Commit Graph

2792 Commits

Author SHA1 Message Date
Martin Basti
c339abbad1 Use domain level constants in topology plugin
Reviewed-By: David Kupka <dkupka@redhat.com>
2015-11-10 13:49:50 +01:00
Petr Spacek
50b0471f01 DNS record-add warns when a suspicious DNS name is detected
Relative name "record.zone" is being added into zone "zone.",
which is probably a mistake. User probably wanted to either specify
relative name "record" or use FQDN "record.zone.".

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-11-10 13:47:27 +01:00
Martin Basti
6119dbb9a9 ipa-csreplica-manage: disable connect/disconnect/del with domain level > 0
* ipa-csreplica-manage {connect|disconnect} - a user should use 'ipa
topologysegment-*' commands
* ipa-csreplica-manage del - a user should use ipa-replica-manage del

https://fedorahosted.org/freeipa/ticket/5405

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-11-02 13:31:27 +01:00
Abhijeet Kasurde
c60cec4fa7 Added user friendly error message for dnszone enable and disable
Added try-except block in dns plugin in order to provide user
friendly message to end user.

https://fedorahosted.org/freeipa/ticket/4811

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-29 13:41:41 +01:00
Martin Babinsky
82fd4250b9 silence pylint in Python 3-specific portion of ipalib/rpc.py
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 18:27:19 +01:00
Petr Viktorin
c38516eab7 ipalib.rpc: Update for Python 3
The client XML-RPC implementation is tied to rpclib internals,
so with a change in Python it needs to be updated. And rpclib
changed in Python 3.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Petr Viktorin
6811b4be6a ipapython.nsslib: Remove NSSHTTPS
This workaround is unused in Python 2.7+.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Petr Viktorin
4ddd1821b6 ipapython.nsslib, ipalib.rpc: Remove code for Python 2.6 and below
IPA hasn't supported these pythons for a while now.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Martin Basti
beb6a3236d Domain levels: use constants rather than hardcoded values
Added constants for domain levels
DOMAIN_LEVEL_0 = 0
DOMAIN_LEVEL_1 = 1

This allows to search for domain level easier in code.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 10:29:41 +01:00
Tomas Babej
c6a558c30e trustdomain: Perform validation of the trust domain first
Makes sure that the first check that is performed when trustdomain-del
command is run is that the actual trusted domain exists. This is done to
prevent a subseqent error which might be misleading.

https://fedorahosted.org/freeipa/ticket/5389

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-10-26 14:10:53 +01:00
Tomas Babej
4d0d5913dd trusts: Make trust_show.get_dn raise properly formatted NotFound
The trust_show command does not raise a properly formatted NotFound
error if the trust is not found, only a generic EmptyResult error
is raised.

This patch makes the trust_show tell us what actually could not be
found.

https://fedorahosted.org/freeipa/ticket/5389

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-10-26 14:10:53 +01:00
Martin Babinsky
c43dce3a61 always ask the resolver for the reverse zone when manipulating PTR records
Instead of searching for all zones to identify the correct reverse zone, we
will first ask the resolver to return the name of zone that should contain the
desired record and then see if IPA manages this zone.

This patch also removes a duplicate function in bindinstance.py that is not
used anywhere.

https://fedorahosted.org/freeipa/ticket/5200

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-10-22 18:36:17 +02:00
Petr Viktorin
ab75964b9a Work around ipalib.text (i18n) str/unicode handling
Python 3 doesn't provide ugettext/ungettext, since gettext/ngettext
work with (unicode) strings.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Petr Viktorin
8a2b65a357 Fix more bytes/unicode issues
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Petr Viktorin
0a23afeab2 ipalib.messages: Add "message" property to PublicMessage
In Python 3, the "message" property was removed in favor of calling str().
Add it to PublicMessage, since IPA code depends on it.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Petr Viktorin
eab334dde8 Handle binascii.Error from base64.b64decode()
In Python 3, the base64.b64decode function raises binascii.Error (a ValueError
subclass) when it finds incorrect padding. In Python 2 it raises TypeError.

Callers should usually handle ValueError; unless they are specifically
concerned with handling base64 padding issues).

In some cases, callers should handle ValueError:
- ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should
  handle ValueError
- ipalib.x509 (load_certificate*, get_*): callers should handle ValueError

In other cases ValueError is handled:
- ipalib.parameters
- ipapython.ssh
- ipalib.rpc (json_decode_binary - callers already expect ValueError)
- ipaserver.install.ldapupdate

Elsewhere no error handling is done, because values come from trusted
sources, or are pre-validated:
- vault plugin
- ipaserver.install.cainstance
- ipaserver.install.certs
- ipaserver.install.ipa_otptoken_import

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Martin Basti
92a4b18fc2 DNSSEC: warn user if DNSSEC key master is not installed
Warning user that DNSSEC key master is not installed when commands
dnszone-add, dnszone-mod, dnszone-show when option dnssec=true

https://fedorahosted.org/freeipa/ticket/5290

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-10-22 18:29:44 +02:00
Martin Babinsky
6a401fbf31 execute user-del pre-callback also during user preservation
user preservation code was not using the pre-callback function which did check
whether a protected member is being deleted and facilitated the
orphaning/deletion of OTP tokens owner/managed by the user.

https://fedorahosted.org/freeipa/ticket/5362
https://fedorahosted.org/freeipa/ticket/5372

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-21 12:33:39 +02:00
Martin Babinsky
e0d9a1b47c do not ask for segment direction when running topology commands
https://fedorahosted.org/freeipa/ticket/5222

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-10-20 15:32:47 +02:00
Petr Vobornik
834b5fd513 enable topology plugin on upgrade
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-15 14:24:33 +02:00
Tomas Babej
4c2276f7ec idoverride: Ignore ValidationErrors when converting the anchor
When converting the anchor to a human readable form, SID validation
may fail, i.e. if the domain is no longer trusted.

