ds-base, mod_nss and selinux-policy. * Set min version of 389-ds-base to 1.2.8 * Set min version of mod_nss 1.0.8-10 * Set min version of selinux-policy to 3.9.7-27
2011-02-02 15:32:39 -06:00
* Thu Feb 2 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-43
- Set min version of 389-ds-base to 1.2.8
- Set min version of mod_nss 1.0.8-10
- Set min version of selinux-policy to 3.9.7-27
Apply changes discovered in Fedora package review process (#672986) Ticket 804
2011-01-27 16:02:24 -06:00
* Thu Jan 27 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-42
- Apply changes discovered in Fedora package review process (#672986)
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
* Tue Jan 25 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-41
- Re-arrange doc and defattr to clean up rpmlint warnings
- Remove conditionals on older releases
- Move some man pages into admintools subpackage
- Remove some explicit Requires in client that aren't needed
- Consistent use of buildroot vs RPM_BUILD_ROOT
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
* Thu Jan 19 2011 Adam Young <ayoung@redhat.com> - 1.99-40
- Moved directory install/static to install/ui
Remove dependency on nss_ldap/nss-pam-ldapd We use sssd in ipa v2 Fixes: https://fedorahosted.org/freeipa/ticket/757
2011-01-13 17:09:21 -06:00
* Thu Jan 13 2011 Simo Sorce <ssorce@redhat.com> - 1.99-39
- Remove dependency on nss_ldap/nss-pam-ldapd
- The official client is sssd and that's what we use by default.
Remove radius options completely. This has been completely abandoned since ipa v1 and is not built by default. Instead of carrying dead weight, let's remove it for now. Fixes: https://fedorahosted.org/freeipa/ticket/761
2011-01-13 15:57:23 -06:00
* Thu Jan 13 2011 Simo Sorce <ssorce@redhat.com> - 1.99-38
- Remove radius subpackages
Set minimum version of dogtag to 9 ticket 763
2011-01-13 12:17:36 -06:00
* Thu Jan 13 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-37
- Set minimum pki-ca and pki-silent versions to 9.0.0
Drop dependency on mozldap
2011-01-12 16:14:06 -06:00
* Wed Jan 12 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-36
- Drop BuildRequires on mozldap-devel
Add krb5-pkinit-openssl as a Requires on ipa-server package ticket 599
2010-12-13 13:46:09 -06:00
* Mon Dec 13 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-35
- Add Requires on krb5-pkinit-openssl
managed entry hostgroup netgroup support https://fedorahosted.org/freeipa/ticket/543
2010-12-10 17:21:39 -06:00
* Fri Dec 10 2010 Jr Aquino <jr.aquino@citrix.com> - 1.99-34
- Add ipa-host-net-manage script
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
* Tue Dec 7 2010 Simo Sorce <ssorce@redhat.com> - 1.99-33
- Add ipa init script
Display user and host membership in netgroups. This uses an enhanced memberof plugin that allows multiple attributes to be configured to create memberOf attributes. tickets 109 and 110
2010-11-19 10:16:23 -06:00
* Fri Nov 19 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-32
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
Remove ipa-fix-CVE-2008-3274, it isn't needed any more. ticket 331
2010-11-03 12:47:15 -05:00
* Wed Nov 3 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-31
- remove ipa-fix-CVE-2008-3274
Add default python encoding module to reset default from ascii to utf-8 Also clean up some duplicate files in the rpm for the UI.
