diff --git a/debian/changelog b/debian/changelog index 3eda200ca..f39f1625f 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,17 @@ +freeipa (4.5.0-1) UNRELEASED; urgency=medium + + * New upstream release. + - Remove upstreamed patches: add-debian-platform.diff, + ipa-kdb-support-dal-version-5-and-6.diff, + purge-firefox-extension.diff, fix-ipa-otpd-install.diff, + fix-ipa-otpd-service.diff, purge-firefox-extension.diff + - Remove obsolete patches: fix-memcached.diff, + fix-oddjobs.diff + - Refresh patches: fix-dnssec-services.diff, + fix-ipa-conf.diff, fix-replicainstall.diff + + -- Timo Aaltonen Tue, 14 Mar 2017 16:55:45 +0200 + freeipa (4.4.3-4) UNRELEASED; urgency=medium * fix-is-running.diff: Add a third argument to is_running() in diff --git a/debian/patches/add-debian-platform.diff b/debian/patches/add-debian-platform.diff deleted file mode 100644 index c19568f73..000000000 --- a/debian/patches/add-debian-platform.diff +++ /dev/null @@ -1,460 +0,0 @@ -commit b076743f2cdd3a3cb9e8d0e8be7be8c90160fc21 -Author: Timo Aaltonen -Date: Fri Mar 1 12:21:00 2013 +0200 - - add debian platform support - ---- /dev/null -+++ b/ipaplatform/debian/__init__.py -@@ -0,0 +1,22 @@ -+# Authors: -+# Timo Aaltonen -+# -+# Copyright (C) 2014 Timo Aaltonen -+# see file 'COPYING' for use and warranty information -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation, either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+ -+""" -+This module contains Debian specific platform files. -+""" ---- /dev/null -+++ b/ipaplatform/debian/paths.py -@@ -0,0 +1,112 @@ -+# Authors: -+# Timo Aaltonen -+# -+# Copyright (C) 2014 Timo Aaltonen -+# see file 'COPYING' for use and warranty information -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation, either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+ -+""" -+This Debian base platform module exports default filesystem paths as common -+in Debian-based systems. -+""" -+ -+# Fallback to default path definitions -+from ipaplatform.base.paths import BasePathNamespace -+import sysconfig -+ -+MULTIARCH = sysconfig.get_config_var('MULTIARCH') -+ -+class DebianPathNamespace(BasePathNamespace): -+ BIN_HOSTNAMECTL = "/usr/bin/hostnamectl" -+ AUTOFS_LDAP_AUTH_CONF = "/etc/autofs_ldap_auth.conf" -+ ETC_HTTPD_DIR = "/etc/apache2" -+ HTTPD_ALIAS_DIR = "/etc/apache2/nssdb" -+ ALIAS_CACERT_ASC = "/etc/apache2/nssdb/cacert.asc" -+ ALIAS_PWDFILE_TXT = "/etc/apache2/nssdb/pwdfile.txt" -+ HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/" -+ HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf" -+ HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf" -+ HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf" -+ HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf" -+ HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf" -+ IPA_KEYTAB = "/etc/apache2/ipa.keytab" -+ HTTPD_PASSWORD_CONF = "/etc/apache2/password.conf" -+ NAMED_CONF = "/etc/bind/named.conf" -+ NAMED_VAR_DIR = "/var/cache/bind" -+ NAMED_KEYTAB = "/etc/bind/named.keytab" -+ NAMED_RFC1912_ZONES = "/etc/bind/named.conf.default-zones" -+ NAMED_ROOT_KEY = "/etc/bind/bind.keys" -+ NAMED_BINDKEYS_FILE = "/etc/bind/bind.keys" -+ NAMED_MANAGED_KEYS_DIR = "/var/cache/bind/dynamic" -+ OPENLDAP_LDAP_CONF = "/etc/ldap/ldap.conf" -+ ETC_DEBIAN_VERSION = "/etc/debian_version" -+ IPA_P11_KIT = "/usr/local/share/ca-certificates/ipa-ca.crt" -+ ETC_SYSCONFIG_DIR = "/etc/default" -+ SYSCONFIG_AUTOFS = "/etc/default/autofs" -+ SYSCONFIG_DIRSRV = "/etc/default/dirsrv" -+ SYSCONFIG_DIRSRV_INSTANCE = "/etc/default/dirsrv-%s" -+ SYSCONFIG_DIRSRV_SYSTEMD = "/etc/default/dirsrv.systemd" -+ SYSCONFIG_IPA_DNSKEYSYNCD = "/etc/default/ipa-dnskeysyncd" -+ SYSCONFIG_IPA_ODS_EXPORTER = "/etc/default/ipa-ods-exporter" -+ SYSCONFIG_KRB5KDC_DIR = "/etc/default/krb5-kdc" -+ SYSCONFIG_NAMED = "/etc/default/bind9" -+ SYSCONFIG_NFS = "/etc/default/nfs-common" -+ SYSCONFIG_NTPD = "/etc/default/ntp" -+ SYSCONFIG_ODS = "/etc/default/opendnssec" -+ SYSCONFIG_PKI = "/etc/dogtag/" -+ SYSCONFIG_PKI_TOMCAT = "/etc/default/pki-tomcat" -+ SYSCONFIG_PKI_TOMCAT_PKI_TOMCAT_DIR = "/etc/dogtag/tomcat/pki-tomcat" -+ SYSTEMD_SYSTEM_HTTPD_D_DIR = "/etc/systemd/system/apache2.service.d/" -+ SYSTEMD_SYSTEM_HTTPD_IPA_CONF = "/etc/systemd/system/apache2.service.d/ipa.conf" -+ DNSSEC_TRUSTED_KEY = "/etc/bind/trusted-key.key" -+ KRA_AGENT_PEM = "/etc/apache2/nssdb/kra-agent.pem" -+ SBIN_SERVICE = "/usr/sbin/service" -+ CERTMONGER_COMMAND_TEMPLATE = "/usr/lib/ipa/certmonger/%s" -+ UPDATE_CA_TRUST = "/usr/sbin/update-ca-certificates" -+ BIND_LDAP_SO = "/usr/share/doc/bind9-dyndb-ldap/copyright" -+ BIND_LDAP_DNS_IPA_WORKDIR = "/var/cache/bind/dyndb-ldap/ipa/" -+ BIND_LDAP_DNS_ZONE_WORKDIR = "/var/cache/bind/dyndb-ldap/ipa/master/" -+ LIBSOFTHSM2_SO = "/usr/lib/softhsm/libsofthsm2.so" -+ PAM_KRB5_SO = "/usr/lib/%s/security/pam_krb5.so" % MULTIARCH -+ LIB_SYSTEMD_SYSTEMD_DIR = "/lib/systemd/system/" -+ DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT = "/usr/lib/certmonger/dogtag-ipa-ca-renew-agent-submit" -+ DOGTAG_IPA_RENEW_AGENT_SUBMIT = "/usr/lib/certmonger/dogtag-ipa-renew-agent-submit" -+ IPA_SERVER_GUARD = "/usr/lib/certmonger/ipa-server-guard" -+ GENERATE_RNDC_KEY = "/bin/true" -+ IPA_DNSKEYSYNCD_REPLICA = "/usr/lib/ipa/ipa-dnskeysync-replica" -+ IPA_DNSKEYSYNCD = "/usr/lib/ipa/ipa-dnskeysyncd" -+ IPA_ODS_EXPORTER = "/usr/lib/ipa/ipa-ods-exporter" -+ HTTPD = "/usr/sbin/apache2ctl" -+ REMOVE_DS_PL = "/usr/sbin/remove-ds" -+ SETUP_DS_PL = "/usr/sbin/setup-ds" -+ VAR_KERBEROS_KRB5KDC_DIR = "/var/lib/krb5kdc/" -+ VAR_KRB5KDC_K5_REALM = "/var/lib/krb5kdc/.k5." -+ CACERT_PEM = "/var/lib/krb5kdc/cacert.pem" -+ KRB5KDC_KADM5_ACL = "/etc/krb5kdc/kadm5.acl" -+ KRB5KDC_KADM5_KEYTAB = "/etc/krb5kdc/kadm5.keytab" -+ KRB5KDC_KDC_CONF = "/etc/krb5kdc/kdc.conf" -+ KDC_PEM = "/var/lib/krb5kdc/kdc.pem" -+ VAR_LOG_HTTPD_DIR = "/var/log/apache2" -+ VAR_LOG_HTTPD_ERROR = "/var/log/apache2/error.log" -+ NAMED_RUN = "/var/cache/bind/named.run" -+ VAR_OPENDNSSEC_DIR = "/var/lib/opendnssec" -+ OPENDNSSEC_KASP_DB = "/var/lib/opendnssec/db/kasp.db" -+ IPA_ODS_EXPORTER_CCACHE = "/var/lib/opendnssec/tmp/ipa-ods-exporter.ccache" -+ KRB5CC_HTTPD = "/var/run/apache2/ipa/krbcache/krb5ccache" -+ IPA_CUSTODIA_SOCKET = "/run/apache2/ipa-custodia.sock" -+ IPA_CUSTODIA_AUDIT_LOG = '/var/log/ipa-custodia.audit.log' -+ IPA_GETKEYTAB = '/usr/sbin/ipa-getkeytab' -+ -+paths = DebianPathNamespace() ---- /dev/null -+++ b/ipaplatform/debian/services.py -@@ -0,0 +1,198 @@ -+# Authors: -+# Timo Aaltonen -+# -+# Copyright (C) 2014 Timo Aaltonen -+# see file 'COPYING' for use and warranty information -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation, either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+ -+""" -+Contains Debian-specific service class implementations. -+""" -+ -+import time -+ -+from ipaplatform.tasks import tasks -+from ipaplatform.base import services as base_services -+from ipaplatform.redhat import services as redhat_services -+from ipapython import ipautil -+from ipapython.ipa_log_manager import root_logger -+from ipalib import api -+from ipaplatform.paths import paths -+ -+# Mappings from service names as FreeIPA code references to these services -+# to their actual systemd service names -+debian_system_units = redhat_services.redhat_system_units -+ -+debian_system_units['httpd'] = 'apache2.service' -+debian_system_units['kadmin'] = 'krb5-admin-server.service' -+debian_system_units['krb5kdc'] = 'krb5-kdc.service' -+debian_system_units['named-regular'] = 'bind9.service' -+debian_system_units['named-pkcs11'] = 'bind9-pkcs11.service' -+debian_system_units['named'] = debian_system_units['named-pkcs11'] -+debian_system_units['pki-tomcatd'] = 'pki-tomcatd.service' -+debian_system_units['pki_tomcatd'] = debian_system_units['pki-tomcatd'] -+debian_system_units['ods-enforcerd'] = 'opendnssec-enforcer.service' -+debian_system_units['ods_enforcerd'] = debian_system_units['ods-enforcerd'] -+debian_system_units['ods-signerd'] = 'opendnssec-signer.service' -+debian_system_units['ods_signerd'] = debian_system_units['ods-signerd'] -+debian_system_units['rpcgssd'] = 'rpc-gssd.service' -+debian_system_units['rpcidmapd'] = 'nfs-idmapd.service' -+debian_system_units['smb'] = 'smbd.service' -+ -+# Service classes that implement Debian-specific behaviour -+ -+class DebianService(redhat_services.RedHatService): -+ system_units = debian_system_units -+ -+ -+class DebianSysvService(base_services.PlatformService): -+ def __wait_for_open_ports(self, instance_name=""): -+ """ -+ If this is a service we need to wait for do so. -+ """ -+ ports = None -+ if instance_name in base_services.wellknownports: -+ ports = base_services.wellknownports[instance_name] -+ else: -+ if self.service_name in base_services.wellknownports: -+ ports = base_services.wellknownports[self.service_name] -+ if ports: -+ ipautil.wait_for_open_ports('localhost', ports, api.env.startup_timeout) -+ def stop(self, instance_name='', capture_output=True): -+ ipautil.run([paths.SBIN_SERVICE, self.service_name, "stop", -+ instance_name], capture_output=capture_output) -+ if 'context' in api.env and api.env.context in ['ipactl', 'installer']: -+ update_service_list = True -+ else: -+ update_service_list = False -+ super(DebianSysvService, self).stop(instance_name) -+ -+ def start(self, instance_name='', capture_output=True, wait=True): -+ ipautil.run([paths.SBIN_SERVICE, self.service_name, "start", -+ instance_name], capture_output=capture_output) -+ if 'context' in api.env and api.env.context in ['ipactl', 'installer']: -+ update_service_list = True -+ else: -+ update_service_list = False -+ if wait and self.is_running(instance_name): -+ self.__wait_for_open_ports(instance_name) -+ super(DebianSysvService, self).start(instance_name) -+ -+ def restart(self, instance_name='', capture_output=True, wait=True): -+ ipautil.run([paths.SBIN_SERVICE, self.service_name, "restart", -+ instance_name], capture_output=capture_output) -+ if wait and self.is_running(instance_name): -+ self.__wait_for_open_ports(instance_name) -+ -+ def is_running(self, instance_name=""): -+ ret = True -+ try: -+ result = ipautil.run([paths.SBIN_SERVICE, -+ self.service_name, "status", -+ instance_name], -+ capture_output=True) -+ sout = result.output -+ if sout.find("NOT running") >= 0: -+ ret = False -+ if sout.find("stop") >= 0: -+ ret = False -+ if sout.find("inactive") >= 0: -+ ret = False -+ except ipautil.CalledProcessError: -+ ret = False -+ return ret -+ -+ def is_installed(self): -+ installed = True -+ try: -+ ipautil.run([paths.SBIN_SERVICE, self.service_name, "status"]) -+ except ipautil.CalledProcessError, e: -+ if e.returncode == 1: -+ # service is not installed or there is other serious issue -+ installed = False -+ return installed -+ -+ def is_enabled(self, instance_name=""): -+ # Services are always assumed to be enabled when installed -+ return True -+ -+ def enable(self): -+ return True -+ -+ def disable(self): -+ return True -+ -+ def install(self): -+ return True -+ -+ def remove(self): -+ return True -+ -+ def tune_nofile_platform(self): -+ return True -+ -+# For services which have no