Commit Graph

6157 Commits

Author SHA1 Message Date
Petr Vobornik
04839a2aea Web UI integration tests: Code quality fixes
* variables with python build-in names renamed
 * unused parameters used or removed

 https://fedorahosted.org/freeipa/ticket/3744
2013-07-26 13:35:12 +02:00
Petr Vobornik
6ec5e5fec6 Web UI integration tests: PEP8 fixes
Tests modified to comply with PEP8 rules with exception of rule E501 (long lines).
Done by autopep8 tool and 2 manual modifications.

https://fedorahosted.org/freeipa/ticket/3744
2013-07-26 13:35:12 +02:00
Petr Vobornik
8a3d8aeca3 Web UI integration tests: Compute range sizes to avoid overlaps
Heavily inspired by code from xmlrpc tests.

To obtain ranges, this patch also adds method to execute FreeIPA command through Web UI.
It uses Web UI instead of ipalib so it doesn't need to care about authentication on a test-runner machine.

https://fedorahosted.org/freeipa/ticket/3744
2013-07-26 13:35:12 +02:00
Petr Vobornik
a3567cef98 Web UI integration tests: Verify data after add and mod
https://fedorahosted.org/freeipa/ticket/3744
2013-07-26 13:35:12 +02:00
Petr Vobornik
bc06e30481 Web UI integration tests: Add ui_driver method descriptions
https://fedorahosted.org/freeipa/ticket/3744
2013-07-26 13:35:12 +02:00
Petr Vobornik
ae31130098 Web UI integration tests: Add trust tests
https://fedorahosted.org/freeipa/ticket/3744
2013-07-26 13:35:12 +02:00
Martin Kosek
6a0aabede5 Free NSS objects in --external-ca scenario
In external CA installation, ipa-server-install leaked NSS objects
which caused an installation crash later when a subsequent call of
NSSConnection tried to free them.

Properly freeing the NSS objects avoid this crash.

https://fedorahosted.org/freeipa/ticket/3773
2013-07-26 12:51:10 +02:00
Tomas Babej
8a41b64a8c Change shebang to absolute path in ipa-client-automount
https://fedorahosted.org/freeipa/ticket/3811
2013-07-25 15:27:37 +02:00
Lukas Slebodnik
6782a24ff1 Remove unused variable
Variable was set, but it was not used.
2013-07-25 13:21:30 +02:00
Lukas Slebodnik
905f835647 Remove unused variable 2013-07-25 13:21:30 +02:00
Lukas Slebodnik
c098435040 Use right function prototype for thread function
warning: passing argument from incompatible pointer type
2013-07-25 13:21:30 +02:00
Petr Viktorin
2f80855e15 test_simple_replication: Wait for replication to finish before checking
Add ldap_connect() method to Host to allow executing querying LDAP from tests.

Use information in the mapping tree to poll until all replication is finished
(or failing) before checking that entries replicated successfully.
2013-07-25 12:41:26 +02:00
Petr Viktorin
15e83befaf Correct default value of LDAPClient.get_entries scope argument 2013-07-25 12:41:16 +02:00
Petr Viktorin
e38816bdaf Add tar and xz dependencies to the freeipa-tests package
The beakerLib plugin collects log files via compressed tarballs,
so these dependencies are needed
2013-07-25 12:32:36 +02:00
Petr Viktorin
00dfd9399b Add the ipa-test-task tool
This script makes common testing tasks such as IPA installation
and uninstallation available outside of Python.

https://fedorahosted.org/freeipa/ticket/3721
2013-07-25 12:32:35 +02:00
Petr Viktorin
13f4b7e9cf Add install_topo to test tasks
This allows a cluster of replicas and clients to be installed
in a named topology.
Several named topologies are available (star, line, complete, tree,
tree2) and new ones can be defined as a simple function.
2013-07-25 12:32:35 +02:00
Petr Viktorin
ac70c2cc5c Add more test tasks
- install_client
- connect_replica
- disconnect_replica
- prepare_host
- kinit_admin
2013-07-25 12:32:34 +02:00
Petr Viktorin
db8027407a test_integration: Set up CA on replicas by default
For complex topologies the CA needs to be available on most
replicas, since only servgers with a CA can prepare replica files.
2013-07-25 12:32:33 +02:00
Petr Viktorin
4b439356b7 test_integration: Add log collection to Host
This allows collecting logs when a test context is not available.
2013-07-25 12:32:33 +02:00
Petr Viktorin
65dfcb7cec Move BeakerLibProcess out of BeakerLibPlugin
This allows reusing the code elsewhere
2013-07-25 12:32:32 +02:00
Tomas Babej
d094481ea6 Move requirement for keyutils to freeipa-python package
There was already a dependency in server package, however,
the correct place for such dependency is in freeipa-python,
since the relevant code using keyutils resides there.

