- 1.0.0-1
- Version bump for release
diff --git a/ipa-server/ipa-upgradeconfig b/ipa-server/ipa-upgradeconfig
new file mode 100644
index 000000000..2fa290168
--- /dev/null
+++ b/ipa-server/ipa-upgradeconfig
@@ -0,0 +1,112 @@
+#!/usr/bin/python
+#
+# Upgrade configuration files to a newer template.
+
+import sys
+try:
+ from ipa import ipautil
+ import krbV
+ import re
+ import os
+ import shutil
+ import fileinput
+except ImportError:
+ print >> sys.stderr, """\
+There was a problem importing one of the required Python modules. The
+error was:
+
+ %s
+""" % sys.exc_value
+ sys.exit(1)
+
+def backup_file(filename, ext):
+ """Make a backup of filename using ext as the extension. Do not overwrite
+ previous backups."""
+ if not os.path.isabs(filename):
+ raise ValueError("Absolute path required")
+
+ backupfile = filename + ".bak"
+ (reldir, file) = os.path.split(filename)
+
+ while os.path.exists(backupfile):
+ backupfile = backupfile + "." + str(ext)
+
+ shutil.copy2(filename, backupfile)
+
+def update_conf(sub_dict, filename, template_filename):
+ template = ipautil.template_file(template_filename, sub_dict)
+ fd = open(filename, "w")
+ fd.write(template)
+ fd.close()
+
+def find_hostname():
+ """Find the hostname currently configured in ipa-rewrite.conf"""
+ filename="/etc/httpd/conf.d/ipa-rewrite.conf"
+ if os.path.exists(filename):
+ pattern = "^[\s#]*.*https:\/\/([A-Za-z0-9\.\-]*)\/.*"
+ p = re.compile(pattern)
+ for line in fileinput.input(filename):
+ if p.search(line):
+ fileinput.close()
+ return p.search(line).group(1)
+ fileinput.close()
+
+ return None
+
+def find_version(filename):
+ """Find the version of a configuration file"""
+ if os.path.exists(filename):
+ pattern = "^[\s#]*VERSION\s+([0-9]+)\s+.*"
+ p = re.compile(pattern)
+ for line in fileinput.input(filename):
+ if p.search(line):
+ fileinput.close()
+ return p.search(line).group(1)
+ fileinput.close()
+
+ # no VERSION found
+ return 0
+ else:
+ return -1
+
+def upgrade(sub_dict, filename, template):
+ old = int(find_version(filename))
+ new = int(find_version(template))
+
+ if old < 0:
+ print "%s not found." % filename
+ sys.exit(1)
+
+ if new < 0:
+ print "%s not found." % template
+
+ if old < new:
+ backup_file(filename, new)
+ update_conf(sub_dict, filename, template)
+ print "Upgraded %s to version %d" % (filename, new)
+
+def main():
+ try:
+ krbctx = krbV.default_context()
+ except krbV.Krb5Error, e:
+ print "Unable to get default kerberos realm: %s" % e[1]
+ sys.exit(1)
+
+ fqdn = find_hostname()
+
+ if fqdn is None:
+ print "Unable to determine hostname from ipa-rewrite.conf"
+ sys.exit(1)
+
+ sub_dict = { "REALM" : krbctx.default_realm, "FQDN": fqdn }
+
+ upgrade(sub_dict, "/etc/httpd/conf.d/ipa.conf", ipautil.SHARE_DIR + "ipa.conf")
+ upgrade(sub_dict, "/etc/httpd/conf.d/ipa-rewrite.conf", ipautil.SHARE_DIR + "ipa-rewrite.conf")
+
+try:
+ if __name__ == "__main__":
+ sys.exit(main())
+except SystemExit, e:
+ sys.exit(e)
+except KeyboardInterrupt, e:
+ sys.exit(1)
diff --git a/ipa-server/xmlrpc-server/ipa-rewrite.conf b/ipa-server/xmlrpc-server/ipa-rewrite.conf
