Commit Graph

9679 Commits

Author SHA1 Message Date
Fraser Tweedale
0078e7a919 ipa-certupdate: track lightweight CA certificates
Enhance the ipa-certupdate program to add Certmonger tracking
requests for lightweight CA certificates.

Also update the dogtag-ipa-ca-renew-agent-submit to not store or
retrieve lightweight CA certificates, becaues Dogtag clones observe
renewals and update their NSSDBs on their own, and allow the helper
to request non-self-signed certificates.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-29 08:52:29 +02:00
Fraser Tweedale
b720aa94e9 Update lightweight CA serial after renewal
For CA replicas to pick up renewed lightweight CA signing
certificates, the authoritySerial attribute can be updated with the
new serial number.

Update the renew_ca_cert script, which is executed by Certmonger
after writing a renewed CA certificate to the NSSDB, to update the
authoritySerial attribute if the certificate belongs to a
lightweight CA.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-29 08:52:29 +02:00
Fraser Tweedale
67f13c82d8 Skip CS.cfg update if cert nickname not known
After CA certificate renewal, the ``renew_ca_cert`` helper updates
certificate data in CS.cfg.  An unrecognised nickname will raise
``KeyError``.  To allow the helper to be used for arbitrary
certificates (e.g. lightweight CAs), do not fail if the nickname is
unrecognised - just skip the update.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-29 08:52:29 +02:00
Fraser Tweedale
f0b1e37d2e ipaldap: turn LDAP filter utility functions into class methods
The LDAP filter utilities do not use any instance attributes, so
collectively turn them into class methods to promote reuse.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-29 08:52:29 +02:00
Fraser Tweedale
45daffa22f Set default OCSP URI on install and upgrade
Dogtag has been updated to support a default OCSP URI when the
profile includes AuthInfoAccess with URI method but does not specify
the URI (instead of constructing one based on Dogtag's hostname and
port).

Add the pkispawn config to ensure that the OCSP URI is set before
issuing CA and system certificates, and add the config to existing
CA instances on upgrade.

Fixes: https://fedorahosted.org/freeipa/ticket/5956
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-28 19:15:35 +02:00
Martin Basti
5693d19550 CA replica promotion: add proper CA DNS records
Update 'ipa-ca' records with A/AAAA records of the newly added replica

https://fedorahosted.org/freeipa/ticket/5966

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-06-28 16:56:35 +02:00
Martin Basti
104040cf36 DNS Locations: cleanup of bininstance
We don't need anymore:
* sample of zone file - list of all records required by IPa will be
provided

* NTP related params - DNS records will be updated automatically,
based on LDAP values

* CA related params - DNS records will be updated automatically based
* on LDAP values

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-06-28 15:23:51 +02:00
David Kupka
a636842889 schema: Caching on schema on client
Store schema in per user cache. Together with schemas also information
about mapping between server and fingerprint is stored to reduce traffic.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-28 15:03:42 +02:00
David Kupka
65aa2d48ff env: Add 'server' variable to api.env
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-28 15:03:42 +02:00
Petr Spacek
bf91c0f938 DNS: Fix tests for realm domains integration with DNS zone add
We forgot to update tests after change in
22f4045f72.

https://fedorahosted.org/freeipa/ticket/5980

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-28 14:19:56 +02:00
Petr Spacek
8b12ef50e1 client: Share validator and domain name normalization with server install
https://fedorahosted.org/freeipa/ticket/5976

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-28 14:14:32 +02:00
Jan Cholasta
5f52e0fcbf frontend: forward command calls using full name
Forward commands to remote server using the full versioned name.

https://fedorahosted.org/freeipa/ticket/4427

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-28 13:30:49 +02:00
Jan Cholasta
8466e94440 schema: support plugin versioning
Update API schema server and client code to support plugin versioning.

https://fedorahosted.org/freeipa/ticket/4427

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-28 13:30:49 +02:00
Jan Cholasta
4284d4fb4d plugable: support plugin versioning
Allow multiple incompatible versions of a plugin using the same name. The
current plugins are assumed to be version '1'.