Both freeipa-server and freeipa-client require freeipa-python.

https://fedorahosted.org/freeipa/ticket/3808
2013-07-24 17:17:56 +02:00
Martin Kosek
5b54451e0e Become 3.3.0 Beta 1 2013-07-24 13:37:46 +02:00
Martin Kosek
9c851019ae Bump minimum SSSD version
Pick up latest SSSD 1.11 Beta development
2013-07-24 13:37:45 +02:00
Jan Cholasta
693710784b Print newline after receiving EOF in installutils.read_password. 2013-07-24 10:00:03 +02:00
Jan Cholasta
ab2debd1ea Ask for PKCS#12 password interactively in ipa-replica-prepare.
https://fedorahosted.org/freeipa/ticket/3717
2013-07-24 10:00:03 +02:00
Jan Cholasta
ea544bee4c Ask for PKCS#12 password interactively in ipa-server-install.
https://fedorahosted.org/freeipa/ticket/3717
2013-07-24 10:00:02 +02:00
Petr Vobornik
e08f4620cf Remove word 'field' from GECOS param label
No other param/field has 'field' in a label.
2013-07-23 15:32:13 +02:00
Petr Vobornik
1f89cb959c Break long words in notification area
Long words (ie. service principal) breaks out of notification area. It doesn't look good. Patch adds word-wrap to break them to multiple pieces.
2013-07-23 15:32:06 +02:00
Jakub Hrozek
4a5cbde4bb IPA KDB MS-PAC: remove unused variable 2013-07-23 16:25:26 +03:00
Jakub Hrozek
85b8c747bb IPA KDB MS-PAC: return ENOMEM if allocation fails 2013-07-23 16:25:20 +03:00
Alexander Bokovoy
7b5cc3ed83 ipaserver/dcerpc: attempt to resolve SIDs through SSSD first
Attempt to resolve SIDs through SSSD first to avoid using trust
account password. This makes possible to run HBAC test requests
without being in 'trusted admins' group.

https://fedorahosted.org/freeipa/ticket/3803
2013-07-23 16:24:38 +03:00
Tomas Babej
17c7d46c25 Use AD LDAP probing to create trusted domain ID range
When creating a trusted domain ID range, probe AD DC to get
information about ID space leveraged by POSIX users already
defined in AD, and create an ID range with according parameters.

For more details:
http://www.freeipa.org/page/V3/Use_posix_attributes_defined_in_AD
https://fedorahosted.org/freeipa/ticket/3649
2013-07-23 16:24:33 +03:00
Alexander Bokovoy
84b2269589 ipa-kdb: reinit mspac on HTTP TGT acquisition to aid trust-add case
When trust is established, we also create idrange for the trusted domain.
With FreeIPA 3.3 these ranges can have different types, and in order to
detect which one is to create, we need to do lookup at AD LDAP server.

Such lookup requires authenticated bind. We cannot bind as user because
IPA framework operates under constrained delegation using the user's
credentials and allowing HTTP/ipa.server@REALM to impersonate the user
against trusted domain's services would require two major things:

  - first, as we don't really know exact AD LDAP server names (any AD DC
    can be used), constrained delegation would have to be defined against
    a wild-card

  - second, constrained delegation requires that target principal exists
    in IPA LDAP as DN.

These two together limit use of user's ticket for the purpose of IPA
framework looking up AD LDAP.

Additionally, immediately after trust is established, issuing TGT with
MS-PAC to HTTP/ipa.server@REALM may fail due to the fact that KDB driver
did not yet refreshed its list of trusted domains -- we have limited
refresh rate of 60 seconds by default.

This patch makes possible to force re-initialization of trusted domains'
view in KDB driver if we are asked for TGT for HTTP/ipa.server@REALM.

We will need to improve refresh of trusted domains' view in KDB driver
in future to notice changes in cn=etc,$SUFFIX tree automatically.

This improvement is tracked in https://fedorahosted.org/freeipa/ticket/1302 and
https://fedorahosted.org/freeipa/ticket/3626

Part of https://fedorahosted.org/freeipa/ticket/3649
2013-07-23 16:24:29 +03:00
Alexander Bokovoy
67bcbab897 ipa-kdb: cache KDC hostname on startup
We need KDC hostname for several purposes:
- short-circuit detection of principals on the same server as KDC
- generating NetBIOS name

Make sure we cache hostname information on startup and use it
instead of detecting the hostname in run-time. This will miss the
case that KDC hostname got changed but such cases are not supported
anyway without restarting KDC and making changes to principals.
2013-07-23 16:24:24 +03:00
Petr Vobornik
881290b010 Web UI search optimization
This patch optimizes options used in commands executed by search pages.

1) Removed --all from _find and _show commands used by search pages. All displayed attributes should be already included in default attributes.

2) Removed search_all_attributes - Not needed since introduction of paging.