2010-10-06 12:41:26 -05:00
* Wed Oct 6 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-30
- Remove duplicate %%files entries on share/ipa/static
- Add python default encoding shared library
Drop python-configobj from Requires and remove message about ipa-ldap-updater python-configobj is a leftover from TurboGears requires as far as I can tell. The ipa-ldap-updater message was supposed to detect when an upgrade was installed but not applied. We are doing upgrades differently in v2. tickets 141 and 219
2010-09-20 11:55:15 -05:00
* Mon Sep 20 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-29
- Drop requires on python-configobj (not used any more)
- Drop ipa-ldap-updater message, upgrades are done differently now
Clean up the spec file, add Requires for nss-pam-ldapd for F14+ Also do the following: - Remove conflicts on mod_ssl - Remove a lot of version checking for EOL'd Fedora versions - Add a few conditionals for rhel6 - Add Requires of nss-tools on ipa-client
2010-09-09 17:10:14 -05:00
* Wed Sep 8 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-28
- Drop conflicts on mod_nss
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
- Drop a slew of conditionals on older Fedora releases (< 12)
- Add a few conditionals against RHEL 6
- Add Requires of nss-tools on ipa-client
Break out install into more steps, add -key_algorithm to pkisilent Installing dogtag is quite slow and it isn't always clear that things are working. This breaks out some restart calls into separate steps to show some amount of progress. There are still some steps that take more than a minute (pkicreate and pkisilent). Add new argument to pkisilent, -key_algorithm Update a bunch of minimum required versions in the spec file. tickets 139 (time) and 144 (key_algorithm)
2010-08-16 16:55:07 -05:00
* Fri Aug 13 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-27
- Set minimum version of certmonger to 0.26 (to pck up #621670)
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
- Set minimum version of pki-ca to 1.3.6
- Set minimum version of sssd to 1.2.1
Add a BuildRequires for authconfig ticket 137
2010-08-10 15:39:17 -05:00
* Tue Aug 10 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-26
- Add BuildRequires for authconfig
Drop our own PKCS#10 ASN.1 decoder and use the one from python-nss This patch: - bumps up the minimum version of python-nss - will initialize NSS with nodb if a CSR is loaded and it isn't already init'd - will shutdown NSS if initialized in the RPC subsystem so we use right db - updated and added a few more tests Relying more on NSS introduces a bit of a problem. For NSS to work you need to have initialized a database (either a real one or no_db). But once you've initialized one and want to use another you have to close down the first one. I've added some code to nsslib.py to do just that. This could potentially have some bad side-effects at some point, it works ok now.
2010-07-20 13:00:43 -05:00
* Mon Jul 19 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-25
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
This patch removes the existing UI functionality, as a prep for adding the Javascript based ui.
2010-07-26 10:57:29 -05:00
* Thu Jun 24 2010 Adam Young <ayoung@redhat.com> - 1.99-24
- Removed python-asset based webui
Include missing file from version plugin and update min version of 389-ds
2010-06-24 16:28:29 -05:00
* Thu Jun 24 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-23
- Change Requires from fedora-ds-base to 389-ds-base
- Set minimum level of 389-ds-base to 1.2.6 for the replication
version plugin.
Remove Requires on separate package python-krbV in client We need the configured kerberos realm so we can clean up /etc/krb5.keytab. We have this already in /etc/ipa/default.conf so use that instead of requiring a whole other python package to do it.
2010-06-01 13:24:37 -05:00
* Tue Jun 1 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-22
- Drop Requires of python-krbV on ipa-client
Move the dogtag SELinux rules loading into the spec file I couldn't put the dogtag rules into the spec file until we required dogtag as a component. If it wasn't pre-loaded them the rules loading would fail because types would be missing.
2010-05-20 10:54:41 -05:00
* Mon May 17 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-21
- Load ipa_dogtag.pp in post install
client installation fixes: nscd, sssd min version, bogus join error - Don't run nscd if using sssd, the caching of nscd conflicts with sssd - Set the minimum version of sssd to 1.1.1 to pick up needed hbac fixes - only try to read the file configuration if the server isn't passed in
2010-05-03 14:15:43 -05:00
* Mon Apr 26 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-20
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
* Thu Mar 4 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-19
Don't create /var/log/ipa_error.log since we aren't using TurboGears any more.
2010-03-04 09:58:37 -06:00
- No need to create /var/log/ipa_error.log since we aren't using
TurboGears any more.