Ignore such cases and pass along the anchor in the raw format.

https://fedorahosted.org/freeipa/ticket/5322

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-10-14 16:11:25 +02:00
Martin Babinsky
5484ae014e remove ID overrides when deleting a user
patch fixes a regression introduced during user-del refactoring

https://fedorahosted.org/freeipa/ticket/5365

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-14 13:16:34 +02:00
Jan Cholasta
2f3450249d vault: fix private service vault creation
https://fedorahosted.org/freeipa/ticket/5361

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-10-13 14:34:00 +02:00
Petr Viktorin
5f7c206e74 rpc: Name argument to KerberosError
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
614b490402 ipalib.parameters: Require bytes for Bytes.pattern
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
e0eff8b834 ipalib.parameters: Handle 0-prefixed octal format of ints
In Python 2, numbers prfixed with '0' are parsed as octal,
e.g. '020' -> 16. In Python 3, the prefix is '0o'.

Handle the old syntax for IPA's parameter conversion to keep
backwards compatibility.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
b71fd2d3c9 Add message property to IPA's errors and warnings under Python 3
Python 3 removes the "message" attribute from exceptions, in favor
of just calling str().
Add it back for IPA's own exception types.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
905d81f500 ipalib.aci: Port to Python 3
- Don't encode under Python 3, where shlex would choke on bytes
- Sort the attrs dictionary in export_to_string, so the tests are
  deterministic. (The iteration order of dicts was always unspecified,
  but was always the same in practice under CPython 2.)

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
88ac1c1616 Rename caught exception for use outside the except: block.
In Python 3, the variable with the currently handled exception is unset
at the end of the except block. (This is done to break reference
cycles, since exception instances now carry tracebacks, which contain
all locals.)

Fix this in baseldap's error handler.

Use a simpler structure for the ipatests.raises utility that only uses the
exception inside the except block.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
929c3d1265 x509: Port to Python 3
In python 3 , `bytes` has the buffer interface, and `buffer` was removed.

Also, invalid padding in base64-encoded data raises a ValueError rather
than TypeError.

In tests, use pytest.assert_raises for more correct exception assertions.
Also, get rid of unused imports in the tests

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
59d87d53b1 Do not compare types that are not comparable in Python 3
In Python 3, different types are generally not comparable (except for equality),
and None can't be compared to None.
Fix cases of these comparisons.

In ipatest.util, give up on sorting lists if the sorting raises a TypeError.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Tomas Babej
dae9c6cbc1 realmdomains: Do not fail due the ValidationError when adding _kerberos TXT record
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
1e1d6d15c6 realmdomains: Issue a warning when automated management of realmdomains failed
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
6a2f47acbe realmdomains: Add validation that realmdomain being added is indeed from our realm
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
fc6e1f0bb5 realmdomains: Minor style and wording improvements
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
4ceae037f5 util: Add detect_dns_zone_realm_type helper
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Jan Cholasta
4b381b1503 vault: select a server with KRA for vault operations
This uses the same mechanism which is used for the CA.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-08 13:42:58 +02:00
Petr Viktorin
e3c05fcb73 Remove uses of the types module
In Python 3, the types module no longer provide alternate names for
built-in types, e.g. `types.StringType` can just be spelled `str`.

NoneType is also removed; it needs to be replaced with type(None)

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
187efdfe42 Use six.moves.configparser instead of ConfigParser
The module name was lowercased in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
ad2bc94725 Use six.moves.xmlrpc.client instead of xmlrpclib
The module is renamed to xmlrpc.client in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
70b37a956c Use six.moves.urllib instead of urllib/urllib2/urlparse
In Python 3, these modules are reorganized.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
c9ca8de7a2 rpc: Don't use undocumented urllib functions
The "splittype" and "splithost" functions in urllib.parse
are undocumented and reserved for internal use,
see http://bugs.python.org/issue11009

Use urlsplit instead.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Robert Kuska
01da4a8de3 Replace StandardError with Exception
StandardError was removed in Python3 and instead
Exception should be used.

Signed-off-by: Robert Kuska <rkuska@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-30 10:51:36 +02:00
Michael Simacek
bdccebbcdb Rewrap errors in get_principal to CCacheError
Causes nicer error message when kerberos credentials are not available.

https://fedorahosted.org/freeipa/ticket/5272

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-09-22 13:29:55 +02:00
Gabe
65e958fda4 Standardize minvalue for ipasearchrecordlimit and ipasesarchsizelimit for unlimited minvalue
https://fedorahosted.org/freeipa/ticket/4023

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-22 08:00:16 +02:00
Jan Cholasta
0dfcf1d9db vault: add permissions and administrator privilege
https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Jan Cholasta
5cf46b8936 vault: set owner to current user on container creation
This reverts commit 419754b1c1.

https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Petr Vobornik
d396913e9c vault: add vault container commands
adds commands:
* vaultcontainer-show [--service <service>|--user <user>|--shared ]
* vaultcontainer-del [--service <service>|--user <user>|--shared ]
* vaultcontainer-add-owner
     [--service <service>|--user <user>|--shared ]
     [--users <users>]  [--groups <groups>] [--services <services>]
* vaultcontainer-remove-owner
     [--service <service>|--user <user>|--shared ]
     [--users <users>]  [--groups <groups>] [--services <services>]

https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Jan Cholasta
2964b019d9 baseldap: make subtree deletion optional in LDAPDelete
https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Jan Cholasta
ba5201979d Use bytes instead of str where appropriate
Under Python 2, "str" and "bytes" are synonyms.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-17 11:08:43 +02:00