3) Added --no-members options to search _show commmands. Members are not displayed on search pages and such change drastically improves performance. It reduces computations on server and amount of data transferred to Web UI.

https://fedorahosted.org/freeipa/ticket/3706
2013-07-23 13:14:02 +02:00
Jan Cholasta
b7f10d9fe6 Add new hidden command option to suppress processing of membership attributes.
https://fedorahosted.org/freeipa/ticket/3706
2013-07-23 13:13:54 +02:00
Ana Krivokapic
8a8a9045b9 Fix internal error in idrange-add
Fix internal error in idrange-add, caused by a missing 'name' argument of
ValidationError.

https://fedorahosted.org/freeipa/ticket/3781
2013-07-22 10:49:40 +02:00
Ana Krivokapic
8a22bce242 Use admin@REALM when testing if SSSD is ready
https://fedorahosted.org/freeipa/ticket/3771
2013-07-19 12:37:43 +02:00
Petr Viktorin
efb7a2d54d ipa-client: Use "ipa" as the package name for i18n
IPA uses "ipa" as the "package name" for all translations,
even in the ipa-client package.

https://fedorahosted.org/freeipa/ticket/3695
2013-07-19 12:26:28 +02:00
Nathaniel McCallum
6c0b7f3389 Use libunistring ulc_casecmp() on unicode strings
https://fedorahosted.org/freeipa/ticket/3772
2013-07-18 18:08:53 +02:00
Alexander Bokovoy
e95a7b1b8d ipa-adtrust-install: configure compatibility tree to serve trusted domain users
Enables  support  for  trusted  domains  users  for old clients through Schema
Compatibility plugin.  SSSD supports trusted domains natively starting with
version 1.9 platform. For platforms that lack SSSD or run older SSSD version
one needs  to  use  this  option.  When  enabled, slapi-nis  package  needs  to
be  installed  and schema-compat-plugin will be configured to provide lookup of
users and groups from trusted domains via SSSD on IPA server. These users and
groups will be available under  cn=users,cn=compat,$SUFFIX  and
cn=groups,cn=compat,$SUFFIX trees.  SSSD will normalize names of users and
groups to lower case.

In  addition  to  providing  these users and groups through the compat tree,
this option enables authentication over LDAP for trusted domain users with DN
under compat tree, i.e. using bind DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX.

This authentication  is related to  PAM  stack  using  'system-auth' PAM
service. If you have disabled HBAC rule 'allow_all', then make sure there is
special service called 'system-auth' created and HBAC rule to allow access to
anyone to this rule on IPA masters is added. Please note that system-auth PAM
service is  not used directly by any other application, therefore it is safe to
create one specifically to support trusted domain users via compatibility path.

https://fedorahosted.org/freeipa/ticket/3567
2013-07-18 17:56:30 +02:00
Ana Krivokapic
f98054a31a Bump version of sssd in spec file
https://fedorahosted.org/freeipa/ticket/3652
2013-07-18 17:49:28 +02:00
Ana Krivokapic
595de183a7 Add 'ipa_server_mode' option to SSSD configuration
https://fedorahosted.org/freeipa/ticket/3652
2013-07-18 17:49:23 +02:00
Ana Krivokapic
f637d05a18 Properly handle non-existent cert files
https://fedorahosted.org/freeipa/ticket/3785
2013-07-18 13:37:40 +02:00
Rob Crittenden
240b12169b Hide sensitive attributes in LDAP updater logging and output
The LDAP updater prints the initial and final states of an entry, as well
as details on the changes made to attributes. This has the potential to
expose sensitive values so exclude those from logging.

https://fedorahosted.org/freeipa/ticket/3782
2013-07-18 10:49:43 +03:00
Rob Crittenden
198d82d4ce Add Camellia ciphers to allowed list.
https://fedorahosted.org/freeipa/ticket/3749
2013-07-18 10:49:38 +03:00
Martin Kosek
1dcbb3adfa Require new selinux-policy replacing old server-selinux subpackage
Features of the new policy:
- labels /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t which is
  writeable by PKI and readable by HTTPD
- contains Conflicts with old freeipa-server-selinux package to avoid
  SELinux upgrade issues

https://fedorahosted.org/freeipa/ticket/3788
2013-07-17 16:21:14 +02:00
Jan Cholasta
b5d008ed5a Run gpg-agent explicitly when encrypting/decrypting files.
Also add an option to ipautil.run to redirect command output to /dev/null.

https://fedorahosted.org/freeipa/ticket/3767
2013-07-17 16:15:15 +02:00
Tomas Babej
c81849712f Provide ipa-advise tool
Provides a pluggable framework for generating configuration
scriptlets and instructions for various machine setups and use
cases.

Creates a new ipa-advise command, available to root user
on the IPA server.

Also provides an example configuration plugin,
config-fedora-authconfig.

https://fedorahosted.org/freeipa/ticket/3670
2013-07-17 13:49:59 +02:00
Petr Vobornik
2a9be92855 Upstream Web UI tests
Documentation: http://www.freeipa.org/page/Web_UI_Integration_Tests

https://fedorahosted.org/freeipa/ticket/3744
2013-07-16 13:15:59 +02:00