Fixed ipa.spec.in to include share/ipa/wsgi.py*
2010-03-01 22:41:41 -06:00
* Mon Mar 1 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-18
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
Run ipaserver under mod_wsgi
2010-02-24 12:29:23 -06:00
* Wed Feb 24 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-17
- Added Require mod_wsgi, added share/ipa/wsgi.py
Add fix for wehjit (ctypes) SELinux problem
2010-02-11 03:27:00 -06:00
* Thu Feb 11 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-16
- Require python-wehjit >= 0.2.2
Configure sssd and certmonger in ipa-client-install This does a number of things under the hood: - Use authconfig to enable sssd in nss and pam - Configure /etc/sssd/sssd.conf to use our IPA provider - Enable the certmonger process and request a server cert - join the IPA domain and retrieve a principal. The clinet machine *must* exist in IPA to be able to do a join. - And then undo all this on uninstall
2010-02-03 14:41:02 -06:00
* Wed Feb 3 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-15
- Add sssd and certmonger as a Requires on ipa-client
Update spec to require python-wehjit >= 0.2.0
2010-01-27 01:44:00 -06:00
* Wed Jan 27 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-14
- Require python-wehjit >= 0.2.0
A utility for removing principals from a keytab. When we un-enroll a client we'll do a bit of cleanup including removing any principals for the IPA realm from /etc/krb5.keytab. This removes principals in 2 ways: - By principal, only entries matching the full principal are removed - By realm. Any principal for that realm is removed This does not change the KDC at all, just removes entries from a file on the client machine.
2009-12-04 15:29:09 -06:00
* Fri Dec 4 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-13
- Add ipa-rmkeytab tool
Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1 Any type
2009-12-01 13:02:46 -06:00
* Tue Dec 1 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-12
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
Any type
Replace /etc/ipa/ipa.conf with /etc/ipa/default.conf The new framework uses default.conf instead of ipa.conf. This is useful also because Apache uses a configuration file named ipa.conf. This wipes out the last vestiges of the old ipa.conf from v1.
2009-11-25 16:16:06 -06:00
* Wed Nov 25 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-11
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
Bash tab completion script
2009-11-23 15:19:14 -06:00
* Fri Nov 13 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-10
- Add bash completion script and own /etc/bash_completion.d in case it
doesn't already exist
Add SELinux policy for UI assets This also removes the Index option of /ipa-assets as well as the deprecated IPADebug option. No need to build or install ipa_webgui anymore. Leaving in the code for reference purposes for now.
2009-11-03 14:26:00 -06:00
* Tue Nov 3 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-9
- Remove ipa_webgui, its functions rolled into ipa_httpd
Giant webui patch take 2
2009-10-13 12:28:00 -05:00
* Mon Oct 12 2009 Jason Gerard DeRose <jderose@redhat.com> - 1.99-8
- Removed python-cherrypy from BuildRequires and Requires
- Added Requires python-assets, python-wehjit
Generate CRLs and make them available from the IPA web server
2009-08-24 12:42:48 -05:00
* Mon Aug 24 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-7
- Added httpd SELinux policy so CRLs can be read
Move ipalib to the ipa-python subpackage and bump up min version of slapi-nis.
2009-05-21 14:25:57 -05:00
* Thu May 21 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-6
- Move ipalib to ipa-python subpackage
- Bump minimum version of slapi-nis to 0.15
New tool to enable/disable DS plugin to act as NIS server
2009-05-07 09:51:44 -05:00
* Thu May 6 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-5
- Set 0.14 as minimum version for slapi-nis
Add python-nss as a dependency
2009-04-22 16:14:09 -05:00
* Wed Apr 22 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-4
- Add Requires: python-nss to ipa-python sub-package
Remove our copy of the DNA plugin and use the one that comes with DS. The DS plugin does config checking when adding new entries online so we are dropping the Posix subtree.