The unique identifier of plugins was changed from plugin name to plugin
name and version. By default, the highest version available at build time
is used. If the plugin is an unknown remote plugin, version of '1' is used
by default.

https://fedorahosted.org/freeipa/ticket/4427

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-28 13:30:49 +02:00
Jan Cholasta
79d1f58335 plugable: use plugin class as the key in API namespaces
When iterating over APINameSpace objects, use plugin class rather than its
name as the key.

https://fedorahosted.org/freeipa/ticket/4427

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-28 13:30:49 +02:00
Jan Cholasta
9a21964877 misc: generate plugins result directly in the command
Move the code that generated result of the `plugins` command from API to
the command itself.

https://fedorahosted.org/freeipa/ticket/4427

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-28 13:30:49 +02:00
Lenka Doudova
22f26cfa8e Tests: Make ID views tests reflect new krbcanonicalname attribute
https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-06-28 10:50:25 +02:00
Martin Babinsky
d0c38d86a1 test-{service,host}-plugin: only expect krbcanonicalname when all=True
fixes incorrect assertions in tests that create, retrieve, and search for
services

https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
2016-06-28 09:17:30 +02:00
Martin Babinsky
a79d45ad79 test_serverroles: ensure that test API is initialized with correct ldap_uri
This ensures that the serverroles test works also when run together with other
iaserver test suites.

https://fedorahosted.org/freeipa/ticket/6000

Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
2016-06-28 09:14:28 +02:00
Jan Cholasta
f7cc15f099 schema: client-side code cleanup
Move client-side code scattered in global functions into neat classes.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-27 16:42:42 +02:00
Jan Cholasta
61987b66ba automember: fix automember to work with thin client
Properly mark `cn` as primary key of `automember` object.

This fixes automember crashing on output validation expecting primary key
value of None.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-27 16:42:42 +02:00
Jan Cholasta
055dfaf657 schema: do not crash in command_defaults if argument is None
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-27 16:42:42 +02:00
Jan Cholasta
ac8e8ecdd3 schema: fix param default value handling
Advertise param's default value even when `autofill` is False. When
`autofill` is False, set `alwaysask` to True in the schema, as it is
semantically equivallent and removes redundancy.

This fixes default value disappearing in CLI for some params.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-27 16:42:42 +02:00
Martin Babinsky
7b8247a485 keep setting ipakrbprincipal objectclass on new service entries
this is required for replica promotion to work, since the ACI allowing hosts
to add their own services uses this objectclass as target filter.

This partially reverts changes from commit
705f66f749

https://fedorahosted.org/freeipa/ticket/5996

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-27 13:38:07 +02:00
Martin Basti
7bf3b1d546 DNS Locations: optimization: use server-find to get information
Because separated calls for of server-show, getting server data is quite
slow. This commit replaces several server-show with one server-find
command. There are future plans to improve speed of server-find that
will be beneficial for DNS locations.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-06-27 13:35:00 +02:00
Martin Basti
218734ba5a DNS Locations: hide option --no-msdcs in adtrust-install
Since DNS location mechanism is active, this option has no effect,
because records are generate dynamically.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-06-27 13:35:00 +02:00
Martin Basti
e42f662b78 Revert "DNS Locations: do not generate location records for unused locations"
This reverts commit bbf8227e3f.

After deeper investigation, we found out that empty locations are needed
for clients, because clients may have cached records for longer time for
that particular location. Only way how to remove location is to remove
it using location-del

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-06-27 13:35:00 +02:00
Fraser Tweedale
47d33f3650 Fix IssuerDN presence check in cert search result
When checking for presence of IssuerDN in certificate search result,
we mistakenly check for the presence of the SubjectDN field, then
unsafely index into the IssuerDN field.  Check the presence of
IssuerDN correctly.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-27 13:11:57 +02:00
Martin Babinsky
9392b21271 Fix incorrect construction of service principal during replica cleanup
https://fedorahosted.org/freeipa/ticket/5985

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-27 12:59:48 +02:00
Martin Basti
a07030f386 ipa-rmkeytab, ipa-join: don't fail if init of gettext failed
If locale setting was incorect, gettext failed to initialize and scripts
failed. this commit replaces error exit with warning message. (Better to
have untranslated output than fail)

https://fedorahosted.org/freeipa/ticket/5973

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-06-27 12:34:18 +02:00
Stanislav Laznicka
e136db0192 Add missing nsSystemIndex attributes
https://fedorahosted.org/freeipa/ticket/5947

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-27 10:49:51 +02:00
Martin Basti
c6f7d94d5b DNS Locations: server-mod: fix if statement
Statement used for detection if objeclass change is needed was logically
wrong, this fixes it.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-06-27 10:22:39 +02:00
Martin Basti
deb99c11d4 Increase ipa-getkeytab LDAP timeout to 100sec
On slower machines, the original time 10s is not enough. Raising timeout
to 100sec should help.

https://fedorahosted.org/freeipa/ticket/5842

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-06-27 09:33:02 +02:00
Petr Vobornik
fd840a9cd7 mod_auth_gssapi: enable unique credential caches names
mod_auth_gssapi > 1.4.0 implements support for unique ccaches names.
Without it ccache name is derived from pricipal name.