index af3a3afe2..fc7ce6806 100644
--- a/ipa-server/xmlrpc-server/ipa-rewrite.conf
+++ b/ipa-server/xmlrpc-server/ipa-rewrite.conf
@@ -1,9 +1,11 @@
+# VERSION 1 - DO NOT REMOVE THIS LINE
+
RewriteEngine on
# By default forward all requests to /ipa. If you don't want IPA
# to be the default on your web server comment this line out. You will
# need to modify ipa_webgui.cfg as well.
-RewriteRule ^/$$ https://$FQDN/ipa [L,NC,R=301]
+RewriteRule ^/$$ https://$FQDN/ipa/ui [L,NC,R=301]
# Redirect to the fully-qualified hostname. Not redirecting to secure
# port so configuration files can be retrieved without requiring SSL.
diff --git a/ipa-server/xmlrpc-server/ipa.conf b/ipa-server/xmlrpc-server/ipa.conf
index c08282e3b..1eca97757 100644
--- a/ipa-server/xmlrpc-server/ipa.conf
+++ b/ipa-server/xmlrpc-server/ipa.conf
@@ -1,3 +1,6 @@
+#
+# VERSION 1 - DO NOT REMOVE THIS LINE
+#
# LoadModule auth_kerb_module modules/mod_auth_kerb.so
ProxyRequests Off
@@ -17,7 +20,7 @@ AddType application/java-archive jar
Krb5KeyTab /etc/httpd/conf/ipa.keytab
KrbSaveCredentials on
Require valid-user
- ErrorDocument 401 /errors/unauthorized.html
+ ErrorDocument 401 /ipa/errors/unauthorized.html
RewriteEngine on
Order deny,allow
Allow from all
@@ -28,20 +31,17 @@ AddType application/java-archive jar
# The URI's with a trailing ! are those that aren't handled by the proxy
-ProxyPass /ipa http://localhost:8080/ipa
-ProxyPassReverse /ipa http://localhost:8080/ipa
+ProxyPass /ipa/ui http://localhost:8080/ipa/ui
+ProxyPassReverse /ipa/ui http://localhost:8080/ipa/ui
# Configure the XML-RPC service
-Alias /ipaxml "/usr/share/ipa/ipaserver/XMLRPC"
+Alias /ipa/xml "/usr/share/ipa/ipaserver/XMLRPC"
# This is where we redirect on failed auth
-Alias /errors "/usr/share/ipa/html"
+Alias /ipa/errors "/usr/share/ipa/html"
# For the MIT Windows config files
-Alias /config "/usr/share/ipa/html"
-
-# So we don't have to hardcode a path into the CSS
-Alias /static "/usr/share/ipa/ipagui/static"
+Alias /ipa/config "/usr/share/ipa/html"
AuthType Kerberos
@@ -53,7 +53,7 @@ Alias /static "/usr/share/ipa/ipagui/static"
Krb5KeyTab /etc/httpd/conf/ipa.keytab
KrbSaveCredentials on
Require valid-user
- ErrorDocument 401 /errors/unauthorized.html
+ ErrorDocument 401 /ipa/errors/unauthorized.html
SetHandler mod_python
PythonHandler ipaxmlrpc
@@ -84,7 +84,7 @@ Alias /static "/usr/share/ipa/ipagui/static"
Krb5KeyTab /etc/httpd/conf/ipa.keytab
KrbSaveCredentials on
Require valid-user
- ErrorDocument 401 /errors/unauthorized.html
+ ErrorDocument 401 /ipa/errors/unauthorized.html
#Alias /ipatest "/usr/share/ipa/ipatest"
@@ -99,7 +99,7 @@ Alias /static "/usr/share/ipa/ipagui/static"
# Krb5KeyTab /etc/httpd/conf/ipa.keytab
# KrbSaveCredentials on
# Require valid-user
-# ErrorDocument 401 /errors/unauthorized.html
+# ErrorDocument 401 /ipa/errors/unauthorized.html
#
# SetHandler mod_python
# PythonHandler test_mod_python
diff --git a/ipa-server/xmlrpc-server/unauthorized.html b/ipa-server/xmlrpc-server/unauthorized.html
index cc53e33b7..6ba8a99ee 100644
--- a/ipa-server/xmlrpc-server/unauthorized.html
+++ b/ipa-server/xmlrpc-server/unauthorized.html
@@ -5,12 +5,12 @@
Unable to verify your Kerberos credentials. Please make sure
that you have valid Kerberos tickets (obtainable via kinit), and that you
-have configured your
+have configured your
browser correctly. If you are still unable to access
the IPA Web interface, please contact the helpdesk on for additional assistance.
-Import the IPA Certificate Authority.
+Import the IPA Certificate Authority.