2009-03-06 09:29:48 -06:00
* Thu Mar 5 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-3
- Remove the IPA DNA plugin, use the DS one
* Wed Mar 4 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-2
Don't build radius by default
2009-03-04 13:07:27 -06:00
- Build radius separately
- Fix a few minor issues
Replace TurboGears requirement with python-cherrypy Remove some commented-out files Move /usr/bin/ipa to admintools package
2009-02-04 09:50:52 -06:00
* Tue Feb 3 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-1
- Replace TurboGears requirement with python-cherrypy
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
* Sat Jan 17 2009 Tomas Mraz <tmraz@redhat.com> - 1.2.1-3
- rebuild with new openssl
* Fri Dec 19 2008 Dan Walsh <dwalsh@redhat.com> - 1.2.1-2
- Fix SELinux code
* Mon Dec 15 2008 Simo Sorce <ssorce@redhat.com> - 1.2.1-1
- Fix breakage caused by python-kerberos update to 1.1
* Fri Dec 5 2008 Simo Sorce <ssorce@redhat.com> - 1.2.1-0
- New upstream release 1.2.1
* Sat Nov 29 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> - 1.2.0-4
- Rebuild for Python 2.6
* Fri Nov 14 2008 Simo Sorce <ssorce@redhat.com> - 1.2.0-3
- Respin after the tarball has been re-released upstream
New hash is 506c9c92dcaf9f227cba5030e999f177
* Thu Nov 13 2008 Simo Sorce <ssorce@redhat.com> - 1.2.0-2
- Conditionally restart also dirsrv and httpd when upgrading
* Wed Oct 29 2008 Rob Crittenden <rcritten@redhat.com> - 1.2.0-1
- Update to upstream version 1.2.0
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
- Set the minimum version for SELinux policy
- Remove references to Fedora 7
* Wed Jul 23 2008 Simo Sorce <ssorce@redhat.com> - 1.1.0-3
- Fix for CVE-2008-3274
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
- Add fix for bug #453185
- Rebuild against openldap libraries, mozldap ones do not work properly
- TurboGears is currently broken in rawhide. Added patch to not build
the UI locales and removed them from the ipa-server files section.
* Wed Jun 18 2008 Rob Crittenden <rcritten@redhat.com> - 1.1.0-2
- Add call to /usr/sbin/upgradeconfig to post install
* Wed Jun 11 2008 Rob Crittenden <rcritten@redhat.com> - 1.1.0-1
- Update to upstream version 1.1.0
- Patch for indexing memberof attribute
- Patch for indexing uidnumber and gidnumber
- Patch to change DNA default values for replicas
- Patch to fix uninitialized variable in ipa-getkeytab
* Fri May 16 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-5
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
version to 1.0.7-4 so we pick up the NSS fixes.
- Add selinux-policy-base(post) to Requires (446496)
* Tue Apr 29 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-4
- Add missing entry for /var/cache/ipa/kpasswd (444624)
- Added patch to fix permissions problems with the Apache NSS database.
- Added patch to fix problem with DNS querying where the query could be
returned as the answer.
- Fix spec error where patch1 was in the wrong section
* Fri Apr 25 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-3
- Added patch to fix problem reported by ldapmodify
* Fri Apr 25 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-2
- Fix Requires for krb5-server that was missing for Fedora versions > 9
- Remove quotes around test for fedora version to package egg-info
* Fri Apr 18 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-1
- Update to upstream version 1.0.0
* Tue Mar 18 2008 Rob Crittenden <rcritten@redhat.com> 0.99-12
- Pull upstream changelog 722
- Add Conflicts mod_ssl (435360)
* Thu Feb 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-11
- Pull upstream changelog 698
- Fix ownership of /var/log/ipa_error.log during install (435119)
- Add pwpolicy command and man page
* Thu Feb 21 2008 Rob Crittenden <rcritten@redhat.com> 0.99-10
- Pull upstream changelog 678
- Add new subpackage, ipa-server-selinux
- Add Requires: authconfig to ipa-python (bz #433747)
- Package i18n files
* Mon Feb 18 2008 Rob Crittenden <rcritten@redhat.com> 0.99-9
- Pull upstream changelog 641
- Require minimum version of krb5-server on F-7 and F-8
- Package some new files
* Thu Jan 31 2008 Rob Crittenden <rcritten@redhat.com> 0.99-8
- Marked with wrong license. IPA is GPLv2.