It solves a race condition in two concurrent request of the same
principal. Where first request deletes the ccache and the second
tries to use it which then fails. It may lead e.g. to a failure of
two concurrent ipa-client-install.

With this feature there are two ccaches so there is no clash.

https://fedorahosted.org/freeipa/ticket/5653

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
2016-06-24 16:06:49 +02:00
Thierry Bordaz
1ce8d32fd6 ipapwd_extop should use TARGET_DN defined by a pre-extop plugin
ipapwd_extop allows to update the password on a specific entry, identified by its DN.
It can be usefull to support virtual DN in the extop so that update of a virtual entry
would land into the proper real entry.

If a pre-extop sets the TARGET_DN, ipapwd_extop sets ORIGINAL_DN with the value
of TARGET_DN, instead of using the original one (in the ber req)
There is a dependency on slapi-nis >= 0.56-0.1 (https://fedorahosted.org/freeipa/ticket/5955)

https://fedorahosted.org/freeipa/ticket/5946

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-06-24 14:51:15 +02:00
Lenka Doudova
d64513f1ff Tests: Fix ipatests/test_ipaserver/test_rpcserver.py
Removed no longer valid assert.

Reviewed-By: Oleg Fayans <ofayans@redhat.com>
2016-06-24 14:22:40 +02:00
Stanislav Laznicka
13328bc751 topo segment-add: validate that both masters support target suffix
This patch removes the ability to add segment between hosts where
either does not support the requested suffix.

https://fedorahosted.org/freeipa/ticket/5967

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-06-24 13:32:02 +02:00
Stanislav Laznicka
5b5258b010 Fix topologysuffix-verify failing connections
topologysuffix-verify would have checked connectivity even between hosts that
are not managed by the given suffix.

https://fedorahosted.org/freeipa/ticket/5967

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-06-24 13:32:02 +02:00
Martin Kosek
b081023c3a Update Contributors.txt
Update .mailmap to fix wrong commit author and re-generate
the Developer contributor list.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-24 12:49:39 +02:00
Lenka Doudova
eec440b2d5 Tests: Fix for failing location tests
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-23 15:29:06 +02:00
Martin Basti
926462d335 Server-del: fix system records removal
Services on replica to be removed  must be deleted first, otherwise
update of system records will not take this change into account

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-06-23 12:33:43 +02:00
Stanislav Laznicka
0db48e4d04 Fix to ipa-ca-install asking for host principal password
With a ca_cert_file specified in options, the nss_db was used before the
certificates from the file were added to it, which caused an exception
that led to fallback to ssh which is broken.

https://fedorahosted.org/freeipa/ticket/5965

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-23 12:26:20 +02:00
Martin Babinsky
06d945a046 account for added krbcanonicalname attribute during xmlrpc tests
https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-06-23 09:48:06 +02:00
Martin Babinsky
1bba2ed45d set krbcanonicalname on host entry during krbinstance configuration
part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-06-23 09:48:06 +02:00
Martin Babinsky
705f66f749 IPA API: set krbcanonicalname instead of ipakrbprincipalalias on new entities
Hosts, services, and (stage)-users will now have krbcanonicalname attribute
set to the same value as krbprincipalname on creation. Moreover, new services
will not have ipakrbprincipalalias set anymore.

Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-06-23 09:48:06 +02:00
Martin Babinsky
b169a72735 ipa-enrollment: set krbCanonicalName attribute on enrolled host entry
Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-06-23 09:48:06 +02:00
Martin Babinsky
7ed7a86511 ipa-kdb: set krbCanonicalName when creating new principals
Additionally, stop setting ipakrbprincipalalias attribute during principal
creation.

Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-06-23 09:48:06 +02:00
Martin Babinsky
3f93f80557 add krbCanonicalName to attributes watched by MODRDN plugin
https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-06-23 09:48:06 +02:00
Martin Babinsky
229ab40dd3 add case-insensitive matching rule to krbprincipalname index
Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-06-23 09:48:06 +02:00
Martin Babinsky
5f963e1ad1 mark 'ipaKrbPrincipalAlias' attribute as deprecated in schema
part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-06-23 09:48:06 +02:00