Debian counterpart -+class DebianNoService(base_services.PlatformService): -+ def start(self): -+ return True -+ -+ def stop(self): -+ return True -+ -+ def restart(self): -+ return True -+ -+ def disable(self): -+ return True -+ -+class DebianSSHService(DebianSysvService): -+ def get_config_dir(self, instance_name=""): -+ return '/etc/ssh' -+ -+# Function that constructs proper Debian-specific server classes for services -+# of specified name -+ -+def debian_service_class_factory(name): -+ if name == 'dirsrv': -+ return redhat_services.RedHatDirectoryService(name) -+ if name == 'domainname': -+ return DebianNoService(name) -+ if name == 'ipa': -+ return redhat_services.RedHatIPAService(name) -+ if name == 'messagebus': -+ return DebianNoService(name) -+ if name == 'ntpd': -+ return DebianSysvService("ntp") -+ if name == 'sshd': -+ return DebianSSHService(name) -+ return DebianService(name) -+ -+ -+# Magicdict containing DebianService instances. -+ -+class DebianServices(base_services.KnownServices): -+ def __init__(self): -+ services = dict() -+ for s in base_services.wellknownservices: -+ services[s] = debian_service_class_factory(s) -+ # Call base class constructor. This will lock services to read-only -+ super(DebianServices, self).__init__(services) -+ -+ -+# Objects below are expected to be exported by platform module -+ -+from ipaplatform.base.services import timedate_services -+service = debian_service_class_factory -+knownservices = DebianServices() ---- /dev/null -+++ b/ipaplatform/debian/tasks.py -@@ -0,0 +1,61 @@ -+# Authors: -+# Timo Aaltonen -+# -+# Copyright (C) 2014 Timo Aaltonen -+# see file 'COPYING' for use and warranty information -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation, either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+ -+""" -+This module contains default Debian-specific implementations of system tasks. -+""" -+ -+from ipaplatform.paths import paths -+from ipaplatform.base.tasks import * -+from ipaplatform.redhat.tasks import RedHatTaskNamespace -+ -+BaseTask = BaseTaskNamespace() -+ -+class DebianTaskNamespace(RedHatTaskNamespace): -+ -+ def restore_pre_ipa_client_configuration(self, fstore, statestore, -+ was_sssd_installed, -+ was_sssd_configured): -+ # Debian doesn't use authconfig, nothing to restore -+ return True -+ -+ def set_nisdomain(self, nisdomain): -+ # Debian doesn't use authconfig, nothing to set -+ return True -+ -+ def modify_nsswitch_pam_stack(self, sssd, mkhomedir, statestore): -+ # Debian doesn't use authconfig, this is handled by pam-auth-update -+ return True -+ -+ def modify_pam_to_use_krb5(self, statestore): -+ # Debian doesn't use authconfig, this is handled by pam-auth-update -+ return True -+ -+ def backup_auth_configuration(self, path): -+ # Debian doesn't use authconfig, nothing to backup -+ return True -+ -+ def restore_auth_configuration(self, path): -+ # Debian doesn't use authconfig, nothing to restore -+ return True -+ -+ def parse_ipa_version(self, version): -+ return BaseTask.parse_ipa_version(version) -+ -+tasks = DebianTaskNamespace() ---- a/ipaplatform/setup.py.in -+++ b/ipaplatform/setup.py.in -@@ -66,6 +66,7 @@ def setup_package(): - package_dir = {'ipaplatform': ''}, - packages = ["ipaplatform", - "ipaplatform.base", -+ "ipaplatform.debian", - "ipaplatform.fedora", - "ipaplatform.redhat", - "ipaplatform.rhel"], ---- a/ipaserver/install/ntpinstance.py -+++ b/ipaserver/install/ntpinstance.py -@@ -70,6 +70,8 @@ class NTPInstance(service.Service): - os = "fedora" - elif ipautil.file_exists(paths.ETC_REDHAT_RELEASE): - os = "rhel" -+ elif ipautil.file_exists(paths.ETC_DEBIAN_VERSION): -+ os = "debian" - - srv_vals = [] - srv_vals.append("0.%s.pool.ntp.org" % os) ---- /dev/null -+++ b/ipaplatform/debian/constants.py -@@ -0,0 +1,25 @@ -+# -+# Copyright (C) 2015 FreeIPA Contributors see COPYING for license -+# -+ -+''' -+This Debian family platform module exports platform dependant constants. -+''' -+ -+# Fallback to default path definitions -+from ipaplatform.base.constants import BaseConstantsNamespace -+ -+ -+class DebianConstantsNamespace(BaseConstantsNamespace): -+ HTTPD_USER = "www-data" -+ NAMED_USER = "bind" -+ NAMED_GROUP = "bind" -+ # ntpd init variable used for daemon options -+ NTPD_OPTS_VAR = "NTPD_OPTS" -+ # quote used for daemon options -+ NTPD_OPTS_QUOTE = "\'" -+ ODS_USER = "opendnssec" -+ ODS_GROUP = "opendnssec" -+ SECURE_NFS_VAR = "NEED_GSSD" -+ -+constants = DebianConstantsNamespace() diff --git a/debian/patches/fix-dnssec-services.diff b/debian/patches/fix-dnssec-services.diff index 4bf5c919a..75f8dfe8b 100644 --- a/debian/patches/fix-dnssec-services.diff +++ b/debian/patches/fix-dnssec-services.diff @@ -1,33 +1,25 @@ ---- a/daemons/dnssec/ipa-dnskeysyncd.service -+++ b/daemons/dnssec/ipa-dnskeysyncd.service -@@ -2,11 +2,11 @@ - Description=IPA key daemon - +--- a/daemons/dnssec/ipa-dnskeysyncd.service.in ++++ b/daemons/dnssec/ipa-dnskeysyncd.service.in +@@ -4,9 +4,9 @@ Description=IPA key daemon [Service] --EnvironmentFile=/etc/sysconfig/ipa-dnskeysyncd --ExecStart=/usr/libexec/ipa/ipa-dnskeysyncd + EnvironmentFile=@sysconfenvdir@/ipa-dnskeysyncd + ExecStart=@libexecdir@/ipa/ipa-dnskeysyncd -User=ods -Group=named -SupplementaryGroups=ods -+EnvironmentFile=/etc/default/ipa-dnskeysyncd -+ExecStart=/usr/lib/ipa/ipa-dnskeysyncd +User=opendnssec +Group=bind +SupplementaryGroups=opendnssec PrivateTmp=yes Restart=on-failure RestartSec=60s ---- a/daemons/dnssec/ipa-ods-exporter.service -+++ b/daemons/dnssec/ipa-ods-exporter.service -@@ -4,9 +4,9 @@ Wants=ipa-ods-exporter.socket - After=ipa-ods-exporter.socket - +--- a/daemons/dnssec/ipa-ods-exporter.service.in ++++ b/daemons/dnssec/ipa-ods-exporter.service.in +@@ -6,7 +6,7 @@ After=ipa-ods-exporter.socket [Service] --EnvironmentFile=/etc/sysconfig/ipa-ods-exporter --ExecStart=/usr/libexec/ipa/ipa-ods-exporter + EnvironmentFile=@sysconfenvdir@/ipa-ods-exporter + ExecStart=@libexecdir@/ipa/ipa-ods-exporter -User=ods -+EnvironmentFile=/etc/default/ipa-ods-exporter -+ExecStart=/usr/lib/ipa/ipa-ods-exporter +User=opendnssec PrivateTmp=yes Restart=on-failure diff --git a/debian/patches/fix-ipa-conf.diff b/debian/patches/fix-ipa-conf.diff index ca2913b8b..2f5d8b178 100644 --- a/debian/patches/fix-ipa-conf.diff +++ b/debian/patches/fix-ipa-conf.diff @@ -10,20 +10,16 @@ Description: Fix paths # Configure mod_wsgi handler for /ipa -@@ -63,9 +63,9 @@ WSGIScriptReloading Off - - AuthType GSSAPI - AuthName "Kerberos Login" -- GssapiCredStore keytab:/etc/httpd/conf/ipa.keytab -- GssapiCredStore client_keytab:/etc/httpd/conf/ipa.keytab -- GssapiDelegCcacheDir /var/run/httpd/ipa/clientcaches -+ GssapiCredStore keytab:/etc/apache2/ipa.keytab -+ GssapiCredStore client_keytab:/etc/apache2/ipa.keytab -+ GssapiDelegCcacheDir /var/run/apache2/ipa/clientcaches - GssapiDelegCcacheUnique On - GssapiUseS4U2Proxy on - GssapiAllowedMech krb5 -@@ -111,7 +111,7 @@ WSGIScriptReloading Off +@@ -68,7 +68,7 @@ WSGIScriptReloading Off + SessionCookieName ipa_session path=/ipa;httponly;secure; + SessionHeader IPASESSION + SessionMaxAge 1800 +- GssapiSessionKey file:/etc/httpd/alias/ipasession.key ++ GssapiSessionKey file:/etc/apache2/ipasession.key + + GssapiDelegCcacheDir /var/run/ipa/ccaches + GssapiDelegCcachePerms mode:0660 gid:ipaapi +@@ -112,7 +112,7 @@ Alias /ipa/session/cookie "/usr/share/ip # Custodia stuff is redirected to the custodia daemon # after authentication @@ -32,7 +28,7 @@ Description: Fix paths RequestHeader set GSS_NAME %{GSS_NAME}s RequestHeader set REMOTE_USER %{REMOTE_USER}s -@@ -145,8 +145,8 @@ Alias /ipa/crl "$CRL_PUBLISH_PATH" +@@ -146,8 +146,8 @@ Alias /ipa/crl "$CRL_PUBLISH_PATH" # List explicitly only the fonts we want to serve diff --git a/debian/patches/fix-ipa-otpd-install.diff b/debian/patches/fix-ipa-otpd-install.diff deleted file mode 100644 index d0a07105b..000000000 --- a/debian/patches/fix-ipa-otpd-install.diff +++ /dev/null @@ -1,12 +0,0 @@ ---- a/daemons/ipa-otpd/Makefile.am -+++ b/daemons/ipa-otpd/Makefile.am -@@ -2,7 +2,8 @@ AM_CFLAGS := @LDAP_CFLAGS@ @LIBVERTO_CFL - AM_LDFLAGS := @LDAP_LIBS@ @LIBVERTO_LIBS@ @KRAD_LIBS@ - - noinst_HEADERS = internal.h --libexec_PROGRAMS = ipa-otpd -+appdir = $(libexecdir)/ipa/ -+app_PROGRAMS = ipa-otpd - dist_noinst_DATA = ipa-otpd.socket.in ipa-otpd@.service.in test.py - systemdsystemunit_DATA = ipa-otpd.socket ipa-otpd@.service - diff --git a/debian/patches/fix-ipa-otpd-service.diff b/debian/patches/fix-ipa-otpd-service.diff deleted file mode 100644 index 4ed614e87..000000000 --- a/debian/patches/fix-ipa-otpd-service.diff +++ /dev/null @@ -1,11 +0,0 @@ ---- a/daemons/ipa-otpd/ipa-otpd@.service.in -+++ b/daemons/ipa-otpd/ipa-otpd@.service.in -@@ -3,7 +3,7 @@ Description=ipa-otpd service - - [Service] - EnvironmentFile=@sysconfdir@/ipa/default.conf --ExecStart=@libexecdir@/ipa-otpd $ldap_uri -+ExecStart=@libexecdir@/ipa/ipa-otpd $ldap_uri - StandardInput=socket - StandardOutput=socket - StandardError=syslog diff --git a/debian/patches/fix-memcached.diff b/debian/patches/fix-memcached.diff deleted file mode 100644 index 6cfd3d6d4..000000000 --- a/debian/patches/fix-memcached.diff +++ /dev/null @@ -1,20 +0,0 @@ ---- a/init/ipa_memcached.conf -+++ b/init/ipa_memcached.conf -@@ -1,5 +1,5 @@ - SOCKET_PATH=/var/run/ipa_memcached/ipa_memcached --USER=apache -+USER=www-data - MAXCONN=1024 - CACHESIZE=64 - OPTIONS= ---- a/init/systemd/ipa_memcached.service -+++ b/init/systemd/ipa_memcached.service -@@ -4,7 +4,7 @@ After=network.target - - [Service] - Type=forking --EnvironmentFile=/etc/sysconfig/ipa_memcached -+EnvironmentFile=/etc/default/ipa_memcached - PIDFile=/var/run/ipa_memcached/ipa_memcached.pid - ExecStart=/usr/bin/memcached -d -s $SOCKET_PATH -u $USER -m $CACHESIZE -c $MAXCONN -P /var/run/ipa_memcached/ipa_memcached.pid $OPTIONS - diff --git a/debian/patches/fix-oddjobs.diff b/debian/patches/fix-oddjobs.diff deleted file mode 100644 index 215005c07..000000000 --- a/debian/patches/fix-oddjobs.diff +++ /dev/null @@ -1,58 +0,0 @@ ---- a/install/oddjob/etc/dbus-1/system.d/oddjob-ipa-trust.conf -+++ b/install/oddjob/etc/dbus-1/system.d/oddjob-ipa-trust.conf -@@ -30,7 +30,7 @@ - send_member="Get"/> - - -- -+ - - - -- -+ - - - ---- a/install/oddjob/etc/oddjobd.conf.d/ipa-server.conf -+++ b/install/oddjob/etc/oddjobd.conf.d/ipa-server.conf -@@ -2,11 +2,11 @@ - - - -- -+ - - - -- ---- a/install/oddjob/etc/oddjobd.conf.d/oddjobd-ipa-trust.conf -+++ b/install/oddjob/etc/oddjobd.conf.d/oddjobd-ipa-trust.conf -@@ -2,7 +2,7 @@ - - - -- -+ - - - -@@ -10,7 +10,7 @@ - - - -- diff --git a/debian/patches/fix-replicainstall.diff b/debian/patches/fix-replicainstall.diff index f40335845..50d410334 100644 --- a/debian/patches/fix-replicainstall.diff +++ b/debian/patches/fix-replicainstall.diff @@ -1,11 +1,11 @@ --- a/ipaserver/install/server/replicainstall.py +++ b/ipaserver/install/server/replicainstall.py -@@ -630,7 +630,7 @@ def install_check(installer): +@@ -768,7 +768,7 @@ def install_check(installer): finally: shutil.rmtree(tmp_db_dir) - ldapuri = 'ldaps://%s' % ipautil.format_netloc(config.master_host_name) + ldapuri = 'ldap://%s' % ipautil.format_netloc(config.master_host_name) remote_api = create_api(mode=None) - remote_api.bootstrap(in_server=True, context='installer', - ldap_uri=ldapuri) + remote_api.bootstrap(in_server=True, + context='installer', diff --git a/debian/patches/ipa-kdb-support-dal-version-5-and-6.diff b/debian/patches/ipa-kdb-support-dal-version-5-and-6.diff deleted file mode 100644 index 8805bb4e9..000000000 --- a/debian/patches/ipa-kdb-support-dal-version-5-and-6.diff +++ /dev/null @@ -1,125 +0,0 @@ -commit 2775042787be4ea236c0b99dd75337414e24b89d -Author: Simo Sorce -Date: Tue Nov 1 15:13:14 2016 -0400 - - Support DAL version 5 and version 6 - - https://fedorahosted.org/freeipa/ticket/6466 - - Signed-off-by: Simo Sorce - Reviewed-By: Tomas Krizek - Reviewed-By: Robbie Harwood - -diff --git a/daemons/ipa-kdb/ipa_kdb.c b/daemons/ipa-kdb/ipa_kdb.c -index fbcb03b..e96353f 100644 ---- a/daemons/ipa-kdb/ipa_kdb.c -+++ b/daemons/ipa-kdb/ipa_kdb.c -@@ -625,45 +625,69 @@ static void ipadb_free(krb5_context context, void *ptr) - - /* KDB Virtual Table */ - -+#if KRB5_KDB_DAL_MAJOR_VERSION == 5 - kdb_vftabl kdb_function_table = { -- KRB5_KDB_DAL_MAJOR_VERSION, /* major version number */ -- 0, /* minor version number */ -- ipadb_init_library, /* init_library */ -- ipadb_fini_library, /* fini_library */ -- ipadb_init_module, /* init_module */ -- ipadb_fini_module, /* fini_module */ -- ipadb_create, /* create */ -- NULL, /* destroy */ -- ipadb_get_age, /* get_age */ -- NULL, /* lock */ -- NULL, /* unlock */ -- ipadb_get_principal, /* get_principal */ -- ipadb_free_principal, /* free_principal */ -- ipadb_put_principal, /* put_principal */ -- ipadb_delete_principal, /* delete_principal */ -- ipadb_iterate, /* iterate */ -- ipadb_create_pwd_policy, /* create_policy */ -- ipadb_get_pwd_policy, /* get_policy */ -- ipadb_put_pwd_policy, /* put_policy */ -- ipadb_iterate_pwd_policy, /* iter_policy */ -- ipadb_delete_pwd_policy, /* delete_policy */ -- ipadb_free_pwd_policy, /* free_policy */ -- ipadb_alloc, /* alloc */ -- ipadb_free, /* free */ -- ipadb_fetch_master_key, /* fetch_master_key */ -- NULL, /* fetch_master_key_list */ -- ipadb_store_master_key_list, /* store_master_key_list */ -- NULL, /* dbe_search_enctype */ -- ipadb_change_pwd, /* change_pwd */ -- NULL, /* promote_db */ -- NULL, /* decrypt_key_data */ -- NULL, /* encrypt_key_data */ -- ipadb_sign_authdata, /* sign_authdata */ -- ipadb_check_transited_realms, /* check_transited_realms */ -- ipadb_check_policy_as, /* check_policy_as */ -- NULL, /* check_policy_tgs */ -- ipadb_audit_as_req, /* audit_as_req */ -- NULL, /* refresh_config */ -- ipadb_check_allowed_to_delegate /* check_allowed_to_delegate */ -+ .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION, -+ .min_ver = 0, -+ .init_library = ipadb_init_library, -+ .fini_library = ipadb_fini_library, -+ .init_module = ipadb_init_module, -+ .fini_module = ipadb_fini_module, -+ .create = ipadb_create, -+ .get_age = ipadb_get_age, -+ .get_principal = ipadb_get_principal, -+ .free_principal = ipadb_free_principal, -+ .put_principal = ipadb_put_principal, -+ .delete_principal = ipadb_delete_principal, -+ .iterate = ipadb_iterate, -+ .create_policy = ipadb_create_pwd_policy, -+ .get_policy = ipadb_get_pwd_policy, -+ .put_policy = ipadb_put_pwd_policy, -+ .iter_policy = ipadb_iterate_pwd_policy, -+ .delete_policy = ipadb_delete_pwd_policy, -+ .free_policy = ipadb_free_pwd_policy, -+ .alloc = ipadb_alloc, -+ .free = ipadb_free, -+ .fetch_master_key = ipadb_fetch_master_key, -+ .store_master_key_list = ipadb_store_master_key_list, -+ .change_pwd = ipadb_change_pwd, -+ .sign_authdata = ipadb_sign_authdata, -+ .check_transited_realms = ipadb_check_transited_realms, -+ .check_policy_as = ipadb_check_policy_as, -+ .audit_as_req = ipadb_audit_as_req, -+ .check_allowed_to_delegate = ipadb_check_allowed_to_delegate - }; - -+#elif KRB5_KDB_DAL_MAJOR_VERSION == 6 -+kdb_vftabl kdb_function_table = { -+ .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION, -+ .min_ver = 0, -+ .init_library = ipadb_init_library, -+ .fini_library = ipadb_fini_library, -+ .init_module = ipadb_init_module, -+ .fini_module = ipadb_fini_module, -+ .create = ipadb_create, -+ .get_age = ipadb_get_age, -+ .get_principal = ipadb_get_principal, -+ .put_principal = ipadb_put_principal, -+ .delete_principal = ipadb_delete_principal, -+ .iterate = ipadb_iterate, -+ .create_policy = ipadb_create_pwd_policy, -+ .get_policy = ipadb_get_pwd_policy, -+ .put_policy = ipadb_put_pwd_policy, -+ .iter_policy = ipadb_iterate_pwd_policy, -+ .delete_policy = ipadb_delete_pwd_policy, -+ .fetch_master_key = ipadb_fetch_master_key, -+ .store_master_key_list = ipadb_store_master_key_list, -+ .change_pwd = ipadb_change_pwd, -+ .sign_authdata = ipadb_sign_authdata, -+ .check_transited_realms = ipadb_check_transited_realms, -+ .check_policy_as = ipadb_check_policy_as, -+ .audit_as_req = ipadb_audit_as_req, -+ .check_allowed_to_delegate = ipadb_check_allowed_to_delegate -+}; -+ -+#else -+#error unsupported DAL major version -+#endif -+ diff --git a/debian/patches/purge-firefox-extension.diff b/debian/patches/purge-firefox-extension.diff deleted file mode 100644 index aa13dae36..000000000 --- a/debian/patches/purge-firefox-extension.diff +++ /dev/null @@ -1,632 +0,0 @@ -commit 5d6e79b8f03198056103a31acc20536f8323756d -Author: Timo Aaltonen -Date: Tue Mar 29 21:33:15 2016 +0300 - - Purge firefox extension - ---- a/freeipa.spec.in -+++ b/freeipa.spec.in -@@ -165,7 +165,6 @@ Requires: pki-ca >= 10.3.5-6 - Requires: pki-kra >= 10.3.5-6 - Requires(preun): python systemd-units - Requires(postun): python