* Tue Jan 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-7
- Ensure that /etc/ipa exists before moving user-modifiable html files there
- Put html files into /etc/ipa/html instead of /etc/ipa
* Tue Jan 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-6
- Pull upstream changelog 608 which renamed several files
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-5
- package the sessions dir /var/cache/ipa/sessions
- Pull upstream changelog 597
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-4
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
UI to not start.
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-3
- Included LICENSE and README in all packages for documentation
Add fix for wehjit (ctypes) SELinux problem
2010-02-11 03:27:00 -06:00
- Move user-modifiable content to /etc/ipa and linked back to
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
/usr/share/ipa/html
- Changed some references to /usr to the {_usr} macro and /etc
to {_sysconfdir}
- Added popt-devel to BuildRequires for Fedora 8 and higher and
popt for Fedora 7
- Package the egg-info for Fedora 9 and higher for ipa-python
* Tue Jan 22 2008 Rob Crittenden <rcritten@redhat.com> 0.99-2
- Added auto* BuildRequires
* Mon Jan 21 2008 Rob Crittenden <rcritten@redhat.com> 0.99-1
- Unified spec file
* Thu Jan 17 2008 Rob Crittenden <rcritten@redhat.com> - 0.6.0-2
- Fixed License in specfile
- Include files from /usr/lib/python*/site-packages/ipaserver
* Fri Dec 21 2007 Karl MacMillan <kmacmill@redhat.com> - 0.6.0-1
- Version bump for release
* Wed Nov 21 2007 Karl MacMillan <kmacmill@mentalrootkit.com> - 0.5.0-1
- Preverse mode on ipa-keytab-util
- Version bump for relase and rpm name change
* Thu Nov 15 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.1-2
- Broke invididual Requires and BuildRequires onto separate lines and
reordered them
- Added python-tgexpandingformwidget as a dependency
- Require at least fedora-ds-base 1.1
* Thu Nov 1 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.1-1
- Version bump for release
* Wed Oct 31 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-6
- Add dep for freeipa-admintools and acl
* Wed Oct 24 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.0-5
- Add dependency for python-krbV
* Fri Oct 19 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.0-4
- Require mod_nss-1.0.7-2 for mod_proxy fixes
* Thu Oct 18 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-3
- Convert to autotools-based build
* Tue Sep 25 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-2
Add fix for wehjit (ctypes) SELinux problem
2010-02-11 03:27:00 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
* Fri Sep 7 2007 Karl MacMillan <kmacmill@redhat.com> - 0.3.0-1
- Added support for libipa-dna-plugin
* Fri Aug 10 2007 Karl MacMillan <kmacmill@redhat.com> - 0.2.0-1
- Added support for ipa_kpasswd and ipa_pwd_extop
* Mon Aug 5 2007 Rob Crittenden <rcritten@redhat.com> - 0.1.0-3
- Abstracted client class to work directly or over RPC
* Wed Aug 1 2007 Rob Crittenden <rcritten@redhat.com> - 0.1.0-2
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
- Remove references to admin server in ipa-server-setupssl
- Generate a client certificate for the XML-RPC server to connect to LDAP with
- Create a keytab for Apache
- Create an ldif with a test user
- Provide a certmap.conf for doing SSL client authentication
* Fri Jul 27 2007 Karl MacMillan <kmacmill@redhat.com> - 0.1.0-1
- Initial rpm version
Reference in New Issue Copy Permalink