systemd-units --Requires: zip - Requires: policycoreutils >= 2.1.12-5 - Requires: tar - Requires(pre): certmonger >= 0.78 ---- a/install/Makefile.am -+++ b/install/Makefile.am -@@ -7,7 +7,6 @@ NULL = - SUBDIRS = \ - certmonger \ - conf \ -- ffextension \ - html \ - migration \ - share \ ---- a/install/ffextension/Makefile.am -+++ /dev/null -@@ -1,23 +0,0 @@ --AUTOMAKE_OPTIONS = 1.7 -- --NULL = -- --SUBDIRS = \ -- chrome \ -- locale \ -- $(NULL) -- --appdir = $(IPA_DATA_DIR)/ffextension --app_DATA = \ -- bootstrap.js \ -- chrome.manifest \ -- install.rdf \ -- $(NULL) -- --EXTRA_DIST = \ -- $(app_DATA) \ -- $(NULL) -- --MAINTAINERCLEANFILES = \ -- *~ \ -- Makefile.in ---- a/install/ffextension/bootstrap.js -+++ /dev/null -@@ -1,88 +0,0 @@ --// Heavily inspired by Dave Townsend's post: --// Playing with windows in restartless (bootstrapped) extensions --// http://www.oxymoronical.com/blog/2011/01/Playing-with-windows-in-restartless-bootstrapped-extensions -- --const Cc = Components.classes; --const Ci = Components.interfaces; --const Cu = Components.utils; -- --var WindowListener = { -- -- setupBrowserUI: function(domWindow) { -- var doc = domWindow.document; -- domWindow.kerberosauth_listener = kerberosauth_listener(domWindow); -- doc.addEventListener('kerberos-auth-config', domWindow.kerberosauth_listener, false, true); -- }, -- -- tearDownBrowserUI: function(domWindow) { -- -- var doc = domWindow.document; -- doc.removeEventListener('kerberos-auth-config', domWindow.kerberosauth_listener); -- delete domWindow.kerberosauth_listener; -- }, -- -- // nsIWindowMediatorListener functions -- onOpenWindow: function(xulWindow) { -- // A new window has opened -- var domWindow = xulWindow.QueryInterface(Ci.nsIInterfaceRequestor). -- getInterface(Ci.nsIDOMWindowInternal); -- -- // Wait for it to finish loading -- domWindow.addEventListener("load", function listener() { -- domWindow.removeEventListener("load", listener, false); -- -- // If this is a browser window then setup its UI -- if (domWindow.document.documentElement.getAttribute("windowtype") === "navigator:browser") { -- WindowListener.setupBrowserUI(domWindow); -- } -- }, false); -- }, -- -- onCloseWindow: function(xulWindow) { -- }, -- -- onWindowTitleChange: function(xulWindow, newTitle) { -- } --}; -- --function startup(data, reason) { -- var wm = Cc["@mozilla.org/appshell/window-mediator;1"].getService(Ci.nsIWindowMediator); -- -- Cu['import']("chrome://kerberosauth/content/kerberosauth.js"); -- -- // Get the list of browser windows already open -- var windows = wm.getEnumerator("navigator:browser"); -- while (windows.hasMoreElements()) { -- var domWindow = windows.getNext().QueryInterface(Ci.nsIDOMWindow); -- -- WindowListener.setupBrowserUI(domWindow); -- } -- -- // Wait for any new browser windows to open -- wm.addListener(WindowListener); --} -- --function shutdown(data, reason) { -- // When the application is shutting down we normally don't have to clean -- // up any UI changes made -- if (reason == APP_SHUTDOWN) -- return; -- -- var wm = Cc["@mozilla.org/appshell/window-mediator;1"]. -- getService(Ci.nsIWindowMediator); -- -- // Get the list of browser windows already open -- var windows = wm.getEnumerator("navigator:browser"); -- while (windows.hasMoreElements()) { -- var domWindow = windows.getNext().QueryInterface(Ci.nsIDOMWindow); -- WindowListener.tearDownBrowserUI(domWindow); -- } -- -- // Stop listening for any new browser windows to open -- wm.removeListener(WindowListener); -- -- Cu.unload("chrome://kerberosauth/content/kerberosauth.js"); --} -- --function install() {} --function uninstall() {} -\ No newline at end of file ---- a/install/ffextension/chrome.manifest -+++ /dev/null -@@ -1,4 +0,0 @@ --content kerberosauth chrome/content/ --resource kerberosauth chrome/content/ --overlay chrome://browser/content/browser.xul resource://kerberosauth/kerberosauth_overlay.xul --locale kerberosauth en-US locale/en-US/ -\ No newline at end of file ---- a/install/ffextension/chrome/Makefile.am -+++ /dev/null -@@ -1,19 +0,0 @@ --AUTOMAKE_OPTIONS = 1.7 -- --NULL = -- --SUBDIRS = \ -- content \ -- $(NULL) -- --appdir = $(IPA_DATA_DIR)/ffextension/chrome --app_DATA = \ -- $(NULL) -- --EXTRA_DIST = \ -- $(app_DATA) \ -- $(NULL) -- --MAINTAINERCLEANFILES = \ -- *~ \ -- Makefile.in ---- a/install/ffextension/chrome/content/Makefile.am -+++ /dev/null -@@ -1,17 +0,0 @@ --AUTOMAKE_OPTIONS = 1.7 -- --NULL = -- --appdir = $(IPA_DATA_DIR)/ffextension/chrome/content --app_DATA = \ -- kerberosauth_overlay.xul \ -- kerberosauth.js \ -- $(NULL) -- --EXTRA_DIST = \ -- $(app_DATA) \ -- $(NULL) -- --MAINTAINERCLEANFILES = \ -- *~ \ -- Makefile.in ---- a/install/ffextension/chrome/content/kerberosauth.js -+++ /dev/null -@@ -1,197 +0,0 @@ --/* Authors: -- * Petr Vobornik -- * -- * Copyright (C) 2012 Red Hat -- * see file 'COPYING' for use and warranty information -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License as published by -- * the Free Software Foundation, either version 3 of the License, or -- * (at your option) any later version. -- * -- * This program is distributed in the hope that it will be useful, -- * but WITHOUT ANY WARRANTY; without even the implied warranty of -- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -- * GNU General Public License for more details. -- * -- * You should have received a copy of the GNU General Public License -- * along with this program. If not, see . -- */ -- --var EXPORTED_SYMBOLS = ["kerberosauth", "kerberosauth_listener"]; -- --var Cc = Components.classes; --var Ci = Components.interfaces; -- --var kerberosauth = { -- -- // Dictionary of configuration options this extension can configure. -- // An alias (key) is set for each options. Using a set of aliases limits -- // configuration pages from supplying potential malicious options. -- config_options: { -- referer: ['network.http.sendRefererHeader', 'int'], -- native_gss_lib: ['network.negotiate-auth.using-native-gsslib', 'bool'], -- trusted_uris: ['network.negotiate-auth.trusted-uris', 'str'], -- allow_proxies: ['network.negotiate-auth.allow-proxies', 'bool'] -- }, -- -- // Some preconfigurations to make things easier. Can be good if UI is added -- // (mostly for future usage). -- predefined_configurations: { -- ipa: { -- referer: '2', -- native_gss_lib: 'true', -- trusted_uris: '', -- allow_proxies: 'true', -- append: ['trusted_uris'] -- } -- }, -- -- page_listener: function(event, dom_window) { -- -- var self = this; -- -- var conf = { -- event: event, -- window: dom_window || window, -- element: event.target -- }; -- -- if (!conf.element.hasAttribute('method')) return; -- -- var method = conf.element.getAttribute('method'); -- -- if (method === 'configure') self.configure(conf); -- if (method === 'can_configure') self.send_response(conf.element, { answer: 'true' }); -- }, -- -- send_response: function(element, options) { -- -- options = options || {}; -- -- var doc = element.ownerDocument; -- -- for (var opt in options) { -- element.setAttribute(opt, options[opt]); -- } -- -- var answer_event = doc.createEvent("HTMLEvents"); -- answer_event.initEvent("kerberos-auth-answer", true, false); -- element.dispatchEvent(answer_event); -- }, -- -- notify_installed: function(window) { -- var doc = window.document; -- var event = doc.createEvent("HTMLEvents"); -- event.initEvent("kerberos-auth-installed", true, false); -- doc.dispatchEvent(event); -- }, -- -- configure: function(conf) { -- var self = this; -- -- var options = {}; // options to be configured -- var opt; -- -- // use predefined configuration if supplied -- if (conf.element.hasAttribute('predefined')) { -- var predefined = conf.element.getAttribute('predefined'); -- -- var pconfig = self.predefined_configurations[predefined]; -- if (pconfig) { -- for (opt in pconfig) { -- options[opt] = pconfig[opt]; -- } -- } -- } -- -- // overwrite predefined with supplied and only supported options -- for (var i=0; i < conf.element.attributes.length; i++) { -- var attr = conf.element.attributes[i].name; -- if (attr in self.config_options) { -- options[attr] = conf.element.getAttribute(attr); -- } -- } -- -- if (self.prompt(conf, options)) { -- self.configure_core(conf, options); -- self.send_response(conf.element, { answer: 'configured' }); -- } else { -- self.send_response(conf.element, { answer: 'aborted' }); -- } -- }, -- -- configure_core: function(conf, options) { -- -- var self = this; -- -- var prefs = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch); -- var append_opts = options.append || []; -- -- for (var opt in options) { -- -- if (!self.config_options[opt]) continue; -- -- var name = self.config_options[opt][0]; -- var type = self.config_options[opt][1]; -- var value = options[opt]; -- -- if (type === 'str') { -- if (value && append_opts.indexOf(opt) > -1) { -- var current = prefs.getCharPref(name) || ''; -- if (this.str_contains(current, value)) { -- continue; -- } else if (current) { -- value = current + ', ' + value; -- } -- } -- prefs.setCharPref(name, value); -- } else if (type ==='int') { -- prefs.setIntPref(name, Number(value)); -- } else if (type === 'bool') { -- prefs.setBoolPref(name, value === 'true'); -- } -- } -- }, -- -- str_contains: function(str, value) { -- -- if (!str) return false; -- var vals = str.split(','); -- for (var i=0, l=vals.length; i -- -- -- -- -- -\ No newline at end of file ---- a/install/ffextension/install.rdf -+++ /dev/null -@@ -1,26 +0,0 @@ -- -- -- -- -- -- kerberosauth@redhat.com -- Kerberos Configuration -- 0.1 -- Configures browser to use negotiate authentication -- 2 -- Red Hat, Inc. -- Petr Vobornik -- http://www.redhat.com/ -- true -- -- -- -- -- {ec8030f7-c20a-464f-9b0e-13a3a9e97384} -- 10.0 -- 15.0.* -- -- -- -- -\ No newline at end of file ---- a/install/ffextension/locale/Makefile.am -+++ /dev/null -@@ -1,19 +0,0 @@ --AUTOMAKE_OPTIONS = 1.7 -- --NULL = -- --SUBDIRS = \ -- en-US \ -- $(NULL) -- --appdir = $(IPA_DATA_DIR)/ffextension/locale --app_DATA = \ -- $(NULL) -- --EXTRA_DIST = \ -- $(app_DATA) \ -- $(NULL) -- --MAINTAINERCLEANFILES = \ -- *~ \ -- Makefile.in ---- a/install/ffextension/locale/en-US/Makefile.am -+++ /dev/null -@@ -1,16 +0,0 @@ --AUTOMAKE_OPTIONS = 1.7 -- --NULL = -- --appdir = $(IPA_DATA_DIR)/ffextension/locale/en-US --app_DATA = \ -- kerberosauth.properties \ -- $(NULL) -- --EXTRA_DIST = \ -- $(app_DATA) \ -- $(NULL) -- --MAINTAINERCLEANFILES = \ -- *~ \ -- Makefile.in ---- a/install/ffextension/locale/en-US/kerberosauth.properties -+++ /dev/null -@@ -1,4 +0,0 @@ --prompt_title=Kerberos configuration confirmation --prompt_topic=The page you are visiting is trying to configure Firefox for Kerberos authentication. --prompt_domain=\n\nDomain: ${domain} --prompt_question=\n\nDo you want to configure the browser? -\ No newline at end of file ---- a/install/share/Makefile.am -+++ b/install/share/Makefile.am -@@ -51,7 +51,6 @@ app_DATA = \ - krb5.conf.template \ - krb5.ini.template \ - krb.con.template \ -- krb.js.template \ - krbrealm.con.template \ - smb.conf.template \ - smb.conf.empty \ ---- a/install/share/krb.js.template -+++ /dev/null -@@ -1,2 +0,0 @@ --var IPA_REALM = "$REALM"; --var IPA_DOMAIN = "$DOMAIN"; -\ No newline at end of file ---- a/ipaplatform/base/paths.py -+++ b/ipaplatform/base/paths.py -@@ -184,7 +184,6 @@ class BasePathNamespace(object): - BIN_TIMEOUT = "/usr/bin/timeout" - UPDATE_CA_TRUST = "/usr/bin/update-ca-trust" - BIN_CURL = "/usr/bin/curl" -- ZIP = "/usr/bin/zip" - BIND_LDAP_SO = "/usr/lib/bind/ldap.so" - BIND_LDAP_DNS_IPA_WORKDIR = "/var/named/dyndb-ldap/ipa/" - BIND_LDAP_DNS_ZONE_WORKDIR = "/var/named/dyndb-ldap/ipa/master/" -@@ -231,12 +230,9 @@ class BasePathNamespace(object): - USERADD = "/usr/sbin/useradd" - USR_SHARE_IPA_DIR = "/usr/share/ipa/" - CA_TOPOLOGY_ULDIF = "/usr/share/ipa/ca-topology.uldif" -- FFEXTENSION = "/usr/share/ipa/ffextension" - IPA_HTML_DIR = "/usr/share/ipa/html" - CA_CRT = "/usr/share/ipa/html/ca.crt" -- KERBEROSAUTH_XPI = "/usr/share/ipa/html/kerberosauth.xpi" - KRB_CON = "/usr/share/ipa/html/krb.con" -- KRB_JS = "/usr/share/ipa/html/krb.js" - HTML_KRB5_INI = "/usr/share/ipa/html/krb5.ini" - HTML_KRBREALM_CON = "/usr/share/ipa/html/krbrealm.con" - NIS_ULDIF = "/usr/share/ipa/nis.uldif" ---- a/ipaserver/install/httpinstance.py -+++ b/ipaserver/install/httpinstance.py -@@ -130,7 +130,7 @@ class HTTPInstance(service.Service): - subject_base = ipautil.dn_attribute_property('_subject_base') - - def create_instance(self, realm, fqdn, domain_name, dm_password=None, -- autoconfig=True, pkcs12_info=None, -+ pkcs12_info=None, - subject_base=None, auto_redirect=True, ca_file=None, - ca_is_configured=None, promote=False): - self.fqdn = fqdn -@@ -173,8 +173,6 @@ class HTTPInstance(service.Service): - self.step("setting up httpd keytab", self.__create_http_keytab) - self.step("setting up ssl", self.__setup_ssl) - self.step("importing CA certificates from LDAP", self.__import_ca_certs) -- if autoconfig: -- self.step("setting up browser autoconfig", self.__setup_autoconfig) - self.step("publish CA cert", self.__publish_ca_cert) - self.step("clean up any existing httpd ccache", self.remove_httpd_ccache) - self.step("configuring SELinux for httpd", self.configure_selinux_for_httpd) -@@ -383,42 +381,6 @@ class HTTPInstance(service.Service): - db = certs.CertDB(self.realm, subject_base=self.subject_base) - self.import_ca_certs(db, self.ca_is_configured) - -- def __setup_autoconfig(self): -- self.setup_firefox_extension(self.realm, self.domain) -- -- def setup_firefox_extension(self, realm, domain): -- """Set up the signed browser configuration extension -- """ -- -- target_fname = paths.KRB_JS -- sub_dict = dict(REALM=realm, DOMAIN=domain) -- db = certs.CertDB(realm) -- with open(db.passwd_fname) as pwdfile: -- pwd = pwdfile.read() -- -- ipautil.copy_template_file(ipautil.SHARE_DIR + "krb.js.template", -- target_fname, sub_dict) -- os.chmod(target_fname, 0o644) -- -- # Setup extension -- tmpdir = tempfile.mkdtemp(prefix="tmp-") -- extdir = tmpdir + "/ext" -- target_fname = paths.KERBEROSAUTH_XPI -- shutil.copytree(paths.FFEXTENSION, extdir) -- if db.has_nickname('Signing-Cert'): -- db.run_signtool(["-k", "Signing-Cert", -- "-p", pwd, -- "-X", "-Z", target_fname, -- extdir]) -- else: -- root_logger.warning('Object-signing certificate was not found. ' -- 'Creating unsigned Firefox configuration extension.') -- filenames = os.listdir(extdir) -- ipautil.run([paths.ZIP, '-r', target_fname] + filenames, -- cwd=extdir) -- shutil.rmtree(tmpdir) -- os.chmod(target_fname, 0o644) -- - def __publish_ca_cert(self): - ca_db = certs.CertDB(self.realm) - ca_db.publish_ca_cert(paths.CA_CRT) ---- a/ipaserver/install/server/replicainstall.py -+++ b/ipaserver/install/server/replicainstall.py -@@ -186,12 +186,10 @@ def install_http(config, auto_redirect, - http = httpinstance.HTTPInstance() - http.create_instance( - config.realm_name, config.host_name, config.domain_name, -- config.dirman_password, False, pkcs12_info, -+ config.dirman_password, pkcs12_info, - auto_redirect=auto_redirect, ca_file=ca_file, - ca_is_configured=ca_is_configured, promote=promote) - -- http.setup_firefox_extension(config.realm_name, config.domain_name) -- - return http - - ---- a/ipaserver/install/server/upgrade.py -+++ b/ipaserver/install/server/upgrade.py -@@ -270,16 +270,6 @@ def cleanup_adtrust(fstore): - root_logger.debug('Removing %s from backup', backed_up_file) - - --def setup_firefox_extension(fstore): -- """Set up the Firefox configuration extension, if it's not set up yet -- """ -- root_logger.info('[Setting up Firefox extension]') -- http = httpinstance.HTTPInstance(fstore) -- realm = api.env.realm -- domain = api.env.domain -- http.setup_firefox_extension(realm, domain) -- -- - def upgrade_adtrust_config(): - """ - Upgrade 'dedicated keytab file' in smb.conf to omit FILE: prefix -@@ -1737,7 +1727,6 @@ def upgrade_configuration(): - - cleanup_kdc(fstore) - cleanup_adtrust(fstore) -- setup_firefox_extension(fstore) - upgrade_adtrust_config() - - bind = bindinstance.BindInstance(fstore) diff --git a/debian/patches/series b/debian/patches/series index c5a4bb28c..0f8087aa8 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,5 +1,4 @@ -# upstreamed -ipa-kdb-support-dal-version-5-and-6.diff +# from upstream # not upstreamable prefix.patch @@ -7,17 +6,11 @@ hack-libarch.diff enable-mod-nss-during-setup.diff # send upstream -add-debian-platform.diff fix-ipa-conf.diff fix-kdcproxy-paths.diff -fix-ipa-otpd-install.diff fix-replicainstall.diff fix-dnssec-services.diff create-sysconfig-ods.diff fix-named-conf-template.diff -fix-memcached.diff -fix-oddjobs.diff -purge-firefox-extension.diff -fix-ipa-otpd-service.diff fix-is-running.diff fix-kdcproxy-path.diff